Let’s Encrypt + Nginx + Tornado 開啟 HTTPS

Yusheng發表於2016-04-16

Python Tornado 建站流程：使用 Let’s Encrypt + Nginx 開啟 HTTPS，結合 GitHub Webhook 實現自動部署。

1. Let’s Encrypt

需要開放 443 埠：

git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt
./letsencrypt-auto certonly -d pyhub.cc -d www.pyhub.cc

git clone https://github.com/letsencrypt/letsencrypt

cd letsencrypt

./letsencrypt-auto certonly -d pyhub.cc -d www.pyhub.cc

2. Nginx

# 重定向 HTTP
server {
    listen 80;
    server_name www.pyhub.cc pyhub.cc;
    rewrite ^(.*)$ https://$host$1 permanent;
}
# Tornado proxy
upstream pycc{
    server 127.0.0.1:8080;
}
server {
    listen 443;
    server_name pyhub.cc www.pyhub.cc;
    ssl on;
    ssl_certificate /etc/letsencrypt/live/pyhub.cc/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/pyhub.cc/privkey.pem;
    location / {
            proxy_pass_header Server;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Scheme $scheme;
            proxy_pass http://pycc;
        }
}

# 重定向 HTTP

server {

listen 80;

server_name www.pyhub.cc pyhub.cc;

rewrite ^(.*)$ https://$host$1 permanent;

}

# Tornado proxy

upstream pycc{

server 127.0.0.1:8080;

}

server {

listen 443;

server_name pyhub.cc www.pyhub.cc;

ssl on;

ssl_certificate /etc/letsencrypt/live/pyhub.cc/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/pyhub.cc/privkey.pem;

location / {

proxy_pass_header Server;

proxy_set_header Host $http_host;

proxy_redirect off;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Scheme $scheme;

proxy_pass http://pycc;

}

Tornado

def main():
    # 設定 xheaders = True
    http_server = tornado.httpserver.HTTPServer(Application(), xheaders=True)
    http_server.listen(options.port)
    tornado.ioloop.IOLoop.current().start()

if __name__ == '__main__':
    main()

def main():

# 設定 xheaders = True

http_server = tornado.httpserver.HTTPServer(Application(), xheaders=True)

http_server.listen(options.port)

tornado.ioloop.IOLoop.current().start()

if __name__ == '__main__':

main()

優化ssl配置

參考：Guide to Deploying Diffie-Hellman for TLS

執行：

openssl dhparam -out dhparams.pem 2048

1	openssl dhparam -out dhparams.pem 2048

經過相當長一段時間後生成 dhparams.pem，修改 Nginx 配置：

ssl on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-EC
DSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES1
28-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
ssl_dhparam /etc/nginx/conf.d/dhparams.pem;

ssl_certificate /etc/letsencrypt/live/pyhub.cc/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/pyhub.cc/privkey.pem;

ssl on;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:10m;

ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-EC

DSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES1

28-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

ssl_dhparam /etc/nginx/conf.d/dhparams.pem;

ssl_certificate /etc/letsencrypt/live/pyhub.cc/fullchain.pem;

ssl_certificate_key /etc/letsencrypt/live/pyhub.cc/privkey.pem;

自動更新

官方給出了自動更新證照的指令碼 https_renew.sh：

#!/bin/sh
nginx -s stop  # or whatever your webserver is
/opt/letsencrypt/letsencrypt-auto renew -nvv --standalone --force-renewal &gt; /var/log/letsencrypt/renew.log 2&gt;&amp;1
LE_STATUS=$?
nginx # or whatever your webserver is
if [ "$LE_STATUS" != 0 ]; then
    echo Automated renewal failed:
    cat /var/log/letsencrypt/renew.log
    exit 1
fi

#!/bin/sh

nginx -s stop # or whatever your webserver is

/opt/letsencrypt/letsencrypt-auto renew -nvv --standalone --force-renewal > /var/log/letsencrypt/renew.log 2>&1

LE_STATUS=$?

nginx # or whatever your webserver is

if [ "$LE_STATUS" != 0 ]; then

echo Automated renewal failed:

cat /var/log/letsencrypt/renew.log

exit 1

加入 crontab：

crontab -u root -e
* * */90 * * /path/to/https_renew.sh

1 2	crontab -u root -e * * /90 * /path/to/https_renew.sh

注意

頁面中採用 http 的 CDN 服務會導致（Chrome）如下警告：

One More Thing…

GitHub Webhook：

新增 Webhook 並監聽 Push 事件，推送到伺服器之後可以自動執行 git pull：

# Application 設定開啟 autoreload=True

class WebHookHandler(BaseHandler):
    def post(self, *args, **kwargs):
        if self.request.headers.get('X-GitHub-Event') == 'push':
            print("Execute git pull github master")
            subprocess.call("git pull github master", shell=True)

# Application 設定開啟 autoreload=True

class WebHookHandler(BaseHandler):

def post(self, *args, **kwargs):

if self.request.headers.get('X-GitHub-Event') == 'push':

print("Execute git pull github master")

subprocess.call("git pull github master", shell=True)

打賞支援我寫出更多好文章，謝謝！
打賞作者

打賞支援我寫出更多好文章，謝謝！

Let’s Encrypt + Nginx + Tornado 開啟 HTTPS

快速使用Let's Encrypt開啟個人網站的https
2018-01-18
網站HTTP
Let's Encrypt 泛域名https
2021-02-23
HTTP
let's encrypt 申請 https 證書
2019-02-22
HTTP
用 Let's Encrypt 和 certbot 搭建 https
2017-12-04
HTTP
CentOS 下 Nginx 配置 Let’ s Encrypt 證書
2018-03-15
CentOSNginx
Let's Encrypt 推動了 HTTPS 的普及
2016-11-05
HTTP
使用Let’s Encrypt實現網站https化
2021-06-30
網站HTTP
免費 HTTPS 證書 Let's Encrypt 安裝教程
2018-11-20
HTTP
Let's Encrypt 申請免費的 Https 證書
2019-01-01
HTTP
在Docker容器環境中用Let's Encrypt部署HTTPS
2016-07-05
DockerHTTP
用 let's Encrypt 實現 HTTPS 示例( fasthttp 與net/http)
2019-08-08
HTTPAST
申請Let’s Encrypt萬用字元HTTPS證書(certbot版)
2018-03-16
字元HTTP
Let's Encrypt，站點加密之旅
2016-09-06
加密
Get Let's Encrypt Cert In Five Minutes
2017-10-05
更新：為 NGINX 配置免費的 Let's Encrypt SSL/TLS 證書
2022-11-24
NginxTLS
Ubuntu 18 LTS 下為 Nginx 站點開啟 HTTPS （Lets-Encrypt）
2019-11-28
UbuntuNginxHTTP
Windows Server 下 IIS 申請部署 Let’s Encrypt 證書實現免費 HTTPS
2024-04-03
WindowsServerHTTP
Let's encrypt的TLS-SNI安全問題
2018-02-01
TLS
使用 Let's Encrypt 保護你的網站
2018-04-23
網站
通過 Certbot 安裝 Let's Encrypt 證書，來實現全站的 HTTPS 訪問
2018-11-20
HTTP
透過 Certbot 安裝 Let's Encrypt 證書，來實現全站的 HTTPS 訪問
2018-11-20
HTTP
申請Let's Encrypt永久免費SSL證書
2018-09-07
Let's Encrypt 泛域名證書申請及配置
2018-06-21
申請Let's Encrypt萬用字元SSL證書
2018-05-10
字元
通過 Certbot 安裝 Let's Encrypt 證書，實現免費的全站 HTTPS 訪問
2021-06-14
HTTP
Let's Encrypt - 免費SSL/TLS證書用起來
2021-06-26
TLS
docker獲取Let's Encrypt永久免費SSL證書
2021-01-03
Docker
免費SSL證書Let's Encrypt的替代：SSL.com
2021-08-21
捐贈 Let's Encrypt，共建安全的網際網路
2016-11-03
申請Let’s encrypt免費證書,並自動續訂.
2018-11-07
Let's Encrypt 免費萬用字元 SSL 證書申請教程
2018-03-19
字元
Let's Encrypt 正式釋出，已經保護 380 萬個域名
2016-04-13
IIS - 自動申請、部署Let's Encrypt的免費SSL證書（讓網站實現HTTPS協議）
2018-02-28
網站HTTP協議
80、443 埠無法使用時使用 Let’s Encrypt 簽發證書
2016-02-01
Let's Encrypt 倡議新證書策略提高抗網路攻擊能力
2020-02-21
Let's Encrypt 釋出ACME v2 正式支援萬用字元證書
2018-03-15
ACM字元
由於Bug，Let's Encrypt決定吊銷300多萬張證書！
2020-03-05
基於Let's Encrypt生成免費證書-支援多域名泛域名證書
2021-01-01

Let’s Encrypt + Nginx + Tornado 開啟 HTTPS

1. Let’s Encrypt

2. Nginx

Tornado

優化ssl配置

自動更新

注意

One More Thing…

打賞支援我寫出更多好文章，謝謝！

相關文章