创建免费证书

			
[root@netkiller opt]# certbot certonly --manual --preferred-challenges dns -d "*.netkiller.cn"
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
 (Enter 'c' to cancel): netkiller@msn.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.8-July-06-2026.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Yes

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Account registered.
Requesting a certificate for *.netkiller.cn

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:

_acme-challenge.netkiller.cn.

with the following value:

t2P9psIjbQyv9eTLztCjGjf6-VLr144RqlmQqRVIJ4k

Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.netkiller.cn.
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/netkiller.cn/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/netkiller.cn/privkey.pem
This certificate expires on 2026-12-20.
These files will be updated when the certificate renews.
			
		

注意这两行

		
Certificate is saved at: /etc/letsencrypt/live/netkiller.cn/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/netkiller.cn/privkey.pem
		
		

配置证书

		
sip.netkiller.cn {
    tls /etc/letsencrypt/live/netkiller.cn/fullchain.pem /etc/letsencrypt/live/netkiller.cn/privkey.pem
    @websockets {
        header Connection *Upgrade*
        header Upgrade websocket
    }
    reverse_proxy @websockets 47.112.9.199:5066 {
        transport http {
          versions 1.1
        }
        header_up X-Real-IP {remote}
    }
}
		
		

			
[root@netkiller sip]# certbot certonly --webroot -w /opt/caddy/data/sip -d *.netkiller.cn	
			
			

			
# 续期所有证书
certbot renew
# 测试续期（不真正执行）
certbot renew --dry-run

# 定时续期
# crontab -e
0 3 * * * certbot renew --quiet --post-hook "nginx -s reload"
0 3 * * * certbot renew --quiet --post-hook "docker exec caddy caddy reload"
0 3 * * * certbot renew --quiet --post-hook "systemctl reload caddy "
			
			

			
[root@netkiller sip]# cat /etc/letsencrypt/renewal/netkiller.cn.conf
version = 4.2.0
archive_dir = /etc/letsencrypt/archive/netkiller.cn
cert = /etc/letsencrypt/live/netkiller.cn/cert.pem
privkey = /etc/letsencrypt/live/netkiller.cn/privkey.pem
chain = /etc/letsencrypt/live/netkiller.cn/chain.pem
fullchain = /etc/letsencrypt/live/netkiller.cn/fullchain.pem

# Options used in the renewal process
[renewalparams]
account = b259390a70e233d6972ffa99e69aae31
authenticator = webroot
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
webroot_path = /opt/caddy/data/sip,
[[webroot_map]]