證書

$ sudo apt install certbot
$ sudo certbot certonly -d *.<域名> \
--manual --preferred-challenges dns-01 \
--server https://acme-v02.api.letsencrypt.org/directory

nginx 配置

server {
    listen 80;
    listen [::]:80;
    server_name <域名>;

    rewrite ^(.*)$ https://${server_name}$1 permanent;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    index index.html index.htm;
    server_name <域名>;
    root /data/www/<域名>;

    ssl on;
    ssl_certificate /etc/letsencrypt/live/<域名>/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/<域名>/privkey.pem;
    ssl_session_timeout 5m;
    ssl_protocols SSLv2 SSLv3 TLSv1.2 TLSv1.1 TLSv1;
    ssl_ciphers AES128-SHA:AES256-SHA:RC4-SHA:DES-CBC3-SHA:RC4-MD5;
    ssl_prefer_server_ciphers on;

    resolver 8.8.8.8;
    location / {
        proxy_redirect off;
        proxy_cookie_domain google.com <域名>;
        proxy_pass https://www.google.com;
        proxy_connect_timeout 60s;
        proxy_read_timeout 5400s;
        proxy_send_timeout 5400s;

        proxy_set_header Host "www.google.com";
        proxy_set_header User-Agent $http_user_agent;
        proxy_set_header Referer https://www.google.com;
        proxy_set_header Accept-Encoding "";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Accept-Language "zh-CN";

        #subs_filter www.google.com <域名>;
        #subs_filter_types text/css text/xml text/javascript;
    }
}