LetEncrypt為域名證書，需要先申請域名，并配置解析。
本文以www.example.com為例，請?zhí)鎿Q所有www.example.com為自己的域名
nginx需要安裝sub_filter與ssl模塊

./configure --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_sub_module

一、nginx 配置ssl證書反向代理tomcat

安裝 acme.sh

curl  https://get.acme.sh | sh
cd ~/.acme.sh/

http驗證

yum install socat

需要保證80端口未被占用，如果nginx占用了80端口，需要先停止nginx

sh acme.sh  --issue -d www.example.com   --standalone

copy證書至nginx目錄下

cd /root/.acme.sh/www.example.com
cp www.example.com.cer /usr/local/nginx/conf
cp www.example.com.key /usr/local/nginx/conf

nginx配置
在http如下配置

upstream tomcat {
    server 127.0.0.1:8080 fail_timeout=0; #反向代理到本地tomcat端口
}
server { #監(jiān)聽80端口http訪問，強制跳轉(zhuǎn)到https
         listen     80;
         server_name  127.0.0.1;
         location / {
          rewrite ^(.*)$  https://www.example.com$1 permanent;  #重寫為https
        }
   }
server {
    listen       443 ssl; 
    server_name  127.0.0.1;

    ssl_certificate      /usr/local/nginx/conf/www.example.com.cer;
    ssl_certificate_key  /usr/local/nginx/conf/www.example.com.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;
    underscores_in_headers on;
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Headers X-Requested-With;
    add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header referer “$host“;
        proxy_redirect off;
        proxy_connect_timeout      240;
        proxy_send_timeout         240;
        proxy_read_timeout         240;
        # note, there is not SSL here! plain HTTP is used
        proxy_pass http://tomcat;
        sub_filter 74.xxx.xxx.xxx www.example.com; #替換ip為域名，74.xxx.xxx.xxx為服務(wù)器ip
        sub_filter_once off; 
    }
}

tomcat配置
開啟ssl支持

<Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="443" proxyPort="443" URIEncoding="UTF-8"/>

并添加

<Valve className="org.apache.catalina.valves.RemoteIpValve"
remoteIpHeader="x-forwarded-for"
remoteIpProxiesHeader="x-forwarded-by"
protocolHeader="x-forwarded-proto"/>

更新證書
目前證書在 60 天以后會自動更新, 你無需任何操作. 今后有可能會縮短這個時間, 不過都是自動的, 你不用關(guān)心.

更新 acme.sh
目前由于 acme 協(xié)議和 letsencrypt CA 都在頻繁的更新, 因此 acme.sh 也經(jīng)常更新以保持同步.

升級 acme.sh 到最新版 :

acme.sh --upgrade

如果你不想手動升級, 可以開啟自動升級:

acme.sh  --upgrade  --auto-upgrade

關(guān)閉自動更新:

acme.sh --upgrade  --auto-upgrade  0

二、tomcat 服務(wù)器配置ssl證書

下載腳本

git clone https://github.com/letsencrypt/letsencrypt
cd letsencrypt

獲取證書

./letsencrypt-auto certonly --standalone --email email@qq.com -d example.com -d www.example.com

注意將上面的郵箱和域名替換成自己的。上面命令中的 certonly 表示只獲取證書，不安裝；-d 有兩個，表示將要獲取的SSL證書綁定兩個域名。運行前需要保證80端口未被占用。
上面的命令在執(zhí)行過程中，會有兩次確認。命令執(zhí)行完成后，如果看到提示信息"Congratulations! Your certificate and chain..."就說明證書創(chuàng)建成功了
成功之后再/etc/letsencrypt/live/example.com/目錄會生成4個證書

cd /etc/letsencrypt/live/example.com

可以看到
cert.pem
chain.pem
fullchain.pem
privkey.pem
我們需要將 fullchain.pem 和 privkey.pem轉(zhuǎn)換成tomcat支持的 .jks 格式。

openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out zyxx_letsencrypt.p12 -name tomcat_letsencrypt

需要輸入密碼 隨便輸入

keytool -importkeystore -deststorepass 'zxxx_123' -destkeypass 'zxxx_123' -destkeystore zyxx_letsencrypt.jks -srckeystore zyxx_letsencrypt.p12 -srcstoretype PKCS12 -srcstorepass 'zxxx_123' -alias tomcat_letsencrypt

替換命令中的zxxx_123為上面輸入的密碼
修改tomcat的server.xml

<Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
    maxThreads="150" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS"
    keystoreFile="/etc/letsencrypt/live/example.com/zyxx_letsencrypt.jks"
    keystorePass="zxxx_123"
/>

keystorePass 為上面輸入的密碼
出于安全原因，Let's Encrypt 頒發(fā)的 SSL 證書有效期為90天，我們可以通過自動續(xù)期來解決。如果到期沒有更新證書，Let's Encrypt 會向申請證書時提交的email發(fā)送提醒郵件。
進入到 letsencrypt-auto 腳本所在目錄，執(zhí)行下面的命令即可完成 SSL 證書的續(xù)期。

./letsencrypt-auto renew

默認情況下，在證書即將到期之前才能執(zhí)行續(xù)期操作，否則會提示“Cert not yet due for renewal”，即證書尚未到期。如果需要強制執(zhí)行續(xù)期操作，可以加上參數(shù) --force-renew ，命令如下：

./letsencrypt-auto renew --force-renew

如果nginx想使用這4個證書實現(xiàn)ssl需要在server中添加如下配置。

listen       8081 ssl;
server_name  nginx;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
add_header Strict-Transport-Security max-age=60;