主页 / server / 问题 / 793025
Accepted
ali haider
Asked: 2016-08-01 13:07:48 +0800 CST

无法在 ubuntu 14 服务器上运行 certbot 进行加密

  • 772

我已经让我们在 ubuntu 服务器（python v2.7.6）上进行加密，但它不再运行抱怨我使用的是旧客户端。我下载了 ubuntu 14 的 certbot 客户端，但是当我运行以下命令时，我收到下面复制的错误 - 关于如何进一步解决此问题的任何想法：

./certbot-auto certonly --text --webroot -w /usr/share/nginx/html -d actualurl.com --keep-until-expiring --expand --agree-tos --email [email protected]


2016-07-31 20:50:48,178:DEBUG:certbot.plugins.selection:Selected authenticator <certbot.plugins.webroot.Authenticator object at 0x7f45863102d0> 
and installer None
2016-07-31 20:50:48,350:DEBUG:root:Sending GET request to https://acme-v01.api.letsencrypt.org/directory284. args: (), kwargs: {}
2016-07-31 20:50:48,354:INFO:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
2016-07-31 20:50:48,803:DEBUG:requests.packages.urllib3.connectionpool:"GET /directory284 HTTP/1.1" 404 19
2016-07-31 20:50:48,805:DEBUG:root:Received <Response [404]>. Headers: {'Content-Length': '19', 'X-Content-Type-Options': 'nosniff', 'Boulder-Re
quest-Id': 'gH76WSwBJgzedpyjF8X3TAVVYz0-TLkaiNGTjQa3Weg', 'Expires': 'Sun, 31 Jul 2016 20:50:48 GMT', 'Server': 'nginx', 'Connection': 'keep-ali
ve', 'Pragma': 'no-cache', 'Cache-Control': 'max-age=0, no-cache, no-store', 'Date': 'Sun, 31 Jul 2016 20:50:48 GMT', 'Content-Type': 'text/plai
n; charset=utf-8'}. Content: '404 page not found\n'
2016-07-31 20:50:48,805:DEBUG:acme.client:Received response <Response [404]> (headers: {'Content-Length': '19', 'X-Content-Type-Options': 'nosni
ff', 'Boulder-Request-Id': 'gH76WSwBJgzedpyjF8X3TAVVYz0-TLkaiNGTjQa3Weg', 'Expires': 'Sun, 31 Jul 2016 20:50:48 GMT', 'Server': 'nginx', 'Connec
tion': 'keep-alive', 'Pragma': 'no-cache', 'Cache-Control': 'max-age=0, no-cache, no-store', 'Date': 'Sun, 31 Jul 2016 20:50:48 GMT', 'Content-T
ype': 'text/plain; charset=utf-8'}): '404 page not found\n'
2016-07-31 20:50:48,806:DEBUG:certbot.main:Exiting abnormally:
Traceback (most recent call last):
  File "/root/.local/share/letsencrypt/bin/letsencrypt", line 11, in <module>
    sys.exit(main())
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/main.py", line 744, in main
    return config.func(config, plugins)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/main.py", line 550, in obtain_cert
    le_client = _init_le_client(config, auth, installer)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/main.py", line 360, in _init_le_client
    acc, acme = _determine_account(config)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/main.py", line 345, in _determine_account
    config, account_storage, tos_cb=_tos_cb)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/client.py", line 118, in register
    acme = acme_from_config_key(config, key)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/certbot/client.py", line 42, in acme_from_config_key
    return acme_client.Client(config.server, key=key, net=net)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/acme/client.py", line 63, in __init__
    self.net.get(directory).json())
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/acme/client.py", line 631, in get
    self._send_request('GET', url, **kwargs), content_type=content_type)
  File "/root/.local/share/letsencrypt/local/lib/python2.7/site-packages/acme/client.py", line 578, in _check_response
    raise errors.ClientError(response)
ClientError: <Response [404]>

我也用 certonly 运行了 certbot-auto，但我得到了同样的错误。

对话版

Version: 1.2-20130928

lsb_release -a

Distributor ID: Ubuntu
Description:    Ubuntu 14.04.3 LTS
Release:    14.04
Codename:   trusty

我下载了 certbot 使用

wget https://dl.eff.org/certbot-auto

此外，nginx 进程正在运行，并且仍然拥有较旧的 let 加密证书。从那以后，我尝试删除它并重新启动 nginx，但我仍然遇到同样的错误。我在端口 80 上运行 HA 代理并重定向到 Nginx。

我安装了以下 certbot 插件：

* apache
Description: Apache Web Server - Alpha
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: apache = certbot_apache.configurator:ApacheConfigurator

* webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot.plugins.webroot:Authenticator

* standalone
Description: Automatically use a temporary webserver
Interfaces: IAuthenticator, IPlugin
Entry point: standalone = certbot.plugins.standalone:Authenticator
certbot lets-encrypt

2 个回答

  1. 由于我不喜欢停止网络服务器（出于多种原因）或它前面的任何预处理器（HAProxy、Varnish 等），我一直以这种方式利用最新版本的certbot-auto'spre-hook和post-hook选项：

    certbot-auto certonly --standalone --preferred-challenges tls-sni-01 --tls-sni-01-port 44033 \
  --pre-hook  "iptables -t nat -I PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 44033" \
  --post-hook "iptables -t nat -D PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 44033"

    如果我运行该命令会发生什么：

    1. certbot-auto检查是否所有证书都需要续订
    2. 如果任何证书需要更新，它会执行pre-hook：创建从端口 443（网络服务器正在侦听的端口）到端口 44033（certbot-auto正在侦听的端口）的重定向
    3. 续订完成后，执行post-hook：删除步骤2中创建的重定向。

    有很多好处：

    • 如前所述，我不必停止当前侦听端口 443（或 80）的任何进程
    • 另外，我不必更改网络服务器的任何配置......并且记得在之后恢复更改
    • 它自包含在一个文件中。我现在有以下脚本/etc/cron.daily：

    letsencrypt-renew.sh

    #!/bin/bash
Redir() {
    echo "iptables -t nat $1 PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 44033"
}
certbot-auto renew --standalone \
    --preferred-challenges tls-sni-01 --tls-sni-01-port 44033 \
    --pre-hook "$(Redir -I)" \
    --post-hook "$(Redir -D)"

    （请注意，通过简单地替换renew为certonly，您还可以使用此脚本执行证书的初始请求。替换renew为${1:-renew}允许将操作指定为脚本的 arg。）

    • 1
  2. Best Answer

    我按照此链接上的步骤操作，它对我有用（能够获得证书）。 

    https://github.com/eustasy/certbot-with-nginx

    步骤中唯一缺少的是确保我们将 nginx.welll-known.conf 文件复制到 /etc/nginx 目录中（或者只是创建一个链接）。我正在使用 nginx 来提供内容（我关闭了在端口 80 上侦听的 HA 代理以确保此设置有效）。

    • 0

相关问题