用mac申请ssl证书给nas使用
2024-04-13 09:49≈ 240字≈ 2分钟
由于群晖自带的申请letsencrypt证书使用的是http的方式，必须要求diskstation走80端口才可以，但是家里的网络默认是封闭80端口的，导致你怎么试都是失败，只能用自己的电脑来申请
最头疼的是三个月需要续订一次，每次都要如此操作…记录一下吧，省的满世界找命令
1、安装homebrew
2、安装certbot
1brew install certbot
3、执行命令，比如域名是 *.example.com
1sudo certbot certonly --manual --preferred-challenges=dns -d "*.yourdomain.com"
4、剩下的基本默认都是选择y，直到出现下面内容的时候，则需要在域名解析控制台增加一个TXT解析，添加后等待10分钟左右，继续回车下一步
1Please deploy a DNS TXT record under the name:
2
3_acme-challenge.example.com.
4
5with the following value:
6
7D1kOMANSfZG0HVM6-swGIqHrD87p7LGrnDLmoOclSuw
8
9Before continuing, verify the TXT record has been deployed. Depending on the DNS
10provider, this may take some time, from a few seconds to multiple minutes. You can
11check if it has finished deploying with aid of online tools, such as the Google
12Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.wangboweb.site.
13Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
14value(s) you've just added.
5、成功后就会有如下提示
1Successfully received certificate.
2Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
3Key is saved at: /etc/letsencrypt/live/example.com/privkey.pem
4This certificate expires on 2022-12-23.
5These files will be updated when the certificate renews.
6
7NEXT STEPS:
8- This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date.
9- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
10If you like Certbot, please consider supporting our work by:
11 * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
12 * Donating to EFF: https://eff.org/donate-le
6、默认生成的证书在/etc/letsencrypt/achive/example.com/ 目录下，但是这个目录默认是没有权限访问的，需要复制出来的话，只需要在该文件夹右键-显示简介，加个权限就好，然后将fullchain.pem和privkey.pem两个文件复制出来
7、在群晖-控制面板-安全性-证书中上传对应的证书文件即可