{"id":33196,"date":"2026-09-14T10:00:00","date_gmt":"2026-09-14T02:00:00","guid":{"rendered":"https:\/\/cn.hostease.com\/blog\/?p=33196"},"modified":"2026-09-16T20:58:43","modified_gmt":"2026-09-16T12:58:43","slug":"lets-encrypt-wildcard-ssl-auto-renewal","status":"publish","type":"post","link":"https:\/\/cn.hostease.com\/blog\/guides\/lets-encrypt-wildcard-ssl-auto-renewal\/","title":{"rendered":"Let&#8217;s Encrypt \u6cdb\u57df\u540d\u8bc1\u4e66\uff1a\u670d\u52a1\u5668\u591a\u7ad9\u70b9 SSL \u81ea\u52a8\u7eed\u671f\u90e8\u7f72"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/cn.hostease.com\/blog\/wp-content\/uploads\/2026\/09\/lets-encrypt-wildcard-ssl-auto-renewal-cover.webp\" alt=\"Let&#x27;s Encrypt \u6cdb\u57df\u540d\u8bc1\u4e66\u81ea\u52a8\u7eed\u671f\u90e8\u7f72\u5c01\u9762\u56fe\" loading=\"lazy\" \/><\/p>\n<h2>\u4e3a\u4ec0\u4e48\u4f60\u9700\u8981\u4e00\u5f20\u6cdb\u57df\u540d\u8bc1\u4e66<\/h2>\n<p>\u5f53\u4e00\u53f0\u670d\u52a1\u5668\u540c\u65f6\u8dd1\u7740\u4e3b\u7ad9\u3001\u535a\u5ba2\u3001\u63a5\u53e3\u670d\u52a1\u548c\u540e\u53f0\u7ba1\u7406\u7b49\u591a\u4e2a\u5b50\u57df\u540d\u65f6\uff0c\u624b\u52a8\u7ed9\u6bcf\u4e2a\u57df\u540d\u5355\u72ec\u7b7e\u4e00\u5f20 SSL \u8bc1\u4e66\uff0c\u65e2\u7e41\u7410\u53c8\u5bb9\u6613\u51fa\u9519\u3002\u8bc1\u4e66\u5230\u671f\u4e00\u65e6\u5fd8\u8bb0\u7eed\u671f\uff0c\u6d4f\u89c8\u5668\u5c31\u4f1a\u5f39\u51fa&#8221;\u8fde\u63a5\u4e0d\u5b89\u5168&#8221;\u8b66\u544a\uff0c\u7528\u6237\u4fe1\u4efb\u548c\u641c\u7d22\u6392\u540d\u90fd\u53d7\u5f71\u54cd\u3002\u6cdb\u57df\u540d\u8bc1\u4e66\uff08\u5373\u901a\u914d\u7b26\u8bc1\u4e66\uff09\u80fd\u4e00\u6b21\u6027\u8986\u76d6\u4e3b\u57df\u4e0b\u7684\u5168\u90e8\u5b50\u57df\u540d\uff0c\u914d\u5408\u5b9a\u65f6\u4efb\u52a1\u81ea\u52a8\u7eed\u671f\uff0c\u57fa\u672c\u53ef\u4ee5\u505a\u5230&#8221;\u8bc1\u4e66\u5230\u671f\u4ece\u65e5\u5e38\u8fd0\u7ef4\u91cc\u6d88\u5931&#8221;\u3002\u4e0b\u9762\u6211\u4f1a\u4e00\u6b65\u6b65\u6559\u4f60\u7528 Let&#8217;s Encrypt \u514d\u8d39\u7b7e\u51fa\u6cdb\u57df\u540d\u8bc1\u4e66\u5e76\u81ea\u52a8\u7eed\u671f\u3002\u5982\u679c\u4f60\u521a\u63a5\u89e6\u670d\u52a1\u5668\u8fd0\u7ef4\uff0c\u53ef\u5148\u8fc7\u4e00\u904d<a href=\"https:\/\/cn.hostease.com\/blog\/server\/\">\u670d\u52a1\u5668\u914d\u7f6e\u4e0e\u4f18\u5316<\/a>\u5206\u7c7b\u5efa\u7acb\u57fa\u7840\u3002<\/p>\n<h2>\u6cdb\u57df\u540d\u8bc1\u4e66\u4e3a\u4f55\u5fc5\u987b\u8d70 DNS \u6821\u9a8c<\/h2>\n<p>\u7b7e\u53d1\u6cdb\u57df\u540d\u8bc1\u4e66\u7684\u5173\u952e\u662f\u57df\u540d\u6240\u6709\u6743\u6821\u9a8c\u3002Let&#8217;s Encrypt \u63d0\u4f9b HTTP \u548c DNS \u4e24\u79cd\u6821\u9a8c\uff0c\u4f46\u6cdb\u57df\u540d\u53ea\u80fd\u7528 DNS \u6821\u9a8c\uff1aHTTP \u6821\u9a8c\u8981\u6c42\u670d\u52a1\u5668\u4e0a\u5b58\u5728\u4e0e\u8bc1\u4e66\u8303\u56f4\u5bf9\u5e94\u7684\u771f\u5b9e\u7ad9\u70b9\uff0c\u800c <code>*.example.com<\/code> \u4e0d\u6307\u5411\u5177\u4f53\u4e3b\u673a\uff0c\u65e0\u6cd5\u653e\u7f6e\u6821\u9a8c\u6587\u4ef6\u3002<\/p>\n<p>DNS \u6821\u9a8c\u7684\u601d\u8def\u662f\uff1aLet&#8217;s Encrypt \u751f\u6210\u4e00\u6bb5\u968f\u673a TXT \u8bb0\u5f55\u503c\uff0c\u4f60\u8981\u628a\u5b83\u52a0\u5230\u57df\u540d\u89e3\u6790\u91cc\uff0c\u89e3\u6790\u751f\u6548\u5373\u8bc1\u660e\u57df\u540d\u63a7\u5236\u6743\u3002\u56e0\u6b64\u4f60\u9700\u8981\u80fd\u64cd\u4f5c\u57df\u540d\u89e3\u6790\u9762\u677f\u3002\u7edd\u5927\u591a\u6570\u7b2c\u4e09\u65b9\u6743\u5a01 DNS \u670d\u52a1\u5546\u63d0\u4f9b API\uff0ccertbot \u8fd9\u7c7b\u5ba2\u6237\u7aef\u53ef\u901a\u8fc7 API \u81ea\u52a8\u5199\u5165\u548c\u5220\u9664 TXT \u8bb0\u5f55\uff0c\u4ece\u800c\u505a\u5230\u65e0\u4eba\u5de5\u4ecb\u5165\u7684\u81ea\u52a8\u7b7e\u53d1\u4e0e\u7eed\u671f\u3002<\/p>\n<p>\u9700\u8981\u6f84\u6e05\u7684\u662f\uff0cDNS \u6821\u9a8c\u5e76\u4e0d\u662f\u6cdb\u57df\u7684\u4e13\u5c5e\u9650\u5236\uff0c\u800c\u662f\u5728\u6cdb\u57df\u540d\u573a\u666f\u4e0b\u7684\u5fc5\u7136\u9009\u62e9\u3002\u56e0\u4e3a\u901a\u914d\u7b26\u8bc1\u4e66\u672c\u8eab\u58f0\u660e\u7684\u662f&#8221;\u8fd9\u4e00\u6574\u7ec4\u5b50\u57df\u540d&#8221;\uff0c\u5e76\u6ca1\u6709\u4e00\u4e2a\u53ef\u4ee5\u88ab HTTP \u8bf7\u6c42\u547d\u4e2d\u7684\u5b9e\u4f53\u9875\u9762\u6765\u627f\u63a5\u6821\u9a8c\u6587\u4ef6\uff0c\u53ea\u6709\u89e3\u6790\u8bb0\u5f55\u80fd\u4ee3\u8868\u6574\u7ec4\u57df\u540d\u7684\u5f52\u5c5e\u3002\u4e86\u89e3\u8fd9\u4e00\u70b9\uff0c\u4f60\u5728\u914d\u7f6e\u65f6\u5c31\u4e0d\u4f1a\u56e0\u4e3a&#8221;\u4e3a\u4ec0\u4e48\u4e0d\u80fd\u7528\u547d\u4ee4\u884c\u76f4\u63a5\u514d\u63d2\u4ef6\u7b7e\u53d1&#8221;\u800c\u56f0\u60d1\u3002\u6b64\u5916\uff0cDNS \u6821\u9a8c\u8fd8\u6709\u4e2a\u989d\u5916\u7684\u5b89\u5168\u6027\u6536\u76ca\uff1a\u6821\u9a8c\u8fc7\u7a0b\u5b8c\u5168\u5728\u89e3\u6790\u5c42\u5b8c\u6210\uff0c\u4e0d\u4f9d\u8d56 Web \u670d\u52a1\u662f\u5426\u6b63\u5e38\u8fd0\u884c\uff0c\u5373\u4f7f\u67d0\u6bb5\u65f6\u95f4\u7ad9\u70b9\u6302\u4e86\uff0c\u53ea\u8981\u89e3\u6790\u670d\u52a1\u6b63\u5e38\uff0c\u7eed\u671f\u4ecd\u7136\u53ef\u4ee5\u8fdb\u884c\u3002<\/p>\n<p>\u76f8\u6bd4 HTTP \u6821\u9a8c\uff0cDNS \u6821\u9a8c\u591a\u4e00\u6b65\u89e3\u6790\u4f20\u64ad\u7b49\u5f85\uff0c\u901a\u5e38\u51e0\u5341\u79d2\u5230\u51e0\u5206\u949f\uff0c\u4f46\u5bf9\u81ea\u52a8\u5316\u90e8\u7f72\u5f71\u54cd\u4e0d\u5927\uff0c\u53cd\u800c\u56e0\u4e3a\u4e0d\u4f9d\u8d56\u7ad9\u70b9\u8def\u5f84\uff0c\u66f4\u9002\u5408\u6279\u91cf\u7b7e\u53d1\u3002<\/p>\n<h2>\u7b2c\u4e00\u6b65\uff1a\u5b89\u88c5 Certbot<\/h2>\n<p>\u7b7e\u53d1\u548c\u7eed\u671f\u8bc1\u4e66\u7684\u5b98\u65b9\u5ba2\u6237\u7aef\u662f Certbot\u3002\u4ee5 Ubuntu\u3001Debian \u4e3a\u4f8b\uff1a<\/p>\n<pre><code class=\"language-bash\">sudo apt update\nsudo apt install certbot python3-certbot-nginx python3-certbot-dns-cloudflare\n<\/code><\/pre>\n<ul>\n<li><code>python3-certbot-nginx<\/code>\uff1a\u81ea\u52a8\u628a\u8bc1\u4e66\u88c5\u8fdb Nginx \u914d\u7f6e\uff08\u7528 Apache \u5219\u88c5 <code>python3-certbot-apache<\/code>\uff09\u3002<\/li>\n<li><code>python3-certbot-dns-cloudflare<\/code>\uff1aDNS \u670d\u52a1\u5546\u63d2\u4ef6\uff0c\u8ba9 Certbot \u901a\u8fc7 API \u81ea\u52a8\u589e\u5220 TXT \u8bb0\u5f55\uff0c\u662f\u81ea\u52a8\u7eed\u671f\u7684\u5173\u952e\u3002<\/li>\n<\/ul>\n<p>\u82e5\u4f60\u7528\u522b\u7684 DNS \u670d\u52a1\u5546\uff0c\u4e5f\u6709\u5bf9\u5e94\u63d2\u4ef6\uff0c\u5982 <code>python3-certbot-dns-dnsimple<\/code>\u3001<code>python3-certbot-dns-route53<\/code>\u3002\u88c5\u5b8c\u6267\u884c <code>certbot --version<\/code> \u786e\u8ba4\u53ef\u7528\u3002<\/p>\n<h2>\u7b2c\u4e8c\u6b65\uff1a\u914d\u7f6e DNS \u51ed\u636e<\/h2>\n<p>\u5148\u5728 DNS \u670d\u52a1\u5546\u540e\u53f0\u751f\u6210 API \u4ee4\u724c\uff08Cloudflare \u81f3\u5c11\u9700 Zone \u7ea7 DNS \u7f16\u8f91\u6743\u9650\uff09\uff0c\u5199\u5165\u4ec5 root \u53ef\u8bfb\u7684\u51ed\u636e\u6587\u4ef6\uff1a<\/p>\n<pre><code class=\"language-bash\">sudo mkdir -p \/etc\/letsencrypt\nsudo tee \/etc\/letsencrypt\/cloudflare.ini &gt; \/dev\/null &lt;&lt;'EOF'\ndns_cloudflare_api_token = your_token_here\nEOF\nsudo chmod 600 \/etc\/letsencrypt\/cloudflare.ini\nsudo chown root:root \/etc\/letsencrypt\/cloudflare.ini\n<\/code><\/pre>\n<p><code>chmod 600<\/code> \u4e0e <code>chown root:root<\/code> \u5fc5\u987b\u6267\u884c\uff1aAPI \u4ee4\u724c\u6cc4\u9732\u7b49\u4e8e\u4ea4\u51fa\u8be5\u57df\u540d DNS \u63a7\u5236\u6743\uff0c\u98ce\u9669\u8fdc\u9ad8\u4e8e\u8bc1\u4e66\u672c\u8eab\u3002\u975e Cloudflare \u65f6\u5b57\u6bb5\u540d\u4e0d\u540c\uff08\u5982 <code>dns_digitalocean_token<\/code>\uff09\uff0c\u4f46\u6587\u4ef6\u4f4d\u7f6e\u4e0e\u6743\u9650\u903b\u8f91\u4e00\u81f4\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cn.hostease.com\/blog\/wp-content\/uploads\/2026\/09\/lets-encrypt-wildcard-coverage.webp\" alt=\"\u6cdb\u57df\u540d\u8bc1\u4e66\u8986\u76d6\u5b50\u57df\u540d\u7684\u793a\u610f\u56fe\" loading=\"lazy\" \/><\/p>\n<h2>\u7b2c\u4e09\u6b65\uff1a\u7b7e\u53d1\u6cdb\u57df\u540d\u8bc1\u4e66<\/h2>\n<p>\u628a <code>example.com<\/code> \u6362\u6210\u771f\u5b9e\u4e3b\u57df\u540d\u540e\u6267\u884c\uff1a<\/p>\n<pre><code class=\"language-bash\">sudo certbot certonly \\\n  --dns-cloudflare \\\n  --dns-cloudflare-credentials \/etc\/letsencrypt\/cloudflare.ini \\\n  -d &quot;*.example.com&quot; \\\n  -d &quot;example.com&quot; \\\n  --email you@example.com \\\n  --agree-tos \\\n  --no-eff-email\n<\/code><\/pre>\n<p>\u540c\u65f6\u5199 <code>*.example.com<\/code> \u548c <code>example.com<\/code> \u662f\u56e0\u4e3a\u901a\u914d\u7b26\u4e0d\u8986\u76d6\u88f8\u57df\uff0c\u4e00\u8d77\u7b7e\u53ef\u4fdd\u8bc1\u8bbf\u95ee\u4e3b\u57df\u4e5f\u6709\u8bc1\u4e66\u3002<code>--certonly<\/code> \u53ea\u7533\u8bf7\u8bc1\u4e66\u3001\u4e0d\u6539 Web \u914d\u7f6e\u3002\u7b7e\u53d1\u65f6\u63d2\u4ef6\u4f1a\u81ea\u52a8\u6dfb\u52a0\u5e76\u7a0d\u540e\u5220\u9664 <code>_acme-challenge<\/code> \u7684 TXT \u8bb0\u5f55\uff0c\u65e0\u9700\u8fdb DNS \u9762\u677f\u3002\u8bc1\u4e66\u5b58\u4e8e <code>\/etc\/letsencrypt\/live\/example.com\/<\/code>\uff0c\u5176\u4e2d <code>fullchain.pem<\/code> \u662f\u8bc1\u4e66\u94fe\u3001<code>privkey.pem<\/code> \u662f\u79c1\u94a5\u3002<\/p>\n<h2>\u7b2c\u56db\u6b65\uff1a\u628a\u8bc1\u4e66\u63a5\u5165 Nginx \u591a\u7ad9\u70b9<\/h2>\n<p>\u5404\u5b50\u57df\u540d\u5171\u7528\u4e00\u5f20\u8bc1\u4e66\uff0c\u53ea\u8981\u5728\u5404\u81ea server \u914d\u7f6e\u91cc\u5f15\u7528\u540c\u4e00\u8bc1\u4e66\u8def\u5f84\uff1a<\/p>\n<pre><code class=\"language-nginx\">server {\n    listen 443 ssl http2;\n    server_name www.example.com;\n    ssl_certificate     \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\n    root \/var\/www\/www.example.com;\n    index index.html;\n}\n<\/code><\/pre>\n<p>\u7b2c\u4e8c\u4e2a\u7ad9\u70b9 <code>blog.example.com<\/code> \u53ea\u9700\u6539 <code>server_name<\/code>\uff0c\u8bc1\u4e66\u8def\u5f84\u4e0d\u53d8\uff0c\u8fd9\u6b63\u662f\u6cdb\u57df\u540d\u8bc1\u4e66\u7701\u4e8b\u4e4b\u5904\u3002\u6539\u5b8c\u5148\u6d4b\u8bed\u6cd5\u518d\u91cd\u8f7d\uff1a<\/p>\n<pre><code class=\"language-bash\">sudo nginx -t\nsudo systemctl reload nginx\n<\/code><\/pre>\n<p><code>nginx -t<\/code> \u8f93\u51fa <code>syntax is ok<\/code> \u548c <code>test is successful<\/code> \u5373\u53ef\u91cd\u8f7d\uff0c\u4e0d\u4e2d\u65ad\u8bbf\u95ee\u3002\u7528 Apache \u5219\u628a\u6240\u6709 HTTPS \u7ad9\u70b9\u7684 <code>SSLCertificateFile<\/code> \u6307\u5411 <code>fullchain.pem<\/code>\u3001<code>SSLCertificateKeyFile<\/code> \u6307\u5411 <code>privkey.pem<\/code>\uff0c\u539f\u7406\u4e00\u81f4\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cn.hostease.com\/blog\/wp-content\/uploads\/2026\/09\/lets-encrypt-cron-renewal.webp\" alt=\"cron \u5b9a\u65f6\u81ea\u52a8\u7eed\u671f\u4e0e\u91cd\u8f7d\u670d\u52a1\u7684\u793a\u610f\u56fe\" loading=\"lazy\" \/><\/p>\n<h2>\u7b2c\u4e94\u6b65\uff1a\u7528 Cron \u81ea\u52a8\u7eed\u671f<\/h2>\n<p>Let&#8217;s Encrypt \u8bc1\u4e66\u6709\u6548\u671f\u4ec5 90 \u5929\uff0c\u5fc5\u987b\u8ba9\u81ea\u52a8\u7eed\u671f\u63a5\u7ba1\u3002\u5148\u624b\u52a8\u9a8c\u8bc1\u7eed\u671f\u6d41\u7a0b\uff1a<\/p>\n<pre><code class=\"language-bash\">sudo certbot renew --dry-run\n<\/code><\/pre>\n<p><code>--dry-run<\/code> \u662f\u6a21\u62df\u3001\u4e0d\u771f\u6b63\u7b7e\u53d1\u3002\u6210\u529f\u540e\u518d\u5199\u8fdb crontab\uff1a<\/p>\n<pre><code class=\"language-bash\">sudo crontab -e\n<\/code><\/pre>\n<p>\u52a0\u5165\u4e00\u884c\uff1a<\/p>\n<pre><code>15 2 * * * \/usr\/bin\/certbot renew --quiet --deploy-hook &quot;systemctl reload nginx&quot;\n<\/code><\/pre>\n<p>\u542b\u4e49\u662f\u6bcf\u5929 2:15 \u68c0\u67e5\u7eed\u671f\uff0c<code>--quiet<\/code> \u6b63\u5e38\u9759\u9ed8\u3001\u51fa\u9519\u624d\u8f93\u51fa\uff0c<code>--deploy-hook<\/code> \u5728\u7eed\u671f\u6210\u529f\u540e\u81ea\u52a8\u91cd\u8f7d Nginx \u8ba9\u65b0\u8bc1\u4e66\u751f\u6548\u3002\u8981\u6f84\u6e05\u4e00\u4e2a\u8bef\u533a\uff1acron \u6bcf\u6b21\u8fd0\u884c <code>certbot renew<\/code>\uff0c\u4e0d\u4ee3\u8868\u8bc1\u4e66\u90fd\u88ab\u91cd\u7b7e\u3002Certbot \u53ea\u5728\u8bc1\u4e66 30 \u5929\u5185\u5230\u671f\u65f6\u624d\u771f\u6b63\u7eed\u671f\uff0c\u5176\u4f59\u65f6\u95f4\u81ea\u52a8\u8df3\u8fc7\uff0c\u6240\u4ee5\u6bcf\u5929\u8dd1\u4e00\u6b21\u65e2\u4e0d\u4f1a\u4ea7\u751f\u65e0\u8c13\u7b7e\u53d1\u538b\u529b\uff0c\u4e5f\u4e0d\u4f1a\u89e6\u53d1\u901f\u7387\u9650\u5236\u3002<\/p>\n<h2>\u5e38\u89c1\u7eed\u671f\u95ee\u9898\u4e0e\u6392\u67e5<\/h2>\n<p>\u81ea\u52a8\u7eed\u671f\u4e0a\u7ebf\u540e\uff0c\u5076\u5c14\u4f1a\u9047\u5230\u7eed\u671f\u5931\u8d25\u7684\u60c5\u51b5\uff0c\u63d0\u524d\u719f\u6089\u51e0\u4e2a\u9ad8\u9891\u95ee\u9898\u80fd\u5e2e\u4f60\u5feb\u901f\u5b9a\u4f4d\u3002\u9664\u4e86\u4e0a\u9762\u5217\u51fa\u7684 DNS \u8d85\u65f6\u3001\u51ed\u636e\u6743\u9650\u548c\u672a\u91cd\u8f7d\u4e09\u7c7b\u95ee\u9898\uff0c\u8fd8\u6709\u51e0\u70b9\u503c\u5f97\u7559\u610f\u3002<\/p>\n<p>\u7b2c\u4e00\uff0c\u8bc1\u4e66\u7684\u7eed\u671f\u7a97\u53e3\u5224\u65ad\u3002Certbot \u9ed8\u8ba4\u53ea\u5728\u8bc1\u4e66\u5230\u671f\u524d 30 \u5929\u5185\u624d\u771f\u6b63\u6267\u884c\u7eed\u671f\uff0c\u6240\u4ee5\u5982\u679c\u4f60\u7684\u7ad9\u70b9\u521a\u7b7e\u5b8c\u8bc1\u4e66\uff0c\u8fd0\u884c <code>certbot renew<\/code> \u770b\u5230&#8221;no renewals were attempted&#8221;\u662f\u6b63\u5e38\u73b0\u8c61\uff0c\u4e0d\u4ee3\u8868\u81ea\u52a8\u7eed\u671f\u6ca1\u914d\u7f6e\u597d\u3002\u7b2c\u4e8c\uff0c\u591a\u57df\u540d\u540c\u4e00\u5f20\u8bc1\u4e66\u65f6\uff0c\u53ea\u8981\u5176\u4e2d\u4efb\u610f\u4e00\u4e2a\u57df\u540d\u89e3\u6790\u5f02\u5e38\uff0c\u6574\u5f20\u8bc1\u4e66\u7684\u7eed\u671f\u90fd\u4f1a\u5931\u8d25\uff0c\u56e0\u4e3a\u7b7e\u53d1\u547d\u4ee4\u662f\u6574\u4f53\u5904\u7406\u7684\uff0c\u6392\u969c\u65f6\u8981\u9010\u4e2a\u68c0\u67e5\u6d89\u53ca\u7684\u6240\u6709\u57df\u540d\u89e3\u6790\u3002\u7b2c\u4e09\uff0c<code>--deploy-hook<\/code> \u53ea\u4f1a\u5728\u8bc1\u4e66\u771f\u6b63\u88ab\u7eed\u671f\u540e\u89e6\u53d1\uff0c\u5982\u679c\u4f60\u5e0c\u671b\u9a8c\u8bc1\u91cd\u8f7d\u73af\u8282\u662f\u5426\u6b63\u5e38\uff0c\u53ef\u4ee5\u624b\u52a8\u8dd1\u4e00\u6b21\u5e26 <code>--force-renewal<\/code> \u7684\u6d4b\u8bd5\u547d\u4ee4\u6765\u89c2\u5bdf\u94a9\u5b50\u662f\u5426\u6267\u884c\u3002<\/p>\n<p><strong>\u7eed\u671f\u5931\u8d25\u3001\u65e5\u5fd7\u62a5 DNS \u6821\u9a8c\u8d85\u65f6\u3002<\/strong> \u591a\u4e3a TXT \u8bb0\u5f55\u4f20\u64ad\u8fc7\u6162\u3002\u53ef\u5728\u547d\u4ee4\u91cc\u52a0 <code>--dns-cloudflare-propagation-seconds 60<\/code> \u62c9\u957f\u7b49\u5f85\u65f6\u95f4\u540e\u91cd\u8dd1 <code>sudo certbot renew --dry-run<\/code>\u3002<\/p>\n<p><strong>\u51ed\u636e\u6587\u4ef6\u6743\u9650\u4e0d\u5bf9\u3002<\/strong> Certbot \u5f3a\u5236\u51ed\u636e\u53ea\u5141\u8bb8 root \u8bfb\uff1b\u82e5\u4e4b\u524d\u7528\u4e86 <code>chmod 644<\/code> \u6216\u653e\u5230\u666e\u901a\u7528\u6237\u76ee\u5f55\u4f1a\u76f4\u63a5\u62a5\u9519\uff0c\u6267\u884c <code>sudo chmod 600 \/etc\/letsencrypt\/cloudflare.ini<\/code> \u6536\u56de\u5373\u53ef\u3002<\/p>\n<p><strong>\u8bc1\u4e66\u7eed\u671f\u6210\u529f\u4f46\u7ad9\u70b9\u4ecd\u663e\u793a\u65e7\u8bc1\u4e66\u3002<\/strong> \u8bf4\u660e\u7eed\u671f\u540e\u672a\u91cd\u8f7d Web \u670d\u52a1\uff0c\u8865\u4e0a <code>--deploy-hook<\/code> \u5e76\u624b\u6572\u4e00\u6b21 <code>sudo systemctl reload nginx<\/code>\u3002<\/p>\n<p>\u82e5\u4ee5\u4e0a\u90fd\u6ca1\u89e3\u51b3\uff0c\u5148\u786e\u8ba4\u670d\u52a1\u5668\u7cfb\u7edf\u65f6\u95f4\u662f\u5426\u51c6\u786e\u2014\u2014\u8bc1\u4e66\u6821\u9a8c\u5f3a\u4f9d\u8d56\u65f6\u95f4\u540c\u6b65\uff0c\u504f\u5dee\u8fc7\u5927\u4f1a\u5bfc\u81f4\u7b7e\u53d1\u548c\u7eed\u671f\u5931\u8d25\u3002<\/p>\n<h2>\u603b\u7ed3\u4e0e\u540e\u7eed\u5efa\u8bae<\/h2>\n<p>\u6cdb\u57df\u540d\u8bc1\u4e66\u914d\u5408\u81ea\u52a8\u7eed\u671f\uff0c\u662f\u670d\u52a1\u5668\u8dd1\u591a\u4e2a\u5b50\u7ad9\u70b9\u65f6\u7684\u7701\u5fc3\u65b9\u6848\u3002\u6838\u5fc3\u94fe\u8def\u56db\u6b65\uff1a\u7528 DNS \u63d2\u4ef6\u8ba9 Certbot \u80fd\u64cd\u4f5c TXT \u8bb0\u5f55 \u2192 \u7b7e\u53d1\u8986\u76d6\u901a\u914d\u7b26\u548c\u88f8\u57df\u7684\u8bc1\u4e66 \u2192 \u7edf\u4e00\u63a5\u5165 Nginx \u6216 Apache \u2192 \u7528 cron \u6bcf\u5929\u8dd1 <code>certbot renew<\/code> \u5e76\u914d\u5408 <code>--deploy-hook<\/code> \u91cd\u8f7d\u3002\u9996\u6b21\u642d\u5efa\u7ea6\u4e00\u4e24\u4e2a\u5c0f\u65f6\uff0c\u4e4b\u540e\u57fa\u672c\u4e0d\u7528\u518d\u7ba1\u8bc1\u4e66\u3002<\/p>\n<p>\u6211\u5efa\u8bae\u5148\u5728\u6d4b\u8bd5\u670d\u52a1\u5668\u5b8c\u6574\u8d70\u4e00\u904d\u7b7e\u53d1\u3001\u7eed\u671f\u3001\u91cd\u8f7d\u4e09\u4e2a\u73af\u8282\uff0c\u786e\u8ba4\u65e0\u8bef\u518d\u4e0a\u751f\u4ea7\uff0c\u907f\u514d\u628a\u8bc1\u4e66\u95ee\u9898\u5e26\u5230\u7ebf\u4e0a\u3002\u5982\u679c\u4f60\u8fd8\u60f3\u4e86\u89e3\u52a0\u8f7d\u901f\u5ea6\u5bf9\u8bbf\u95ee\u4f53\u9a8c\u7684\u5f71\u54cd\uff0c\u53ef\u53c2\u8003\u6211\u4eec\u5173\u4e8e<a href=\"https:\/\/cn.hostease.com\/blog\/guides\/ttfb-hosting-optimization\/\">\u7f51\u7ad9\u6027\u80fd\u4f18\u5316<\/a>\u7684\u6587\u7ae0\u3002\u603b\u7ed3\u6765\u8bf4\uff0c\u82e5\u8981\u4e00\u53f0\u914d\u7f6e\u7a7a\u95f4\u8db3\u591f\u7684\u673a\u5668\u627f\u8f7d\u591a\u7ad9\u70b9\uff0c\u53ef\u4e86\u89e3 Hostease \u7684<a href=\"https:\/\/cn.hostease.com\/dedicated-server\/\">\u72ec\u7acb\u670d\u52a1\u5668<\/a>\u65b9\u6848\uff1b\u9884\u7b97\u6709\u9650\u53c8\u60f3\u7075\u6d3b\u62d3\u5c55\u7684\u573a\u666f\uff0c\u53ef\u4ee5\u8003\u8651<a href=\"https:\/\/cn.hostease.com\/vps\/\">VPS\u4e3b\u673a<\/a>\uff08<a href=\"https:\/\/cn.hostease.com\/vps\/\">\u865a\u62df\u4e13\u7528\u670d\u52a1\u5668<\/a>\uff0c\u5373\u5728\u4e00\u53f0\u7269\u7406\u673a\u4e0a\u5212\u5206\u51fa\u7684\u72ec\u7acb\u8fd0\u884c\u73af\u5883\uff09\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u672c\u6587\u8bb2\u89e3\u5982\u4f55\u5728 Linux \u670d\u52a1\u5668\u4e0a\u7528 Let&#8217;s Encrypt \u6cdb\u57df\u540d\u8bc1\u4e66\u4e3a\u591a\u4e2a\u5b50\u57df\u540d\u7edf\u4e00\u7b7e\u53d1 SSL \u8bc1\u4e66\uff0c\u5e76\u901a\u8fc7 cron \u5b9a\u65f6\u4efb\u52a1\u81ea\u52a8\u7eed\u671f\uff0c\u51cf\u5c11\u624b\u52a8\u7ef4\u62a4\u6210\u672c\u3002<\/p>\n","protected":false},"author":2,"featured_media":33193,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3822],"tags":[4259,162,4451,157,5086],"class_list":["post-33196","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guides","tag-letsencrypt","tag-ssl","tag-4451","tag-157","tag-5086"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/cn.hostease.com\/blog\/wp-content\/uploads\/2026\/09\/lets-encrypt-wildcard-ssl-auto-renewal-cover.webp","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/posts\/33196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/comments?post=33196"}],"version-history":[{"count":1,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/posts\/33196\/revisions"}],"predecessor-version":[{"id":33207,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/posts\/33196\/revisions\/33207"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/media\/33193"}],"wp:attachment":[{"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/media?parent=33196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/categories?post=33196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cn.hostease.com\/blog\/wp-json\/wp\/v2\/tags?post=33196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}