0

我刚刚在教程（ https://gogs.io/docs/installation/install_from_source）的帮助下在 VPS 上安装了 Gogs 。我有一个子域可以访问我的 gogs 实例：git.mydomainname.com 并且它可以工作：http : //git.mydomainname.com 使用反向代理访问我的 gogs 实例。

我想通过 SSL 保护我的 gogs，所以我想使用以下教程（https://certbot.eff.org/#debianstretch-nginx）安装 LetsEncrypt。

我想说我是系统管理新手，不一定了解我在安装 Gogs 期间所做的一切。我也是 Nginx 的新手（更习惯于 Apache）。

这是我遵循的过程：

$ sudo certbot certonly
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?
-------------------------------------------------------------------------------
1: Place files in webroot directory (webroot)
2: Spin up a temporary webserver (standalone)
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1
Please enter in your domain name(s) (comma and/or space separated)  (Enter 'c'
to cancel):git.mydomainname.com
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for git.mydomainname.com

Select the webroot for git.mydomainname.com:
-------------------------------------------------------------------------------
1: Enter a new webroot
-------------------------------------------------------------------------------
Press 1 [enter] to confirm the selection (press 'c' to cancel): /home/git/go/src/github.com/gogits/gogs

** Invalid input **
Press 1 [enter] to confirm the selection (press 'c' to cancel): 1
Input the webroot for git.mydomainname.com: (Enter 'c' to cancel):/home/git/go/src/github.com/gogits/gogs
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. git.mydomainname.com (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://git.mydomainname.com/.well-known/acme-challenge/N4rMGzoq1Bwyt9MP9fUlVY3_mDnJfRYpQkdvc7WrNJs: "<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>"

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: git.mydomainname.com
   Type:   unauthorized
   Detail: Invalid response from
   http://git.mydomainname.com/.well-known/acme-challenge/N4rMGzoq1Bwyt9MP9fUlVY3_mDnJfRYpQkdvc7WrNJs:
   "<html>
   <head><title>404 Not Found</title></head>
   <body bgcolor="white">
   <center><h1>404 Not Found</h1></center>
   <hr><center>"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address.

所以我检查了错误，DNS A记录是OK的。我还找到了另一个法语教程（https://www.grafikart.fr/formations/serverur-linux/nginx-ssl-letsencrypt）来帮助我，我注意到我必须为网站更新我的 nginx 配置，我做到了，尽管我有一个反向代理（也许问题就在这里）。

server {
    listen 80;
    server_name git.mydomainname.com

    location ~ /\.well-known/acme-challenge {
        allow all;
    }

    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    location / {
        proxy_pass http://localhost:port_number;
    }
}

谢谢你的帮助。

4

1 回答 1

0

您将所有请求代理到http://localhost:port_number，但该程序可能不知道如何处理lets-encrypt 请求。

相反，您应该将 .well-known 位置更改为：

location ^~ /.well-known/acme-challenge/ {
  allow all;
  root /var/www/letsencrypt;
}

当 certbot 要求您提供 webroot 时，您可以回答/var/www/letsencrypt

注意：您可以更改/var/www/letsencrypt为您想要的任何目录。它只需要首先创建，并由您的 nginx 用户读取

于 2017-08-17T13:22:51.257 回答