ssl - 如何配置 Let's Encrypt 的 ssl_trusted_certificate？

Question

我使用 Mozilla SSL 配置生成器( https://mozilla.github.io/server-side-tls/ssl-config-generator/ ) 生成 nginx 配置文件。

配置文件中有一项，是这样的:

ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

我用的是Let's Encrypt的证书，如何生成ssl_trusted_certificate？

Answer 1

ssl_trusted_certificate/etc/letsencrypt/live/YOUR_DOMAIN/chain.pem;

来自 Where are my certificates :

All generated keys and issued certificates can be found in /etc/letsencrypt/live/$domain.

...

If you’re using OCSP stapling with Nginx >= 1.3.7, chain.pem should be provided as the ssl_trusted_certificate to validate OCSP responses.

此信息也包含在 certbot 为您的域安装的 README 文件中。下面是我的域的文件:

root@webserver:/etc/letsencrypt/live/dougrichardson.org$ ls
README  cert.pem  chain.pem  fullchain.pem  privkey.pem
root@webserver:/etc/letsencrypt/live/dougrichardson.org$ cat README
This directory contains your keys and certificates.

`privkey.pem`  : the private key for your certificate.
`fullchain.pem`: the certificate file used in most server software.
`chain.pem`    : used for OCSP stapling in Nginx >=1.3.7.
`cert.pem`     : will break many server configurations, and should not be used
                 without reading further documentation (see link below).

WARNING: DO NOT MOVE OR RENAME THESE FILES!
         Certbot expects these files to remain in this location in order
         to function properly!

We recommend not moving these files. For more information, see the Certbot
User Guide at https://certbot.eff.org/docs/using.html#where-are-my-certificates.