Saving debug log to /var/log/letsencrypt/letsencrypt.log Enter email address (used for urgent renewal and security notices) (Enter 'c' to cancel): [email protected]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Please read the Terms of Service at https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf. You must agree in order to register with the ACME server. Do you agree? - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: Y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Would you be willing, once your first certificate is successfully issued, to share your email address with the Electronic Frontier Foundation, a founding partner of the Let's Encrypt project and the non-profit organization that develops Certbot? We'd like to send you email about our work encrypting the web, EFF news, campaigns, and ways to support digital freedom. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - (Y)es/(N)o: N Account registered. Requesting a certificate for clickhouse.eu.org and *.clickhouse.eu.org Waiting 30 seconds for DNS changes to propagate
Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/ssssssssssssss.com/fullchain.pem Key is saved at: /etc/letsencrypt/live/ssssssssssssss.com/privkey.pem This certificate expires on 2025-08-19. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background.
# 日志函数 log_message() { local level="$1" local message="$2" local timestamp=$(date +"%Y-%m-%d %H:%M:%S") echo"[$timestamp] [$level] $message" | tee -a "$LOG_FILE" }
# 检查命令是否存在 check_command() { if ! command -v "$1" &> /dev/null; then log_message "ERROR""命令不存在: $1" exit 1 fi }
# 检查文件是否存在 check_file() { if [ ! -f "$1" ]; then log_message "ERROR""文件不存在: $1" exit 1 fi }
# 创建日志目录（如果不存在） mkdir -p "$(dirname "$LOG_FILE")"
# 主函数 main() { log_message "INFO""开始证书更新检查..." # 检查依赖 check_command "$NGINX_BINARY" check_command date check_command stat # 验证证书文件 if [[ ! -f "$FULLCHAIN_FILE" || ! -f "$PRIVKEY_FILE" ]]; then log_message "ERROR""证书文件不存在，请检查域名配置：$CERT_DOMAIN" exit 1 fi # 获取当前时间和证书修改时间 CURRENT_TIME=$(date +%s) FULLCHAIN_MTIME=$(stat -c %Y "$FULLCHAIN_FILE") PRIVKEY_MTIME=$(stat -c %Y "$PRIVKEY_FILE") # 计算最新修改时间和时间差 LATEST_MTIME=$((FULLCHAIN_MTIME > PRIVKEY_MTIME ? FULLCHAIN_MTIME : PRIVKEY_MTIME)) TIME_DIFF=$((CURRENT_TIME - LATEST_MTIME)) # 判断是否需要重启Nginx if [[ $TIME_DIFF -ge $TIME_THRESHOLD ]]; then log_message "INFO""证书未在${TIME_THRESHOLD}秒内更新（时间差：$TIME_DIFF 秒），无需重启Nginx。" exit 0 fi log_message "INFO""证书已更新（时间差：$TIME_DIFF 秒），准备重启Nginx..." # 验证Nginx配置 if ! "$NGINX_BINARY" -t &> /dev/null; then local error=$("$NGINX_BINARY" -t 2>&1) log_message "ERROR""证书已更新，但nginx配置验证失败:\n$error" exit 1 fi # 尝试平滑重启Nginx if ! sudo -u $NGINX_USER"$NGINX_BINARY" -s reload; then log_message "ERROR""Nginx平滑重启失败，可能需要手动干预" exit 1 fi log_message "SUCCESS""证书更新! 已成功重启Nginx！" }
```bash certbot renew -q --dry-run Attempting to renew cert (sofunnyai.com) from /etc/letsencrypt/renewal/sofunnyai.com.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration. The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',). Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/sofunnyai.com/fullchain.pem (failure)
echo"添加记录结果Add record result: ${ADD_RECORD_RESULT}"
if [[ ! $(echo"${ADD_RECORD_RESULT}" | grep "true") ]]; then echo"添加记录失败....Add record failed, exit" exit 1 fi
whiletrue; do records=$(dig -t TXT ${CHALLENGE_DOMAIN} @${DNS_SERVER} +noall +answer +short | grep "${CERTBOT_VALIDATION}") if [[ ${records} ]]; then break fi echo"等待DNS生效.....DNS records have not been propagate, sleep 10s..." sleep 10 done
echo"DNS已经生效，DNS record have been propagated, finish"
