Ghost中使用ZeroSSL替代Let's Encrypt配置域名SSL证书问题咨询

方案1：直接绑定已手动申请的ZeroSSL证书 #

步骤1：上传证书到服务器 #

创建证书存储目录并设置权限：

mkdir -p /etc/nginx/ssl/steptzi.com.ng
chmod 600 /etc/nginx/ssl/steptzi.com.ng

将从ZeroSSL下载的certificate.crt、private.key、ca_bundle.crt上传到该目录，执行以下命令合并证书得到fullchain文件：

cat /etc/nginx/ssl/steptzi.com.ng/certificate.crt /etc/nginx/ssl/steptzi.com.ng/ca_bundle.crt > /etc/nginx/ssl/steptzi.com.ng/fullchain.crt

步骤2：替换Nginx配置 #

将/etc/nginx/sites-enabled/steptzi.com.ng.conf内容替换为以下配置：

# 所有HTTP请求统一跳转HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name steptzi.com.ng www.steptzi.com.ng;
    root /var/www/ghost/system/nginx-root;

    location ~ /.well-known {
        allow all;
    }

    location / {
        return 301 https://steptzi.com.ng$request_uri;
    }
}

# HTTPS 非www主配置
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name steptzi.com.ng;
    root /var/www/ghost/system/nginx-root;

    # SSL证书配置
    ssl_certificate /etc/nginx/ssl/steptzi.com.ng/fullchain.crt;
    ssl_certificate_key /etc/nginx/ssl/steptzi.com.ng/private.key;

    # SSL安全优化配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        proxy_pass http://127.0.0.1:2368;
    }

    client_max_body_size 50m;
}

# HTTPS www域名跳转至非www
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.steptzi.com.ng;

    ssl_certificate /etc/nginx/ssl/steptzi.com.ng/fullchain.crt;
    ssl_certificate_key /etc/nginx/ssl/steptzi.com.ng/private.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    return 301 https://steptzi.com.ng$request_uri;
}

如果需要统一使用www域名，将所有跳转地址替换为https://www.steptzi.com.ng，同时修改config.production.json中的url参数为对应地址即可。

步骤3：生效配置 #

执行以下命令验证配置合法性，无报错后重载Nginx即可生效：

nginx -t
systemctl reload nginx

方案2：使用acme.sh自动签发、续期ZeroSSL证书（推荐） #

Ghost CLI的SSL配置默认硬编码调用Let's Encrypt，因此无需再执行ghost setup ssl命令，直接通过acme.sh操作即可。

步骤1：绑定ZeroSSL账号 #

将你的账号邮箱替换到下方命令执行，完成ZeroSSL账号关联：

acme.sh --register-account -m 你的联系邮箱

步骤2：签发双域名证书 #

使用现有Nginx配置的webroot路径直接签发包含两个域名的证书：

acme.sh --issue -d steptzi.com.ng -d www.steptzi.com.ng -w /var/www/ghost/system/nginx-root --server zerossl

步骤3：安装证书并配置自动续期 #

执行以下命令将证书安装到Nginx目录，同时配置自动续期后自动重载Nginx：

acme.sh --install-cert -d steptzi.com.ng -d www.steptzi.com.ng \
--key-file /etc/nginx/ssl/steptzi.com.ng/private.key \
--fullchain-file /etc/nginx/ssl/steptzi.com.ng/fullchain.crt \
--reloadcmd "systemctl reload nginx"

步骤4：配置Nginx #

后续Nginx配置和生效步骤和方案1完全一致。

注意事项 #

• 需确认steptzi.com.ng和www.steptzi.com.ng的DNS解析均已指向当前服务器IP，否则证书签发会失败
• 不要再次执行ghost setup ssl命令，否则会覆盖手动修改的Nginx配置，重新触发Let's Encrypt申请请求

内容的提问来源于stack exchange，提问作者Sheyzi Silver