如何从cPanel的uapi命令结果中导出cab、crt、key SSL文件供Nginx使用

前置依赖 #

推荐使用yq工具解析uapi返回的YAML格式数据，CentOS/RHEL系统安装方式如下：

• 安装EPEL源：yum install epel-release -y
• 安装yq：yum install yq -y

单域名证书导出脚本 #

替换脚本内的cPanel用户名、目标域名、证书保存路径变量后即可执行：

# 替换为实际的cPanel用户名
CPANEL_USER="example"
# 替换为实际需要导出证书的域名
DOMAIN="example.com"
# 替换为Nginx证书存放目录
CERT_SAVE_PATH="/etc/nginx/ssl/${DOMAIN}"

# 创建证书保存目录
mkdir -p ${CERT_SAVE_PATH}

# 导出合并域名证书与CA证书为Nginx所需的fullchain.pem
uapi --user=${CPANEL_USER} SSL fetch_best_for_domain domain=${DOMAIN} | yq e '.result.data.crt' - | sed 's/\\n/\n/g' > ${CERT_SAVE_PATH}/fullchain.pem
uapi --user=${CPANEL_USER} SSL fetch_best_for_domain domain=${DOMAIN} | yq e '.result.data.cab' - | sed 's/\\n/\n/g' >> ${CERT_SAVE_PATH}/fullchain.pem
# 导出私钥
uapi --user=${CPANEL_USER} SSL fetch_best_for_domain domain=${DOMAIN} | yq e '.result.data.key' - | sed 's/\\n/\n/g' > ${CERT_SAVE_PATH}/privkey.pem

# 设置证书权限，避免泄露
chmod 600 ${CERT_SAVE_PATH}/privkey.pem
chmod 644 ${CERT_SAVE_PATH}/fullchain.pem

无yq工具替代导出方案 #

如果不想安装额外依赖，可以用grep+sed直接提取字段：

CPANEL_USER="example"
DOMAIN="example.com"
CERT_SAVE_PATH="/etc/nginx/ssl/${DOMAIN}"
mkdir -p ${CERT_SAVE_PATH}

# 拉取证书数据存为临时变量
SSL_DATA=$(uapi --user=${CPANEL_USER} SSL fetch_best_for_domain domain=${DOMAIN})

# 提取并合并证书
echo "${SSL_DATA}" | grep -A1 'crt: "' | tail -n1 | sed 's/^ *"//;s/"$//;s/\\n/\n/g' > ${CERT_SAVE_PATH}/fullchain.pem
echo "${SSL_DATA}" | grep -A1 'cab: "' | tail -n1 | sed 's/^ *"//;s/"$//;s/\\n/\n/g' >> ${CERT_SAVE_PATH}/fullchain.pem
# 提取私钥
echo "${SSL_DATA}" | grep -A1 'key: "' | tail -n1 | sed 's/^ *"//;s/"$//;s/\\n/\n/g' > ${CERT_SAVE_PATH}/privkey.pem

chmod 600 ${CERT_SAVE_PATH}/privkey.pem
chmod 644 ${CERT_SAVE_PATH}/fullchain.pem

自动续期配置 #

cPanel AutoSSL会自动续签证书，可将上述脚本添加到定时任务，每月自动更新Nginx使用的证书：

• 编辑定时任务：crontab -e
• 新增定时规则（每月1号凌晨2点执行，替换为你的脚本实际路径）：
  0 2 1 * * /bin/bash /path/to/ssl_export_script.sh > /dev/null 2>&1

Nginx配置参考 #

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/nginx/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/example.com/privkey.pem;

    # 其余站点配置省略
}

内容的提问来源于stack exchange，提问作者Mikel Tawfik