# 自动获取域名证书及DNS设置
> How to Get a Free SSL and auto update via cloudflare dns
## Method One:
方法1:
1. get a domain
    1. you can get a domain with godaddy.com or [name.com](http://name.com) or other domain sp EXCEPT chinese sp.
	* 获取域名。我之前推荐使用name.com申请域名。但是现在我更倾向于直接在[cloudflare.com](https://www.cloudflare.com)上申请，并开启自动续费，如果有必要。但是千万不要申请国内域名商的域名。如果有国内的域名，请转出。
2. redirect your domain ns server(nameserver) to cloudflare and get your dns api global key:
    1. redirect domain ns server:modify your domain ns server to cloudflare, You must delete old nameserver and update to new nameserver :[coby.ns.cloudflare.com](http://coby.ns.cloudflare.com/)   and   [mira.ns.cloudflare.com](http://mira.ns.cloudflare.com/) .
    2. get api key: In your cloudfare account profile,you can get your api key.choose GLOBAL Key,like that:cc729fd0aebf3f59a0102a037558aa07f1d52 and your account ,an email address.
	* 如果不在cloudflare上面的域名，建议转到cloudflare或者ns服务器更改为cloudflare的。:coby.ns.cloudflare.com 和  mira.ns.cloudflare.com（可能会有变化，请在官网查看）。
	* 获取到域名/cloudflare的api key。在个人账户里面，找到GLOBAL key。类似这样一串数字：cc729fd0aebf3f59a0102a037558aa07f1d52。外加你的cloudflare的账号（邮箱）。
3. install acme.sh
    1. install。use this code :
    * 安装acme.sh：（如果你在墙内，可能速度很慢甚至无法下载。这个自己解决）
        
        ```shell
        curl  https://get.acme.sh | sh -s email=your@mail.com
        ```
        
    2. your [acme.sh](http://acme.sh) is in your home directory: ~/.acme.sh/
    3. acme的目录在 ~/.acme.sh/ 
    4. create an alias like that: alias [acme.sh](http://acme.sh) = ~/.acme.sh/acme.sh
    * 创建一个应用程序的快捷方式alias，以便后面直接调用。 可以写入到bash.rc里面。如：ache.sh=~/.acme.sh/acme.sh
    5. modify your account config,add your cloudflare key to ~/.acme.sh/account.conf .
    * 修改acme.sh的配置文件：在～/.acme.sh/account.conf里。填入刚才在cloudflare里面获取到的api key。
        
        ```bash
        SAVED_CF_Key='your cloudflare global key'
        SAVED_CF_Email='your@mail.com'
        ```
        
    5. others like dnspod,please modify the key,like:
    * 如果用的不是cloudflare而是其他的，比如Dnspod，则用以下配置。具体可以参看acme的帮助文档：
    
    ```bash
    DP_Id = '123455' # your id;
    DP_Key = 'your key like eabd83adxxxx'
    ```
    
4. get your domain connect to your service
    1. make sure your dns A record is done and in cloudflare;
    2. use this  code to install your domain(cloudflare):
	* 让acme控制你的域名：
        
        ```bash
        "/yourname/.acme.sh"/acme.sh --issue --dns dns_cf -d yourdomain.com -d www.yourdomain.com
        ```
        
    3. others like dnspod:
        
        ```bash
        "/yourname/.acme.sh"/acme.sh --issue --dns dns_dp -d yourdomain.com -d www.yourdomain.com
        ```
        * 以上，其实就完成了。可以看看你的`crontab -l` 定时任务里有没有acme的定时任务。 
	4. auto update
		 1. ganarally,the [ache.sh](http://ache.sh) will add cron job to crontab automaticly;
    	2. use crontab -l to see the [job.](http://job.you) you will find this in list:
        
        ```bash
        52 0 * * * "/yourname/.acme.sh"/acme.sh --cron --home "/yourname/.acme.sh" > /dev/null
        ```
        
    3. if you can't find this, you can use this command  to add job to corntab:
    * 如果没有加入定时任务，则安装cronjob：
        
        ```bash
        "/yourname/.acme.sh/acme.sh" --install-cronjob
        ```
        
6. copy your cert and key file to your really using cert and key file:
    * 接下来，把生成的证书，复制到你要用的地方。千万不要直接链接到证书生成的地方：
    ```bash
    "/yourname/.ache.sh/acme.sh" --install-cert -d example.com \
    --key-file       /path/to/keyfile/in/nginx/key.pem  \
    --fullchain-file /path/to/fullchain/nginx/cert.pem \
    --reloadcmd     3u88额u鹅ue e e e u e e 4
    ```
    
    please use fullchain file while using nginx.
    如果是nginx的，用--fullchain-file 复制证书cert。
7. check  config file in domain path:
    * 在acme目录里，会生成以域名的名字命名的目录，每个里面都会有一个conf文件：
    you can check the file name such as:
    
    ```ini
    "yourdomain.com.conf"
    ```
    
     in your domain path ,the file struct is like this:
    这个文件长这个样子：
    ```ini
    Le_Domain='www.yourdomain.com'
    Le_Alt='no'
    Le_Webroot='dns_cf'
    Le_PreHook=''
    Le_PostHook=''
    Le_RenewHook=''
    Le_API='https://acme.zerossl.com/v2/DV90'
    Le_Keylength=''
    Le_OrderFinalize='https://acme.zerossl.com/v2/DV90/order/OeqVf5QtIVRk32MefKS05qA/finalize'
    Le_LinkOrder='https://acme.zerossl.com/v2/DV90/order/OeqVf5QtIVRk32MefKS05qA'
    Le_LinkCert='https://acme.zerossl.com/v2/DV90/cert/tLbbP1kzrwv--IyPDT9zjQ'
    Le_CertCreateTime='1626686754'
    Le_CertCreateTimeStr='Mon Jul 19 09:25:54 UTC 2021'
    Le_NextRenewTimeStr='Fri Sep 17 09:25:54 UTC 2021'
    Le_NextRenewTime='1631784354'
    Le_RealCertPath=''
    Le_RealCACertPath=''
    Le_RealKeyPath='/your/real/key/path/www.yourdomain.com.key'
    Le_ReloadCmd='__ACME_BASE64__START_c3lzdGVtY3RsIHJlbG9hRCBuZ2lueA==__ACME_BASE64__END_'
    Le_RealFullChainPath='/your/real/fullchain/path/www.yourdomain.com.crt'
    ```
    
    that's all.and then it will auto renew the cert.
    具体我就不解释了。
8. set your nginx config file
    * 在你的nginx里面，要进行ssl相关的配置，主要是指向证书。
    set your nginx config file for ssl file:
    
    ```bash
    				ssl_certificate       /your/real/key/path/www.yourdomain.com.crt;
            ssl_certificate_key   /your/real/key/path/www.yourdomain.com.key;
            ssl_protocols         TLSv1.2 TLSv1.3;
    ```
    
    you need restart your nginx service while changing the path or file.
	记得改了以后要重启nginx，systemctl restart nginx。
	
	---
	## 我的配置
	
	1. 搬瓦工服务器：
	
		account.conf
		```ini 
		LOG_FILE='/root/.acme.sh/acme.sh.log'
		#LOG_LEVEL=1
		AUTO_UPGRADE='1'
		#NO_TIMESTAMP=1
		UPGRADE_HASH='0013d98d045aa57c6a541ec97dd55722d76b319e'
		USER_PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin'
		SAVED_CF_Key='cc729fd0febf3f59a0102a047558aa07f1d51'
		SAVED_CF_Email='maxwellxzy@gmail.com'
		```

		i.disbaidu.com.conf
		```
		Le_Domain='i.disbaidu.com'
		Le_Alt='no'
		Le_Webroot='dns_cf'
		Le_PreHook=''
		Le_PostHook=''
		Le_RenewHook=''
		Le_API='https://acme.zerossl.com/v2/DV90'
		Le_Keylength='2048'
		Le_OrderFinalize='https://acme.zerossl.com/v2/DV90/order/_nt_mu_uXXi1CH6a334enw/finalize'
		Le_LinkOrder='https://acme.zerossl.com/v2/DV90/order/_nt_mu_uXXi1CH6a334enw'
		Le_LinkCert='https://acme.zerossl.com/v2/DV90/cert/BQEhssHOMGSEiFQOD_NT1g'
		Le_CertCreateTime='1657904190'
		Le_CertCreateTimeStr='2022-07-15T16:56:30Z'
		Le_NextRenewTimeStr='2022-09-13T16:56:30Z'
		Le_NextRenewTime='1663001790'
		Le_RealCertPath=''
		Le_RealCACertPath=''
		Le_RealKeyPath='/data/i.disbaidu.com.key'
		Le_ReloadCmd='__ACME_BASE64__START_c3lzdGVtY3RsIHJlbG9hZCBuZ2lueA==__ACME_BASE64__END_'
		Le_RealFullChainPath='/data/i.disbaidu.com.crt'
		```


	3. 南非服务器：

