记录网站从http升级到https的过程
适用于 Ubuntu 22.04 + Nginx + PM2
✅ 已完成以下操作：
PM2 正在后台运行你的博客（监听 localhost:3000）
c11njxx.cn 的 A 记录 已正确指向腾讯云服务器公网 IP
通过 http://c11njxx.cn 可以正常访问网站
Certbot 官网推荐使用 Snap 安装方式。
sudo apt update
sudo apt install snapd -y
sudo snap install core
sudo snap refresh coresudo apt remove certbot -ysudo snap install --classic certbotsudo ln -s /snap/bin/certbot /usr/bin/certbotsudo certbot --nginx -d c11njxx.cn -d www.c11njxx.cn过程中会：
要你输入邮箱（用于续期提醒）
询问是否同意服务条款（选 “Yes”）
询问是否加入用户体验计划（类似这个意思，就是发广告）
询问是否自动重定向 HTTP → HTTPS（选“2”启用跳转）
root@VM-4-5-ubuntu:~# sudo certbot --nginx -d c11njxx.cn -d www.c11njxx.cn
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
(Enter 'c' to cancel): 你的邮箱
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Requesting a certificate for c11njxx.cn and www.c11njxx.cn
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/c11njxx.cn/fullchain.pem
Key is saved at: /etc/letsencrypt/live/c11njxx.cn/privkey.pem
This certificate expires on 2025-10-23.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate
Successfully deployed certificate for c11njxx.cn to /etc/nginx/sites-enabled/blog.conf
Successfully deployed certificate for www.c11njxx.cn to /etc/nginx/sites-enabled/default
Congratulations! You have successfully enabled HTTPS on https://c11njxx.cn and https://www.c11njxx.cn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -成功后你会看到：
Congratulations! You have successfully enabled https://c11njxx.cnCertbot 会自动替换配置。查看配置文件确认：
sudo nano /etc/nginx/sites-enabled/blog.conf在浏览器中访问：
https://c11njxx.cn✅ 应显示安全绿锁 🔒
✅ 访问 http://c11njxx.cn 会自动跳转到 https://c11njxx.cn
Let’s Encrypt 证书默认有效期为 90 天。Snap 版 Certbot 会自动注册系统定时任务。
你可以手动测试是否成功：
sudo certbot renew --dry-run| 步骤 | 命令或说明 |
|---|---|
| 安装 snap + certbot | sudo snap install --classic certbot |
| 获取 HTTPS 证书 | sudo certbot --nginx -d c11njxx.cn -d www... |
| 自动跳转到 HTTPS | 由 Certbot 自动添加配置 |
| 自动续期测试 | sudo certbot renew --dry-run |
root@VM-4-5-ubuntu:~# sudo apt update
Hit:1 http://mirrors.tencentyun.com/ubuntu noble InRelease
Get:2 http://mirrors.tencentyun.com/ubuntu noble-updates InRelease [126 kB]
Get:3 http://mirrors.tencentyun.com/ubuntu noble-backports InRelease [126 kB]
Get:4 http://mirrors.tencentyun.com/ubuntu noble-updates/main amd64 Packages [1,282 kB]
Get:5 http://mirrors.tencentyun.com/ubuntu noble-updates/main Translation-en [260 kB]
Get:6 http://mirrors.tencentyun.com/ubuntu noble-updates/main amd64 Components [163 kB]
Get:7 http://mirrors.tencentyun.com/ubuntu noble-updates/restricted amd64 Components [212 B]
Get:8 http://mirrors.tencentyun.com/ubuntu noble-updates/universe amd64 Packages [1,113 kB]
Get:9 http://mirrors.tencentyun.com/ubuntu noble-updates/universe Translation-en [284 kB]
Get:10 http://mirrors.tencentyun.com/ubuntu noble-updates/universe amd64 Components [377 kB]
Get:11 http://mirrors.tencentyun.com/ubuntu noble-updates/multiverse amd64 Components [940 B]
Get:12 http://mirrors.tencentyun.com/ubuntu noble-backports/main amd64 Components [7,060 B]
Get:13 http://mirrors.tencentyun.com/ubuntu noble-backports/restricted amd64 Components [216 B]
Get:14 http://mirrors.tencentyun.com/ubuntu noble-backports/universe amd64 Components [28.3 kB]
Get:15 http://mirrors.tencentyun.com/ubuntu noble-backports/multiverse amd64 Components [212 B]
Fetched 3,768 kB in 1s (3,018 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
41 packages can be upgraded. Run 'apt list --upgradable' to see them.
root@VM-4-5-ubuntu:~# sudo apt install snapd -y
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
snapd is already the newest version (2.67.1+24.04).
The following packages were automatically installed and are no longer required:
eatmydata libeatmydata1 python3-json-pointer python3-jsonpatch python3-jsonschema python3-pyrsistent
Use 'sudo apt autoremove' to remove them.
0 upgraded, 0 newly installed, 0 to remove and 41 not upgraded.
root@VM-4-5-ubuntu:~# sudo apt autoremove
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages will be REMOVED:
eatmydata libeatmydata1 python3-json-pointer python3-jsonpatch python3-jsonschema python3-pyrsistent
0 upgraded, 0 newly installed, 6 to remove and 41 not upgraded.
After this operation, 919 kB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 129005 files and directories currently installed.)
Removing eatmydata (131-1ubuntu1) ...
Removing libeatmydata1:amd64 (131-1ubuntu1) ...
Removing python3-jsonpatch (1.32-3) ...
Removing python3-json-pointer (2.0-0ubuntu1) ...
Removing python3-jsonschema (4.10.3-2ubuntu1) ...
Removing python3-pyrsistent:amd64 (0.20.0-1build2) ...
Processing triggers for man-db (2.12.0-4build2) ...
Processing triggers for libc-bin (2.39-0ubuntu8.4) ...
root@VM-4-5-ubuntu:~# sudo snap install core
2025-07-25T16:46:29+08:00 INFO Waiting for automatic snapd restart...
core 16-2.61.4-20250508 from Canonical✓ installed
root@VM-4-5-ubuntu:~# sudo snap refresh core
snap "core" has no updates available
root@VM-4-5-ubuntu:~# sudo snap install --classic certbot
2025-07-25T16:48:03+08:00 INFO Waiting for automatic snapd restart...
certbot 4.1.1 from Certbot Project (certbot-eff✓) installed
root@VM-4-5-ubuntu:~# sudo ln -s /snap/bin/certbot /usr/bin/certbot
root@VM-4-5-ubuntu:~# sudo certbot --nginx -d c11njxx.cn -d www.c11njxx.cn
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
(Enter 'c' to cancel): 你的邮箱
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.
Requesting a certificate for c11njxx.cn and www.c11njxx.cn
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/c11njxx.cn/fullchain.pem
Key is saved at: /etc/letsencrypt/live/c11njxx.cn/privkey.pem
This certificate expires on 2025-10-23.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
Deploying certificate
Successfully deployed certificate for c11njxx.cn to /etc/nginx/sites-enabled/blog.conf
Successfully deployed certificate for www.c11njxx.cn to /etc/nginx/sites-enabled/default
Congratulations! You have successfully enabled HTTPS on https://c11njxx.cn and https://www.c11njxx.cn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
root@VM-4-5-ubuntu:~# sudo nano /etc/nginx/sites-available/c11njxx.cn
root@VM-4-5-ubuntu:~# sudo nano /etc/nginx/sites-available/
blog.conf default
root@VM-4-5-ubuntu:~# sudo nano /etc/nginx/sites-available/blog.conf
root@VM-4-5-ubuntu:~# sudo certbot renew --dry-run
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/c11njxx.cn.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Account registered.
Simulating renewal of an existing certificate for c11njxx.cn and www.c11njxx.cn
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations, all simulated renewals succeeded:
/etc/letsencrypt/live/c11njxx.cn/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -