Python - Sim Wiki

最后修改人	sim
最后修改时间	2025-11-19 10:43:58
创建人	sim
创建时间	2025-11-18 17:58:02

该文档由 sim 创建于 2025-11-18 17:58:02 ， sim 在 2025-11-19 10:43:58 修改了该文档。

[TOCM]

#### 环境依赖
要求至少openssl-1.1.1w
```shell
./configure --prefix=/opt/python38 --with-openssl=/usr/local/openssl
make -j8
make install
# 验证
/opt/python38/bin/python3.8 -c "import ssl; print(ssl.OPENSSL_VERSION)"
# 输出应为
OpenSSL 1.1.1w  11 Sep 2023
```
Python SSL 默认查找路径显示：
```shell
openssl_cafile='/usr/local/openssl/ssl/cert.pem'
openssl_capath='/usr/local/openssl/ssl/certs'
```
确保链接到系统 CA：
```shell
mkdir -p /usr/local/openssl/ssl/certs
ln -sf /etc/pki/tls/certs/ca-bundle.crt /usr/local/openssl/ssl/cert.pem
ln -sf /etc/pki/tls/certs /usr/local/openssl/ssl/certs
```
验证：
```shell
python3.8 -c "import ssl; ssl.create_default_context()"
```
不报错表示 Python SSL 已正常工作。
#### 下载Python3.8源码
```shell
cd /usr/local/src
wget https://www.python.org/ftp/python/3.8.18/Python-3.8.18.tar.xz
tar xf Python-3.8.18.tar.xz && cd Python-3.8.18
```
#### 编译安装
```shell
./configure --prefix=/opt/python38 --enable-optimizations --with-openssl=/usr/local/openssl
make altinstall
```
#### 使用虚拟环境运行
```shell
cd /opt/python38/bin
./python3.8 -m venv /opt/certbot-venv
source /opt/certbot-venv/bin/activate	#进入虚拟环境
deactivate							   #退出虚拟环境
```
#### 在虚拟环境中安装
```shell
pip install --upgrade pip setuptools wheel
pip install certbot
pip install certbot-dns-tencentcloud
```
#### 配置腾讯云dns api
```shell
vi /etc/letsencrypt/tencentcloud.ini
####
	dns_tencentcloud_secret_id = AKIDxxxxxxxxxxxxxxxxxxxx
	dns_tencentcloud_secret_key = xxxxxxxxxxxxxxxxxxxxxxxx
####
chmod 600 /etc/letsencrypt/tencentcloud.ini
```
#### 申请泛域名证书
```shell
certbot certonly \
  --authenticator dns-tencentcloud \
  --dns-tencentcloud-credentials /etc/letsencrypt/tencentcloud.ini \
  --dns-tencentcloud-propagation-seconds 120 \
  -d "*.wangyanhan.com.cn" \
  -d "wangyanhan.com.cn" \
  --agree-tos \
  --no-eff-email \
  -m noname@gmail.com
```
证书生成位置
```shell
/etc/letsencrypt/live/wangyanhan.com.cn/fullchain.pem
/etc/letsencrypt/live/wangyanhan.com.cn/privkey.pem
```
nginx中配置
```shell
ssl_certificate     /etc/letsencrypt/live/wangyanhan.com.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/wangyanhan.com.cn/privkey.pem;
```
#### 自动续签
手动续签并reload nginx命令
```shell
/opt/certbot-venv/bin/certbot renew --quiet --deploy-hook "/usr/local/nginx/sbin/nginx -s reload"
```
配置crontab定时任务自动触发（凌晨3点）
```shell
0 3 * * * /opt/certbot-venv/bin/certbot renew --quiet --deploy-hook "/usr/local/nginx/sbin/nginx -s reload"
```
#### 主流域名dns服务商下ssl申请插件
| DNS 服务商          | Certbot 插件名称               | 支持泛域名 | 所需认证方式                     |       
| ---------------- | -------------------------- | ----- | -------------------------- |
| Cloudflare       | `certbot-dns-cloudflare`   | ✔     | API Token 或 Global API Key |        
| 阿里云 AliDNS       | `certbot-dns-aliyun`       | ✔     | AccessKey ID + Secret      |        
| GoDaddy          | `certbot-dns-godaddy`      | ✔     | API Key + API Secret       |         
| AWS Route53      | `certbot-dns-route53`      | ✔     | IAM Access keys            |      
| Namecheap        | `certbot-dns-namecheap`    | ✔     | API Key                    |        
| DigitalOcean     | `certbot-dns-digitalocean` | ✔     | API Token                  |        
| Google Cloud DNS | `certbot-dns-google`       | ✔     | JSON Service Account       |         
| 腾讯云              | `certbot-dns-tencentcloud` | ✔     | SecretId + SecretKey       |

#### 域名在各不同服务商下申请ssl方式
##### 阿里云
```shell
pip install certbot-dns-aliyun
# 配置文件 /etc/letsencrypt/alidns.ini
	dns_aliyun_access_key = your_access_key
	dns_aliyun_access_key_secret = your_secret_key
chmod 600 /etc/letsencrypt/alidns.ini
```
申请命令
```shell
certbot certonly \
  --authenticator dns-aliyun \
  --dns-aliyun-credentials /etc/letsencrypt/alidns.ini \
  --dns-aliyun-propagation-seconds 120 \
  -d "*.example.com" \
  -d "example.com" \
  --agree-tos \
  --no-eff-email \
  -m admin@example.com
```
##### Cloudflare
```shell
pip install certbot-dns-cloudflare
# 配置文件 /etc/letsencrypt/cloudflare.ini：
	dns_cloudflare_api_token = your_cloudflare_api_token
chmod 600 /etc/letsencrypt/cloudflare.ini
```
申请命令
```shell
certbot certonly --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
-d "*.example.com" -d "example.com"
```
##### AWS Route53
```shell
pip install certbot-dns-route53
# 需要系统中配置 AWS CLI 的 credentials，在 ~/.aws/credentials
```
申请命令
```shell
certbot certonly --dns-route53 -d "*.example.com" -d "example.com"
```
##### GoDaddy
```shell
pip install certbot-dns-godaddy
# 配置文件 /etc/letsencrypt/godaddy.ini：
	dns_godaddy_api_key = your_api_key
	dns_godaddy_api_secret = your_api_secret
chmod 600 /etc/letsencrypt/godaddy.ini
```
申请命令
```shell
certbot certonly \
  --authenticator dns-godaddy \
  --dns-godaddy-credentials /etc/letsencrypt/godaddy.ini \
  --dns-godaddy-propagation-seconds 120 \
  -d "*.example.com" \
  -d "example.com" \
  --agree-tos \
  --no-eff-email \
  -m admin@example.com
```