本篇文章所搭配環境為 Debian 9 + Nginx 並使用架構在 Let’s Encrypt 上的 Certbot 來啟用 HTTPS 。

找出各網域所對應的根目錄

先去 /etc/nginx/sites-enabled/default 這個檔案記錄下各子網域所對應的根目錄
例如我的像是這樣
dreambreakerx.com /usr/share/nginx/www
api.dreambreakerx.com /usr/share/nginx/api
blog.dreambreakerx.com /usr/share/nginx/blog

安裝 Certbot

apt-get install python-certbot-nginx -t stretch-backports

如果無錯誤請直接跳到設定 Certbot 那個步驟，若是出現
E: The value 'stretch-backports' is invalid for APT::Default-Release as such a release is not available in the sources
請按照 https://backports.debian.org/Instructions/
編輯 /etc/apt/sources.list 這個檔案新增這行
deb http://ftp.debian.org/debian stretch-backports main

pico /etc/apt/sources.list
apt-get update
apt-get install python-certbot-nginx -t stretch-backports

設定 Certbot

certbot --authenticator webroot --installer nginx

各項設定請參考下面，需要注意的是我輸入一個空格字元選擇所有的網域，以及最後我設定強制使用 https

Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): example@gmail.com

-------------------------------------------------------------------------------
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v01.api.letsencrypt.org/directory
-------------------------------------------------------------------------------
(A)gree/(C)ancel: A

-------------------------------------------------------------------------------
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about EFF and
our work to encrypt the web, protect its users and defend digital rights.
-------------------------------------------------------------------------------
(Y)es/(N)o: Y

Which names would you like to activate HTTPS for?
-------------------------------------------------------------------------------
1: dreambreakerx.com
2: api.dreambreakerx.com
3: blog.dreambreakerx.com
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):

Input the webroot for dreambreakerx.com: (Enter 'c' to cancel): /usr/share/nginx/www

Select the webroot for api.dreambreakerx.com:
-------------------------------------------------------------------------------
1: Enter a new webroot
2: /usr/share/nginx/www
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 1
Input the webroot for api.dreambreakerx.com: (Enter 'c' to cancel): /usr/share/nginx/api

Select the webroot for blog.dreambreakerx.com:
-------------------------------------------------------------------------------
1: Enter a new webroot
2: /usr/share/nginx/api
3: /usr/share/nginx/www
-------------------------------------------------------------------------------
Select the appropriate number [1-3] then [enter] (press 'c' to cancel): 1
Input the webroot for blog.dreambreakerx.com: (Enter 'c' to cancel): /usr/share/nginx/blog

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

接著可以試試新網址，也試試舊網址有沒有轉址到 https

自動更新證書

更新時使用這句

certbot renew --dry-run

也可以加入 Cron Job ，讓它每個星期一早上3點30分自動執行

crontab -e
30 3 * * 1 certbot renew --dry-run