## acme.sh免费给web站增加SSL
#### 安装
``` Bash
# 安装 acme.sh
curl https://get.acme.sh | sh
# 配置生成证书
acme.sh --issue --debug -d www.demo.com --webroot /web_dir_url
# 放入ssl文件到相关目录
mkdir /www.demo.com/
# 安装证书
acme.sh --install-cert -d www.demo.com \
--key-file /www.demo.com/www.demo.com.key \
--fullchain-file /www.demo.com/fullchain.cer \
--reloadcmd "service nginx force-reload"
# 生成 ssl_dhparam
openssl dhparam -out /dhparam.pem 2048
```
#### Nginx配置
``` nginx
server {
...
listen 443 ssl;
ssl_session_cache shared:le_nginx_SSL:1m;
ssl_session_timeout 1440m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA";
ssl_certificate /www.demo.com/fullchain.cer;
ssl_certificate_key /www.demo.com/www.demo.com.key;
ssl_dhparam /www.demo.com/dhparam.pem;
...
}
```