1
2

export CF_Token="xxx"
export CF_Account_ID="xxxx"

1

curl https://get.acme.sh | sh -s email=my@example.com

1

acme.sh --issue -d '*.mydomain.com' --dns dns_cf

1
2
3
4
5
6

mkdir -p /etc/nginx/ssl

acme.sh --install-cert -d '*.mydomain.com' \
--key-file       /etc/nginx/ssl/key.pem  \
--fullchain-file /etc/nginx/ssl/cert.pem \
--reloadcmd     "systemctl force-reload nginx"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

listen 443 ssl;
http2 on;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256';

ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;
ssl_session_tickets off;
add_header Strict-Transport-Security "max-age=63072000" always;