免费证书申请

SSL 证书可以让你的网站支持 HTTPS，提升安全性和可信度。以下介绍几种常见的免费 SSL 证书申请方式。

1. 使用 `caddy` 自动代理并生成 SSL

Caddy 是一个自动化 HTTPS 的 Web 服务器，支持自动申请和续签 Let’s Encrypt 证书。

Caddy 配置示例

example.com {
    reverse_proxy 127.0.0.1:8080
    encode gzip
}

Caddy 会自动为域名申请并续签 SSL 证书，无需手动操作。

2. 使用 `nginx` 配置 IP 证书

以 IP 证书 nginx 配置为例：

server {
  listen 80 default_server;
  listen [::]:80 default_server;
  location / {
    add_header "Access-Control-Allow-Origin" "*";
    root	/home/www;
    index  index.html index.htm test.html demo.html;
  }
  return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    # listen [::]:443 ssl http2;

    ssl_certificate /etc/nginx/conf.d/182.61.6.105.crt;
    ssl_certificate_key /etc/nginx/conf.d/182.61.6.105.key;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
    ssl_session_tickets off;
    
    # curl https://certbase.com/ffdhe2048.txt > /path/to/dhparam
    # ssl_dhparam /path/to/dhparam;
    # intermediate configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    # add_header Strict-Transport-Security "max-age=63072000" always;
    
    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;

    # verify chain of trust of OCSP response using Root CA and Intermediate certs
    # ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

    # replace with the IP address of your resolver
    # resolver 127.0.0.1;
    location / {
    	add_header "Access-Control-Allow-Origin" "*";
    	root	/home/www;
    	index  index.html index.htm test.html demo.html;
    }
}