• 修改 acme 驗證 CA 為 letsencrypt
  acme.sh –set-default-ca –server letsencrypt

• acme.sh 使用教學 ( Web server 80 port 須對外開放提供驗證 )

• Nginx install cert

  ​​​​acme.sh --install-cert -d domain.com \
  ​​​​--key-file       /etc/nginx/ssl/domain.com/key.pem  \
  ​​​​--fullchain-file /etc/nginx/ssl/domain.com/cert.pem \
  ​​​​--reloadcmd     "service nginx force-reload"
  

• Others

  ​​​​acme.sh --install-cert -d domain.com \
  ​​​​--key-file /ssl/domain.com/key.pem  \
  ​​​​--fullchain-file /ssl/domain.com/fullchain.pem \
  ​​​​--cert-file /ssl/domain.com/cert.pem
  

• KeyCloak run with SSL

  ​​​​docker run \
  ​​​​  --name keycloak \
  ​​​​  -e KEYCLOAK_ADMIN=admin \
  ​​​​  -e KEYCLOAK_ADMIN_PASSWORD=admin \
  ​​​​  -e KC_HTTPS_CERTIFICATE_FILE=/opt/keycloak/conf/fullchain.pem \
  ​​​​  -e KC_HTTPS_CERTIFICATE_KEY_FILE=/opt/keycloak/conf/key.pem \
  ​​​​  -v /ssl/domain.com/docker/fullchain.pem:/opt/keycloak/conf/fullchain.pem \
  ​​​​  -v /ssl/domain.com/docker/key.pem:/opt/keycloak/conf/key.pem \
  ​​​​  -p 8443:8443 \
  ​​​​  -d \
  ​​​​  quay.io/keycloak/keycloak:18.0.2 \
  ​​​​  start-dev 
  

測試

openssl s_client -connect domain.com:443 -tls1_2
openssl s_client -connect domain.com:443 -tls1_3