【建站教程4/6】Part4 ssl证书申请设置{从零开始通过centos 7全指令手动搭建typecho博客心得分享，含linux系统基本操作，mysql/mariadb数据库指令，ssl证书申请和防火墙设置}

Author： plumn
发布时间：October 23, 2018
1016views
No comments
15221字数
Categories：建站攻略

<img src="https://omo.moe/usr/uploads/2018/10/726674342.jpg" alt="yande.re 27547 sample lolita_fashion morinaga_korune.jpg" />
此为自己通过centos7系统搭建typecho博客的心得分享，全文目前6部分，这是第四节
点此参看下一节：<div class="preview">
<div class="post-inser post box-shadow-wrap-normal">
<a href="https://omo.moe/archives/322/" target="_blank" class="post_inser_a ">
<div class="inner-image bg" style="background-image: url(https://omo.moe/usr/uploads/2018/10/618033048.jpg);background-size: cover;"></div>

<div class="inner-content" >
<p class="inser-title">【建站教程5/6】Part5 Firewalld防火墙安全设置{从零开始通过centos 7全指令手动搭建typecho博客心得分享，含linux系统基本操作，mysql/mariadb数据库指令，ssl证书申请和防火墙设置}</p>
<div class="inster-summary text-muted">
此为自己通过centos7系统搭建typecho博客的心得分享，全文目前6部分，这是第五节点此参看下一节：Frie...
</div>
</div>
</a>

</div>

</div>
SSL证书申请设置

---

视频分享地址：

第一步在服务器的nginx配置好ssl证书，并启用443端口，
`vi /etc/nginx/conf.d/steamoe.com.conf`加入

``````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
listen  443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
server_name www.steamoe.com steamoe.com;
root  /home/wwwroot/steamoe.com;
ssl on;
ssl_certificate "/usr/local/cert/star.steamoe.com.crt";
ssl_certificate_key "/usr/local/cert/star.steamoe.com.key";
ssl_session_timeout 10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers  ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_prefer_server_ciphers on;
``````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````

加在server 普通80端口监听配置下面即可 
我们新建一个证书存放路径：

``````````````````````````
mkdir -p /usr/local/cert/
``````````````````````````

通过sftp root用户登陆把证书.crt和自己的私钥.key文件命名好，传到这个位置
证书申请用的野卡泛域名证书，先填写CSR申请表格，有在线的
https://csr.chinassl.net/generator-csr.html
填写参考 桌面图CSR.png 注意域名前加上*.就是泛域名证书了，你的二级域名可以共用这个证书
注意邮箱要可用，勾选发送申请信息会发到你的邮箱里
提供一家收费的moeclub:

````````````````````````````````````````
https://shop.moeclub.org/cart.php?gid=4
````````````````````````````````````````

~~然后去申请免费的alphassl 泛域名证书~~这位大佬的免费证书已阵亡
~~https://ssl.ni-co.moe/ssl/create/free.html~~~~粘贴刚才获得的CSR信息，表头和结尾全复制过来~~
有谷歌验证，自行解决
如果你的域名 开启了whoisguard域名隐私保护，可以考虑关闭，不过这玩意要等生效很慢
所以推荐使用域名邮箱认证，免费的域名邮箱申请，阿里云和腾讯都有，百度一下，一般都是给
域名加3个解析：一个mx邮箱解析，一个txt文本指向，一个cname值
加好后，就可以成功获得你的域名对应邮箱后缀服务了
office365 e3 MSDN订阅，直接加一个新的成员，设置成需要的用户名，
比如admin@你的域名
webmaster@你的域名之类的
看下拉列表规则
然后自己写信测试看看是不是可用
可用后，就提交申请
等待验证你域名所有人的邮件到达，点击后确认申请信息无误
就确认
一般来说几分钟证书就下发成功了
根据邮件提示（打开邮箱查看），去alphassl网站复制一个通用的intermediate中间人证书
https://www.alphassl.com/support/install-root-certificate.html
与邮件末尾给你颁发的证书公钥部分（intermediate_domain_ca）组合一下，得到完整证书文件，改名为 你的域名.crt
再和你之前拿到的私钥.key文件，都命名ok，准备上传到vps使用

注意，移动卡发送国际短信收费1元，联通卡便宜点，只要8毛，省2毛；

2. 在typecho后台中配置

登录Typecho后台 -> 设置 -> 基本设置 -> 站点地址改成https的域名是必须的。
编辑Typecho站点根目录下的文件config.inc.php加入下面一行配置，否则网站后台还是会调用HTTP资源。

```````````````````````````````````
define('__TYPECHO_SECURE__',true);
```````````````````````````````````

想要http连接全部跳转到Https的话，继续编辑nginx的vhost配置

``````````````````````````````````````
vi /etc/nginx/conf.d/steamoe.com.conf
``````````````````````````````````````

开头新加一个server 做restrun 301跳转：

````````````````````````````````````````````````````````````````````````````````````````````````````
server
{
listen 80;
server_name steamoe.com;
return 301 https://$server_name$request_uri;
}
````````````````````````````````````````````````````````````````````````````````````````````````````

最后完整成品站点配置文件示例：

```````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
server {
listen 80;
server_name omo.moe;

return 301 https://$server_name$request_uri;
}
server {
listen 80;
listen  [::]:80 default_server;
root /home/wwwroot/omo.moe;
index index.html index.htm index.php;
#charset koi8-r;
access_log  /var/log/nginx/omo.moe.access.log  main;

listen  443 ssl http2 default_server;
#ssl on; #新版本nginx无需此命令
ssl_certificate "/usr/local/cert/omo_moe.crt";
ssl_certificate_key "/usr/local/cert/omo_moe.key";
ssl_session_timeout 10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers  ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_prefer_server_ciphers on;

error_page  404                 /404.html;
error_page  500 502 503 504  /50x.html;
location = /50x.html {
root   /usr/share/nginx/html;
}
client_max_body_size 8888m;

location / {
index index.html index.php;
if (-f $request_filename/index.html) {
rewrite (.*) $1/index.html break;
}
if (-f $request_filename/index.php) {
rewrite (.*) $1/index.php;
}
if (!-f $request_filename) {
rewrite (.*) /index.php;
}
}
location ~ \.php {
fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_index  index.php;
include        fastcgi_params;
fastcgi_split_path_info ^((?U).+\.php)(/?.+)$;
fastcgi_param  PATH_INFO        $fastcgi_path_info;
fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
}
location ~ ^.+\.php {
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
}
location ~ /.ht {
deny all;
}
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 15d;
}
location ~ .*\.(js|css)?$
{
expires 1d;
}
}
```````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````

重写下location ~ ./php{ 的伪静态，让文章页前面的index.php也隐藏起来：

`````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
location / {
index index.html index.php;
if (-f $request_filename/index.html) {
rewrite (.*) $1/index.html break;
}
if (-f $request_filename/index.php) {
rewrite (.*) $1/index.php;
}
if (!-f $request_filename) {
rewrite (.*) /index.php;
}
`````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````

替换之前的!e $request_filename段落，
完善一下php文件的匹配规则：添加：

location ~ ^.+\.php {
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
}

最后成品参考：

```````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
server {
listen 80;
server_name steamoe.com;

return 301 https://$server_name$request_uri;
}
server {
listen 80;
listen  [::]:80 default_server;
root /home/wwwroot/steamoe.com;
index index.html index.htm index.php;
#charset koi8-r;
access_log  /var/log/nginx/steamoe.com.access.log  main;

listen  443 ssl http2 default_server;
ssl on;
ssl_certificate "/usr/local/cert/star.steamoe.com.crt";
ssl_certificate_key "/usr/local/cert/star.steamoe.com.key";
ssl_session_timeout 10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers  ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_prefer_server_ciphers on;

error_page  404                 /404.html;
error_page  500 502 503 504  /50x.html;
location = /50x.html {
root   /usr/share/nginx/html;
}
location / {
index index.html index.php;
if (-f $request_filename/index.html) {
rewrite (.*) $1/index.html break;
}
if (-f $request_filename/index.php) {
rewrite (.*) $1/index.php;
}
if (!-f $request_filename) {
rewrite (.*) /index.php;
}
}
location ~ \.php {
fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
fastcgi_index  index.php;
include        fastcgi_params;
fastcgi_split_path_info ^((?U).+\.php)(/?.+)$;
fastcgi_param  PATH_INFO        $fastcgi_path_info;
fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
}
location ~ ^.+\.php {
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
}
location ~ /.ht {
deny all;
}
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
{
expires 15d;
}
location ~ .*\.(js|css)?$
{
expires 1d;
}
}  
```````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````

需要注意的是，原监听80端口的server框里，务必要有一个root 路径，以便那里面的location fastcgi_param
下的$document_root变量能获取到具体的路径，否则会导致
No input file specified.

设置好以后所有的http请求会重定向到https
可以测试下是否正确：

`````````
nginx -t
`````````

看到多余一个server_name，咱们把普通监听80端口这个去掉
只留下301跳转监听这个，因为这个$host name$字符串必须要引用上面的
server_name
`nginx -t` 没问题了
那就重新加载下吧

````````````````
nginx -s reload
````````````````

就生效了

3. 导入旧站数据库

由于Chrome浏览器对HTTPS要求较高，Firefox已经显示小绿锁，
可是Chrome还是有警告提示，F12查看，可能是评论表单的action地址还是http，
找到站点主题目录下的 comments.php 文件，并搜索 `$this->commentUrl()`，
将其替换为：`echo str_replace("http","https",$this->commentUrl())`;
也可能是上传的图片地址没有加s，那就直接加上
直接手动改一改就好。
把test发帖里面的图片附件地址加个s
然后控制台--外观---修改下footer.php模板，把页脚那个网址加上s.

最后保存。

接下来，导入旧站数据

下载wordpress to typecho 插件
http://docs.typecho.org/plugins/wordpress-to-typecho
有兴趣的可以看看其他插件
社区插件集合地址：
https://github.com/typecho-fans/plugins

解压后sftp将整个文件夹上传到 网站目录下的/usr/plugins/
去typecho后台，插件里面启用，然后设置数据库信息
我们去旧的vps修改下远程访问权限

1. 登陆mysql数据库

mysql -u root -p

查看user表

mysql> use mysql;

实现远程连接

flush privileges;
Query OK, 0 rows affected (0.00 sec)

mysql> select host,user,password from user;
+--------------+------+-------------------------------------------+
| host         | user | password                                  |
+--------------+------+-------------------------------------------+
| localhost    | root | *A731AEBFB621E354CD41BAF207D884A609E81F5E |
| 192.168.1.1 | root | *A731AEBFB621E354CD41BAF207D884A609E81F5E |
| %            | root | *A731AEBFB621E354CD41BAF207D884A609E81F5E |
+--------------+------+-------------------------------------------+
3 rows in set (0.00 sec)
">
`````````````````````````````````````````````````````````````````````````````````````````````````
mysql> use mysql;
Database changed
mysql> grant all privileges  on *.* to root@'%' identified by "password";

Query OK, 0 rows affected (0.00 sec)

mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)

清除这条远程访问权限则：

```````````````````````````````````````````````````````
delete from mysql.user where user='root' and host='%';
```````````````````````````````````````````````````````

这样就可以从新站读取旧站数据库了

```````````````````````````````
show databases;
use wordpress;
```````````````````````````````

查看旧站数据库表前缀名，获得所有信息就可以填写转移了

```````````````
show tables；
```````````````

直接导入，咱们就可以在新站看到文章数据和评论都ok回来了
但是注意，附件（上传的图片这些）是引用的原网站地址，
所以，我们还得将咱们上传的文件从wordpress拷贝过来
wordpress的上传目录，默认是在wp-content/uploads/下面，我们拷贝到
typecho的usr/uploads下面
sftp登陆旧站直接输入地址：
/home/wwwroot/default/wp-content/uploads
下载到本地，然后上传到新站的
/home/wwwroot/steamoe.com/usr/uploads

等待上传下载附件的过程中，我们可以同时
将数据库里，链接到附件路径的所有数据替换成新的附件路径，
我们去新站的SSH里进mariaDB搞起

``````````````````````````````````````
mysql -u root -p
use typecho_steamoe;
``````````````````````````````````````

进入咱们的数据库
批量替换文档表里的链接文字：
【文档】批量替换数据库表附件链接地址.txt

```````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
UPDATE typecho_contents SET text = REPLACE(text,'https://omo.moe/wp-content/uploads/','https://steamoe.com/usr/uploads/');
```````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````

如何找到这个目录名字呢？咱们可以这样：

`````````````
show tables;
`````````````

列出咱们typecho_steamoe数据库里面所有的表
看到typecho_contents表，咱们进去看看：

````````````````````````````````````````
show full fields from typecho_contents;
````````````````````````````````````````

嗯，里面一些字段应该就是咱们的文章数据了，改这个表，没错了。
我们再次查看网站文章，发现有的文章里引用了原网站其他文章地址，我们得将
https://omo.moe/也改成现在的https://steamoe.com
继续进数据库改

`````````````````````````````````````````````````````````````````````````````````````````````````````````````````
use typecho_steamoe;
UPDATE typecho_contents SET text = REPLACE(text,'https://omo.moe/','https://steamoe.com/');
`````````````````````````````````````````````````````````````````````````````````````````````````````````````````

好了，这样一来，咱们的搬家基本上就告一段落了。其实我觉得嘛，主题和博客载体换了，很多附件尺寸都不太匹配，
然后引用的这些文章地址pID其实还得手动改，这里做演示批量替换，实际上博客文章不多的，手动改也行的

要是强迫症，之后还得自己手动修改尺寸，以后再说了

2. 换主题

本地解压主题包handsome主题，整个主题文件夹上传到
/home/wwwroot/steamoe.com/usr/themes
links插件上传到
/home/wwwroot/steamoe.com/usr/plugins/
上传完毕主题和插件之后
去后台初级设置栏目改改显示的名字，左侧头像地址改改

咱们去网站后台启用下
这时候旧站附件应该差不多也上传完成了
ok
差不多就能用了
点此参看下一节：<div class="preview">
<div class="post-inser post box-shadow-wrap-normal">
<a href="https://omo.moe/archives/322/" target="_blank" class="post_inser_a ">
<div class="inner-image bg" style="background-image: url(https://omo.moe/usr/uploads/2018/10/618033048.jpg);background-size: cover;"></div>

Last modification：August 6th, 2020 at 01:10 pm

If you think my article is useful to you, please feel free to appreciate

【建站教程4/6】Part4 ssl证书申请设置{从零开始通过centos 7全指令手动搭建typecho博客心得分享，含linux系统基本操作，mysql/mariadb数据库指令，ssl证书申请和防火墙设置}

plumn • 2018 年 10 月 23 日

---

视频分享地址：

第一步在服务器的nginx配置好ssl证书，并启用443端口，
`vi /etc/nginx/conf.d/steamoe.com.conf`加入

加在server 普通80端口监听配置下面即可 
我们新建一个证书存放路径：

``````````````````````````
mkdir -p /usr/local/cert/
``````````````````````````

````````````````````````````````````````
https://shop.moeclub.org/cart.php?gid=4
````````````````````````````````````````

注意，移动卡发送国际短信收费1元，联通卡便宜点，只要8毛，省2毛；

2. 在typecho后台中配置

```````````````````````````````````
define('__TYPECHO_SECURE__',true);
```````````````````````````````````

想要http连接全部跳转到Https的话，继续编辑nginx的vhost配置

``````````````````````````````````````
vi /etc/nginx/conf.d/steamoe.com.conf
``````````````````````````````````````

开头新加一个server 做restrun 301跳转：

最后完整成品站点配置文件示例：

```````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
server {
listen 80;
server_name omo.moe;

error_page  404                 /404.html;
error_page  500 502 503 504  /50x.html;
location = /50x.html {
root   /usr/share/nginx/html;
}
client_max_body_size 8888m;

重写下location ~ ./php{ 的伪静态，让文章页前面的index.php也隐藏起来：

`````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
location / {
index index.html index.php;
if (-f $request_filename/index.html) {
rewrite (.*) $1/index.html break;
}
if (-f $request_filename/index.php) {
rewrite (.*) $1/index.php;
}
if (!-f $request_filename) {
rewrite (.*) /index.php;
}
`````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````

替换之前的!e $request_filename段落，
完善一下php文件的匹配规则：添加：

最后成品参考：

```````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````````
server {
listen 80;
server_name steamoe.com;

设置好以后所有的http请求会重定向到https
可以测试下是否正确：

`````````
nginx -t
`````````

````````````````
nginx -s reload
````````````````

就生效了

3. 导入旧站数据库

最后保存。

接下来，导入旧站数据

下载wordpress to typecho 插件
http://docs.typecho.org/plugins/wordpress-to-typecho
有兴趣的可以看看其他插件
社区插件集合地址：
https://github.com/typecho-fans/plugins

解压后sftp将整个文件夹上传到 网站目录下的/usr/plugins/
去typecho后台，插件里面启用，然后设置数据库信息
我们去旧的vps修改下远程访问权限

1. 登陆mysql数据库

mysql -u root -p

查看user表

mysql> use mysql;

实现远程连接

flush privileges;
Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)

清除这条远程访问权限则：

```````````````````````````````````````````````````````
delete from mysql.user where user='root' and host='%';
```````````````````````````````````````````````````````

这样就可以从新站读取旧站数据库了

```````````````````````````````
show databases;
use wordpress;
```````````````````````````````

查看旧站数据库表前缀名，获得所有信息就可以填写转移了

```````````````
show tables；
```````````````

等待上传下载附件的过程中，我们可以同时
将数据库里，链接到附件路径的所有数据替换成新的附件路径，
我们去新站的SSH里进mariaDB搞起

``````````````````````````````````````
mysql -u root -p
use typecho_steamoe;
``````````````````````````````````````

进入咱们的数据库
批量替换文档表里的链接文字：
【文档】批量替换数据库表附件链接地址.txt

如何找到这个目录名字呢？咱们可以这样：

`````````````
show tables;
`````````````

列出咱们typecho_steamoe数据库里面所有的表
看到typecho_contents表，咱们进去看看：

````````````````````````````````````````
show full fields from typecho_contents;
````````````````````````````````````````

要是强迫症，之后还得自己手动修改尺寸，以后再说了

2. 换主题

【建站教程4/6】Part4 ssl证书申请设置{从零开始通过centos 7全指令手动搭建typecho博客心得分享，含linux系统基本操作，mysql/mariadb数据库指令，ssl证书申请和防火墙设置}

Leave a Comment Cancel reply

利用AWS lightsail 解锁Netflix，让你所有vps可以直接看Netflix的方法分享【转】

CentOS 7 使用rclone挂载谷歌团队网盘（Google Team Drive）

Screen指令的使用以及Rclone突破谷歌云盘每日API上传750GB限制

【分享】如何将你的微软Onedrive网盘免费升级到25TB容量

谷歌云盘性能体验以及移动端辅种多端上传转移应用体验

利用AutoJS在Buff平台自动扫货/按键精灵自动连点/csgo商业脚本配套插件介绍

Skillshare&Udemy学习网站下载缓存视频方法

【Unity 3D进阶教程分享】EndlessTerrain无限地形搭建第十节：LOD结合视距分区块mesh地形渲染

C#常用快捷键清单，个人备忘专用，持续更新

【Unity 3D进阶教程分享】EndlessTerrain无限地形搭建第六节：地形Mesh网格生成器实现

【建站教程4/6】Part4 ssl证书申请设置{从零开始通过centos 7全指令手动搭建typecho博客心得分享，含linux系统基本操作，mysql/mariadb数据库指令，ssl证书申请和防火墙设置}