域名通配符的配置方法 1、获取域名dns api 阿里云： ~~~ export Ali_Key="123456" export Ali_Secret="abcdef" ~~~ | AccessKey ID | Access Key Secret | 状态 | 创建时间 | 操作 | | --- | --- | --- | --- | --- | | 123456 | abcdefdfsfdsfdsfsdj | 启用 | 2017-11-19 15:52:47 | 禁用|删除 | 2、将域名解析到服务器，并添加txt记录  3、这里选择ali阿里云 ~~~ lnmp dnsssl {cx|ali|cf|dp|he|gd|aws} lnmp dnsssl ali ~~~ 4、 ~~~ [root@izeano5qvehexvz home]# lnmp dnsssl ali +-------------------------------------------+ |   Manager for LNMP, Written by Licess   | +-------------------------------------------+ |             https://lnmp.org             | +-------------------------------------------+ /usr/local/acme.sh/acme.sh [found] Please enter domain(example: www.lnmp.org): buhuokeji.com Your domain: buhuokeji.com Enter more domain name(example: lnmp.org *.lnmp.org): *.buhuokeji.com domain list: *.buhuokeji.com Please enter the directory for domain buhuokeji.com: /home/wwwroot/buhuokeji.com Allow Rewrite rule? (y/n) y Please enter the rewrite of programme, wordpress,discuzx,typecho,thinkphp,laravel,codeigniter,yii2 rewrite was exist. (Default rewrite: other): You choose rewrite: other Allow access log? (y/n) y Enter access log filename(Default:buhuokeji.com.log): You access log filename: buhuokeji.com.log Enable PHP Pathinfo? (y/n) y Enable pathinfo. Starting create SSL Certificate use Let's Encrypt... [Tue Apr 30 17:33:49 CST 2019] Registering account [Tue Apr 30 17:33:51 CST 2019] Registered [Tue Apr 30 17:33:51 CST 2019] ACCOUNT_THUMBPRINT='eBcLD5tn9t0cEzh3YvifBbiXUX1Ns9rqCvJ6U79nJRM' [Tue Apr 30 17:33:51 CST 2019] Creating domain key [Tue Apr 30 17:33:51 CST 2019] The domain key is here: /usr/local/nginx/conf/ssl/buhuokeji.com/buhuokeji.com.key [Tue Apr 30 17:33:51 CST 2019] Multi domain='DNS:buhuokeji.com,DNS:*.buhuokeji.com' [Tue Apr 30 17:33:51 CST 2019] Getting domain auth token for each domain [Tue Apr 30 17:33:53 CST 2019] Getting webroot for domain='buhuokeji.com' [Tue Apr 30 17:33:53 CST 2019] Getting webroot for domain='*.buhuokeji.com' [Tue Apr 30 17:33:53 CST 2019] Found domain api file: /usr/local/acme.sh/dnsapi/dns_ali.sh [Tue Apr 30 17:33:56 CST 2019] Found domain api file: /usr/local/acme.sh/dnsapi/dns_ali.sh [Tue Apr 30 17:33:58 CST 2019] Sleep 120 seconds for the txt records to take effect [Tue Apr 30 17:36:00 CST 2019] Verifying:buhuokeji.com [Tue Apr 30 17:36:03 CST 2019] Success [Tue Apr 30 17:36:03 CST 2019] Verifying:*.buhuokeji.com [Tue Apr 30 17:36:06 CST 2019] Success [Tue Apr 30 17:36:06 CST 2019] Removing DNS records. [Tue Apr 30 17:36:13 CST 2019] Verify finished, start to sign. [Tue Apr 30 17:36:15 CST 2019] Cert success. [Tue Apr 30 17:36:16 CST 2019] Your cert is in /usr/local/nginx/conf/ssl/buhuokeji.com/buhuokeji.com.cer [Tue Apr 30 17:36:16 CST 2019] Your cert key is in /usr/local/nginx/conf/ssl/buhuokeji.com/buhuokeji.com.key [Tue Apr 30 17:36:16 CST 2019] The intermediate CA cert is in /usr/local/nginx/conf/ssl/buhuokeji.com/ca.cer [Tue Apr 30 17:36:16 CST 2019] And the full chain certs is there: /usr/local/nginx/conf/ssl/buhuokeji.com/fullchain.cer [Tue Apr 30 17:36:16 CST 2019] Run reload cmd: /etc/init.d/nginx reload Reload service nginx...  done [Tue Apr 30 17:36:16 CST 2019] Reload success You select the exist rewrite rule:/usr/local/nginx/conf/rewrite/other.conf Test Nginx configure file...... nginx: [warn] conflicting server name "buhuokeji.com" on 0.0.0.0:80, ignored nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful Reload Nginx...... nginx: [warn] conflicting server name "buhuokeji.com" on 0.0.0.0:80, ignored Test Nginx configure file...... nginx: [warn] conflicting server name "buhuokeji.com" on 0.0.0.0:80, ignored nginx: [warn] conflicting server name "buhuokeji.com" on 0.0.0.0:443, ignored nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful Reload Nginx...... nginx: [warn] conflicting server name "buhuokeji.com" on 0.0.0.0:80, ignored nginx: [warn] conflicting server name "buhuokeji.com" on 0.0.0.0:443, ignored Let's Encrypt SSL Certificate create successfully. ~~~ 4、测试 将子域名证书路径更改为通配符文件fullchain.cer，key更改为主域名key文件  5、验证 证书有效，有效期为三个月，用DNS颁发的将会在到期自动续期。   https://github.com/Neilpang/acme.sh/tree/master/dnsapi