如何配置 Let's Encrypt 的 ssl_trusted_certificate？答案

【问题标题】：How to config ssl_trusted_certificate of Let’s Encrypt?如何配置 Let's Encrypt 的 ssl_trusted_certificate？
【发布时间】：2018-02-18 17:30:52
【问题描述】：

我使用Mozilla SSL Configuration Generator(https://mozilla.github.io/server-side-tls/ssl-config-generator/)来生成一个nginx配置文件。

配置文件中有一项，像这样：

ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

我使用Let's Encrypt的证书，如何生成ssl_trusted_certificate？

【问题讨论】：

标签： ssl nginx lets-encrypt

【解决方案1】：

仅当您进行客户端证书验证时才需要这样做。

Syntax: ssl_trusted_certificate file;
Default:    —
Context:    http, server
This directive appeared in version 1.3.7.
Specifies a file with trusted CA certificates in the PEM format used to verify client certificates and OCSP responses if ssl_stapling is enabled.

In contrast to the certificate set by ssl_client_certificate, the list of these certificates will not be sent to clients.

我相信您不需要这样做，因为您只是想托管一个 HTTPS 站点。你只需要评论指令就可以了。

【讨论】：

正如您引用的文档所说，如果启用了 ssl_stapling，这也用于验证 OCSP 响应。它不仅仅用于客户端证书验证。

【解决方案2】：

`ssl_trusted_certificate /etc/letsencrypt/live/YOUR_DOMAIN/chain.pem;`

来自Where are my certificates：

所有生成的密钥和颁发的证书都可以在 /etc/letsencrypt/live/$domain 中找到。

...

如果您在 Nginx >= 1.3.7 中使用 OCSP 装订，则应提供 chain.pem 作为 ssl_trusted_certificate 以验证 OCSP 响应。

此信息也在 certbot 为您的域安装的 README 文件中。以下是我的域的文件：

root@webserver:/etc/letsencrypt/live/dougrichardson.org$ ls
README  cert.pem  chain.pem  fullchain.pem  privkey.pem
root@webserver:/etc/letsencrypt/live/dougrichardson.org$ cat README
This directory contains your keys and certificates.

`privkey.pem`  : the private key for your certificate.
`fullchain.pem`: the certificate file used in most server software.
`chain.pem`    : used for OCSP stapling in Nginx >=1.3.7.
`cert.pem`     : will break many server configurations, and should not be used
                 without reading further documentation (see link below).

WARNING: DO NOT MOVE OR RENAME THESE FILES!
         Certbot expects these files to remain in this location in order
         to function properly!

We recommend not moving these files. For more information, see the Certbot
User Guide at https://certbot.eff.org/docs/using.html#where-are-my-certificates.

【讨论】：