与许多 NGINX 模块一样，ngx_http_acme_module 是一个动态模块，需要手动编译并加载到您的 NGINX 中，也可以使用官方源来使用yum/apt来进行安装。

版本要求与兼容性
在开始之前，最重要的一点是理解版本兼容性。nginx-acme 模块及其底层的 ngx-rust SDK 是非常新的技术，它们依赖 NGINX 核心中新增的函数接口（API）。

最低版本要求：NGINX 1.25.1。任何低于此版本的 NGINX（如 1.24.x, 1.22.x）都缺少必要的 API，会导致编译时出现 not found in nginx_sys 等错误而失败。
生产环境推荐：NGINX 1.28.0 或更高的稳定（Stable）版本。该版本继承了 1.26+ 系列的所有关于tls相关的优化功能，并进入了以修复 bug 为主的稳定维护周期，是生产环境的最佳选择。

本生产环境使用最新的稳定版1.28.x

1、安装nginx官方源和acme模块

1、安装依赖包，参考文档：https://nginx.org/en/linux_packages.html
sudo apt install curl gnupg2 ca-certificates lsb-release debian-archive-keyring

2、获取官方源的key
curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor \
    | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null

3、设置官方源
echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \
https://nginx.org/packages/debian `lsb_release -cs` nginx" \
    | sudo tee /etc/apt/sources.list.d/nginx.list

echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" \
    | sudo tee /etc/apt/preferences.d/99nginx

4、安装nginx 和 ngx_http_acme_module 模块
sudo apt update
sudo apt install nginx nginx-module-acme

2、创建证书保存目录和配置文件

2.1、创建证书保存目录并设置目录权限和用户组
mkdir -p /var/cache/nginx/acme/letsencrypt
chown -R nginx:root /var/cache/nginx/acme/
chmod -R 700 /var/cache/nginx/acme/

2.2、修改配置文件用来加载acme和配置acme，参考文档：https://nginx.org/en/docs/http/ngx_http_acme_module.html

vi /etc/nginx/nginx.conf

#添加下行以加载ngx_http_acme_module动态模块
load_module /usr/lib/nginx/modules/ngx_http_acme_module.so; 

user www-data;
worker_processes  auto;

pid        /var/run/nginx.pid;
error_log  /var/log/nginx/error.log  crit;

worker_rlimit_nofile 4096;


events {
	use epoll;
	worker_connections  4096;
	multi_accept on;

}


http {
	include       /etc/nginx/mime.types;
	default_type  application/octet-stream;

	log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
		'$status  $body_bytes_sent "$http_referer" '
		'"$http_user_agent" "$http_x_forwarded_for"'
		'"$upstream_addr $request_time $upstream_response_time $request_body"';

	access_log  /var/log/nginx/access.log  main;


	set_real_ip_from 127.0.0.1;
	real_ip_header X-Forwarded-For;

	##
	# Basic Settings
	##

	keepalive_timeout    65;
	server_tokens off;
	ssi off;
	etag off;
	charset utf-8;
	types_hash_max_size  2048;
	##
	# Performance Settings
	##
	sendfile     on;
	tcp_nopush   on;
	tcp_nodelay  on;
	open_file_cache            max=50000  inactive=20s; 
	open_file_cache_valid      30s; 
	open_file_cache_min_uses   2;
	open_file_cache_errors     on;
	reset_timedout_connection  on;
	client_body_timeout        65;
	send_timeout               2;
	##
	# DDoS Protection Settings
	##
	client_body_buffer_size      128k;
	client_header_buffer_size 16k;
	large_client_header_buffers  4 32k;
	client_max_body_size 8m;
	server_names_hash_bucket_size 128;

	#    proxy_headers_hash_max_size 51200;
	#    proxy_headers_hash_bucket_size 6400;


	#    limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
	#    limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=50r/s;
	#    limit_conn conn_limit_per_ip 20;
	#    limit_req zone=req_limit_per_ip burst=20;

	fastcgi_connect_timeout 300; #如果你不使用FastCGI，请用井号注释该段每一行
	fastcgi_send_timeout 300;
	fastcgi_read_timeout 300;

	fastcgi_buffer_size 128k;
	fastcgi_buffers 16 64k;
	fastcgi_busy_buffers_size 128k;
	fastcgi_temp_file_write_size 128k;


	gzip on; #如果你不使用GZip，请用井号注释该段每一行
	gzip_min_length  1k;
	gzip_buffers     4 16k;
	gzip_http_version 1.1;
	gzip_comp_level 4;
	gzip_types       text/plain application/javascript text/css application/xml text/javascript application/x-httpd-php image/jpeg image/gif image/png;
	gzip_vary off;
	gzip_proxied        expired no-cache no-store private auth;
	gzip_disable        "MSIE [1-6]\.";

	include /etc/nginx/conf.d/*.conf;

}


2.3、修改配置文件 /etc/nginx/conf.d/default.conf 添加以下内容
vi /etc/nginx/conf.d/default.conf

resolver 8.8.8.8 1.1.1.1;
acme_issuer letsencrypt {
	uri         https://acme-v02.api.letsencrypt.org/directory;
	contact     mailto:你的邮箱@gmail.com;
	state_path  acme/letsencrypt;  #证书保存位置：/var/cache/nginx/acme/letsencrypt/
	accept_terms_of_service;
}
acme_shared_zone zone=acme_shared:1M;

server {
	listen 443 ssl;
	server_name kaifashuo.com www.kaifashuo.com;

	acme_certificate    letsencrypt;
	ssl_certificate     $acme_certificate;
	ssl_certificate_key   $acme_certificate_key;
	ssl_certificate_cache   max=2;  # required ngx 1.27.4+


	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
	ssl_prefer_server_ciphers off;


	# 启用 HTTP/2 
	http2 on;

	add_header X-Frame-Options "SAMEORIGIN";
	add_header X-XSS-Protection "1; mode=block";
	add_header X-Content-Type-Options "nosniff";

	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;


	if ($request_method !~* GET|POST) {
		return 403;
	}

	location / {
		proxy_pass http://127.0.0.1:6081;

		proxy_set_header X-Real-IP  $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto https;
		proxy_set_header X-Forwarded-Port 443;
		proxy_set_header Host $host;
		proxy_set_header REMOTE-HOST $remote_addr; 
		proxy_hide_header X-Powered-By;

	}

}

2.4、重启nginx
systemctl restart  nginx

至此，Nginx配合动态模块nginx-module-acme自动生成letsencrypt https证书配置完毕。