Home首页 · Docs文档 · Monthly checklist每月换证

Monthly renew checklist每月换证 checklist

The smallest loop that still ships HTTPS in production — distilled from real multi-domain ops.生产里真正在用的最小闭环——从多域名运维经验压出来的。

status → renew → deploy → verify · ~90 days

timing节奏 Let's Encrypt lasts ~90 days. Renew when ≤30 days remain (or on a monthly pass). Issuing is easy; deploy to every target is the part that fails silently. Let's Encrypt 约 90 天有效。剩余 ≤30 天就续（或按月巡检）。申请不难；每个目标都部署到位才是容易漏的环节。

Four steps (per certificate entry)四步（按每条证书）

Check status看状态

Record expiry. Skip if still healthy.记下过期时间。还健康就跳过本条。

Generate / renew申请 / 续期

Prefer a wildcard row when many subdomains share one cert. Confirm fullchain.cer in the success log.子域名多时优先一条泛域名。成功日志里确认有 fullchain.cer。

Deploy everywhere部署到每一处

Auto: deploy each host / subdomain target. Manual: download ZIP / fullchain+key and upload the CDN console. Same cert, two delivery modes.自动：对每个机 / 子域目标跑 deploy。手动：下 ZIP 或 fullchain+key，上 CDN 控制台。同一张证，两种交付。

Verify live HTTPS验线上 HTTPS

curl -I each hostname. Optionally check dates with openssl. Confirm CDN hosts too — origin renew ≠ CDN renew.每个主机名 curl -I。可选 openssl 看日期。CDN 域名也要验——源站换了不等于 CDN 换了。

Command template (desensitized)命令模板（已脱敏）

monthly pass

# 01 status
$ docker exec acme-ssl-manager /scripts/cert-manager.sh status example.com

# 02 renew / generate (wildcard entry)
$ docker exec acme-ssl-manager /scripts/cert-manager.sh renew example.com
# or: generate '*.example.com' --force

# 03a auto deploy — one cert, many targets
$ docker exec acme-ssl-manager /scripts/cert-manager.sh deploy shop.example.com server_prod_01
$ docker exec acme-ssl-manager /scripts/cert-manager.sh deploy api.example.com server_prod_02

# 03b manual — list + download ZIP for CDN / console upload
$ docker exec acme-ssl-manager /scripts/cert-manager.sh list-manual
$ docker exec acme-ssl-manager /scripts/cert-manager.sh pack-manual

# 04 verify
$ curl -I https://shop.example.com
$ curl -I https://cdn.static.example.com

Batch checklist (print / tick)批次打勾清单

[ ] Every cert entry due within 30 days is renewed[ ] 30 天内到期的证书条目都已续期
[ ] Every auto target got deploy (or deploy-all)[ ] 每个 auto 目标都跑过 deploy（或 deploy-all）
[ ] Every manual / CDN host got a fresh pack uploaded[ ] 每个 manual / CDN 主机都已上传新包
[ ] Live curl -I shows new dates on origin and CDN[ ] 源站和 CDN 的 curl -I 都已是新日期
[ ] Full chain still has intermediates (see cert chain)[ ] 完整证书链仍含中间证（见证书链）

same cert, two landings同一张证，两处落地 A common production pattern: wildcard renew once → SSH deploy the shop host → hand-upload the static CDN hostname with the same fullchain + key. Details: Deploy. 生产里很常见：泛域名续一次 → SSH 部署商城机 → 同一套 fullchain + key 手传到静态 CDN。细节见证书部署。