1、下载工具
wget https://dl.eff.org/certbot-auto
chmod a+x ./certbot-auto
2、初始化
./certbot-auto
3、获取证书（1）
./certbot-auto certonly --manual -d *.mydomain.com --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory
将*.mydomain.com换成你的域名。
注意：mydomain.com域名必须为你自己所有，且你能操作跟它相关的DNS记录。同时，执行certbot-auto命令的服务器必须就是mydomain.com所对应的服务器。
当我们看到类似以下信息时，就需要停一会：
-------------------------------------------------------------------------------
Please deploy a DNS TXT record under the name
_acme-challenge.mydomain.com with the following value:
xfnee7V1DS2ZlOLllasdkv-HltYfsdfahrradfU47xxs
Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue
4、配置DNS记录
根据第3步的信息，登录我们的DNS控制台，添加TXT记录：
TXT _acme-challenge.mydomain.com xfnee7V1DS2ZlOLllasdkv-HltYfsdfahrradfU47xxs
5、获取证书（2）
等DNS信息生效后，就继续获取证书（1）的步骤，按下回车，系统会自动开始认证。
等待一会，如果出现以下信息，则说明证书生成成功。
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/mydomain.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/mydomain.com/privkey.pem
Your cert will expire on 2019-01-12. To obtain a new or tweaked
version of this certificate in the future, simply run certbot-auto
again. To non-interactively renew *all* of your certificates, run
"certbot-auto renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
6、使用证书
/etc/letsencrypt/live/mydomain.com/fullchain.pem
/etc/letsencrypt/live/mydomain.com/privkey.pem
复制这俩文件到正确的位置，比如nginx的配置目录下，然后修改nginx配置文件：
server {
listen 443 ssl;
server_name www.mydomain.com;
server_name img.mydomain.com; // 这行不要加，这里是为了说明泛域名可以作用于所有二级域名。
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
location / {
root html;
}
}
7、更新证书
// 更新即将到期的证书
./certbot-auto renew
// 强制更新一个证书（这个证书也许还有很久才到期）
./certbot-auto renew --force-renewal
将更新命令加入定时任务，让它自动更新。（如何判断快到90天了）