根据你的 deploy.sh，现有架构是：

主证书：lulongquan.cn + www.lulongquan.cn（一个 SAN 证书） 独立证书：npm.lulongquan.cn img.lulongquan.cn 推荐走独立证书（和 npm 一样），便于管理。以下是完整步骤：

============================================================

新增 img.lulongquan.cn HTTPS 证书

前提：DNS 已添加 A 记录 img.lulongquan.cn → 123.57.246.84

============================================================

1. 创建临时 HTTP 配置供 certbot 验证

cat > /etc/nginx/conf.d/img.conf << 'EOF' server { listen 80; server_name img.lulongquan.cn; location /.well-known/acme-challenge/ { root /usr/share/nginx/html; } location / { return 200 "img ok"; } } EOF

nginx -t && nginx -s reload

2. 申请 Let's Encrypt 证书

certbot --nginx -d img.lulongquan.cn
-m admin@lulongquan.cn --agree-tos --non-interactive

3. 替换为正式 HTTPS 配置

cat > /etc/nginx/conf.d/img.conf << 'EOF' server { listen 80; server_name img.lulongquan.cn; location /.well-known/acme-challenge/ { root /usr/share/nginx/html; } location / { return 301 https://$host$request_uri; } }

server { listen 443 ssl; http2 on; server_name img.lulongquan.cn;

ssl_certificate     /etc/letsencrypt/live/img.lulongquan.cn/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/img.lulongquan.cn/privkey.pem;
ssl_protocols       TLSv1.2 TLSv1.3;
ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers on;
ssl_session_cache   shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets off;

add_header Strict-Transport-Security "max-age=63072000" always;
add_header X-Content-Type-Options nosniff always;

root /www/img;

location ~* \.(jpg|jpeg|png|gif|bmp|webp|svg|ico|avif)$ {
    expires 365d;
    add_header Cache-Control "public, immutable";
    access_log off;
}

access_log /var/log/nginx/img_access.log main;

} EOF

mkdir -p /www/img nginx -t && nginx -s reload

4. 验证

curl -I -k https://img.lulongquan.cn

5. 确认自动续期正常

certbot renew --dry-run