Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
0c9546cc
Commit
0c9546cc
authored
Sep 15, 2016
by
neil
Browse files
fix
https://github.com/Neilpang/acme.sh/issues/288
add --ocsp-must-staple, --ocsp
parent
7b164426
Changes
1
Show whitespace changes
Inline
Side-by-side
acme.sh
View file @
0c9546cc
#!/usr/bin/env sh
VER
=
2.5.
0
VER
=
2.5.
1
PROJECT_NAME
=
"acme.sh"
...
...
@@ -163,11 +163,11 @@ _hasfield() {
for
f
in
$(
echo
"
$_str
"
|
tr
','
' '
)
;
do
if
[
"
$f
"
=
"
$_field
"
]
;
then
_debug
"'
$_str
' contains '
$_field
'"
_debug
2
"'
$_str
' contains '
$_field
'"
return
0
#contains ok
fi
done
_debug
"'
$_str
' does not contain '
$_field
'"
_debug
2
"'
$_str
' does not contain '
$_field
'"
return
1
#not contains
}
...
...
@@ -440,16 +440,20 @@ _createcsr() {
_debug _createcsr
domain
=
"
$1
"
domainlist
=
"
$2
"
key
=
"
$3
"
csr
key
=
"
$3
"
csr
=
"
$4
"
csrconf
=
"
$5
"
_debug2 domain
"
$domain
"
_debug2 domainlist
"
$domainlist
"
_debug2 csrkey
"
$csrkey
"
_debug2 csr
"
$csr
"
_debug2 csrconf
"
$csrconf
"
printf
"[ req_distinguished_name ]
\n
[ req ]
\n
distinguished_name = req_distinguished_name
\n
req_extensions = v3_req
\n
[ v3_req ]
\n\n
keyUsage = nonRepudiation, digitalSignature, keyEncipherment"
>
"
$csrconf
"
if
[
-z
"
$domainlist
"
]
||
[
"
$domainlist
"
=
"no"
]
;
then
#single domain
_info
"Single domain"
"
$domain
"
printf
"[ req_distinguished_name ]
\n
[ req ]
\n
distinguished_name = req_distinguished_name
\n
"
>
"
$csrconf
"
openssl req
-new
-sha256
-key
"
$key
"
-subj
"/CN=
$domain
"
-config
"
$csrconf
"
-out
"
$csr
"
else
if
_contains
"
$domainlist
"
","
;
then
alt
=
"DNS:
$(
echo
$domainlist
|
sed
"s/,/,DNS:/g"
)
"
...
...
@@ -458,9 +462,13 @@ _createcsr() {
fi
#multi
_info
"Multi domain"
"
$alt
"
printf
--
"[ req_distinguished_name ]
\n
[ req ]
\n
distinguished_name = req_distinguished_name
\n
req_extensions = v3_req
\n
[ v3_req ]
\n
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
\n
subjectAltName=
$alt
"
>
"
$csrconf
"
openssl req
-new
-sha256
-key
"
$key
"
-subj
"/CN=
$domain
"
-config
"
$csrconf
"
-out
"
$csr
"
printf
--
"
\n
subjectAltName=
$alt
"
>>
"
$csrconf
"
fi
if
[
"
$Le_OCSP_Stable
"
]
;
then
_savedomainconf Le_OCSP_Stable
"
$Le_OCSP_Stable
"
printf
--
"
\n
basicConstraints = CA:FALSE
\n
1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05"
>>
"
$csrconf
"
fi
openssl req
-new
-sha256
-key
"
$csrkey
"
-subj
"/CN=
$domain
"
-config
"
$csrconf
"
-out
"
$csr
"
}
#_signcsr key csr conf cert
...
...
@@ -1066,56 +1074,56 @@ _setopt() {
#_savedomainconf key value
#save to domain.conf
_savedomainconf
()
{
key
=
"
$1
"
value
=
"
$2
"
_sd
key
=
"
$1
"
_sd
value
=
"
$2
"
if
[
"
$DOMAIN_CONF
"
]
;
then
_setopt
"
$DOMAIN_CONF
"
"
$key
"
"="
"
\"
$value
\"
"
_setopt
"
$DOMAIN_CONF
"
"
$
_sd
key
"
"="
"
\"
$
_sd
value
\"
"
else
_err
"DOMAIN_CONF is empty, can not save
$key
=
$value
"
_err
"DOMAIN_CONF is empty, can not save
$
_sd
key
=
$
_sd
value
"
fi
}
#_cleardomainconf key
_cleardomainconf
()
{
key
=
"
$1
"
_sd
key
=
"
$1
"
if
[
"
$DOMAIN_CONF
"
]
;
then
_sed_i
"s/^
$key
.*
$/
/"
"
$DOMAIN_CONF
"
_sed_i
"s/^
$
_sd
key
.*
$/
/"
"
$DOMAIN_CONF
"
else
_err
"DOMAIN_CONF is empty, can not save
$key
=
$value
"
_err
"DOMAIN_CONF is empty, can not save
$
_sd
key
=
$value
"
fi
}
#_readdomainconf key
_readdomainconf
()
{
key
=
"
$1
"
_sd
key
=
"
$1
"
if
[
"
$DOMAIN_CONF
"
]
;
then
(
eval
$(
grep
"^
$key
*="
"
$DOMAIN_CONF
"
)
eval
"printf
\"
%s
\"
\"\$
$key
\"
"
eval
$(
grep
"^
$
_sd
key
*="
"
$DOMAIN_CONF
"
)
eval
"printf
\"
%s
\"
\"\$
$
_sd
key
\"
"
)
else
_err
"DOMAIN_CONF is empty, can not read
$key
"
_err
"DOMAIN_CONF is empty, can not read
$
_sd
key
"
fi
}
#_saveaccountconf key value
_saveaccountconf
()
{
key
=
"
$1
"
value
=
"
$2
"
_sc
key
=
"
$1
"
_sc
value
=
"
$2
"
if
[
"
$ACCOUNT_CONF_PATH
"
]
;
then
_setopt
"
$ACCOUNT_CONF_PATH
"
"
$key
"
"="
"
\"
$value
\"
"
_setopt
"
$ACCOUNT_CONF_PATH
"
"
$
_sc
key
"
"="
"
\"
$
_sc
value
\"
"
else
_err
"ACCOUNT_CONF_PATH is empty, can not save
$key
=
$value
"
_err
"ACCOUNT_CONF_PATH is empty, can not save
$
_sc
key
=
$
_sc
value
"
fi
}
#_clearaccountconf key
_clearaccountconf
()
{
key
=
"
$1
"
_scvalue
=
"
$1
"
if
[
"
$ACCOUNT_CONF_PATH
"
]
;
then
_sed_i
"s/^
$
key
.*
$/
/"
"
$ACCOUNT_CONF_PATH
"
_sed_i
"s/^
$
_scvalue
.*
$/
/"
"
$ACCOUNT_CONF_PATH
"
else
_err
"ACCOUNT_CONF_PATH is empty, can not clear
$
key
"
_err
"ACCOUNT_CONF_PATH is empty, can not clear
$
_scvalue
"
fi
}
...
...
@@ -1357,7 +1365,7 @@ _initpath() {
fi
if
[
-z
"
$DOMAIN_SSL_CONF
"
]
;
then
DOMAIN_SSL_CONF
=
"
$DOMAIN_PATH
/
$domain
.
ssl
.conf"
DOMAIN_SSL_CONF
=
"
$DOMAIN_PATH
/
$domain
.
csr
.conf"
fi
if
[
-z
"
$CSR_PATH
"
]
;
then
...
...
@@ -3079,6 +3087,7 @@ Parameters:
--pre-hook Command to be run before obtaining any certificates.
--post-hook Command to be run after attempting to obtain/renew certificates. No matter the obain/renew is success or failed.
--renew-hook Command to be run once for each successfully renewed certificate.
--ocsp-must-staple, --ocsp Generate ocsp must Staple extension.
"
}
...
...
@@ -3431,6 +3440,9 @@ _process() {
_renew_hook
=
"
$2
"
shift
;;
--ocsp-must-staple
|
--ocsp
)
Le_OCSP_Stable
=
"1"
;;
*
)
_err
"Unknown parameter :
$1
"
return
1
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment