Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
0c9546cc
Commit
0c9546cc
authored
Sep 15, 2016
by
neil
Browse files
fix
https://github.com/Neilpang/acme.sh/issues/288
add --ocsp-must-staple, --ocsp
parent
7b164426
Changes
1
Show whitespace changes
Inline
Side-by-side
acme.sh
View file @
0c9546cc
#!/usr/bin/env sh
VER
=
2.5.
0
VER=2.5.
1
PROJECT_NAME="acme.sh"
...
...
@@ -163,11 +163,11 @@ _hasfield() {
for f in $(echo "$_str" | tr ',' ' ') ; do
if [ "$f" = "$_field" ] ; then
_debug
"'
$_str
' contains '
$_field
'"
_debug
2
"'$_str' contains '$_field'"
return 0 #contains ok
fi
done
_debug
"'
$_str
' does not contain '
$_field
'"
_debug
2
"'$_str' does not contain '$_field'"
return 1 #not contains
}
...
...
@@ -440,16 +440,20 @@ _createcsr() {
_debug _createcsr
domain="$1"
domainlist="$2"
key
=
"
$3
"
csr
key="$3"
csr="$4"
csrconf="$5"
_debug2 domain "$domain"
_debug2 domainlist "$domainlist"
_debug2 csrkey "$csrkey"
_debug2 csr "$csr"
_debug2 csrconf "$csrconf"
printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" > "$csrconf"
if [ -z "$domainlist" ] || [ "$domainlist" = "no" ]; then
#single domain
_info "Single domain" "$domain"
printf
"[ req_distinguished_name ]
\n
[ req ]
\n
distinguished_name = req_distinguished_name
\n
"
>
"
$csrconf
"
openssl req
-new
-sha256
-key
"
$key
"
-subj
"/CN=
$domain
"
-config
"
$csrconf
"
-out
"
$csr
"
else
if _contains "$domainlist" "," ; then
alt="DNS:$(echo $domainlist | sed "s/,/,DNS:/g")"
...
...
@@ -458,9 +462,13 @@ _createcsr() {
fi
#multi
_info "Multi domain" "$alt"
printf
--
"[ req_distinguished_name ]
\n
[ req ]
\n
distinguished_name = req_distinguished_name
\n
req_extensions = v3_req
\n
[ v3_req ]
\n
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
\n
subjectAltName=
$alt
"
>
"
$csrconf
"
openssl req
-new
-sha256
-key
"
$key
"
-subj
"/CN=
$domain
"
-config
"
$csrconf
"
-out
"
$csr
"
printf -- "\nsubjectAltName=$alt" >> "$csrconf"
fi
if [ "$Le_OCSP_Stable" ] ; then
_savedomainconf Le_OCSP_Stable "$Le_OCSP_Stable"
printf -- "\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >> "$csrconf"
fi
openssl req -new -sha256 -key "$csrkey" -subj "/CN=$domain" -config "$csrconf" -out "$csr"
}
#_signcsr key csr conf cert
...
...
@@ -1066,56 +1074,56 @@ _setopt() {
#_savedomainconf key value
#save to domain.conf
_savedomainconf() {
key
=
"
$1
"
value
=
"
$2
"
_sd
key="$1"
_sd
value="$2"
if [ "$DOMAIN_CONF" ] ; then
_setopt
"
$DOMAIN_CONF
"
"
$key
"
"="
"
\"
$value
\"
"
_setopt "$DOMAIN_CONF" "$
_sd
key" "=" "\"$
_sd
value\""
else
_err
"DOMAIN_CONF is empty, can not save
$key
=
$value
"
_err "DOMAIN_CONF is empty, can not save $
_sd
key=$
_sd
value"
fi
}
#_cleardomainconf key
_cleardomainconf() {
key
=
"
$1
"
_sd
key="$1"
if [ "$DOMAIN_CONF" ] ; then
_sed_i
"s/^
$key
.*
$/
/"
"
$DOMAIN_CONF
"
_sed_i "s/^$
_sd
key.*$//" "$DOMAIN_CONF"
else
_err
"DOMAIN_CONF is empty, can not save
$key
=
$value
"
_err "DOMAIN_CONF is empty, can not save $
_sd
key=$value"
fi
}
#_readdomainconf key
_readdomainconf() {
key
=
"
$1
"
_sd
key="$1"
if [ "$DOMAIN_CONF" ] ; then
(
eval
$(
grep
"^
$key
*="
"
$DOMAIN_CONF
"
)
eval
"printf
\"
%s
\"
\"\$
$key
\"
"
eval $(grep "^$
_sd
key *=" "$DOMAIN_CONF")
eval "printf \"%s\" \"\$$
_sd
key\""
)
else
_err
"DOMAIN_CONF is empty, can not read
$key
"
_err "DOMAIN_CONF is empty, can not read $
_sd
key"
fi
}
#_saveaccountconf key value
_saveaccountconf() {
key
=
"
$1
"
value
=
"
$2
"
_sc
key="$1"
_sc
value="$2"
if [ "$ACCOUNT_CONF_PATH" ] ; then
_setopt
"
$ACCOUNT_CONF_PATH
"
"
$key
"
"="
"
\"
$value
\"
"
_setopt "$ACCOUNT_CONF_PATH" "$
_sc
key" "=" "\"$
_sc
value\""
else
_err
"ACCOUNT_CONF_PATH is empty, can not save
$key
=
$value
"
_err "ACCOUNT_CONF_PATH is empty, can not save $
_sc
key=$
_sc
value"
fi
}
#_clearaccountconf key
_clearaccountconf() {
key
=
"
$1
"
_scvalue
="$1"
if [ "$ACCOUNT_CONF_PATH" ] ; then
_sed_i
"s/^
$
key
.*
$/
/"
"
$ACCOUNT_CONF_PATH
"
_sed_i "s/^$
_scvalue
.*$//" "$ACCOUNT_CONF_PATH"
else
_err
"ACCOUNT_CONF_PATH is empty, can not clear
$
key
"
_err "ACCOUNT_CONF_PATH is empty, can not clear $
_scvalue
"
fi
}
...
...
@@ -1357,7 +1365,7 @@ _initpath() {
fi
if [ -z "$DOMAIN_SSL_CONF" ] ; then
DOMAIN_SSL_CONF
=
"
$DOMAIN_PATH
/
$domain
.
ssl
.conf"
DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.
csr
.conf"
fi
if [ -z "$CSR_PATH" ] ; then
...
...
@@ -3079,6 +3087,7 @@ Parameters:
--pre-hook Command to be run before obtaining any certificates.
--post-hook Command to be run after attempting to obtain/renew certificates. No matter the obain/renew is success or failed.
--renew-hook Command to be run once for each successfully renewed certificate.
--ocsp-must-staple, --ocsp Generate ocsp must Staple extension.
"
}
...
...
@@ -3431,6 +3440,9 @@ _process() {
_renew_hook="$2"
shift
;;
--ocsp-must-staple|--ocsp)
Le_OCSP_Stable="1"
;;
*)
_err "Unknown parameter : $1"
return 1
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment