Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
1add47a6
Commit
1add47a6
authored
Feb 12, 2016
by
neil
Browse files
support ECC key, ECDSA certificate
parent
0f71a9fe
Changes
2
Show whitespace changes
Inline
Side-by-side
README.md
View file @
1add47a6
...
@@ -181,6 +181,25 @@ If your dns provider is not in the supported list above, you can write your own
...
@@ -181,6 +181,25 @@ If your dns provider is not in the supported list above, you can write your own
For more details:
[
How to use dns api
](
dnsapi
)
For more details:
[
How to use dns api
](
dnsapi
)
# Issue ECC certificate:
LetsEncrypt now can issue ECDSA certificate.
And we also support it.
Just set key length to the
`length`
paramiter with a prefix "ec-".
For example:
```
le issue /home/wwwroot/aa.com aa.com www.aa.com ec-256
```
Please look at the last parameter above.
Valid values are:
1.
ec-256 (prime256v1, "ECDSA P-256")
2.
ec-384 (secp384r1, "ECDSA P-384")
3.
ec-521 (secp521r1, "ECDSA P-521", not supported by letsencrypt yet.)
#Under the Hood
#Under the Hood
Speak ACME language with bash directly to Let's encrypt.
Speak ACME language with bash directly to Let's encrypt.
...
...
le.sh
View file @
1add47a6
#!/bin/bash
#!/bin/bash
VER
=
1.1.
5
VER
=
1.1.
6
PROJECT
=
"https://github.com/Neilpang/le"
PROJECT
=
"https://github.com/Neilpang/le"
DEFAULT_CA
=
"https://acme-v01.api.letsencrypt.org"
DEFAULT_CA
=
"https://acme-v01.api.letsencrypt.org"
...
@@ -41,6 +41,7 @@ _err() {
...
@@ -41,6 +41,7 @@ _err() {
else
else
echo
"
$1
"
=
"
$2
"
>
&2
echo
"
$1
"
=
"
$2
"
>
&2
fi
fi
return
1
}
}
_h2b
()
{
_h2b
()
{
...
@@ -66,12 +67,17 @@ _base64() {
...
@@ -66,12 +67,17 @@ _base64() {
createAccountKey
()
{
createAccountKey
()
{
_info
"Creating account key"
_info
"Creating account key"
if
[
-z
"
$1
"
]
;
then
if
[
-z
"
$1
"
]
;
then
echo
Usage:
$0
account-domain
[
2048]
echo
Usage:
createAccountKey
account-domain
[
2048]
return
return
fi
fi
account
=
$1
account
=
$1
length
=
$2
length
=
$2
if
[[
"
$length
"
==
"ec-"
*
]]
;
then
length
=
2048
fi
if
[
-z
"
$2
"
]
;
then
if
[
-z
"
$2
"
]
;
then
_info
"Use default length 2048"
_info
"Use default length 2048"
length
=
2048
length
=
2048
...
@@ -92,21 +98,50 @@ createAccountKey() {
...
@@ -92,21 +98,50 @@ createAccountKey() {
createDomainKey
()
{
createDomainKey
()
{
_info
"Creating domain key"
_info
"Creating domain key"
if
[
-z
"
$1
"
]
;
then
if
[
-z
"
$1
"
]
;
then
echo
Usage:
$0
domain
[
2048]
echo
Usage:
createDomainKey
domain
[
2048]
return
return
fi
fi
domain
=
$1
domain
=
$1
length
=
$2
length
=
$2
if
[
-z
"
$2
"
]
;
then
isec
=
""
_info
"Use default length 2048"
if
[[
"
$length
"
==
"ec-"
*
]]
;
then
isec
=
"1"
length
=
$(
printf
$length
|
cut
-d
'-'
-f
2-100
)
eccname
=
"
$length
"
fi
if
[
-z
"
$length
"
]
;
then
if
[
"
$isec
"
]
;
then
length
=
256
else
length
=
2048
length
=
2048
fi
fi
fi
_info
"Use length
$length
"
if
[
"
$isec
"
]
;
then
if
[
"
$length
"
==
"256"
]
;
then
eccname
=
"prime256v1"
fi
if
[
"
$length
"
==
"384"
]
;
then
eccname
=
"secp384r1"
fi
if
[
"
$length
"
==
"521"
]
;
then
eccname
=
"secp521r1"
fi
_info
"Using ec name:
$eccname
"
fi
_initpath
$domain
_initpath
$domain
if
[
!
-f
"
$CERT_KEY_PATH
"
]
||
(
[
"
$FORCE
"
]
&&
!
[
"
$IS_RENEW
"
]
)
;
then
if
[
!
-f
"
$CERT_KEY_PATH
"
]
||
(
[
"
$FORCE
"
]
&&
!
[
"
$IS_RENEW
"
]
)
;
then
#generate account key
#generate account key
openssl genrsa
$length
>
"
$CERT_KEY_PATH
"
if
[
"
$isec
"
]
;
then
openssl ecparam
-name
$eccname
-genkey
2>/dev/null
>
"
$CERT_KEY_PATH
"
else
openssl genrsa
$length
2>/dev/null
>
"
$CERT_KEY_PATH
"
fi
else
else
if
[
"
$IS_RENEW
"
]
;
then
if
[
"
$IS_RENEW
"
]
;
then
_info
"Domain key exists, skip"
_info
"Domain key exists, skip"
...
@@ -250,7 +285,7 @@ _savedomainconf() {
...
@@ -250,7 +285,7 @@ _savedomainconf() {
if
[
"
$DOMAIN_CONF
"
]
;
then
if
[
"
$DOMAIN_CONF
"
]
;
then
_setopt
$DOMAIN_CONF
"
$key
"
"="
"
$value
"
_setopt
$DOMAIN_CONF
"
$key
"
"="
"
$value
"
else
else
_
debug
"DOMAIN_CONF is empty, can not save
$key
=
$value
"
_
err
"DOMAIN_CONF is empty, can not save
$key
=
$value
"
fi
fi
}
}
...
@@ -261,7 +296,7 @@ _saveaccountconf() {
...
@@ -261,7 +296,7 @@ _saveaccountconf() {
if
[
"
$ACCOUNT_CONF_PATH
"
]
;
then
if
[
"
$ACCOUNT_CONF_PATH
"
]
;
then
_setopt
$ACCOUNT_CONF_PATH
"
$key
"
"="
"
$value
"
_setopt
$ACCOUNT_CONF_PATH
"
$key
"
"="
"
$value
"
else
else
_
debug
"ACCOUNT_CONF_PATH is empty, can not save
$key
=
$value
"
_
err
"ACCOUNT_CONF_PATH is empty, can not save
$key
=
$value
"
fi
fi
}
}
...
@@ -330,28 +365,28 @@ _initpath() {
...
@@ -330,28 +365,28 @@ _initpath() {
ACCOUNT_KEY_PATH
=
"
$LE_WORKING_DIR
/account.key"
ACCOUNT_KEY_PATH
=
"
$LE_WORKING_DIR
/account.key"
fi
fi
if
[
-z
"
$domain
"
]
;
then
if
[
-z
"
$domain
"
]
;
then
return
0
return
0
fi
fi
mkdir
-p
"
$LE_WORKING_DIR
/
$domain
"
domainhome
=
"
$LE_WORKING_DIR
/
$domain
"
mkdir
-p
"
$domainhome
"
if
[
-z
"
$DOMAIN_CONF
"
]
;
then
if
[
-z
"
$DOMAIN_CONF
"
]
;
then
DOMAIN_CONF
=
"
$
LE_WORKING_DIR
/
$
domain
/
$Le_Domain
.conf"
DOMAIN_CONF
=
"
$domain
home
/
$Le_Domain
.conf"
fi
fi
if
[
-z
"
$CSR_PATH
"
]
;
then
if
[
-z
"
$CSR_PATH
"
]
;
then
CSR_PATH
=
"
$
LE_WORKING_DIR
/
$
domain
/
$domain
.csr"
CSR_PATH
=
"
$domain
home
/
$domain
.csr"
fi
fi
if
[
-z
"
$CERT_KEY_PATH
"
]
;
then
if
[
-z
"
$CERT_KEY_PATH
"
]
;
then
CERT_KEY_PATH
=
"
$
LE_WORKING_DIR
/
$
domain
/
$domain
.key"
CERT_KEY_PATH
=
"
$domain
home
/
$domain
.key"
fi
fi
if
[
-z
"
$CERT_PATH
"
]
;
then
if
[
-z
"
$CERT_PATH
"
]
;
then
CERT_PATH
=
"
$
LE_WORKING_DIR
/
$
domain
/
$domain
.cer"
CERT_PATH
=
"
$domain
home
/
$domain
.cer"
fi
fi
if
[
-z
"
$CA_CERT_PATH
"
]
;
then
if
[
-z
"
$CA_CERT_PATH
"
]
;
then
CA_CERT_PATH
=
"
$
LE_WORKING_DIR
/
$
domain
/ca.cer"
CA_CERT_PATH
=
"
$domain
home
/ca.cer"
fi
fi
}
}
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment