Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
43e9553e
Unverified
Commit
43e9553e
authored
Mar 18, 2018
by
neil
Committed by
GitHub
Mar 18, 2018
Browse files
Merge pull request #1413 from Neilpang/dev
sync
parents
dff4d03b
e8b54a50
Changes
7
Show whitespace changes
Inline
Side-by-side
README.md
View file @
43e9553e
...
...
@@ -37,6 +37,8 @@ Twitter: [@neilpangxa](https://twitter.com/neilpangxa)
-
[
splynx
](
https://forum.splynx.com/t/free-ssl-cert-for-splynx-lets-encrypt/297
)
-
[
archlinux
](
https://aur.archlinux.org/packages/acme.sh-git/
)
-
[
opnsense.org
](
https://github.com/opnsense/plugins/tree/master/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient
)
-
[
CentOS Web Panel
](
http://centos-webpanel.com/
)
-
[
lnmp.org
](
https://lnmp.org/
)
-
[
more...
](
https://github.com/Neilpang/acme.sh/wiki/Blogs-and-tutorials
)
# Tested OS
...
...
@@ -398,7 +400,7 @@ Valid values are:
It's simple, just give a wildcard domain as the
`-d`
parameter.
```
sh
acme.sh
--issue
-d
example.com
-d
*
.example.com
--dns
dns_cf
acme.sh
--issue
-d
example.com
-d
'
*.example.com
'
--dns
dns_cf
```
...
...
acme.sh
View file @
43e9553e
...
...
@@ -1617,6 +1617,7 @@ _post() {
_debug $httpmethod
_debug "_post_url" "$_post_url"
_debug2 "body" "$body"
_debug2 "_postContentType" "$_postContentType"
_inithttp
...
...
@@ -1625,15 +1626,20 @@ _post() {
if [ "$HTTPS_INSECURE" ]; then
_CURL="$_CURL --insecure "
fi
if
[
"
$_postContentType
"
]
;
then
_CURL
=
"
$_CURL
-H
\"
Content-Type:
$_postContentType
\"
"
fi
_debug "_CURL" "$_CURL"
if [ "$needbase64" ]; then
if [ "$_postContentType" ]; then
response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
else
response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
fi
else
if [ "$_postContentType" ]; then
response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
else
response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
fi
fi
_ret="$?"
if [ "$_ret" != "0" ]; then
_err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
...
...
@@ -1785,6 +1791,11 @@ _send_signed_request() {
return 1
fi
if [ "$ACME_VERSION" = "2" ]; then
__request_conent_type="$CONTENT_TYPE_JSON"
else
__request_conent_type=""
fi
payload64=$(printf "%s" "$payload" | _base64 | _url_replace)
_debug3 payload64 "$payload64"
...
...
@@ -1797,7 +1808,7 @@ _send_signed_request() {
if [ "$ACME_NEW_NONCE" ]; then
_debug2 "Get nonce. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
nonceurl="$ACME_NEW_NONCE"
if
_post
""
"
$nonceurl
"
""
"HEAD"
"
$
CONTENT_TYPE_JSON
"
;
then
if _post "" "$nonceurl" "" "HEAD" "$
__request_conent_type
"; then
_headers="$(cat "$HTTP_HEADER")"
fi
fi
...
...
@@ -1852,7 +1863,7 @@ _send_signed_request() {
fi
_debug3 body "$body"
response
=
"
$(
_post
"
$body
"
"
$url
"
"
$needbase64
"
"POST"
"
$
CONTENT_TYPE_JSON
"
)
"
response="$(_post "$body" "$url" "$needbase64" "POST" "$
__request_conent_type
")"
_CACHED_NONCE=""
if [ "$?" != "0" ]; then
...
...
@@ -3247,10 +3258,16 @@ _regAccount() {
return 1
fi
_debug2 responseHeaders "$responseHeaders"
_accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
_debug "_accUri" "$_accUri"
if [ -z "$_accUri" ]; then
_err "Can not find account id url."
_err "$responseHeaders"
return 1
fi
_savecaconf "ACCOUNT_URL" "$_accUri"
export
ACCOUNT_URL
=
"
$
ACCOUNT_URL
"
export ACCOUNT_URL="$
_accUri
"
CA_KEY_HASH="$(__calcAccountKeyHash)"
_debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
...
...
@@ -3521,7 +3538,7 @@ issue() {
_saved_account_key_hash="$(_readcaconf "CA_KEY_HASH")"
_debug2 _saved_account_key_hash "$_saved_account_key_hash"
if
[
-z
"
$_saved_account_key_hash
"
]
||
[
"
$_saved_account_key_hash
"
!=
"
$(
__calcAccountKeyHash
)
"
]
;
then
if [ -z
"$ACCOUNT_URL" ] || [ -z
"$_saved_account_key_hash" ] || [ "$_saved_account_key_hash" != "$(__calcAccountKeyHash)" ]; then
if ! _regAccount "$_accountkeylength"; then
_on_issue_err "$_post_hook"
return 1
...
...
@@ -3819,7 +3836,7 @@ $_authorizations_map"
if [ "$dnsadded" = '0' ]; then
_savedomainconf "Le_Vlist" "$vlist"
_debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
_err
"Please add the TXT records to the domains, and re
try again
."
_err "Please add the TXT records to the domains, and re
-run with --renew
."
_clearup
_on_issue_err "$_post_hook"
return 1
...
...
@@ -4105,12 +4122,12 @@ $_authorizations_map"
fi
else
if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
_err
"Sign failed."
_err "Sign failed.
$response
"
_on_issue_err "$_post_hook"
return 1
fi
_rcert="$response"
Le_LinkCert
=
"
$(
grep
-i
'^Location.*$'
"
$HTTP_HEADER
"
| _
head
_n 1 |
tr
-d
"
\r\n
"
|
cut
-d
" "
-f
2
)
"
Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _
tail
_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
echo "$BEGIN_CERT" >"$CERT_PATH"
#if ! _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH" ; then
...
...
@@ -5456,8 +5473,8 @@ Parameters:
--cert-home Specifies the home dir to save all the certs, only valid for '--install' command.
--config-home Specifies the home dir to save all the configurations.
--useragent Specifies the user agent string. it will be saved for future use too.
--accountemail Specifies the account email
for registering
,
O
nly valid for the '--install' command.
--accountkey Specifies the account key path,
O
nly valid for the '--install' command.
--accountemail Specifies the account email,
o
nly valid for the '--install'
and '--update-account'
command.
--accountkey Specifies the account key path,
o
nly valid for the '--install' command.
--days Specifies the days to renew the cert when using '--issue' command. The max value is $MAX_RENEW days.
--httpport Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
--local-address Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
...
...
dnsapi/dns_azure.sh
View file @
43e9553e
...
...
@@ -99,6 +99,7 @@ dns_azure_add() {
_azure_rest PUT
"
$acmeRecordURI
"
"
$body
"
"
$accesstoken
"
if
[
"
$_code
"
=
"200"
]
||
[
"
$_code
"
=
'201'
]
;
then
_info
"validation value added"
return
0
else
_err
"error adding validation value (
$_code
)"
return
1
...
...
@@ -194,6 +195,7 @@ dns_azure_rm() {
_azure_rest PUT
"
$acmeRecordURI
"
"
$body
"
"
$accesstoken
"
if
[
"
$_code
"
=
"200"
]
||
[
"
$_code
"
=
'201'
]
;
then
_info
"validation value removed"
return
0
else
_err
"error removing validation value (
$_code
)"
return
1
...
...
@@ -226,6 +228,7 @@ _azure_rest() {
else
response
=
"
$(
_get
"
$ep
"
)
"
fi
_ret
=
"
$?
"
_secure_debug2
"response
$response
"
_code
=
"
$(
grep
"^HTTP"
"
$HTTP_HEADER
"
| _tail_n 1 |
cut
-d
" "
-f
2 |
tr
-d
"
\r\n
"
)
"
_debug
"http response code
$_code
"
...
...
@@ -236,7 +239,7 @@ _azure_rest() {
return
1
fi
# See https://docs.microsoft.com/en-us/azure/architecture/best-practices/retry-service-specific#general-rest-and-retry-guidelines for retryable HTTP codes
if
[
"
$
?
"
!=
"0"
]
||
[
-z
"
$_code
"
]
||
[
"
$_code
"
=
"408"
]
||
[
"
$_code
"
=
"500"
]
||
[
"
$_code
"
=
"503"
]
||
[
"
$_code
"
=
"504"
]
;
then
if
[
"
$
_ret
"
!=
"0"
]
||
[
-z
"
$_code
"
]
||
[
"
$_code
"
=
"408"
]
||
[
"
$_code
"
=
"500"
]
||
[
"
$_code
"
=
"503"
]
||
[
"
$_code
"
=
"504"
]
;
then
_request_retry_times
=
"
$(
_math
"
$_request_retry_times
"
+ 1
)
"
_info
"REST call error
$_code
retrying
$ep
in
$_request_retry_times
s"
_sleep
"
$_request_retry_times
"
...
...
@@ -281,6 +284,7 @@ _azure_getaccess_token() {
body
=
"resource=
$(
printf
"%s"
'https://management.core.windows.net/'
| _url_encode
)
&client_id=
$(
printf
"%s"
"
$clientID
"
| _url_encode
)
&client_secret=
$(
printf
"%s"
"
$clientSecret
"
| _url_encode
)
&grant_type=client_credentials"
_secure_debug2
"data
$body
"
response
=
"
$(
_post
"
$body
"
"https://login.microsoftonline.com/
$tenantID
/oauth2/token"
""
"POST"
)
"
_ret
=
"
$?
"
_secure_debug2
"response
$response
"
response
=
"
$(
echo
"
$response
"
| _normalizeJson
)
"
accesstoken
=
$(
echo
"
$response
"
| _egrep_o
"
\"
access_token
\"
:
\"
[^
\"
]*
\"
"
| _head_n 1 |
cut
-d
:
-f
2 |
tr
-d
\"
)
...
...
@@ -290,7 +294,7 @@ _azure_getaccess_token() {
_err
"no acccess token received. Check your Azure settings see
$WIKI
"
return
1
fi
if
[
"
$
?
"
!=
"0"
]
;
then
if
[
"
$
_ret
"
!=
"0"
]
;
then
_err
"error
$response
"
return
1
fi
...
...
dnsapi/dns_cf.sh
View file @
43e9553e
...
...
@@ -19,8 +19,8 @@ dns_cf_add() {
if
[
-z
"
$CF_Key
"
]
||
[
-z
"
$CF_Email
"
]
;
then
CF_Key
=
""
CF_Email
=
""
_err
"You d
o
n't specify cloudflare api key and email yet."
_err
"Please create
you
key and try again."
_err
"You d
id
n't specify
a
cloudflare api key and email yet."
_err
"Please create
the
key and try again."
return
1
fi
...
...
@@ -94,8 +94,8 @@ dns_cf_rm() {
if
[
-z
"
$CF_Key
"
]
||
[
-z
"
$CF_Email
"
]
;
then
CF_Key
=
""
CF_Email
=
""
_err
"You d
o
n't specify cloudflare api key and email yet."
_err
"Please create
you
key and try again."
_err
"You d
id
n't specify
a
cloudflare api key and email yet."
_err
"Please create
the
key and try again."
return
1
fi
...
...
dnsapi/dns_dgon.sh
View file @
43e9553e
...
...
@@ -20,12 +20,22 @@
dns_dgon_add
()
{
fulldomain
=
"
$(
echo
"
$1
"
| _lower_case
)
"
txtvalue
=
$2
DO_API_KEY
=
"
${
DO_API_KEY
:-
$(
_readaccountconf_mutable DO_API_KEY
)
}
"
# Check if API Key Exist
if
[
-z
"
$DO_API_KEY
"
]
;
then
DO_API_KEY
=
""
_err
"You did not specify DigitalOcean API key."
_err
"Please export DO_API_KEY and try again."
return
1
fi
_info
"Using digitalocean dns validation - add record"
_debug fulldomain
"
$fulldomain
"
_debug txtvalue
"
$txtvalue
"
## save the env vars (key and domain split location) for later automated use
_saveaccountconf DO_API_KEY
"
$DO_API_KEY
"
_saveaccountconf
_mutable
DO_API_KEY
"
$DO_API_KEY
"
## split the domain for DO API
if
!
_get_base_domain
"
$fulldomain
"
;
then
...
...
@@ -39,7 +49,7 @@ dns_dgon_add() {
export
_H1
=
"Content-Type: application/json"
export
_H2
=
"Authorization: Bearer
$DO_API_KEY
"
PURL
=
'https://api.digitalocean.com/v2/domains/'
$_domain
'/records'
PBODY
=
'{"type":"TXT","name":"'
$_sub_domain
'","data":"'
$txtvalue
'"}'
PBODY
=
'{"type":"TXT","name":"'
$_sub_domain
'","data":"'
$txtvalue
'"
,"ttl":120
}'
_debug PURL
"
$PURL
"
_debug PBODY
"
$PBODY
"
...
...
@@ -65,6 +75,16 @@ dns_dgon_add() {
dns_dgon_rm
()
{
fulldomain
=
"
$(
echo
"
$1
"
| _lower_case
)
"
txtvalue
=
$2
DO_API_KEY
=
"
${
DO_API_KEY
:-
$(
_readaccountconf_mutable DO_API_KEY
)
}
"
# Check if API Key Exist
if
[
-z
"
$DO_API_KEY
"
]
;
then
DO_API_KEY
=
""
_err
"You did not specify DigitalOcean API key."
_err
"Please export DO_API_KEY and try again."
return
1
fi
_info
"Using digitalocean dns validation - remove record"
_debug fulldomain
"
$fulldomain
"
_debug txtvalue
"
$txtvalue
"
...
...
@@ -92,11 +112,11 @@ dns_dgon_rm() {
domain_list
=
"
$(
_get
"
$GURL
"
)
"
## 2) find record
## check for what we are looing for: "type":"A","name":"$_sub_domain"
record
=
"
$(
echo
"
$domain_list
"
| _egrep_o
"
\"
id
\"\s
*
\:\s
*
\"
*
\d
+
\"
*[^}]*
\"
name
\"\s
*
\:\s
*
\"
$_sub_domain
\"
[^}]*
\"
data
\"\s
*
\:\s
*
\"
$txtvalue
\"
"
)
"
record
=
"
$(
echo
"
$domain_list
"
| _egrep_o
"
\"
id
\"\s
*
\:\s
*
\"
*
[0-9]
+
\"
*[^}]*
\"
name
\"\s
*
\:\s
*
\"
$_sub_domain
\"
[^}]*
\"
data
\"\s
*
\:\s
*
\"
$txtvalue
\"
"
)
"
## 3) check record and get next page
if
[
-z
"
$record
"
]
;
then
## find the next page if we dont have a match
nextpage
=
"
$(
echo
"
$domain_list
"
| _egrep_o
"
\"
links
\"
.*"
| _egrep_o
"
\"
next
\"
.*"
| _egrep_o
"http.*page
\=
\d
+"
)
"
nextpage
=
"
$(
echo
"
$domain_list
"
| _egrep_o
"
\"
links
\"
.*"
| _egrep_o
"
\"
next
\"
.*"
| _egrep_o
"http.*page
\=
[0-9]
+"
)
"
if
[
-z
"
$nextpage
"
]
;
then
_err
"no record and no nextpage in digital ocean DNS removal"
return
1
...
...
@@ -108,7 +128,7 @@ dns_dgon_rm() {
done
## we found the record
rec_id
=
"
$(
echo
"
$record
"
| _egrep_o
"id
\"\s
*
\:\s
*
\"
*
\d
+"
| _egrep_o
"
\d
+"
)
"
rec_id
=
"
$(
echo
"
$record
"
| _egrep_o
"id
\"\s
*
\:\s
*
\"
*
[0-9]
+"
| _egrep_o
"
[0-9]
+"
)
"
_debug rec_id
"
$rec_id
"
## delete the record
...
...
dnsapi/dns_pdns.sh
View file @
43e9553e
...
...
@@ -90,7 +90,7 @@ set_record() {
full
=
$2
txtvalue
=
$3
if
!
_pdns_rest
"PATCH"
"/api/v1/servers/
$PDNS_ServerId
/zones/
$root
.
"
"{
\"
rrsets
\"
: [{
\"
changetype
\"
:
\"
REPLACE
\"
,
\"
name
\"
:
\"
$full
.
\"
,
\"
type
\"
:
\"
TXT
\"
,
\"
ttl
\"
:
$PDNS_Ttl
,
\"
records
\"
: [{
\"
name
\"
:
\"
$full
.
\"
,
\"
type
\"
:
\"
TXT
\"
,
\"
content
\"
:
\"\\\"
$txtvalue
\\\"\"
,
\"
disabled
\"
: false,
\"
ttl
\"
:
$PDNS_Ttl
}]}]}"
;
then
if
!
_pdns_rest
"PATCH"
"/api/v1/servers/
$PDNS_ServerId
/zones/
$root
"
"{
\"
rrsets
\"
: [{
\"
changetype
\"
:
\"
REPLACE
\"
,
\"
name
\"
:
\"
$full
.
\"
,
\"
type
\"
:
\"
TXT
\"
,
\"
ttl
\"
:
$PDNS_Ttl
,
\"
records
\"
: [{
\"
name
\"
:
\"
$full
.
\"
,
\"
type
\"
:
\"
TXT
\"
,
\"
content
\"
:
\"\\\"
$txtvalue
\\\"\"
,
\"
disabled
\"
: false,
\"
ttl
\"
:
$PDNS_Ttl
}]}]}"
;
then
_err
"Set txt record error."
return
1
fi
...
...
@@ -107,7 +107,7 @@ rm_record() {
root
=
$1
full
=
$2
if
!
_pdns_rest
"PATCH"
"/api/v1/servers/
$PDNS_ServerId
/zones/
$root
.
"
"{
\"
rrsets
\"
: [{
\"
changetype
\"
:
\"
DELETE
\"
,
\"
name
\"
:
\"
$full
.
\"
,
\"
type
\"
:
\"
TXT
\"
}]}"
;
then
if
!
_pdns_rest
"PATCH"
"/api/v1/servers/
$PDNS_ServerId
/zones/
$root
"
"{
\"
rrsets
\"
: [{
\"
changetype
\"
:
\"
DELETE
\"
,
\"
name
\"
:
\"
$full
.
\"
,
\"
type
\"
:
\"
TXT
\"
}]}"
;
then
_err
"Delete txt record error."
return
1
fi
...
...
@@ -122,7 +122,7 @@ rm_record() {
notify_slaves
()
{
root
=
$1
if
!
_pdns_rest
"PUT"
"/api/v1/servers/
$PDNS_ServerId
/zones/
$root
.
/notify"
;
then
if
!
_pdns_rest
"PUT"
"/api/v1/servers/
$PDNS_ServerId
/zones/
$root
/notify"
;
then
_err
"Notify slaves error."
return
1
fi
...
...
@@ -144,15 +144,18 @@ _get_root() {
while
true
;
do
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
if
[
-z
"
$h
"
]
;
then
return
1
fi
if
_contains
"
$_zones_response
"
"
\"
name
\"
:
\"
$h
.
\"
"
;
then
_domain
=
"
$h
"
_domain
=
"
$h
."
if
[
-z
"
$h
"
]
;
then
_domain
=
"=2E"
fi
return
0
fi
if
[
-z
"
$h
"
]
;
then
return
1
fi
i
=
$(
_math
$i
+ 1
)
done
_debug
"
$domain
not found"
...
...
dnsapi/dns_yandex.sh
View file @
43e9553e
...
...
@@ -50,9 +50,9 @@ _PDD_get_domain() {
__last
=
0
while
[
$__last
-eq
0
]
;
do
uri1
=
"https://pddimp.yandex.ru/api2/admin/domain/domains?page=
${
__page
}
&on_page=20"
res1
=
$(
_get
"
$uri1
"
| _normalizeJson
)
#
_debug "$res1"
__found
=
$(
echo
"
$res1
"
|
sed
-n
-e
's#.* "found": \([^,]*\),.*#\1#p'
)
res1
=
"
$(
_get
"
$uri1
"
| _normalizeJson
)
"
_debug
2
"res1"
"
$res1
"
__found
=
"
$(
echo
"
$res1
"
|
sed
-n
-e
's#.* "found": \([^,]*\),.*#\1#p'
)
"
_debug
"found:
$__found
results on page"
if
[
"
$__found
"
-lt
20
]
;
then
_debug
"last page:
$__page
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment