Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
48310646
Unverified
Commit
48310646
authored
Feb 21, 2020
by
neil
Committed by
GitHub
Feb 21, 2020
Browse files
Merge pull request #2744 from xpac1985/patch-2
haproxy deploy script now compatible with OpenSSL v1.1+
parents
d4660a23
e184a1b9
Changes
1
Hide whitespace changes
Inline
Side-by-side
deploy/haproxy.sh
View file @
48310646
...
...
@@ -208,33 +208,37 @@ haproxy_deploy() {
_issuerdn
=
$(
openssl x509
-in
"
${
_issuer
}
"
-issuer
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_debug _issuerdn
"
${
_issuerdn
}
"
_info
"Requesting OCSP response"
#
Request the OCSP response from the issuer and store it
#
If the issuer is a CA cert then our command line has "-CAfile" added
if
[
"
${
_subjectdn
}
"
=
"
${
_issuerdn
}
"
]
;
then
# If the issuer is a CA cert then our command line has "-CAfile" added
openssl ocsp
\
-issuer
"
${
_issuer
}
"
\
-cert
"
${
_pem
}
"
\
-url
"
${
_ocsp_url
}
"
\
-header
Host
"
${
_ocsp_host
}
"
\
-respout
"
${
_ocsp
}
"
\
-verify_other
"
${
_issuer
}
"
\
-no_nonce
\
-CAfile
"
${
_issuer
}
"
\
|
grep
-q
"
${
_pe
m
}
: good"
_
ret
=
$?
_cafile_argument
=
"-CAfile
\"
${
_issuer
}
\"
"
else
_cafile_argument
=
""
fi
_debug _cafile_argument
"
${
_cafile_argument
}
"
# if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
_openssl_version
=
$(
openssl version |
cut
-d
' '
-f2
)
_debug _openssl_version
"
${
_openssl_version
}
"
_openssl_major
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f1
)
_openssl_minor
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f2
)
if
[
"
${
_openssl_major
}
"
-eq
"1"
]
&&
[
"
${
_openssl_minor
}
"
-ge
"1"
]
||
[
"
${
_
o
pe
nssl_major
}
"
-ge
"2"
]
;
then
_
header_sep
=
"="
else
# Issuer is not a root CA so no "-CAfile" option
openssl ocsp
\
-issuer
"
${
_issuer
}
"
\
-cert
"
${
_pem
}
"
\
-url
"
${
_ocsp_url
}
"
\
-header
Host
"
${
_ocsp_host
}
"
\
-respout
"
${
_ocsp
}
"
\
-verify_other
"
${
_issuer
}
"
\
-no_nonce
\
|
grep
-q
"
${
_pem
}
: good"
_ret
=
$?
_header_sep
=
" "
fi
# Request the OCSP response from the issuer and store it
_openssl_ocsp_cmd
=
"openssl ocsp
\
-issuer
\"
${
_issuer
}
\"
\
-cert
\"
${
_pem
}
\"
\
-url
\"
${
_ocsp_url
}
\"
\
-header Host
${
_header_sep
}
\"
${
_ocsp_host
}
\"
\
-respout
\"
${
_ocsp
}
\"
\
-verify_other
\"
${
_issuer
}
\"
\
-no_nonce
\
${
_cafile_argument
}
\
| grep -q
\"
${
_pem
}
: good
\"
"
_debug _openssl_ocsp_cmd
"
${
_openssl_ocsp_cmd
}
"
eval
"
${
_openssl_ocsp_cmd
}
"
_ret
=
$?
else
# Non fatal: No issuer file was present so no OCSP stapling file created
_err
"OCSP stapling in use but no .issuer file was present"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment