Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
48310646
Unverified
Commit
48310646
authored
Feb 21, 2020
by
neil
Committed by
GitHub
Feb 21, 2020
Browse files
Merge pull request #2744 from xpac1985/patch-2
haproxy deploy script now compatible with OpenSSL v1.1+
parents
d4660a23
e184a1b9
Changes
1
Hide whitespace changes
Inline
Side-by-side
deploy/haproxy.sh
View file @
48310646
...
@@ -208,33 +208,37 @@ haproxy_deploy() {
...
@@ -208,33 +208,37 @@ haproxy_deploy() {
_issuerdn
=
$(
openssl x509
-in
"
${
_issuer
}
"
-issuer
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_issuerdn
=
$(
openssl x509
-in
"
${
_issuer
}
"
-issuer
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_debug _issuerdn
"
${
_issuerdn
}
"
_debug _issuerdn
"
${
_issuerdn
}
"
_info
"Requesting OCSP response"
_info
"Requesting OCSP response"
#
Request the OCSP response from the issuer and store it
#
If the issuer is a CA cert then our command line has "-CAfile" added
if
[
"
${
_subjectdn
}
"
=
"
${
_issuerdn
}
"
]
;
then
if
[
"
${
_subjectdn
}
"
=
"
${
_issuerdn
}
"
]
;
then
# If the issuer is a CA cert then our command line has "-CAfile" added
_cafile_argument
=
"-CAfile
\"
${
_issuer
}
\"
"
openssl ocsp
\
else
-issuer
"
${
_issuer
}
"
\
_cafile_argument
=
""
-cert
"
${
_pem
}
"
\
fi
-url
"
${
_ocsp_url
}
"
\
_debug _cafile_argument
"
${
_cafile_argument
}
"
-header
Host
"
${
_ocsp_host
}
"
\
# if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
-respout
"
${
_ocsp
}
"
\
_openssl_version
=
$(
openssl version |
cut
-d
' '
-f2
)
-verify_other
"
${
_issuer
}
"
\
_debug _openssl_version
"
${
_openssl_version
}
"
-no_nonce
\
_openssl_major
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f1
)
-CAfile
"
${
_issuer
}
"
\
_openssl_minor
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f2
)
|
grep
-q
"
${
_pe
m
}
: good"
if
[
"
${
_openssl_major
}
"
-eq
"1"
]
&&
[
"
${
_openssl_minor
}
"
-ge
"1"
]
||
[
"
${
_
o
pe
nssl_major
}
"
-ge
"2"
]
;
then
_
ret
=
$?
_
header_sep
=
"="
else
else
# Issuer is not a root CA so no "-CAfile" option
_header_sep
=
" "
openssl ocsp
\
-issuer
"
${
_issuer
}
"
\
-cert
"
${
_pem
}
"
\
-url
"
${
_ocsp_url
}
"
\
-header
Host
"
${
_ocsp_host
}
"
\
-respout
"
${
_ocsp
}
"
\
-verify_other
"
${
_issuer
}
"
\
-no_nonce
\
|
grep
-q
"
${
_pem
}
: good"
_ret
=
$?
fi
fi
# Request the OCSP response from the issuer and store it
_openssl_ocsp_cmd
=
"openssl ocsp
\
-issuer
\"
${
_issuer
}
\"
\
-cert
\"
${
_pem
}
\"
\
-url
\"
${
_ocsp_url
}
\"
\
-header Host
${
_header_sep
}
\"
${
_ocsp_host
}
\"
\
-respout
\"
${
_ocsp
}
\"
\
-verify_other
\"
${
_issuer
}
\"
\
-no_nonce
\
${
_cafile_argument
}
\
| grep -q
\"
${
_pem
}
: good
\"
"
_debug _openssl_ocsp_cmd
"
${
_openssl_ocsp_cmd
}
"
eval
"
${
_openssl_ocsp_cmd
}
"
_ret
=
$?
else
else
# Non fatal: No issuer file was present so no OCSP stapling file created
# Non fatal: No issuer file was present so no OCSP stapling file created
_err
"OCSP stapling in use but no .issuer file was present"
_err
"OCSP stapling in use but no .issuer file was present"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment