Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
48310646
Unverified
Commit
48310646
authored
Feb 21, 2020
by
neil
Committed by
GitHub
Feb 21, 2020
Browse files
Merge pull request #2744 from xpac1985/patch-2
haproxy deploy script now compatible with OpenSSL v1.1+
parents
d4660a23
e184a1b9
Changes
1
Show whitespace changes
Inline
Side-by-side
deploy/haproxy.sh
View file @
48310646
...
...
@@ -208,33 +208,37 @@ haproxy_deploy() {
_issuerdn
=
$(
openssl x509
-in
"
${
_issuer
}
"
-issuer
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_debug _issuerdn
"
${
_issuerdn
}
"
_info
"Requesting OCSP response"
# Request the OCSP response from the issuer and store it
if
[
"
${
_subjectdn
}
"
=
"
${
_issuerdn
}
"
]
;
then
# If the issuer is a CA cert then our command line has "-CAfile" added
openssl ocsp
\
-issuer
"
${
_issuer
}
"
\
-cert
"
${
_pem
}
"
\
-url
"
${
_ocsp_url
}
"
\
-header
Host
"
${
_ocsp_host
}
"
\
-respout
"
${
_ocsp
}
"
\
-verify_other
"
${
_issuer
}
"
\
-no_nonce
\
-CAfile
"
${
_issuer
}
"
\
|
grep
-q
"
${
_pem
}
: good"
_ret
=
$?
if
[
"
${
_subjectdn
}
"
=
"
${
_issuerdn
}
"
]
;
then
_cafile_argument
=
"-CAfile
\"
${
_issuer
}
\"
"
else
# Issuer is not a root CA so no "-CAfile" option
openssl ocsp
\
-issuer
"
${
_issuer
}
"
\
-cert
"
${
_pem
}
"
\
-url
"
${
_ocsp_url
}
"
\
-header
Host
"
${
_ocsp_host
}
"
\
-respout
"
${
_ocsp
}
"
\
-verify_other
"
${
_issuer
}
"
\
_cafile_argument
=
""
fi
_debug _cafile_argument
"
${
_cafile_argument
}
"
# if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
_openssl_version
=
$(
openssl version |
cut
-d
' '
-f2
)
_debug _openssl_version
"
${
_openssl_version
}
"
_openssl_major
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f1
)
_openssl_minor
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f2
)
if
[
"
${
_openssl_major
}
"
-eq
"1"
]
&&
[
"
${
_openssl_minor
}
"
-ge
"1"
]
||
[
"
${
_openssl_major
}
"
-ge
"2"
]
;
then
_header_sep
=
"="
else
_header_sep
=
" "
fi
# Request the OCSP response from the issuer and store it
_openssl_ocsp_cmd
=
"openssl ocsp
\
-issuer
\"
${
_issuer
}
\"
\
-cert
\"
${
_pem
}
\"
\
-url
\"
${
_ocsp_url
}
\"
\
-header Host
${
_header_sep
}
\"
${
_ocsp_host
}
\"
\
-respout
\"
${
_ocsp
}
\"
\
-verify_other
\"
${
_issuer
}
\"
\
-no_nonce
\
|
grep
-q
"
${
_pem
}
: good"
${
_cafile_argument
}
\
| grep -q
\"
${
_pem
}
: good
\"
"
_debug _openssl_ocsp_cmd
"
${
_openssl_ocsp_cmd
}
"
eval
"
${
_openssl_ocsp_cmd
}
"
_ret
=
$?
fi
else
# Non fatal: No issuer file was present so no OCSP stapling file created
_err
"OCSP stapling in use but no .issuer file was present"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment