Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
63fb9080
Commit
63fb9080
authored
Jun 20, 2017
by
neil
Committed by
GitHub
Jun 20, 2017
Browse files
Merge pull request #896 from Neilpang/dev
support --server
parents
26e3263a
88ada806
Changes
1
Hide whitespace changes
Inline
Side-by-side
acme.sh
View file @
63fb9080
#!/usr/bin/env sh
#!/usr/bin/env sh
VER
=
2.7.
2
VER
=
2.7.
3
PROJECT_NAME
=
"acme.sh"
PROJECT_NAME
=
"acme.sh"
...
@@ -13,7 +13,8 @@ _SCRIPT_="$0"
...
@@ -13,7 +13,8 @@ _SCRIPT_="$0"
_SUB_FOLDERS
=
"dnsapi deploy"
_SUB_FOLDERS
=
"dnsapi deploy"
DEFAULT_CA
=
"https://acme-v01.api.letsencrypt.org"
_OLD_CA_HOST
=
"https://acme-v01.api.letsencrypt.org"
DEFAULT_CA
=
"https://acme-v01.api.letsencrypt.org/directory"
DEFAULT_AGREEMENT
=
"https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf"
DEFAULT_AGREEMENT
=
"https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf"
DEFAULT_USER_AGENT
=
"
$PROJECT_NAME
/
$VER
(
$PROJECT
)"
DEFAULT_USER_AGENT
=
"
$PROJECT_NAME
/
$VER
(
$PROJECT
)"
...
@@ -24,7 +25,8 @@ DEFAULT_DOMAIN_KEY_LENGTH=2048
...
@@ -24,7 +25,8 @@ DEFAULT_DOMAIN_KEY_LENGTH=2048
DEFAULT_OPENSSL_BIN
=
"openssl"
DEFAULT_OPENSSL_BIN
=
"openssl"
STAGE_CA
=
"https://acme-staging.api.letsencrypt.org"
STAGE_CA
=
"https://acme-staging.api.letsencrypt.org/directory"
_OLD_STAGE_CA_HOST
=
"https://acme-staging.api.letsencrypt.org"
VTYPE_HTTP
=
"http-01"
VTYPE_HTTP
=
"http-01"
VTYPE_DNS
=
"dns-01"
VTYPE_DNS
=
"dns-01"
...
@@ -1714,9 +1716,19 @@ _send_signed_request() {
...
@@ -1714,9 +1716,19 @@ _send_signed_request() {
while
[
"
${
_request_retry_times
}
"
-lt
"
$MAX_REQUEST_RETRY_TIMES
"
]
;
do
while
[
"
${
_request_retry_times
}
"
-lt
"
$MAX_REQUEST_RETRY_TIMES
"
]
;
do
_debug3 _request_retry_times
"
$_request_retry_times
"
_debug3 _request_retry_times
"
$_request_retry_times
"
if
[
-z
"
$_CACHED_NONCE
"
]
;
then
if
[
-z
"
$_CACHED_NONCE
"
]
;
then
_debug2
"Get nonce."
_headers
=
""
nonceurl
=
"
$API
/directory"
if
[
"
$ACME_NEW_NONCE
"
]
;
then
_headers
=
"
$(
_get
"
$nonceurl
"
"onlyheader"
)
"
_debug2
"Get nonce. ACME_NEW_NONCE"
"
$ACME_NEW_NONCE
"
nonceurl
=
"
$ACME_NEW_NONCE
"
if
_post
""
"
$nonceurl
"
""
"HEAD"
;
then
_headers
=
"
$(
cat
"
$HTTP_HEADER
"
)
"
fi
fi
if
[
-z
"
$_headers
"
]
;
then
_debug2
"Get nonce. ACME_DIRECTORY"
"
$ACME_DIRECTORY
"
nonceurl
=
"
$ACME_DIRECTORY
"
_headers
=
"
$(
_get
"
$nonceurl
"
"onlyheader"
)
"
fi
if
[
"
$?
"
!=
"0"
]
;
then
if
[
"
$?
"
!=
"0"
]
;
then
_err
"Can not connect to
$nonceurl
to get nonce."
_err
"Can not connect to
$nonceurl
to get nonce."
...
@@ -2169,6 +2181,62 @@ __initHome() {
...
@@ -2169,6 +2181,62 @@ __initHome() {
fi
fi
}
}
#server
_initAPI
()
{
_api_server
=
"
${
1
:-
$ACME_DIRECTORY
}
"
_debug
"_init api for server:
$_api_server
"
if
[
"
$_api_server
"
=
"
$DEFAULT_CA
"
]
;
then
#just for performance, hardcode the default entry points
export
ACME_KEY_CHANGE
=
"https://acme-v01.api.letsencrypt.org/acme/key-change"
export
ACME_NEW_AUTHZ
=
"https://acme-v01.api.letsencrypt.org/acme/new-authz"
export
ACME_NEW_ORDER
=
"https://acme-v01.api.letsencrypt.org/acme/new-cert"
export
ACME_NEW_ACCOUNT
=
"https://acme-v01.api.letsencrypt.org/acme/new-reg"
export
ACME_REVOKE_CERT
=
"https://acme-v01.api.letsencrypt.org/acme/revoke-cert"
fi
if
[
-z
"
$ACME_NEW_ACCOUNT
"
]
;
then
response
=
$(
_get
"
$_api_server
"
)
if
[
"
$?
"
!=
"0"
]
;
then
_debug2
"response"
"
$response
"
_err
"Can not init api."
return
1
fi
_debug2
"response"
"
$response
"
ACME_KEY_CHANGE
=
$(
echo
"
$response
"
| _egrep_o
'key-change" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
export
ACME_KEY_CHANGE
ACME_NEW_AUTHZ
=
$(
echo
"
$response
"
| _egrep_o
'new-authz" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
export
ACME_NEW_AUTHZ
ACME_NEW_ORDER
=
$(
echo
"
$response
"
| _egrep_o
'new-cert" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
if
[
-z
"
$ACME_NEW_ORDER
"
]
;
then
ACME_NEW_ORDER
=
$(
echo
"
$response
"
| _egrep_o
'new-order" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
fi
export
ACME_NEW_ORDER
ACME_NEW_ACCOUNT
=
$(
echo
"
$response
"
| _egrep_o
'new-reg" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
if
[
-z
"
$ACME_NEW_ACCOUNT
"
]
;
then
ACME_NEW_ACCOUNT
=
$(
echo
"
$response
"
| _egrep_o
'new-account" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
fi
export
ACME_NEW_ACCOUNT
ACME_REVOKE_CERT
=
$(
echo
"
$response
"
| _egrep_o
'revoke-cert" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
export
ACME_REVOKE_CERT
ACME_NEW_NONCE
=
$(
echo
"
$response
"
| _egrep_o
'new-nonce" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
export
ACME_NEW_NONCE
fi
_debug
"ACME_KEY_CHANGE"
"
$ACME_KEY_CHANGE
"
_debug
"ACME_NEW_AUTHZ"
"
$ACME_NEW_AUTHZ
"
_debug
"ACME_NEW_ORDER"
"
$ACME_NEW_ORDER
"
_debug
"ACME_NEW_ACCOUNT"
"
$ACME_NEW_ACCOUNT
"
_debug
"ACME_REVOKE_CERT"
"
$ACME_REVOKE_CERT
"
}
#[domain] [keylength]
#[domain] [keylength]
_initpath
()
{
_initpath
()
{
...
@@ -2189,17 +2257,19 @@ _initpath() {
...
@@ -2189,17 +2257,19 @@ _initpath() {
CA_HOME
=
"
$DEFAULT_CA_HOME
"
CA_HOME
=
"
$DEFAULT_CA_HOME
"
fi
fi
if
[
-z
"
$A
PI
"
]
;
then
if
[
-z
"
$A
CME_DIRECTORY
"
]
;
then
if
[
-z
"
$STAGE
"
]
;
then
if
[
-z
"
$STAGE
"
]
;
then
A
PI
=
"
$DEFAULT_CA
"
A
CME_DIRECTORY
=
"
$DEFAULT_CA
"
else
else
A
PI
=
"
$STAGE_CA
"
A
CME_DIRECTORY
=
"
$STAGE_CA
"
_info
"Using stage
api:
$API
"
_info
"Using stage
ACME_DIRECTORY:
$ACME_DIRECTORY
"
fi
fi
fi
fi
_API_HOST
=
"
$(
echo
"
$API
"
|
cut
-d
:
-f
2 |
tr
-d
'/'
)
"
_ACME_SERVER_HOST
=
"
$(
echo
"
$ACME_DIRECTORY
"
|
cut
-d
:
-f
2 |
tr
-s
/ |
cut
-d
/
-f
2
)
"
CA_DIR
=
"
$CA_HOME
/
$_API_HOST
"
_debug2
"_ACME_SERVER_HOST"
"
$_ACME_SERVER_HOST
"
CA_DIR
=
"
$CA_HOME
/
$_ACME_SERVER_HOST
"
_DEFAULT_CA_CONF
=
"
$CA_DIR
/ca.conf"
_DEFAULT_CA_CONF
=
"
$CA_DIR
/ca.conf"
...
@@ -3020,7 +3090,7 @@ _regAccount() {
...
@@ -3020,7 +3090,7 @@ _regAccount() {
if
!
_calcjwk
"
$ACCOUNT_KEY_PATH
"
;
then
if
!
_calcjwk
"
$ACCOUNT_KEY_PATH
"
;
then
return
1
return
1
fi
fi
_initAPI
_updateTos
=
""
_updateTos
=
""
_reg_res
=
"new-reg"
_reg_res
=
"new-reg"
while
true
;
do
while
true
;
do
...
@@ -3035,7 +3105,7 @@ _regAccount() {
...
@@ -3035,7 +3105,7 @@ _regAccount() {
if
[
-z
"
$_updateTos
"
]
;
then
if
[
-z
"
$_updateTos
"
]
;
then
_info
"Registering account"
_info
"Registering account"
if
!
_send_signed_request
"
$
API
/acme/new-reg
"
"
$regjson
"
;
then
if
!
_send_signed_request
"
$
{
ACME_NEW_ACCOUNT
}
"
"
$regjson
"
;
then
_err
"Register account Error:
$response
"
_err
"Register account Error:
$response
"
return
1
return
1
fi
fi
...
@@ -3121,12 +3191,12 @@ _findHook() {
...
@@ -3121,12 +3191,12 @@ _findHook() {
__get_domain_new_authz
()
{
__get_domain_new_authz
()
{
_gdnd
=
"
$1
"
_gdnd
=
"
$1
"
_info
"Getting new-authz for domain"
"
$_gdnd
"
_info
"Getting new-authz for domain"
"
$_gdnd
"
_initAPI
_Max_new_authz_retry_times
=
5
_Max_new_authz_retry_times
=
5
_authz_i
=
0
_authz_i
=
0
while
[
"
$_authz_i
"
-lt
"
$_Max_new_authz_retry_times
"
]
;
do
while
[
"
$_authz_i
"
-lt
"
$_Max_new_authz_retry_times
"
]
;
do
_debug
"Try new-authz for the
$_authz_i
time."
_debug
"Try new-authz for the
$_authz_i
time."
if
!
_send_signed_request
"
$
API
/acme/new-authz
"
"{
\"
resource
\"
:
\"
new-authz
\"
,
\"
identifier
\"
: {
\"
type
\"
:
\"
dns
\"
,
\"
value
\"
:
\"
$(
_idn
"
$_gdnd
"
)
\"
}}"
;
then
if
!
_send_signed_request
"
$
{
ACME_NEW_AUTHZ
}
"
"{
\"
resource
\"
:
\"
new-authz
\"
,
\"
identifier
\"
: {
\"
type
\"
:
\"
dns
\"
,
\"
value
\"
:
\"
$(
_idn
"
$_gdnd
"
)
\"
}}"
;
then
_err
"Can not get domain new authz."
_err
"Can not get domain new authz."
return
1
return
1
fi
fi
...
@@ -3204,13 +3274,16 @@ issue() {
...
@@ -3204,13 +3274,16 @@ issue() {
if
[
"
$_web_roots
"
=
"dns-cx"
]
;
then
if
[
"
$_web_roots
"
=
"dns-cx"
]
;
then
_web_roots
=
"dns_cx"
_web_roots
=
"dns_cx"
fi
fi
_debug
"Using api:
$API
"
if
[
!
"
$IS_RENEW
"
]
;
then
if
[
!
"
$IS_RENEW
"
]
;
then
_initpath
"
$_main_domain
"
"
$_key_length
"
_initpath
"
$_main_domain
"
"
$_key_length
"
mkdir
-p
"
$DOMAIN_PATH
"
mkdir
-p
"
$DOMAIN_PATH
"
fi
fi
_debug
"Using ACME_DIRECTORY:
$ACME_DIRECTORY
"
_initAPI
if
[
-f
"
$DOMAIN_CONF
"
]
;
then
if
[
-f
"
$DOMAIN_CONF
"
]
;
then
Le_NextRenewTime
=
$(
_readdomainconf Le_NextRenewTime
)
Le_NextRenewTime
=
$(
_readdomainconf Le_NextRenewTime
)
_debug Le_NextRenewTime
"
$Le_NextRenewTime
"
_debug Le_NextRenewTime
"
$Le_NextRenewTime
"
...
@@ -3244,7 +3317,7 @@ issue() {
...
@@ -3244,7 +3317,7 @@ issue() {
_cleardomainconf
"Le_LocalAddress"
_cleardomainconf
"Le_LocalAddress"
fi
fi
Le_API
=
"
$A
PI
"
Le_API
=
"
$A
CME_DIRECTORY
"
_savedomainconf
"Le_API"
"
$Le_API
"
_savedomainconf
"Le_API"
"
$Le_API
"
if
[
"
$_alt_domains
"
=
"
$NO_VALUE
"
]
;
then
if
[
"
$_alt_domains
"
=
"
$NO_VALUE
"
]
;
then
...
@@ -3683,7 +3756,7 @@ issue() {
...
@@ -3683,7 +3756,7 @@ issue() {
_info
"Verify finished, start to sign."
_info
"Verify finished, start to sign."
der
=
"
$(
_getfile
"
${
CSR_PATH
}
"
"
${
BEGIN_CSR
}
"
"
${
END_CSR
}
"
|
tr
-d
"
\r\n
"
| _url_replace
)
"
der
=
"
$(
_getfile
"
${
CSR_PATH
}
"
"
${
BEGIN_CSR
}
"
"
${
END_CSR
}
"
|
tr
-d
"
\r\n
"
| _url_replace
)
"
if
!
_send_signed_request
"
$
API
/acme/new-cert
"
"{
\"
resource
\"
:
\"
new-cert
\"
,
\"
csr
\"
:
\"
$der
\"
}"
"needbase64"
;
then
if
!
_send_signed_request
"
$
{
ACME_NEW_ORDER
}
"
"{
\"
resource
\"
:
\"
new-cert
\"
,
\"
csr
\"
:
\"
$der
\"
}"
"needbase64"
;
then
_err
"Sign failed."
_err
"Sign failed."
_on_issue_err
"
$_post_hook
"
_on_issue_err
"
$_post_hook
"
return
1
return
1
...
@@ -3736,7 +3809,8 @@ issue() {
...
@@ -3736,7 +3809,8 @@ issue() {
Le_LinkIssuer
=
$(
grep
-i
'^Link'
"
$HTTP_HEADER
"
| _head_n 1 |
cut
-d
" "
-f
2 |
cut
-d
';'
-f
1 |
tr
-d
'<>'
)
Le_LinkIssuer
=
$(
grep
-i
'^Link'
"
$HTTP_HEADER
"
| _head_n 1 |
cut
-d
" "
-f
2 |
cut
-d
';'
-f
1 |
tr
-d
'<>'
)
if
!
_contains
"
$Le_LinkIssuer
"
":"
;
then
if
!
_contains
"
$Le_LinkIssuer
"
":"
;
then
Le_LinkIssuer
=
"
$API$Le_LinkIssuer
"
_info
"
$(
__red
"Relative issuer link found."
)
"
Le_LinkIssuer
=
"
$_ACME_SERVER_HOST$Le_LinkIssuer
"
fi
fi
_debug Le_LinkIssuer
"
$Le_LinkIssuer
"
_debug Le_LinkIssuer
"
$Le_LinkIssuer
"
_savedomainconf
"Le_LinkIssuer"
"
$Le_LinkIssuer
"
_savedomainconf
"Le_LinkIssuer"
"
$Le_LinkIssuer
"
...
@@ -3852,7 +3926,15 @@ renew() {
...
@@ -3852,7 +3926,15 @@ renew() {
.
"
$DOMAIN_CONF
"
.
"
$DOMAIN_CONF
"
if
[
"
$Le_API
"
]
;
then
if
[
"
$Le_API
"
]
;
then
API
=
"
$Le_API
"
if
[
"
$_OLD_CA_HOST
"
=
"
$Le_API
"
]
;
then
export
Le_API
=
"
$DEFAULT_CA
"
_savedomainconf Le_API
"
$Le_API
"
fi
if
[
"
$_OLD_STAGE_CA_HOST
"
=
"
$Le_API
"
]
;
then
export
Le_API
=
"
$STAGE_CA
"
_savedomainconf Le_API
"
$Le_API
"
fi
export
ACME_DIRECTORY
=
"
$Le_API
"
#reload ca configs
#reload ca configs
ACCOUNT_KEY_PATH
=
""
ACCOUNT_KEY_PATH
=
""
ACCOUNT_JSON_PATH
=
""
ACCOUNT_JSON_PATH
=
""
...
@@ -4319,8 +4401,10 @@ revoke() {
...
@@ -4319,8 +4401,10 @@ revoke() {
return
1
return
1
fi
fi
_initAPI
data
=
"{
\"
resource
\"
:
\"
revoke-cert
\"
,
\"
certificate
\"
:
\"
$cert
\"
}"
data
=
"{
\"
resource
\"
:
\"
revoke-cert
\"
,
\"
certificate
\"
:
\"
$cert
\"
}"
uri
=
"
$
API
/acme/revoke-cert
"
uri
=
"
$
{
ACME_REVOKE_CERT
}
"
if
[
-f
"
$CERT_KEY_PATH
"
]
;
then
if
[
-f
"
$CERT_KEY_PATH
"
]
;
then
_info
"Try domain key first."
_info
"Try domain key first."
...
@@ -4452,6 +4536,7 @@ deactivate() {
...
@@ -4452,6 +4536,7 @@ deactivate() {
_d_domain_list
=
"
$1
"
_d_domain_list
=
"
$1
"
_d_type
=
"
$2
"
_d_type
=
"
$2
"
_initpath
_initpath
_initAPI
_debug _d_domain_list
"
$_d_domain_list
"
_debug _d_domain_list
"
$_d_domain_list
"
if
[
-z
"
$(
echo
$_d_domain_list
|
cut
-d
,
-f
1
)
"
]
;
then
if
[
-z
"
$(
echo
$_d_domain_list
|
cut
-d
,
-f
1
)
"
]
;
then
_usage
"Usage:
$PROJECT_ENTRY
--deactivate -d domain.com [-d domain.com]"
_usage
"Usage:
$PROJECT_ENTRY
--deactivate -d domain.com [-d domain.com]"
...
@@ -4879,6 +4964,7 @@ Parameters:
...
@@ -4879,6 +4964,7 @@ Parameters:
--reloadcmd
\"
service nginx reload
\"
After issue/renew, it's used to reload the server.
--reloadcmd
\"
service nginx reload
\"
After issue/renew, it's used to reload the server.
--server SERVER ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
--accountconf Specifies a customized account config file.
--accountconf Specifies a customized account config file.
--home Specifies the home dir for
$PROJECT_NAME
.
--home Specifies the home dir for
$PROJECT_NAME
.
--cert-home Specifies the home dir to save all the certs, only valid for '--install' command.
--cert-home Specifies the home dir to save all the certs, only valid for '--install' command.
...
@@ -5039,6 +5125,7 @@ _process() {
...
@@ -5039,6 +5125,7 @@ _process() {
_openssl_bin
=
""
_openssl_bin
=
""
_syslog
=
""
_syslog
=
""
_use_wget
=
""
_use_wget
=
""
_server
=
""
while
[
${#}
-gt
0
]
;
do
while
[
${#}
-gt
0
]
;
do
case
"
${
1
}
"
in
case
"
${
1
}
"
in
...
@@ -5155,6 +5242,12 @@ _process() {
...
@@ -5155,6 +5242,12 @@ _process() {
--staging
|
--test
)
--staging
|
--test
)
STAGE
=
"1"
STAGE
=
"1"
;;
;;
--server
)
ACME_DIRECTORY
=
"
$2
"
_server
=
"
$ACME_DIRECTORY
"
export
ACME_DIRECTORY
shift
;;
--debug
)
--debug
)
if
[
-z
"
$2
"
]
||
_startswith
"
$2
"
"-"
;
then
if
[
-z
"
$2
"
]
||
_startswith
"
$2
"
"-"
;
then
DEBUG
=
"
$DEBUG_LEVEL_DEFAULT
"
DEBUG
=
"
$DEBUG_LEVEL_DEFAULT
"
...
@@ -5478,6 +5571,9 @@ _process() {
...
@@ -5478,6 +5571,9 @@ _process() {
if
[
"
$DEBUG
"
]
;
then
if
[
"
$DEBUG
"
]
;
then
version
version
if
[
"
$_server
"
]
;
then
_debug
"Using server:
$_server
"
fi
fi
fi
case
"
${
_CMD
}
"
in
case
"
${
_CMD
}
"
in
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment