Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
63fb9080
Commit
63fb9080
authored
Jun 20, 2017
by
neil
Committed by
GitHub
Jun 20, 2017
Browse files
Merge pull request #896 from Neilpang/dev
support --server
parents
26e3263a
88ada806
Changes
1
Show whitespace changes
Inline
Side-by-side
acme.sh
View file @
63fb9080
#!/usr/bin/env sh
VER
=
2.7.
2
VER
=
2.7.
3
PROJECT_NAME
=
"acme.sh"
...
...
@@ -13,7 +13,8 @@ _SCRIPT_="$0"
_SUB_FOLDERS
=
"dnsapi deploy"
DEFAULT_CA
=
"https://acme-v01.api.letsencrypt.org"
_OLD_CA_HOST
=
"https://acme-v01.api.letsencrypt.org"
DEFAULT_CA
=
"https://acme-v01.api.letsencrypt.org/directory"
DEFAULT_AGREEMENT
=
"https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf"
DEFAULT_USER_AGENT
=
"
$PROJECT_NAME
/
$VER
(
$PROJECT
)"
...
...
@@ -24,7 +25,8 @@ DEFAULT_DOMAIN_KEY_LENGTH=2048
DEFAULT_OPENSSL_BIN
=
"openssl"
STAGE_CA
=
"https://acme-staging.api.letsencrypt.org"
STAGE_CA
=
"https://acme-staging.api.letsencrypt.org/directory"
_OLD_STAGE_CA_HOST
=
"https://acme-staging.api.letsencrypt.org"
VTYPE_HTTP
=
"http-01"
VTYPE_DNS
=
"dns-01"
...
...
@@ -1714,9 +1716,19 @@ _send_signed_request() {
while
[
"
${
_request_retry_times
}
"
-lt
"
$MAX_REQUEST_RETRY_TIMES
"
]
;
do
_debug3 _request_retry_times
"
$_request_retry_times
"
if
[
-z
"
$_CACHED_NONCE
"
]
;
then
_debug2
"Get nonce."
nonceurl
=
"
$API
/directory"
_headers
=
""
if
[
"
$ACME_NEW_NONCE
"
]
;
then
_debug2
"Get nonce. ACME_NEW_NONCE"
"
$ACME_NEW_NONCE
"
nonceurl
=
"
$ACME_NEW_NONCE
"
if
_post
""
"
$nonceurl
"
""
"HEAD"
;
then
_headers
=
"
$(
cat
"
$HTTP_HEADER
"
)
"
fi
fi
if
[
-z
"
$_headers
"
]
;
then
_debug2
"Get nonce. ACME_DIRECTORY"
"
$ACME_DIRECTORY
"
nonceurl
=
"
$ACME_DIRECTORY
"
_headers
=
"
$(
_get
"
$nonceurl
"
"onlyheader"
)
"
fi
if
[
"
$?
"
!=
"0"
]
;
then
_err
"Can not connect to
$nonceurl
to get nonce."
...
...
@@ -2169,6 +2181,62 @@ __initHome() {
fi
}
#server
_initAPI
()
{
_api_server
=
"
${
1
:-
$ACME_DIRECTORY
}
"
_debug
"_init api for server:
$_api_server
"
if
[
"
$_api_server
"
=
"
$DEFAULT_CA
"
]
;
then
#just for performance, hardcode the default entry points
export
ACME_KEY_CHANGE
=
"https://acme-v01.api.letsencrypt.org/acme/key-change"
export
ACME_NEW_AUTHZ
=
"https://acme-v01.api.letsencrypt.org/acme/new-authz"
export
ACME_NEW_ORDER
=
"https://acme-v01.api.letsencrypt.org/acme/new-cert"
export
ACME_NEW_ACCOUNT
=
"https://acme-v01.api.letsencrypt.org/acme/new-reg"
export
ACME_REVOKE_CERT
=
"https://acme-v01.api.letsencrypt.org/acme/revoke-cert"
fi
if
[
-z
"
$ACME_NEW_ACCOUNT
"
]
;
then
response
=
$(
_get
"
$_api_server
"
)
if
[
"
$?
"
!=
"0"
]
;
then
_debug2
"response"
"
$response
"
_err
"Can not init api."
return
1
fi
_debug2
"response"
"
$response
"
ACME_KEY_CHANGE
=
$(
echo
"
$response
"
| _egrep_o
'key-change" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
export
ACME_KEY_CHANGE
ACME_NEW_AUTHZ
=
$(
echo
"
$response
"
| _egrep_o
'new-authz" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
export
ACME_NEW_AUTHZ
ACME_NEW_ORDER
=
$(
echo
"
$response
"
| _egrep_o
'new-cert" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
if
[
-z
"
$ACME_NEW_ORDER
"
]
;
then
ACME_NEW_ORDER
=
$(
echo
"
$response
"
| _egrep_o
'new-order" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
fi
export
ACME_NEW_ORDER
ACME_NEW_ACCOUNT
=
$(
echo
"
$response
"
| _egrep_o
'new-reg" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
if
[
-z
"
$ACME_NEW_ACCOUNT
"
]
;
then
ACME_NEW_ACCOUNT
=
$(
echo
"
$response
"
| _egrep_o
'new-account" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
fi
export
ACME_NEW_ACCOUNT
ACME_REVOKE_CERT
=
$(
echo
"
$response
"
| _egrep_o
'revoke-cert" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
export
ACME_REVOKE_CERT
ACME_NEW_NONCE
=
$(
echo
"
$response
"
| _egrep_o
'new-nonce" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
export
ACME_NEW_NONCE
fi
_debug
"ACME_KEY_CHANGE"
"
$ACME_KEY_CHANGE
"
_debug
"ACME_NEW_AUTHZ"
"
$ACME_NEW_AUTHZ
"
_debug
"ACME_NEW_ORDER"
"
$ACME_NEW_ORDER
"
_debug
"ACME_NEW_ACCOUNT"
"
$ACME_NEW_ACCOUNT
"
_debug
"ACME_REVOKE_CERT"
"
$ACME_REVOKE_CERT
"
}
#[domain] [keylength]
_initpath
()
{
...
...
@@ -2189,17 +2257,19 @@ _initpath() {
CA_HOME
=
"
$DEFAULT_CA_HOME
"
fi
if
[
-z
"
$A
PI
"
]
;
then
if
[
-z
"
$A
CME_DIRECTORY
"
]
;
then
if
[
-z
"
$STAGE
"
]
;
then
A
PI
=
"
$DEFAULT_CA
"
A
CME_DIRECTORY
=
"
$DEFAULT_CA
"
else
A
PI
=
"
$STAGE_CA
"
_info
"Using stage
api:
$API
"
A
CME_DIRECTORY
=
"
$STAGE_CA
"
_info
"Using stage
ACME_DIRECTORY:
$ACME_DIRECTORY
"
fi
fi
_API_HOST
=
"
$(
echo
"
$API
"
|
cut
-d
:
-f
2 |
tr
-d
'/'
)
"
CA_DIR
=
"
$CA_HOME
/
$_API_HOST
"
_ACME_SERVER_HOST
=
"
$(
echo
"
$ACME_DIRECTORY
"
|
cut
-d
:
-f
2 |
tr
-s
/ |
cut
-d
/
-f
2
)
"
_debug2
"_ACME_SERVER_HOST"
"
$_ACME_SERVER_HOST
"
CA_DIR
=
"
$CA_HOME
/
$_ACME_SERVER_HOST
"
_DEFAULT_CA_CONF
=
"
$CA_DIR
/ca.conf"
...
...
@@ -3020,7 +3090,7 @@ _regAccount() {
if
!
_calcjwk
"
$ACCOUNT_KEY_PATH
"
;
then
return
1
fi
_initAPI
_updateTos
=
""
_reg_res
=
"new-reg"
while
true
;
do
...
...
@@ -3035,7 +3105,7 @@ _regAccount() {
if
[
-z
"
$_updateTos
"
]
;
then
_info
"Registering account"
if
!
_send_signed_request
"
$
API
/acme/new-reg
"
"
$regjson
"
;
then
if
!
_send_signed_request
"
$
{
ACME_NEW_ACCOUNT
}
"
"
$regjson
"
;
then
_err
"Register account Error:
$response
"
return
1
fi
...
...
@@ -3121,12 +3191,12 @@ _findHook() {
__get_domain_new_authz
()
{
_gdnd
=
"
$1
"
_info
"Getting new-authz for domain"
"
$_gdnd
"
_initAPI
_Max_new_authz_retry_times
=
5
_authz_i
=
0
while
[
"
$_authz_i
"
-lt
"
$_Max_new_authz_retry_times
"
]
;
do
_debug
"Try new-authz for the
$_authz_i
time."
if
!
_send_signed_request
"
$
API
/acme/new-authz
"
"{
\"
resource
\"
:
\"
new-authz
\"
,
\"
identifier
\"
: {
\"
type
\"
:
\"
dns
\"
,
\"
value
\"
:
\"
$(
_idn
"
$_gdnd
"
)
\"
}}"
;
then
if
!
_send_signed_request
"
$
{
ACME_NEW_AUTHZ
}
"
"{
\"
resource
\"
:
\"
new-authz
\"
,
\"
identifier
\"
: {
\"
type
\"
:
\"
dns
\"
,
\"
value
\"
:
\"
$(
_idn
"
$_gdnd
"
)
\"
}}"
;
then
_err
"Can not get domain new authz."
return
1
fi
...
...
@@ -3204,13 +3274,16 @@ issue() {
if
[
"
$_web_roots
"
=
"dns-cx"
]
;
then
_web_roots
=
"dns_cx"
fi
_debug
"Using api:
$API
"
if
[
!
"
$IS_RENEW
"
]
;
then
_initpath
"
$_main_domain
"
"
$_key_length
"
mkdir
-p
"
$DOMAIN_PATH
"
fi
_debug
"Using ACME_DIRECTORY:
$ACME_DIRECTORY
"
_initAPI
if
[
-f
"
$DOMAIN_CONF
"
]
;
then
Le_NextRenewTime
=
$(
_readdomainconf Le_NextRenewTime
)
_debug Le_NextRenewTime
"
$Le_NextRenewTime
"
...
...
@@ -3244,7 +3317,7 @@ issue() {
_cleardomainconf
"Le_LocalAddress"
fi
Le_API
=
"
$A
PI
"
Le_API
=
"
$A
CME_DIRECTORY
"
_savedomainconf
"Le_API"
"
$Le_API
"
if
[
"
$_alt_domains
"
=
"
$NO_VALUE
"
]
;
then
...
...
@@ -3683,7 +3756,7 @@ issue() {
_info
"Verify finished, start to sign."
der
=
"
$(
_getfile
"
${
CSR_PATH
}
"
"
${
BEGIN_CSR
}
"
"
${
END_CSR
}
"
|
tr
-d
"
\r\n
"
| _url_replace
)
"
if
!
_send_signed_request
"
$
API
/acme/new-cert
"
"{
\"
resource
\"
:
\"
new-cert
\"
,
\"
csr
\"
:
\"
$der
\"
}"
"needbase64"
;
then
if
!
_send_signed_request
"
$
{
ACME_NEW_ORDER
}
"
"{
\"
resource
\"
:
\"
new-cert
\"
,
\"
csr
\"
:
\"
$der
\"
}"
"needbase64"
;
then
_err
"Sign failed."
_on_issue_err
"
$_post_hook
"
return
1
...
...
@@ -3736,7 +3809,8 @@ issue() {
Le_LinkIssuer
=
$(
grep
-i
'^Link'
"
$HTTP_HEADER
"
| _head_n 1 |
cut
-d
" "
-f
2 |
cut
-d
';'
-f
1 |
tr
-d
'<>'
)
if
!
_contains
"
$Le_LinkIssuer
"
":"
;
then
Le_LinkIssuer
=
"
$API$Le_LinkIssuer
"
_info
"
$(
__red
"Relative issuer link found."
)
"
Le_LinkIssuer
=
"
$_ACME_SERVER_HOST$Le_LinkIssuer
"
fi
_debug Le_LinkIssuer
"
$Le_LinkIssuer
"
_savedomainconf
"Le_LinkIssuer"
"
$Le_LinkIssuer
"
...
...
@@ -3852,7 +3926,15 @@ renew() {
.
"
$DOMAIN_CONF
"
if
[
"
$Le_API
"
]
;
then
API
=
"
$Le_API
"
if
[
"
$_OLD_CA_HOST
"
=
"
$Le_API
"
]
;
then
export
Le_API
=
"
$DEFAULT_CA
"
_savedomainconf Le_API
"
$Le_API
"
fi
if
[
"
$_OLD_STAGE_CA_HOST
"
=
"
$Le_API
"
]
;
then
export
Le_API
=
"
$STAGE_CA
"
_savedomainconf Le_API
"
$Le_API
"
fi
export
ACME_DIRECTORY
=
"
$Le_API
"
#reload ca configs
ACCOUNT_KEY_PATH
=
""
ACCOUNT_JSON_PATH
=
""
...
...
@@ -4319,8 +4401,10 @@ revoke() {
return
1
fi
_initAPI
data
=
"{
\"
resource
\"
:
\"
revoke-cert
\"
,
\"
certificate
\"
:
\"
$cert
\"
}"
uri
=
"
$
API
/acme/revoke-cert
"
uri
=
"
$
{
ACME_REVOKE_CERT
}
"
if
[
-f
"
$CERT_KEY_PATH
"
]
;
then
_info
"Try domain key first."
...
...
@@ -4452,6 +4536,7 @@ deactivate() {
_d_domain_list
=
"
$1
"
_d_type
=
"
$2
"
_initpath
_initAPI
_debug _d_domain_list
"
$_d_domain_list
"
if
[
-z
"
$(
echo
$_d_domain_list
|
cut
-d
,
-f
1
)
"
]
;
then
_usage
"Usage:
$PROJECT_ENTRY
--deactivate -d domain.com [-d domain.com]"
...
...
@@ -4879,6 +4964,7 @@ Parameters:
--reloadcmd
\"
service nginx reload
\"
After issue/renew, it's used to reload the server.
--server SERVER ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
--accountconf Specifies a customized account config file.
--home Specifies the home dir for
$PROJECT_NAME
.
--cert-home Specifies the home dir to save all the certs, only valid for '--install' command.
...
...
@@ -5039,6 +5125,7 @@ _process() {
_openssl_bin
=
""
_syslog
=
""
_use_wget
=
""
_server
=
""
while
[
${#}
-gt
0
]
;
do
case
"
${
1
}
"
in
...
...
@@ -5155,6 +5242,12 @@ _process() {
--staging
|
--test
)
STAGE
=
"1"
;;
--server
)
ACME_DIRECTORY
=
"
$2
"
_server
=
"
$ACME_DIRECTORY
"
export
ACME_DIRECTORY
shift
;;
--debug
)
if
[
-z
"
$2
"
]
||
_startswith
"
$2
"
"-"
;
then
DEBUG
=
"
$DEBUG_LEVEL_DEFAULT
"
...
...
@@ -5478,6 +5571,9 @@ _process() {
if
[
"
$DEBUG
"
]
;
then
version
if
[
"
$_server
"
]
;
then
_debug
"Using server:
$_server
"
fi
fi
case
"
${
_CMD
}
"
in
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment