Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
6541492a
Commit
6541492a
authored
Jan 06, 2018
by
neilpang
Browse files
first version to support ACME v2
parent
59e97506
Changes
1
Show whitespace changes
Inline
Side-by-side
acme.sh
View file @
6541492a
...
@@ -13,8 +13,15 @@ _SCRIPT_="$0"
...
@@ -13,8 +13,15 @@ _SCRIPT_="$0"
_SUB_FOLDERS="dnsapi deploy"
_SUB_FOLDERS="dnsapi deploy"
_OLD_CA_HOST
=
"https://acme-v01.api.letsencrypt.org"
LETSENCRYPT_CA_V1="https://acme-v01.api.letsencrypt.org/directory"
DEFAULT_CA
=
"https://acme-v01.api.letsencrypt.org/directory"
LETSENCRYPT_STAGING_CA_V1="https://acme-staging.api.letsencrypt.org/directory"
LETSENCRYPT_CA_V2="https://acme-v02.api.letsencrypt.org/directory"
LETSENCRYPT_STAGING_CA_V2="https://acme-staging-v02.api.letsencrypt.org/directory"
DEFAULT_CA=$LETSENCRYPT_CA_V1
DEFAULT_STAGING_CA=$LETSENCRYPT_STAGING_CA_V1
DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
DEFAULT_ACCOUNT_EMAIL=""
DEFAULT_ACCOUNT_EMAIL=""
...
@@ -24,13 +31,13 @@ DEFAULT_DOMAIN_KEY_LENGTH=2048
...
@@ -24,13 +31,13 @@ DEFAULT_DOMAIN_KEY_LENGTH=2048
DEFAULT_OPENSSL_BIN="openssl"
DEFAULT_OPENSSL_BIN="openssl"
STAGE_CA
=
"https://acme-
staging
.api.letsencrypt.org
/directory
"
_OLD_CA_HOST
="https://acme-
v01
.api.letsencrypt.org"
_OLD_STAGE_CA_HOST="https://acme-staging.api.letsencrypt.org"
_OLD_STAGE_CA_HOST="https://acme-staging.api.letsencrypt.org"
VTYPE_HTTP="http-01"
VTYPE_HTTP="http-01"
VTYPE_DNS="dns-01"
VTYPE_DNS="dns-01"
VTYPE_TLS="tls-sni-01"
VTYPE_TLS="tls-sni-01"
#
VTYPE_TLS2="tls-sni-02"
VTYPE_TLS2="tls-sni-02"
LOCAL_ANY_ADDRESS="0.0.0.0"
LOCAL_ANY_ADDRESS="0.0.0.0"
...
@@ -1044,13 +1051,14 @@ _createcsr() {
...
@@ -1044,13 +1051,14 @@ _createcsr() {
if [ -z "$domainlist" ] || [ "$domainlist" = "$NO_VALUE" ]; then
if [ -z "$domainlist" ] || [ "$domainlist" = "$NO_VALUE" ]; then
#single domain
#single domain
_info "Single domain" "$domain"
_info "Single domain" "$domain"
printf -- "\nsubjectAltName=DNS:$domain" >>"$csrconf"
else
else
domainlist="$(_idn "$domainlist")"
domainlist="$(_idn "$domainlist")"
_debug2 domainlist "$domainlist"
_debug2 domainlist "$domainlist"
if _contains "$domainlist" ","; then
if _contains "$domainlist" ","; then
alt
=
"DNS:
$(
echo
"
$domainlist
"
|
sed
"s/,/,DNS:/g"
)
"
alt="DNS:$
domain,DNS:$
(echo "$domainlist" | sed "s/,/,DNS:/g")"
else
else
alt
=
"DNS:
$domainlist
"
alt="DNS:$
domain,DNS:$
domainlist"
fi
fi
#multi
#multi
_info "Multi domain" "$alt"
_info "Multi domain" "$alt"
...
@@ -1421,7 +1429,7 @@ _calcjwk() {
...
@@ -1421,7 +1429,7 @@ _calcjwk() {
JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
JWK_HEADERPLACE_PART1='{"nonce": "'
JWK_HEADERPLACE_PART1='{"nonce": "'
JWK_HEADERPLACE_PART2
=
'", "alg": "RS256"
, "jwk": '
$jwk
'}
'
JWK_HEADERPLACE_PART2='", "alg": "RS256"'
elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
_debug "EC key"
_debug "EC key"
crv="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
crv="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
...
@@ -1490,7 +1498,7 @@ _calcjwk() {
...
@@ -1490,7 +1498,7 @@ _calcjwk() {
JWK_HEADER='{"alg": "ES'$__ECC_KEY_LEN'", "jwk": '$jwk'}'
JWK_HEADER='{"alg": "ES'$__ECC_KEY_LEN'", "jwk": '$jwk'}'
JWK_HEADERPLACE_PART1='{"nonce": "'
JWK_HEADERPLACE_PART1='{"nonce": "'
JWK_HEADERPLACE_PART2
=
'", "alg": "ES'
$__ECC_KEY_LEN
'"
, "jwk": '
$jwk
'}
'
JWK_HEADERPLACE_PART2='", "alg": "ES'$__ECC_KEY_LEN'"'
else
else
_err "Only RSA or EC key is supported."
_err "Only RSA or EC key is supported."
return 1
return 1
...
@@ -1580,7 +1588,7 @@ _inithttp() {
...
@@ -1580,7 +1588,7 @@ _inithttp() {
# body url [needbase64] [POST|PUT]
# body url [needbase64] [POST|PUT]
_post() {
_post() {
body="$1"
body="$1"
url
=
"
$2
"
_post_
url="$2"
needbase64="$3"
needbase64="$3"
httpmethod="$4"
httpmethod="$4"
...
@@ -1588,7 +1596,7 @@ _post() {
...
@@ -1588,7 +1596,7 @@ _post() {
httpmethod="POST"
httpmethod="POST"
fi
fi
_debug $httpmethod
_debug $httpmethod
_debug
"url"
"
$url
"
_debug "
_post_
url" "$
_post_
url"
_debug2 "body" "$body"
_debug2 "body" "$body"
_inithttp
_inithttp
...
@@ -1600,9 +1608,9 @@ _post() {
...
@@ -1600,9 +1608,9 @@ _post() {
fi
fi
_debug "_CURL" "$_CURL"
_debug "_CURL" "$_CURL"
if [ "$needbase64" ]; then
if [ "$needbase64" ]; then
response
=
"
$(
$_CURL
--user-agent
"
$USER_AGENT
"
-X
$httpmethod
-H
"
$_H1
"
-H
"
$_H2
"
-H
"
$_H3
"
-H
"
$_H4
"
-H
"
$_H5
"
--data
"
$body
"
"
$url
"
| _base64
)
"
response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$
_post_
url" | _base64)"
else
else
response
=
"
$(
$_CURL
--user-agent
"
$USER_AGENT
"
-X
$httpmethod
-H
"
$_H1
"
-H
"
$_H2
"
-H
"
$_H3
"
-H
"
$_H4
"
-H
"
$_H5
"
--data
"
$body
"
"
$url
"
)
"
response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$
_post_
url")"
fi
fi
_ret="$?"
_ret="$?"
if [ "$_ret" != "0" ]; then
if [ "$_ret" != "0" ]; then
...
@@ -1620,15 +1628,15 @@ _post() {
...
@@ -1620,15 +1628,15 @@ _post() {
_debug "_WGET" "$_WGET"
_debug "_WGET" "$_WGET"
if [ "$needbase64" ]; then
if [ "$needbase64" ]; then
if [ "$httpmethod" = "POST" ]; then
if [ "$httpmethod" = "POST" ]; then
response
=
"
$(
$_WGET
-S
-O
-
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
--post-data
=
"
$body
"
"
$url
"
2>
"
$HTTP_HEADER
"
| _base64
)
"
response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$
_post_
url" 2>"$HTTP_HEADER" | _base64)"
else
else
response
=
"
$(
$_WGET
-S
-O
-
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
--method
$httpmethod
--body-data
=
"
$body
"
"
$url
"
2>
"
$HTTP_HEADER
"
| _base64
)
"
response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$
_post_
url" 2>"$HTTP_HEADER" | _base64)"
fi
fi
else
else
if [ "$httpmethod" = "POST" ]; then
if [ "$httpmethod" = "POST" ]; then
response
=
"
$(
$_WGET
-S
-O
-
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
--post-data
=
"
$body
"
"
$url
"
2>
"
$HTTP_HEADER
"
)
"
response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$
_post_
url" 2>"$HTTP_HEADER")"
else
else
response
=
"
$(
$_WGET
-S
-O
-
--user-agent
=
"
$USER_AGENT
"
--header
"
$_H5
"
--header
"
$_H4
"
--header
"
$_H3
"
--header
"
$_H2
"
--header
"
$_H1
"
--method
$httpmethod
--body-data
=
"
$body
"
"
$url
"
2>
"
$HTTP_HEADER
"
)
"
response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$
_post_
url" 2>"$HTTP_HEADER")"
fi
fi
fi
fi
_ret="$?"
_ret="$?"
...
@@ -1776,7 +1784,15 @@ _send_signed_request() {
...
@@ -1776,7 +1784,15 @@ _send_signed_request() {
nonce="$_CACHED_NONCE"
nonce="$_CACHED_NONCE"
_debug2 nonce "$nonce"
_debug2 nonce "$nonce"
protected
=
"
$JWK_HEADERPLACE_PART1$nonce
\"
,
\"
url
\"
:
\"
${
url
}
$JWK_HEADERPLACE_PART2
"
if [ "$ACME_VERSION" = "2" ]; then
if [ "$url" = "$ACME_NEW_ACCOUNT" ]; then
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
else
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"$ACCOUNT_URL\""'}'
fi
else
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
fi
_debug3 protected "$protected"
_debug3 protected "$protected"
protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
...
@@ -1791,7 +1807,11 @@ _send_signed_request() {
...
@@ -1791,7 +1807,11 @@ _send_signed_request() {
sig="$(printf "%s" "$_sig_t" | _url_replace)"
sig="$(printf "%s" "$_sig_t" | _url_replace)"
_debug3 sig "$sig"
_debug3 sig "$sig"
if [ "$ACME_VERSION" = "2" ]; then
body="{\"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
else
body="{\"header\": $JWK_HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
body="{\"header\": $JWK_HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
fi
_debug3 body "$body"
_debug3 body "$body"
response="$(_post "$body" "$url" "$needbase64")"
response="$(_post "$body" "$url" "$needbase64")"
...
@@ -2170,9 +2190,15 @@ _initAPI() {
...
@@ -2170,9 +2190,15 @@ _initAPI() {
_debug2 "response" "$response"
_debug2 "response" "$response"
ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'key-change" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'key-change" *: *"[^"]*"' | cut -d '"' -f 3)
if [ -z "$ACME_KEY_CHANGE" ]; then
ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_KEY_CHANGE
export ACME_KEY_CHANGE
ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'new-authz" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'new-authz" *: *"[^"]*"' | cut -d '"' -f 3)
if [ -z "$ACME_NEW_AUTHZ" ]; then
ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_NEW_AUTHZ
export ACME_NEW_AUTHZ
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-cert" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-cert" *: *"[^"]*"' | cut -d '"' -f 3)
...
@@ -2180,6 +2206,9 @@ _initAPI() {
...
@@ -2180,6 +2206,9 @@ _initAPI() {
if [ -z "$ACME_NEW_ORDER" ]; then
if [ -z "$ACME_NEW_ORDER" ]; then
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-order" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-order" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_ORDER_RES="new-order"
ACME_NEW_ORDER_RES="new-order"
if [ -z "$ACME_NEW_ORDER" ]; then
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
fi
fi
fi
export ACME_NEW_ORDER
export ACME_NEW_ORDER
export ACME_NEW_ORDER_RES
export ACME_NEW_ORDER_RES
...
@@ -2189,17 +2218,32 @@ _initAPI() {
...
@@ -2189,17 +2218,32 @@ _initAPI() {
if [ -z "$ACME_NEW_ACCOUNT" ]; then
if [ -z "$ACME_NEW_ACCOUNT" ]; then
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-account" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-account" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_ACCOUNT_RES="new-account"
ACME_NEW_ACCOUNT_RES="new-account"
if [ -z "$ACME_NEW_ACCOUNT" ]; then
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
if [ "$ACME_NEW_ACCOUNT" ]; then
export ACME_VERSION=2
fi
fi
fi
fi
export ACME_NEW_ACCOUNT
export ACME_NEW_ACCOUNT
export ACME_NEW_ACCOUNT_RES
export ACME_NEW_ACCOUNT_RES
ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revoke-cert" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revoke-cert" *: *"[^"]*"' | cut -d '"' -f 3)
if [ -z "$ACME_REVOKE_CERT" ]; then
ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_REVOKE_CERT
export ACME_REVOKE_CERT
ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'new-nonce" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'new-nonce" *: *"[^"]*"' | cut -d '"' -f 3)
if [ -z "$ACME_NEW_NONCE" ]; then
ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_NEW_NONCE
export ACME_NEW_NONCE
ACME_AGREEMENT=$(echo "$response" | _egrep_o 'terms-of-service" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_AGREEMENT=$(echo "$response" | _egrep_o 'terms-of-service" *: *"[^"]*"' | cut -d '"' -f 3)
if [ -z "$ACME_AGREEMENT" ]; then
ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_AGREEMENT
export ACME_AGREEMENT
_debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
_debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
...
@@ -2208,6 +2252,8 @@ _initAPI() {
...
@@ -2208,6 +2252,8 @@ _initAPI() {
_debug "ACME_NEW_ACCOUNT" "$ACME_NEW_ACCOUNT"
_debug "ACME_NEW_ACCOUNT" "$ACME_NEW_ACCOUNT"
_debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
_debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
_debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
_debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
_debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
_debug "ACME_VERSION" "$ACME_VERSION"
fi
fi
}
}
...
@@ -2236,7 +2282,7 @@ _initpath() {
...
@@ -2236,7 +2282,7 @@ _initpath() {
if [ -z "$STAGE" ]; then
if [ -z "$STAGE" ]; then
ACME_DIRECTORY="$DEFAULT_CA"
ACME_DIRECTORY="$DEFAULT_CA"
else
else
ACME_DIRECTORY
=
"
$STAG
E
_CA
"
ACME_DIRECTORY="$
DEFAULT_
STAG
ING
_CA"
_info "Using stage ACME_DIRECTORY: $ACME_DIRECTORY"
_info "Using stage ACME_DIRECTORY: $ACME_DIRECTORY"
fi
fi
fi
fi
...
@@ -2951,6 +2997,7 @@ _on_issue_err() {
...
@@ -2951,6 +2997,7 @@ _on_issue_err() {
_chk_post_hook="$1"
_chk_post_hook="$1"
_chk_vlist="$2"
_chk_vlist="$2"
_debug _on_issue_err
_debug _on_issue_err
_cleardomainconf "ORDER_FINALIZE"
if [ "$LOG_FILE" ]; then
if [ "$LOG_FILE" ]; then
_err "Please check log file for more details: $LOG_FILE"
_err "Please check log file for more details: $LOG_FILE"
else
else
...
@@ -3052,6 +3099,8 @@ _regAccount() {
...
@@ -3052,6 +3099,8 @@ _regAccount() {
_initpath
_initpath
_reg_length="$1"
_reg_length="$1"
_debug3 _regAccount "$_regAccount"
_debug3 _regAccount "$_regAccount"
_initAPI
mkdir -p "$CA_DIR"
mkdir -p "$CA_DIR"
if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
_info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
_info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
...
@@ -3073,12 +3122,19 @@ _regAccount() {
...
@@ -3073,12 +3122,19 @@ _regAccount() {
if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
return 1
return 1
fi
fi
_initAPI
if [ "$ACME_VERSION" = "2" ]; then
regjson='{"termsOfServiceAgreed": true}'
if [ "$ACCOUNT_EMAIL" ]; then
regjson='{"contact": ["mailto: '$ACCOUNT_EMAIL'"], "termsOfServiceAgreed": true}'
fi
else
_reg_res="$ACME_NEW_ACCOUNT_RES"
_reg_res="$ACME_NEW_ACCOUNT_RES"
regjson='{"resource": "'$_reg_res'", "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
regjson='{"resource": "'$_reg_res'", "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
if [ "$ACCOUNT_EMAIL" ]; then
if [ "$ACCOUNT_EMAIL" ]; then
regjson='{"resource": "'$_reg_res'", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
regjson='{"resource": "'$_reg_res'", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
fi
fi
fi
_info "Registering account"
_info "Registering account"
...
@@ -3100,8 +3156,8 @@ _regAccount() {
...
@@ -3100,8 +3156,8 @@ _regAccount() {
_accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
_accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
_debug "_accUri" "$_accUri"
_debug "_accUri" "$_accUri"
_savecaconf "ACCOUNT_URL" "$_accUri"
_savecaconf "ACCOUNT_URL" "$_accUri"
export ACCOUNT_URL="$ACCOUNT_URL"
echo
"
$response
"
>
"
$ACCOUNT_JSON_PATH
"
CA_KEY_HASH="$(__calcAccountKeyHash)"
CA_KEY_HASH="$(__calcAccountKeyHash)"
_debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
_debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
_savecaconf CA_KEY_HASH "$CA_KEY_HASH"
_savecaconf CA_KEY_HASH "$CA_KEY_HASH"
...
@@ -3113,7 +3169,6 @@ _regAccount() {
...
@@ -3113,7 +3169,6 @@ _regAccount() {
ACCOUNT_THUMBPRINT="$(__calc_account_thumbprint)"
ACCOUNT_THUMBPRINT="$(__calc_account_thumbprint)"
_info "ACCOUNT_THUMBPRINT" "$ACCOUNT_THUMBPRINT"
_info "ACCOUNT_THUMBPRINT" "$ACCOUNT_THUMBPRINT"
}
}
#Implement deactivate account
#Implement deactivate account
...
@@ -3251,7 +3306,11 @@ __trigger_validation() {
...
@@ -3251,7 +3306,11 @@ __trigger_validation() {
_debug2 _t_url "$_t_url"
_debug2 _t_url "$_t_url"
_t_key_authz="$2"
_t_key_authz="$2"
_debug2 _t_key_authz "$_t_key_authz"
_debug2 _t_key_authz "$_t_key_authz"
if [ "$ACME_VERSION" = "2" ]; then
_send_signed_request "$_t_url" "{\"keyAuthorization\": \"$_t_key_authz\"}"
else
_send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$_t_key_authz\"}"
_send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$_t_key_authz\"}"
fi
}
}
#webroot, domain domainlist keylength
#webroot, domain domainlist keylength
...
@@ -3393,33 +3452,108 @@ issue() {
...
@@ -3393,33 +3452,108 @@ issue() {
sep='#'
sep='#'
dvsep=','
dvsep=','
if [ -z "$vlist" ]; then
if [ -z "$vlist" ]; then
if [ "$ACME_VERSION" = "2" ] && [ -z "$ORDER_FINALIZE" ]; then
#make new order request
_identifiers="{\"type\":\"dns\",\"value\":\"$_main_domain\"}"
for d in $(echo "$_alt_domains" | tr ',' ' '); do
#todo: check wildcard ?
if [ "$d" ]; then
_identifiers="$_identifiers,{\"type\":\"dns\",\"value\":\"$d\"}"
fi
done
_debug2 _identifiers "$_identifiers"
if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
_err "Create new order error."
_clearup
_on_issue_err "$_post_hook"
return 1
fi
ORDER_FINALIZE="$(echo "$response"| tr -d '\r\n' | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
_debug ORDER_FINALIZE "$ORDER_FINALIZE"
if [ -z "$ORDER_FINALIZE" ]; then
_err "ORDER_FINALIZE not found."
_clearup
_on_issue_err "$_post_hook"
return 1
fi
#for dns manual mode
_savedomainconf "ORDER_FINALIZE" "$ORDER_FINALIZE"
_authorizations_seg="$(echo "$response"| tr -d '\r\n' | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
_debug2 _authorizations_seg "$_authorizations_seg"
if [ -z "$_authorizations_seg" ]; then
_err "_authorizations_seg not found."
_clearup
_on_issue_err "$_post_hook"
return 1
fi
#domain and authz map
_authorizations_map=""
for _authz_url in $(echo "$_authorizations_seg" | tr ',' ' ' ); do
_debug2 "_authz_url" "$_authz_url"
if ! response="$(_get "$_authz_url")"; then
_err "get to authz error."
_clearup
_on_issue_err "$_post_hook"
return 1
fi
response="$(echo "$response" | _normalizeJson)"
_debug2 response "$response"
_d="$(echo "$response" | _egrep_o '"value" *: *"[^"]*"' | cut -d : -f 2 | tr -d ' "')"
_debug2 _d "$_d"
_authorizations_map="$_d,$response
$_authorizations_map"
done
_debug2 _authorizations_map "$_authorizations_map"
fi
alldomains=$(echo "$_main_domain,$_alt_domains" | tr ',' ' ')
alldomains=$(echo "$_main_domain,$_alt_domains" | tr ',' ' ')
_index
=
1
_index=
0
_currentRoot=""
_currentRoot=""
for d in $alldomains; do
for d in $alldomains; do
_info "Getting webroot for domain" "$d"
_info "Getting webroot for domain" "$d"
_index=$(_math $_index + 1)
_w="$(echo $_web_roots | cut -d , -f $_index)"
_w="$(echo $_web_roots | cut -d , -f $_index)"
_debug _w "$_w"
_debug _w "$_w"
if [ "$_w" ]; then
if [ "$_w" ]; then
_currentRoot="$_w"
_currentRoot="$_w"
fi
fi
_debug "_currentRoot" "$_currentRoot"
_debug "_currentRoot" "$_currentRoot"
_index
=
$(
_math
$_index
+ 1
)
vtype="$VTYPE_HTTP"
vtype="$VTYPE_HTTP"
#todo, v2 wildcard force to use dns
if _startswith "$_currentRoot" "dns"; then
if _startswith "$_currentRoot" "dns"; then
vtype="$VTYPE_DNS"
vtype="$VTYPE_DNS"
fi
fi
if [ "$_currentRoot" = "$W_TLS" ]; then
if [ "$_currentRoot" = "$W_TLS" ]; then
if [ "$ACME_VERSION" = "2" ]; then
vtype="$VTYPE_TLS2"
else
vtype="$VTYPE_TLS"
vtype="$VTYPE_TLS"
fi
fi
fi
if [ "$ACME_VERSION" = "2" ]; then
response="$(echo "$_authorizations_map" | grep "^$d," | sed "s/$d,//")"
_debug2 "response" "$response"
if [ -z "$response" ]; then
_err "get to authz error."
_clearup
_on_issue_err "$_post_hook"
return 1
fi
else
if ! __get_domain_new_authz "$d"; then
if ! __get_domain_new_authz "$d"; then
_clearup
_clearup
_on_issue_err "$_post_hook"
_on_issue_err "$_post_hook"
return 1
return 1
fi
fi
fi
if [ -z "$thumbprint" ]; then
if [ -z "$thumbprint" ]; then
thumbprint="$(__calc_account_thumbprint)"
thumbprint="$(__calc_account_thumbprint)"
...
@@ -3436,14 +3570,18 @@ issue() {
...
@@ -3436,14 +3570,18 @@ issue() {
token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
_debug token "$token"
_debug token "$token"
if [ "$ACME_VERSION" = "2" ]; then
uri="$(printf "%s\n" "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
else
uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
fi
_debug uri "$uri"
_debug uri "$uri"
keyauthorization="$token.$thumbprint"
keyauthorization="$token.$thumbprint"
_debug keyauthorization "$keyauthorization"
_debug keyauthorization "$keyauthorization"
if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
_debug
"
$d
is already verified
, skip
."
_debug "$d is already verified."
keyauthorization="$STATE_VERIFIED"
keyauthorization="$STATE_VERIFIED"
_debug keyauthorization "$keyauthorization"
_debug keyauthorization "$keyauthorization"
fi
fi
...
@@ -3685,13 +3823,17 @@ issue() {
...
@@ -3685,13 +3823,17 @@ issue() {
return 1
return 1
fi
fi
if
[
!
-z
"
$code
"
]
&&
[
!
"
$code
"
=
'202'
]
;
then
if [ "$code" ] && [ "$code" != '202' ]; then
if [ "$ACME_VERSION" = "2" ] && [ "$code" = '200' ]; then
_debug "trigger validation code: $code"
else
_err "$d:Challenge error: $response"
_err "$d:Challenge error: $response"
_clearupwebbroot "$_currentRoot" "$removelevel" "$token"
_clearupwebbroot "$_currentRoot" "$removelevel" "$token"
_clearup
_clearup
_on_issue_err "$_post_hook" "$vlist"
_on_issue_err "$_post_hook" "$vlist"
return 1
return 1
fi
fi
fi
waittimes=0
waittimes=0
if [ -z "$MAX_RETRY_TIMES" ]; then
if [ -z "$MAX_RETRY_TIMES" ]; then
...
@@ -3773,18 +3915,32 @@ issue() {
...
@@ -3773,18 +3915,32 @@ issue() {
_info "Verify finished, start to sign."
_info "Verify finished, start to sign."
der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
if
!
_send_signed_request
"
${
ACME_NEW_ORDER
}
"
"{
\"
resource
\"
:
\"
$ACME_NEW_ORDER_RES
\"
,
\"
csr
\"
:
\"
$der
\"
}"
"needbase64"
;
then
if [ "$ACME_VERSION" = "2" ]; then
if ! _send_signed_request "${ORDER_FINALIZE}" "{\"csr\": \"$der\"}"; then
_err "Sign failed."
_err "Sign failed."
_on_issue_err "$_post_hook"
_on_issue_err "$_post_hook"
return 1
return 1
fi
fi
if [ "$code" != "200" ]; then
_err "Sign failed, code is not 200."
_on_issue_err "$_post_hook"
return 1
fi
Le_LinkCert="$(echo "$response"| tr -d '\r\n' | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
if ! _get "$Le_LinkCert" > "$CERT_PATH"; then
_err "Sign failed, code is not 200."
_on_issue_err "$_post_hook"
return 1
fi
else
if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
_err "Sign failed."
_on_issue_err "$_post_hook"
return 1
fi
_rcert="$response"
_rcert="$response"
Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _head_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _head_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
_debug
"Le_LinkCert"
"
$Le_LinkCert
"
_savedomainconf
"Le_LinkCert"
"
$Le_LinkCert
"
if
[
"
$Le_LinkCert
"
]
;
then
echo "$BEGIN_CERT" >"$CERT_PATH"
echo "$BEGIN_CERT" >"$CERT_PATH"
#if ! _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH" ; then
#if ! _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH" ; then
...
@@ -3798,6 +3954,12 @@ issue() {
...
@@ -3798,6 +3954,12 @@ issue() {
fi
fi
echo "$END_CERT" >>"$CERT_PATH"
echo "$END_CERT" >>"$CERT_PATH"
fi
_debug "Le_LinkCert" "$Le_LinkCert"
_savedomainconf "Le_LinkCert" "$Le_LinkCert"
if [ "$Le_LinkCert" ]; then
_info "$(__green "Cert success.")"
_info "$(__green "Cert success.")"
cat "$CERT_PATH"
cat "$CERT_PATH"
...
@@ -3825,6 +3987,8 @@ issue() {
...
@@ -3825,6 +3987,8 @@ issue() {
_cleardomainconf "Le_Vlist"
_cleardomainconf "Le_Vlist"
Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
if [ "$Le_LinkIssuer" ]; then
if ! _contains "$Le_LinkIssuer" ":"; then
if ! _contains "$Le_LinkIssuer" ":"; then
_info "$(__red "Relative issuer link found.")"
_info "$(__red "Relative issuer link found.")"
Le_LinkIssuer="$_ACME_SERVER_HOST$Le_LinkIssuer"
Le_LinkIssuer="$_ACME_SERVER_HOST$Le_LinkIssuer"
...
@@ -3832,11 +3996,16 @@ issue() {
...
@@ -3832,11 +3996,16 @@ issue() {
_debug Le_LinkIssuer "$Le_LinkIssuer"
_debug Le_LinkIssuer "$Le_LinkIssuer"
_savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
_savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
if
[
"
$Le_LinkIssuer
"
]
;
then
_link_issuer_retry=0
_link_issuer_retry=0
_MAX_ISSUER_RETRY=5
_MAX_ISSUER_RETRY=5
while [ "$_link_issuer_retry" -lt "$_MAX_ISSUER_RETRY" ]; do
while [ "$_link_issuer_retry" -lt "$_MAX_ISSUER_RETRY" ]; do
_debug _link_issuer_retry "$_link_issuer_retry"
_debug _link_issuer_retry "$_link_issuer_retry"
if [ "$ACME_VERSION" = "2" ]; then
if _get "$Le_LinkIssuer" >"$CA_CERT_PATH"; then
break
fi
else
if _get "$Le_LinkIssuer" >"$CA_CERT_PATH.der"; then
if _get "$Le_LinkIssuer" >"$CA_CERT_PATH.der"; then
echo "$BEGIN_CERT" >"$CA_CERT_PATH"
echo "$BEGIN_CERT" >"$CA_CERT_PATH"
_base64 "multiline" <"$CA_CERT_PATH.der" >>"$CA_CERT_PATH"
_base64 "multiline" <"$CA_CERT_PATH.der" >>"$CA_CERT_PATH"
...
@@ -3849,6 +4018,7 @@ issue() {
...
@@ -3849,6 +4018,7 @@ issue() {
rm -f "$CA_CERT_PATH.der"
rm -f "$CA_CERT_PATH.der"
break
break
fi
fi
fi
_link_issuer_retry=$(_math $_link_issuer_retry + 1)
_link_issuer_retry=$(_math $_link_issuer_retry + 1)
_sleep "$_link_issuer_retry"
_sleep "$_link_issuer_retry"
done
done
...
@@ -3957,7 +4127,7 @@ renew() {
...
@@ -3957,7 +4127,7 @@ renew() {
_savedomainconf Le_API "$Le_API"
_savedomainconf Le_API "$Le_API"
fi
fi
if [ "$_OLD_STAGE_CA_HOST" = "$Le_API" ]; then
if [ "$_OLD_STAGE_CA_HOST" = "$Le_API" ]; then
export
Le_API
=
"
$STAG
E
_CA
"
export Le_API="$
DEFAULT_
STAG
ING
_CA"
_savedomainconf Le_API "$Le_API"
_savedomainconf Le_API "$Le_API"
fi
fi
export ACME_DIRECTORY="$Le_API"
export ACME_DIRECTORY="$Le_API"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment