Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
851fedf7
Commit
851fedf7
authored
Feb 25, 2017
by
neilpang
Browse files
rename OPENSSL_BIN to ACME_OPENSSL_BIN
parent
e6cd596d
Changes
1
Hide whitespace changes
Inline
Side-by-side
acme.sh
View file @
851fedf7
...
...
@@ -137,11 +137,11 @@ _printargs() {
_dlg_versions
()
{
echo
"Diagnosis versions: "
echo
"openssl:
$OPENSSL_BIN
"
if
_exists
"
$OPENSSL_BIN
"
;
then
$OPENSSL_BIN
version 2>&1
echo
"openssl:
$
ACME_
OPENSSL_BIN
"
if
_exists
"
$
ACME_
OPENSSL_BIN
"
;
then
$
ACME_
OPENSSL_BIN
version 2>&1
else
echo
"
$OPENSSL_BIN
doesn't exists."
echo
"
$
ACME_
OPENSSL_BIN
doesn't exists."
fi
echo
"apache:"
...
...
@@ -780,19 +780,19 @@ _base64() {
[
""
]
#urgly
if
[
"
$1
"
]
;
then
_debug3
"base64 multiline:'
$1
'"
$OPENSSL_BIN
base64
-e
$
ACME_
OPENSSL_BIN
base64
-e
else
_debug3
"base64 single line."
$OPENSSL_BIN
base64
-e
|
tr
-d
'\r\n'
$
ACME_
OPENSSL_BIN
base64
-e
|
tr
-d
'\r\n'
fi
}
#Usage: multiline
_dbase64
()
{
if
[
"
$1
"
]
;
then
$OPENSSL_BIN
base64
-d
-A
$
ACME_
OPENSSL_BIN
base64
-d
-A
else
$OPENSSL_BIN
base64
-d
$
ACME_
OPENSSL_BIN
base64
-d
fi
}
...
...
@@ -809,9 +809,9 @@ _digest() {
if
[
"
$alg
"
=
"sha256"
]
||
[
"
$alg
"
=
"sha1"
]
||
[
"
$alg
"
=
"md5"
]
;
then
if
[
"
$outputhex
"
]
;
then
$OPENSSL_BIN
dgst -
"
$alg
"
-hex
|
cut
-d
=
-f
2 |
tr
-d
' '
$
ACME_
OPENSSL_BIN
dgst -
"
$alg
"
-hex
|
cut
-d
=
-f
2 |
tr
-d
' '
else
$OPENSSL_BIN
dgst -
"
$alg
"
-binary
| _base64
$
ACME_
OPENSSL_BIN
dgst -
"
$alg
"
-binary
| _base64
fi
else
_err
"
$alg
is not supported yet"
...
...
@@ -834,9 +834,9 @@ _hmac() {
if
[
"
$alg
"
=
"sha256"
]
||
[
"
$alg
"
=
"sha1"
]
;
then
if
[
"
$outputhex
"
]
;
then
(
$OPENSSL_BIN
dgst -
"
$alg
"
-mac
HMAC
-macopt
"hexkey:
$secret_hex
"
2>/dev/null
||
$OPENSSL_BIN
dgst -
"
$alg
"
-hmac
"
$(
printf
"%s"
"
$secret_hex
"
| _h2b
)
"
)
|
cut
-d
=
-f
2 |
tr
-d
' '
(
$
ACME_
OPENSSL_BIN
dgst -
"
$alg
"
-mac
HMAC
-macopt
"hexkey:
$secret_hex
"
2>/dev/null
||
$
ACME_
OPENSSL_BIN
dgst -
"
$alg
"
-hmac
"
$(
printf
"%s"
"
$secret_hex
"
| _h2b
)
"
)
|
cut
-d
=
-f
2 |
tr
-d
' '
else
$OPENSSL_BIN
dgst -
"
$alg
"
-mac
HMAC
-macopt
"hexkey:
$secret_hex
"
-binary
2>/dev/null
||
$OPENSSL_BIN
dgst -
"
$alg
"
-hmac
"
$(
printf
"%s"
"
$secret_hex
"
| _h2b
)
"
-binary
$
ACME_
OPENSSL_BIN
dgst -
"
$alg
"
-mac
HMAC
-macopt
"hexkey:
$secret_hex
"
-binary
2>/dev/null
||
$
ACME_
OPENSSL_BIN
dgst -
"
$alg
"
-hmac
"
$(
printf
"%s"
"
$secret_hex
"
| _h2b
)
"
-binary
fi
else
_err
"
$alg
is not supported yet"
...
...
@@ -855,7 +855,7 @@ _sign() {
return
1
fi
_sign_openssl
=
"
$OPENSSL_BIN
dgst -sign
$keyfile
"
_sign_openssl
=
"
$
ACME_
OPENSSL_BIN
dgst -sign
$keyfile
"
if
[
"
$alg
"
=
"sha256"
]
;
then
_sign_openssl
=
"
$_sign_openssl
-
$alg
"
else
...
...
@@ -866,7 +866,7 @@ _sign() {
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
;
then
$_sign_openssl
| _base64
elif
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
;
then
if
!
_signedECText
=
"
$(
$_sign_openssl
|
$OPENSSL_BIN
asn1parse
-inform
DER
)
"
;
then
if
!
_signedECText
=
"
$(
$_sign_openssl
|
$
ACME_
OPENSSL_BIN
asn1parse
-inform
DER
)
"
;
then
_err
"Sign failed:
$_sign_openssl
"
_err
"Key file:
$keyfile
"
_err
"Key content:
$(
wc
-l
<
"
$keyfile
"
)
lises"
...
...
@@ -929,10 +929,10 @@ _createkey() {
if
_isEccKey
"
$length
"
;
then
_debug
"Using ec name:
$eccname
"
$OPENSSL_BIN
ecparam
-name
"
$eccname
"
-genkey
2>/dev/null
>
"
$f
"
$
ACME_
OPENSSL_BIN
ecparam
-name
"
$eccname
"
-genkey
2>/dev/null
>
"
$f
"
else
_debug
"Using RSA:
$length
"
$OPENSSL_BIN
genrsa
"
$length
"
2>/dev/null
>
"
$f
"
$
ACME_
OPENSSL_BIN
genrsa
"
$length
"
2>/dev/null
>
"
$f
"
fi
if
[
"
$?
"
!=
"0"
]
;
then
...
...
@@ -1019,9 +1019,9 @@ _createcsr() {
_csr_cn
=
"
$(
_idn
"
$domain
"
)
"
_debug2 _csr_cn
"
$_csr_cn
"
if
_contains
"
$(
uname
-a
)
"
"MINGW"
;
then
$OPENSSL_BIN
req
-new
-sha256
-key
"
$csrkey
"
-subj
"//CN=
$_csr_cn
"
-config
"
$csrconf
"
-out
"
$csr
"
$
ACME_
OPENSSL_BIN
req
-new
-sha256
-key
"
$csrkey
"
-subj
"//CN=
$_csr_cn
"
-config
"
$csrconf
"
-out
"
$csr
"
else
$OPENSSL_BIN
req
-new
-sha256
-key
"
$csrkey
"
-subj
"/CN=
$_csr_cn
"
-config
"
$csrconf
"
-out
"
$csr
"
$
ACME_
OPENSSL_BIN
req
-new
-sha256
-key
"
$csrkey
"
-subj
"/CN=
$_csr_cn
"
-config
"
$csrconf
"
-out
"
$csr
"
fi
}
...
...
@@ -1033,7 +1033,7 @@ _signcsr() {
cert
=
"
$4
"
_debug
"_signcsr"
_msg
=
"
$(
$OPENSSL_BIN
x509
-req
-days
365
-in
"
$csr
"
-signkey
"
$key
"
-extensions
v3_req
-extfile
"
$conf
"
-out
"
$cert
"
2>&1
)
"
_msg
=
"
$(
$
ACME_
OPENSSL_BIN
x509
-req
-days
365
-in
"
$csr
"
-signkey
"
$key
"
-extensions
v3_req
-extfile
"
$conf
"
-out
"
$cert
"
2>&1
)
"
_ret
=
"
$?
"
_debug
"
$_msg
"
return
$_ret
...
...
@@ -1046,7 +1046,7 @@ _readSubjectFromCSR() {
_usage
"_readSubjectFromCSR mycsr.csr"
return
1
fi
$OPENSSL_BIN
req
-noout
-in
"
$_csrfile
"
-subject
| _egrep_o
"CN *=.*"
|
cut
-d
=
-f
2 |
cut
-d
/
-f
1 |
tr
-d
'\n'
$
ACME_
OPENSSL_BIN
req
-noout
-in
"
$_csrfile
"
-subject
| _egrep_o
"CN *=.*"
|
cut
-d
=
-f
2 |
cut
-d
/
-f
1 |
tr
-d
'\n'
}
#_csrfile
...
...
@@ -1061,7 +1061,7 @@ _readSubjectAltNamesFromCSR() {
_csrsubj
=
"
$(
_readSubjectFromCSR
"
$_csrfile
"
)
"
_debug _csrsubj
"
$_csrsubj
"
_dnsAltnames
=
"
$(
$OPENSSL_BIN
req
-noout
-text
-in
"
$_csrfile
"
|
grep
"^ *DNS:.*"
|
tr
-d
' \n'
)
"
_dnsAltnames
=
"
$(
$
ACME_
OPENSSL_BIN
req
-noout
-text
-in
"
$_csrfile
"
|
grep
"^ *DNS:.*"
|
tr
-d
' \n'
)
"
_debug _dnsAltnames
"
$_dnsAltnames
"
if
_contains
"
$_dnsAltnames
,"
"DNS:
$_csrsubj
,"
;
then
...
...
@@ -1082,7 +1082,7 @@ _readKeyLengthFromCSR() {
return
1
fi
_outcsr
=
"
$(
$OPENSSL_BIN
req
-noout
-text
-in
"
$_csrfile
"
)
"
_outcsr
=
"
$(
$
ACME_
OPENSSL_BIN
req
-noout
-text
-in
"
$_csrfile
"
)
"
if
_contains
"
$_outcsr
"
"Public Key Algorithm: id-ecPublicKey"
;
then
_debug
"ECC CSR"
echo
"
$_outcsr
"
| _egrep_o
"^ *ASN1 OID:.*"
|
cut
-d
':'
-f
2 |
tr
-d
' '
...
...
@@ -1136,9 +1136,9 @@ toPkcs() {
_initpath
"
$domain
"
"
$_isEcc
"
if
[
"
$pfxPassword
"
]
;
then
$OPENSSL_BIN
pkcs12
-export
-out
"
$CERT_PFX_PATH
"
-inkey
"
$CERT_KEY_PATH
"
-in
"
$CERT_PATH
"
-certfile
"
$CA_CERT_PATH
"
-password
"pass:
$pfxPassword
"
$
ACME_
OPENSSL_BIN
pkcs12
-export
-out
"
$CERT_PFX_PATH
"
-inkey
"
$CERT_KEY_PATH
"
-in
"
$CERT_PATH
"
-certfile
"
$CA_CERT_PATH
"
-password
"pass:
$pfxPassword
"
else
$OPENSSL_BIN
pkcs12
-export
-out
"
$CERT_PFX_PATH
"
-inkey
"
$CERT_KEY_PATH
"
-in
"
$CERT_PATH
"
-certfile
"
$CA_CERT_PATH
"
$
ACME_
OPENSSL_BIN
pkcs12
-export
-out
"
$CERT_PFX_PATH
"
-inkey
"
$CERT_KEY_PATH
"
-in
"
$CERT_PATH
"
-certfile
"
$CA_CERT_PATH
"
fi
if
[
"
$?
"
=
"0"
]
;
then
...
...
@@ -1300,7 +1300,7 @@ _calcjwk() {
if
grep
"BEGIN RSA PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
;
then
_debug
"RSA key"
pub_exp
=
$(
$OPENSSL_BIN
rsa
-in
"
$keyfile
"
-noout
-text
|
grep
"^publicExponent:"
|
cut
-d
'('
-f
2 |
cut
-d
'x'
-f
2 |
cut
-d
')'
-f
1
)
pub_exp
=
$(
$
ACME_
OPENSSL_BIN
rsa
-in
"
$keyfile
"
-noout
-text
|
grep
"^publicExponent:"
|
cut
-d
'('
-f
2 |
cut
-d
'x'
-f
2 |
cut
-d
')'
-f
1
)
if
[
"
${#
pub_exp
}
"
=
"5"
]
;
then
pub_exp
=
0
$pub_exp
fi
...
...
@@ -1309,7 +1309,7 @@ _calcjwk() {
e
=
$(
echo
"
$pub_exp
"
| _h2b | _base64
)
_debug3 e
"
$e
"
modulus
=
$(
$OPENSSL_BIN
rsa
-in
"
$keyfile
"
-modulus
-noout
|
cut
-d
'='
-f
2
)
modulus
=
$(
$
ACME_
OPENSSL_BIN
rsa
-in
"
$keyfile
"
-modulus
-noout
|
cut
-d
'='
-f
2
)
_debug3 modulus
"
$modulus
"
n
=
"
$(
printf
"%s"
"
$modulus
"
| _h2b | _base64 | _url_replace
)
"
_debug3 n
"
$n
"
...
...
@@ -1322,12 +1322,12 @@ _calcjwk() {
JWK_HEADERPLACE_PART2
=
'", "alg": "RS256", "jwk": '
$jwk
'}'
elif
grep
"BEGIN EC PRIVATE KEY"
"
$keyfile
"
>
/dev/null 2>&1
;
then
_debug
"EC key"
crv
=
"
$(
$OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^NIST CURVE:"
|
cut
-d
":"
-f
2 |
tr
-d
"
\r\n
"
)
"
crv
=
"
$(
$
ACME_
OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^NIST CURVE:"
|
cut
-d
":"
-f
2 |
tr
-d
"
\r\n
"
)
"
_debug3 crv
"
$crv
"
if
[
-z
"
$crv
"
]
;
then
_debug
"Let's try ASN1 OID"
crv_oid
=
"
$(
$OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^ASN1 OID:"
|
cut
-d
":"
-f
2 |
tr
-d
"
\r\n
"
)
"
crv_oid
=
"
$(
$
ACME_
OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
"^ASN1 OID:"
|
cut
-d
":"
-f
2 |
tr
-d
"
\r\n
"
)
"
_debug3 crv_oid
"
$crv_oid
"
case
"
${
crv_oid
}
"
in
"prime256v1"
)
...
...
@@ -1347,15 +1347,15 @@ _calcjwk() {
_debug3 crv
"
$crv
"
fi
pubi
=
"
$(
$OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
-n
pub: |
cut
-d
:
-f
1
)
"
pubi
=
"
$(
$
ACME_
OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
-n
pub: |
cut
-d
:
-f
1
)
"
pubi
=
$(
_math
"
$pubi
"
+ 1
)
_debug3 pubi
"
$pubi
"
pubj
=
"
$(
$OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
-n
"ASN1 OID:"
|
cut
-d
:
-f
1
)
"
pubj
=
"
$(
$
ACME_
OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
grep
-n
"ASN1 OID:"
|
cut
-d
:
-f
1
)
"
pubj
=
$(
_math
"
$pubj
"
- 1
)
_debug3 pubj
"
$pubj
"
pubtext
=
"
$(
$OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
sed
-n
"
$pubi
,
${
pubj
}
p"
|
tr
-d
"
\n\r
"
)
"
pubtext
=
"
$(
$
ACME_
OPENSSL_BIN
ec
-in
"
$keyfile
"
-noout
-text
2>/dev/null |
sed
-n
"
$pubi
,
${
pubj
}
p"
|
tr
-d
"
\n\r
"
)
"
_debug3 pubtext
"
$pubtext
"
xlen
=
"
$(
printf
"%s"
"
$pubtext
"
|
tr
-d
':'
|
wc
-c
)
"
...
...
@@ -1964,7 +1964,7 @@ _starttlsserver() {
return
1
fi
__S_OPENSSL
=
"
$OPENSSL_BIN
s_server -cert
$TLS_CERT
-key
$TLS_KEY
"
__S_OPENSSL
=
"
$
ACME_
OPENSSL_BIN
s_server -cert
$TLS_CERT
-key
$TLS_KEY
"
if
[
"
$opaddr
"
]
;
then
__S_OPENSSL
=
"
$__S_OPENSSL
-accept
$opaddr
:
$port
"
else
...
...
@@ -2143,8 +2143,8 @@ _initpath() {
CERT_HOME
=
"
$_DEFAULT_CERT_HOME
"
fi
if
[
-z
"
$OPENSSL_BIN
"
]
;
then
OPENSSL_BIN
=
"
$DEFAULT_OPENSSL_BIN
"
if
[
-z
"
$
ACME_
OPENSSL_BIN
"
]
||
[
!
-f
"
$ACME_OPENSSL_BIN
"
]
||
[
!
-x
"
$ACME_OPENSSL_BIN
"
]
;
then
ACME_
OPENSSL_BIN
=
"
$DEFAULT_OPENSSL_BIN
"
fi
if
[
-z
"
$1
"
]
;
then
...
...
@@ -4368,8 +4368,8 @@ _precheck() {
fi
fi
if
!
_exists
"
$OPENSSL_BIN
"
;
then
_err
"Please install openssl first. OPENSSL_BIN=
$OPENSSL_BIN
"
if
!
_exists
"
$
ACME_
OPENSSL_BIN
"
;
then
_err
"Please install openssl first.
ACME_
OPENSSL_BIN=
$
ACME_
OPENSSL_BIN
"
_err
"We need openssl to generate keys."
return
1
fi
...
...
@@ -4791,9 +4791,9 @@ _processAccountConf() {
fi
if
[
"
$_openssl_bin
"
]
;
then
_saveaccountconf
"OPENSSL_BIN"
"
$_openssl_bin
"
elif
[
"
$OPENSSL_BIN
"
]
&&
[
"
$OPENSSL_BIN
"
!=
"
$DEFAULT_OPENSSL_BIN
"
]
;
then
_saveaccountconf
"OPENSSL_BIN"
"
$OPENSSL_BIN
"
_saveaccountconf
"
ACME_
OPENSSL_BIN"
"
$_openssl_bin
"
elif
[
"
$
ACME_
OPENSSL_BIN
"
]
&&
[
"
$
ACME_
OPENSSL_BIN
"
!=
"
$DEFAULT_OPENSSL_BIN
"
]
;
then
_saveaccountconf
"
ACME_
OPENSSL_BIN"
"
$
ACME_
OPENSSL_BIN
"
fi
if
[
"
$_auto_upgrade
"
]
;
then
...
...
@@ -5219,7 +5219,7 @@ _process() {
;;
--openssl-bin
)
_openssl_bin
=
"
$2
"
OPENSSL_BIN
=
"
$_openssl_bin
"
ACME_
OPENSSL_BIN
=
"
$_openssl_bin
"
;;
*
)
_err
"Unknown parameter :
$1
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment