Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
aa692c0e
Commit
aa692c0e
authored
Feb 20, 2016
by
neil
Browse files
Support FreeBSD
parent
0db15ce2
Changes
1
Hide whitespace changes
Inline
Side-by-side
le.sh
View file @
aa692c0e
#!/usr/bin/env bash
VER
=
1.1.
7
VER
=
1.1.
8
PROJECT
=
"https://github.com/Neilpang/le"
DEFAULT_CA
=
"https://acme-v01.api.letsencrypt.org"
...
...
@@ -180,7 +180,8 @@ createCSR() {
alt
=
"DNS:
$(
echo
$domainlist
|
sed
"s/,/,DNS:/g"
)
"
#multi
_info
"Multi domain"
"
$alt
"
openssl req
-new
-sha256
-key
"
$CERT_KEY_PATH
"
-subj
"/CN=
$domain
"
-reqexts
SAN
-config
<
(
printf
"[ req_distinguished_name ]
\n
[ req ]
\n
distinguished_name = req_distinguished_name
\n
[SAN]
\n
subjectAltName=
$alt
"
)
-out
"
$CSR_PATH
"
printf
"[ req_distinguished_name ]
\n
[ req ]
\n
distinguished_name = req_distinguished_name
\n
[SAN]
\n
subjectAltName=
$alt
"
>
"
$DOMAIN_SSL_CONF
"
openssl req
-new
-sha256
-key
"
$CERT_KEY_PATH
"
-subj
"/CN=
$domain
"
-reqexts
SAN
-config
"
$DOMAIN_SSL_CONF
"
-out
"
$CSR_PATH
"
fi
}
...
...
@@ -190,6 +191,19 @@ _b64() {
echo
$__n
|
tr
'/+'
'_-'
|
tr
-d
'= '
}
_time2str
()
{
#BSD
if
date
-u
-d
@
$1
2>/dev/null
;
then
return
fi
#Linux
if
date
-u
-r
$1
2>/dev/null
;
then
return
fi
}
_send_signed_request
()
{
url
=
$1
payload
=
$2
...
...
@@ -208,14 +222,14 @@ _send_signed_request() {
_debug payload64
$payload64
nonceurl
=
"
$API
/directory"
nonce
=
$(
$CURL
-I
$nonceurl
|
grep
"^Replay-Nonce:"
|
sed
s/
\\
r//|sed s/
\\
n//
|
cut
-d
' '
-f
2
)
nonce
=
"
$(
$CURL
-I
$nonceurl
|
grep
-o
"^Replay-Nonce:
.*$
"
|
tr
-d
"
\r\n
"
|
cut
-d
' '
-f
2
)
"
_debug nonce
$nonce
_debug nonce
"
$nonce
"
protected
=
$(
echo
-n
"
$HEADERPLACE
"
|
sed
"s/NONCE/
$nonce
/"
)
protected
=
"
$(
printf
"
$HEADERPLACE
"
|
sed
"s/NONCE/
$nonce
/"
)
"
_debug protected
"
$protected
"
protected64
=
$(
echo
-n
$protected
| _base64 | _b64
)
protected64
=
"
$(
printf
"
$protected
"
| _base64 | _b64
)
"
_debug protected64
"
$protected64
"
sig
=
$(
echo
-n
"
$protected64
.
$payload64
"
| openssl dgst
-sha256
-sign
$ACCOUNT_KEY_PATH
| _base64 | _b64
)
...
...
@@ -230,11 +244,11 @@ _send_signed_request() {
response
=
"
$(
$CURL
-X
POST
--data
"
$body
"
$url
)
"
fi
responseHeaders
=
"
$(
sed
's/\r//g'
$CURL_HEADER
)
"
responseHeaders
=
"
$(
cat
$CURL_HEADER
)
"
_debug responseHeaders
"
$responseHeaders
"
_debug response
"
$response
"
code
=
"
$(
grep
^HTTP
$CURL_HEADER
|
tail
-1
|
cut
-d
" "
-f
2
)
"
code
=
"
$(
grep
^HTTP
$CURL_HEADER
|
tail
-1
|
cut
-d
" "
-f
2
|
tr
-d
"
\r\n
"
)
"
_debug code
$code
}
...
...
@@ -269,7 +283,8 @@ _setopt() {
if
[[
"
$__val
"
==
*
"&"
*
]]
;
then
__val
=
"
$(
echo
$__val
|
sed
's/&/\\&/g'
)
"
fi
sed
-i
"s|^
$__opt$__sep
.*
$|$__opt$__sep$__val$__end
|"
"
$__conf
"
text
=
"
$(
cat
$__conf
)
"
printf
"
$text
"
|
sed
"s|^
$__opt$__sep
.*
$|$__opt$__sep$__val$__end
|"
>
"
$__conf
"
else
_debug APP
echo
"
$__opt$__sep$__val$__end
"
>>
"
$__conf
"
...
...
@@ -368,7 +383,11 @@ _initpath() {
if
[
-z
"
$DOMAIN_CONF
"
]
;
then
DOMAIN_CONF
=
"
$domainhome
/
$Le_Domain
.conf"
fi
if
[
-z
"
$DOMAIN_SSL_CONF
"
]
;
then
DOMAIN_SSL_CONF
=
"
$domainhome
/
$Le_Domain
.ssl.conf"
fi
if
[
-z
"
$CSR_PATH
"
]
;
then
CSR_PATH
=
"
$domainhome
/
$domain
.csr"
fi
...
...
@@ -386,8 +405,8 @@ _initpath() {
_apachePath
()
{
httpdroot
=
"
$(
apachectl
-V
|
grep
HTTPD_ROOT
=
|
cut
-d
=
-f
2 |
sed
s/
\"
//g
)
"
httpdconfname
=
"
$(
apachectl
-V
|
grep
SERVER_CONFIG_FILE
=
|
cut
-d
=
-f
2 |
sed
s/
\"
//g
)
"
httpdroot
=
"
$(
apachectl
-V
|
grep
HTTPD_ROOT
=
|
cut
-d
=
-f
2 |
tr
-d
'"'
)
"
httpdconfname
=
"
$(
apachectl
-V
|
grep
SERVER_CONFIG_FILE
=
|
cut
-d
=
-f
2 |
tr
-d
'"'
)
"
httpdconf
=
"
$httpdroot
/
$httpdconfname
"
if
[
!
-f
$httpdconf
]
;
then
_err
"Apache Config file not found"
$httpdconf
...
...
@@ -606,7 +625,7 @@ issue() {
HEADERPLACE
=
'{"nonce": "NONCE", "alg": "RS256", "jwk": '
$jwk
'}'
_debug HEADER
"
$HEADER
"
accountkey_json
=
$(
echo
-n
"
$jwk
"
|
sed
"s/ //g"
)
accountkey_json
=
$(
echo
-n
"
$jwk
"
|
tr
-d
' '
)
thumbprint
=
$(
echo
-n
"
$accountkey_json
"
| openssl dgst
-sha256
-binary
| _base64 | _b64
)
...
...
@@ -638,7 +657,7 @@ issue() {
_info
"Verify each domain"
sep
=
'#'
if
[
-z
"
$vlist
"
]
;
then
alldomains
=
$(
echo
"
$Le_Domain
,
$Le_Alt
"
|
sed
"s/,/ /g"
)
alldomains
=
$(
echo
"
$Le_Domain
,
$Le_Alt
"
|
tr
','
' '
)
for
d
in
$alldomains
do
_info
"Geting token for domain"
$d
...
...
@@ -649,13 +668,13 @@ issue() {
return
1
fi
entry
=
$(
echo
$response
| egrep
-o
'{[^{]*"type":"'
$vtype
'"[^}]*'
)
entry
=
"
$(
printf
$response
| egrep
-o
'{[^{]*"type":"'
$vtype
'"[^}]*'
)
"
_debug entry
"
$entry
"
token
=
$(
echo
"
$entry
"
|
sed
's/,/\n'
/g|
grep
'"token":
'
|
cut
-d
:
-f
2
|sed
's/"//g
'
)
token
=
"
$(
printf
"
$entry
"
|
e
grep
-o
'"token":
"[^"]*'
|
cut
-d
:
-f
2
|
tr
-d
'"
'
)
"
_debug token
$token
uri
=
$(
echo
"
$entry
"
|
sed
's/,/\n'
/g|
grep
'"uri":'
|
cut
-d
:
-f
2,3
|sed
's/"//g'
)
uri
=
"
$(
printf
"
$entry
"
|
e
grep
-o
'"uri":
"[^"]*
'
|
cut
-d
:
-f
2,3
|
tr
-d
'"'
)
"
_debug uri
$uri
keyauthorization
=
"
$token
.
$thumbprint
"
...
...
@@ -670,7 +689,7 @@ issue() {
#add entry
dnsadded
=
""
ventries
=
$(
echo
"
$vlist
"
|
sed
"s/,/ /g"
)
ventries
=
$(
echo
"
$vlist
"
|
tr
','
' '
)
for
ventry
in
$ventries
do
d
=
$(
echo
$ventry
|
cut
-d
$sep
-f
1
)
...
...
@@ -745,7 +764,7 @@ issue() {
fi
_debug
"ok, let's start to verify"
ventries
=
$(
echo
"
$vlist
"
|
sed
"s/,/ /g"
)
ventries
=
$(
echo
"
$vlist
"
|
tr
','
' '
)
for
ventry
in
$ventries
do
d
=
$(
echo
$ventry
|
cut
-d
$sep
-f
1
)
...
...
@@ -812,7 +831,7 @@ issue() {
return
1
fi
status
=
$(
echo
$response
| egrep
-o
'"status":"[^"]+"'
|
cut
-d
:
-f
2 |
sed
's/"//g
'
)
status
=
$(
echo
$response
| egrep
-o
'"status":"[^"]+"'
|
cut
-d
:
-f
2 |
tr
-d
'"
'
)
if
[
"
$status
"
==
"valid"
]
;
then
_info
"Success"
_stopserver
$serverproc
...
...
@@ -848,7 +867,7 @@ issue() {
_send_signed_request
"
$API
/acme/new-cert"
"{
\"
resource
\"
:
\"
new-cert
\"
,
\"
csr
\"
:
\"
$der
\"
}"
"needbase64"
Le_LinkCert
=
"
$(
grep
-i
-o
'^Location.*'
$CURL_HEADER
|
sed
's/\r//g'
|
cut
-d
" "
-f
2
)
"
Le_LinkCert
=
"
$(
grep
-i
-o
'^Location.*
$
'
$CURL_HEADER
|
tr
-d
"
\r\n
"
|
cut
-d
" "
-f
2
)
"
_setopt
"
$DOMAIN_CONF
"
"Le_LinkCert"
"="
"
$Le_LinkCert
"
if
[
"
$Le_LinkCert
"
]
;
then
...
...
@@ -870,7 +889,7 @@ issue() {
_setopt
"
$DOMAIN_CONF
"
'Le_Vlist'
'='
"
\"\"
"
Le_LinkIssuer
=
$(
grep
-i
'^Link'
$CURL_HEADER
|
cut
-d
" "
-f
2|
cut
-d
';'
-f
1 |
sed
's/<//g'
|
sed
's/>//g'
)
Le_LinkIssuer
=
$(
grep
-i
'^Link'
$CURL_HEADER
|
cut
-d
" "
-f
2|
cut
-d
';'
-f
1 |
tr
-d
'<>'
)
_setopt
"
$DOMAIN_CONF
"
"Le_LinkIssuer"
"="
"
$Le_LinkIssuer
"
if
[
"
$Le_LinkIssuer
"
]
;
then
...
...
@@ -883,7 +902,7 @@ issue() {
Le_CertCreateTime
=
$(
date
-u
"+%s"
)
_setopt
"
$DOMAIN_CONF
"
"Le_CertCreateTime"
"="
"
$Le_CertCreateTime
"
Le_CertCreateTimeStr
=
$(
date
-u
"+%Y-%m-%d %H:%M:%S UTC"
)
Le_CertCreateTimeStr
=
$(
date
-u
)
_setopt
"
$DOMAIN_CONF
"
"Le_CertCreateTimeStr"
"="
"
\"
$Le_CertCreateTimeStr
\"
"
if
[
!
"
$Le_RenewalDays
"
]
;
then
...
...
@@ -892,10 +911,10 @@ issue() {
_setopt
"
$DOMAIN_CONF
"
"Le_RenewalDays"
"="
"
$Le_RenewalDays
"
Le_NextRenewTime
=
$(
date
-u
-d
"+
$
Le_RenewalDays
day"
"+%s"
)
let
"
Le_NextRenewTime=
Le_CertCreateTime+
Le_RenewalDays
*24*60*60"
_setopt
"
$DOMAIN_CONF
"
"Le_NextRenewTime"
"="
"
$Le_NextRenewTime
"
Le_NextRenewTimeStr
=
$(
date
-u
-d
"+
$Le_RenewalDays
day"
"+%Y-%m-%d %H:%M:%S UTC"
)
Le_NextRenewTimeStr
=
$(
_time2str
$Le_NextRenewTime
)
_setopt
"
$DOMAIN_CONF
"
"Le_NextRenewTimeStr"
"="
"
\"
$Le_NextRenewTimeStr
\"
"
...
...
@@ -960,6 +979,7 @@ renewAll() {
Le_ReloadCmd
=
""
DOMAIN_CONF
=
""
DOMAIN_SSL_CONF
=
""
CSR_PATH
=
""
CERT_KEY_PATH
=
""
CERT_PATH
=
""
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment