Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
af3ea2d4
Commit
af3ea2d4
authored
May 22, 2021
by
neil
Browse files
remove ACME v1 support
parent
52a32559
Changes
1
Show whitespace changes
Inline
Side-by-side
acme.sh
View file @
af3ea2d4
...
@@ -20,9 +20,6 @@ _SUB_FOLDER_DEPLOY="deploy"
...
@@ -20,9 +20,6 @@ _SUB_FOLDER_DEPLOY="deploy"
_SUB_FOLDERS="$_SUB_FOLDER_DNSAPI $_SUB_FOLDER_DEPLOY $_SUB_FOLDER_NOTIFY"
_SUB_FOLDERS="$_SUB_FOLDER_DNSAPI $_SUB_FOLDER_DEPLOY $_SUB_FOLDER_NOTIFY"
LETSENCRYPT_CA_V1
=
"https://acme-v01.api.letsencrypt.org/directory"
LETSENCRYPT_STAGING_CA_V1
=
"https://acme-staging.api.letsencrypt.org/directory"
CA_LETSENCRYPT_V2="https://acme-v02.api.letsencrypt.org/directory"
CA_LETSENCRYPT_V2="https://acme-v02.api.letsencrypt.org/directory"
CA_LETSENCRYPT_V2_TEST="https://acme-staging-v02.api.letsencrypt.org/directory"
CA_LETSENCRYPT_V2_TEST="https://acme-staging-v02.api.letsencrypt.org/directory"
...
@@ -2072,7 +2069,7 @@ _send_signed_request() {
...
@@ -2072,7 +2069,7 @@ _send_signed_request() {
_sleep 2
_sleep 2
continue
continue
fi
fi
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
if [ "$url" = "$ACME_NEW_ACCOUNT" ]; then
if [ "$url" = "$ACME_NEW_ACCOUNT" ]; then
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
elif [ "$url" = "$ACME_REVOKE_CERT" ] && [ "$keyfile" != "$ACCOUNT_KEY_PATH" ]; then
elif [ "$url" = "$ACME_REVOKE_CERT" ] && [ "$keyfile" != "$ACCOUNT_KEY_PATH" ]; then
...
@@ -2080,9 +2077,7 @@ _send_signed_request() {
...
@@ -2080,9 +2077,7 @@ _send_signed_request() {
else
else
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"${ACCOUNT_URL}\""'}'
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"${ACCOUNT_URL}\""'}'
fi
fi
else
protected
=
"
$JWK_HEADERPLACE_PART1$nonce
\"
,
\"
url
\"
:
\"
${
url
}
$JWK_HEADERPLACE_PART2
,
\"
jwk
\"
:
$jwk
"
'}'
fi
_debug3 protected "$protected"
_debug3 protected "$protected"
protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
...
@@ -2549,61 +2544,25 @@ _initAPI() {
...
@@ -2549,61 +2544,25 @@ _initAPI() {
response=$(echo "$response" | _json_decode)
response=$(echo "$response" | _json_decode)
_debug2 "response" "$response"
_debug2 "response" "$response"
ACME_KEY_CHANGE
=
$(
echo
"
$response
"
| _egrep_o
'key-change" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
if
[
-z
"
$ACME_KEY_CHANGE
"
]
;
then
ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_KEY_CHANGE
export ACME_KEY_CHANGE
ACME_NEW_AUTHZ
=
$(
echo
"
$response
"
| _egrep_o
'new-authz" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
if
[
-z
"
$ACME_NEW_AUTHZ
"
]
;
then
ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_NEW_AUTHZ
export ACME_NEW_AUTHZ
ACME_NEW_ORDER
=
$(
echo
"
$response
"
| _egrep_o
'new-cert" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
ACME_NEW_ORDER_RES
=
"new-cert"
if
[
-z
"
$ACME_NEW_ORDER
"
]
;
then
ACME_NEW_ORDER
=
$(
echo
"
$response
"
| _egrep_o
'new-order" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
ACME_NEW_ORDER_RES
=
"new-order"
if
[
-z
"
$ACME_NEW_ORDER
"
]
;
then
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
fi
fi
export ACME_NEW_ORDER
export ACME_NEW_ORDER
export
ACME_NEW_ORDER_RES
ACME_NEW_ACCOUNT
=
$(
echo
"
$response
"
| _egrep_o
'new-reg" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
ACME_NEW_ACCOUNT_RES
=
"new-reg"
if
[
-z
"
$ACME_NEW_ACCOUNT
"
]
;
then
ACME_NEW_ACCOUNT
=
$(
echo
"
$response
"
| _egrep_o
'new-account" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
ACME_NEW_ACCOUNT_RES
=
"new-account"
if
[
-z
"
$ACME_NEW_ACCOUNT
"
]
;
then
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
if
[
"
$ACME_NEW_ACCOUNT
"
]
;
then
export
ACME_VERSION
=
2
fi
fi
fi
export ACME_NEW_ACCOUNT
export ACME_NEW_ACCOUNT
export
ACME_NEW_ACCOUNT_RES
ACME_REVOKE_CERT
=
$(
echo
"
$response
"
| _egrep_o
'revoke-cert" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
if
[
-z
"
$ACME_REVOKE_CERT
"
]
;
then
ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_REVOKE_CERT
export ACME_REVOKE_CERT
ACME_NEW_NONCE
=
$(
echo
"
$response
"
| _egrep_o
'new-nonce" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
if
[
-z
"
$ACME_NEW_NONCE
"
]
;
then
ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_NEW_NONCE
export ACME_NEW_NONCE
ACME_AGREEMENT
=
$(
echo
"
$response
"
| _egrep_o
'terms-of-service" *: *"[^"]*"'
|
cut
-d
'"'
-f
3
)
if
[
-z
"
$ACME_AGREEMENT
"
]
;
then
ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
fi
export ACME_AGREEMENT
export ACME_AGREEMENT
_debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
_debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
...
@@ -2613,7 +2572,6 @@ _initAPI() {
...
@@ -2613,7 +2572,6 @@ _initAPI() {
_debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
_debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
_debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
_debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
_debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
_debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
_debug
"ACME_VERSION"
"
$ACME_VERSION
"
fi
fi
}
}
...
@@ -3563,7 +3521,7 @@ _regAccount() {
...
@@ -3563,7 +3521,7 @@ _regAccount() {
if [ "$_email" ]; then
if [ "$_email" ]; then
_savecaconf "CA_EMAIL" "$_email"
_savecaconf "CA_EMAIL" "$_email"
fi
fi
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
if [ "$ACME_DIRECTORY" = "$CA_ZEROSSL" ]; then
if [ "$ACME_DIRECTORY" = "$CA_ZEROSSL" ]; then
if [ -z "$_eab_id" ] || [ -z "$_eab_hmac_key" ]; then
if [ -z "$_eab_id" ] || [ -z "$_eab_hmac_key" ]; then
_info "No EAB credentials found for ZeroSSL, let's get one"
_info "No EAB credentials found for ZeroSSL, let's get one"
...
@@ -3619,13 +3577,6 @@ _regAccount() {
...
@@ -3619,13 +3577,6 @@ _regAccount() {
email_sg="\"contact\": [\"mailto:$_email\"], "
email_sg="\"contact\": [\"mailto:$_email\"], "
fi
fi
regjson="{$email_sg\"termsOfServiceAgreed\": true$externalBinding}"
regjson="{$email_sg\"termsOfServiceAgreed\": true$externalBinding}"
else
_reg_res
=
"
$ACME_NEW_ACCOUNT_RES
"
regjson
=
'{"resource": "'
$_reg_res
'", "terms-of-service-agreed": true, "agreement": "'
$ACME_AGREEMENT
'"}'
if
[
"
$_email
"
]
;
then
regjson
=
'{"resource": "'
$_reg_res
'", "contact": ["mailto:'
$_email
'"], "terms-of-service-agreed": true, "agreement": "'
$ACME_AGREEMENT
'"}'
fi
fi
_info "Registering account: $ACME_DIRECTORY"
_info "Registering account: $ACME_DIRECTORY"
...
@@ -3710,20 +3661,13 @@ updateaccount() {
...
@@ -3710,20 +3661,13 @@ updateaccount() {
_initAPI
_initAPI
_email="$(_getAccountEmail)"
_email="$(_getAccountEmail)"
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
if [ "$ACCOUNT_EMAIL" ]; then
if [ "$ACCOUNT_EMAIL" ]; then
updjson='{"contact": ["mailto:'$_email'"]}'
updjson='{"contact": ["mailto:'$_email'"]}'
else
else
updjson='{"contact": []}'
updjson='{"contact": []}'
fi
fi
else
# ACMEv1: Updates happen the same way a registration is done.
# https://tools.ietf.org/html/draft-ietf-acme-acme-01#section-6.3
_regAccount
return
fi
# this part handles ACMEv2 account updates.
_send_signed_request "$_accUri" "$updjson"
_send_signed_request "$_accUri" "$updjson"
if [ "$code" = '200' ]; then
if [ "$code" = '200' ]; then
...
@@ -3768,11 +3712,8 @@ deactivateaccount() {
...
@@ -3768,11 +3712,8 @@ deactivateaccount() {
fi
fi
_initAPI
_initAPI
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_djson="{\"status\":\"deactivated\"}"
_djson="{\"status\":\"deactivated\"}"
else
_djson
=
"{
\"
resource
\"
:
\"
reg
\"
,
\"
status
\"
:
\"
deactivated
\"
}"
fi
if _send_signed_request "$_accUri" "$_djson" && _contains "$response" '"deactivated"'; then
if _send_signed_request "$_accUri" "$_djson" && _contains "$response" '"deactivated"'; then
_info "Deactivate account success for $_accUri."
_info "Deactivate account success for $_accUri."
_accid=$(echo "$response" | _egrep_o "\"id\" *: *[^,]*," | cut -d : -f 2 | tr -d ' ,')
_accid=$(echo "$response" | _egrep_o "\"id\" *: *[^,]*," | cut -d : -f 2 | tr -d ' ,')
...
@@ -3877,11 +3818,9 @@ __trigger_validation() {
...
@@ -3877,11 +3818,9 @@ __trigger_validation() {
_debug2 _t_key_authz "$_t_key_authz"
_debug2 _t_key_authz "$_t_key_authz"
_t_vtype="$3"
_t_vtype="$3"
_debug2 _t_vtype "$_t_vtype"
_debug2 _t_vtype "$_t_vtype"
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_send_signed_request "$_t_url" "{}"
_send_signed_request "$_t_url" "{}"
else
_send_signed_request
"
$_t_url
"
"{
\"
resource
\"
:
\"
challenge
\"
,
\"
type
\"
:
\"
$_t_vtype
\"
,
\"
keyAuthorization
\"
:
\"
$_t_key_authz
\"
}"
fi
}
}
#endpoint domain type
#endpoint domain type
...
@@ -4297,7 +4236,6 @@ issue() {
...
@@ -4297,7 +4236,6 @@ issue() {
sep='#'
sep='#'
dvsep=','
dvsep=','
if [ -z "$vlist" ]; then
if [ -z "$vlist" ]; then
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
#make new order request
#make new order request
_identifiers="{\"type\":\"dns\",\"value\":\"$(_idn "$_main_domain")\"}"
_identifiers="{\"type\":\"dns\",\"value\":\"$(_idn "$_main_domain")\"}"
_w_index=1
_w_index=1
...
@@ -4364,7 +4302,6 @@ issue() {
...
@@ -4364,7 +4302,6 @@ issue() {
$_authorizations_map"
$_authorizations_map"
done
done
_debug2 _authorizations_map "$_authorizations_map"
_debug2 _authorizations_map "$_authorizations_map"
fi
_index=0
_index=0
_currentRoot=""
_currentRoot=""
...
@@ -4395,7 +4332,6 @@ $_authorizations_map"
...
@@ -4395,7 +4332,6 @@ $_authorizations_map"
vtype="$VTYPE_ALPN"
vtype="$VTYPE_ALPN"
fi
fi
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_idn_d="$(_idn "$d")"
_idn_d="$(_idn "$d")"
_candidates="$(echo "$_authorizations_map" | grep -i "^$_idn_d,")"
_candidates="$(echo "$_authorizations_map" | grep -i "^$_idn_d,")"
_debug2 _candidates "$_candidates"
_debug2 _candidates "$_candidates"
...
@@ -4416,13 +4352,6 @@ $_authorizations_map"
...
@@ -4416,13 +4352,6 @@ $_authorizations_map"
_on_issue_err "$_post_hook"
_on_issue_err "$_post_hook"
return 1
return 1
fi
fi
else
if
!
__get_domain_new_authz
"
$d
"
;
then
_clearup
_on_issue_err
"
$_post_hook
"
return
1
fi
fi
if [ -z "$thumbprint" ]; then
if [ -z "$thumbprint" ]; then
thumbprint="$(__calc_account_thumbprint)"
thumbprint="$(__calc_account_thumbprint)"
...
@@ -4462,11 +4391,9 @@ $_authorizations_map"
...
@@ -4462,11 +4391,9 @@ $_authorizations_map"
_on_issue_err "$_post_hook"
_on_issue_err "$_post_hook"
return 1
return 1
fi
fi
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
else
uri
=
"
$(
echo
"
$entry
"
| _egrep_o
'"uri":"[^"]*'
|
cut
-d
'"'
-f
4
)
"
fi
_debug uri "$uri"
_debug uri "$uri"
if [ -z "$uri" ]; then
if [ -z "$uri" ]; then
...
@@ -4764,11 +4691,9 @@ $_authorizations_map"
...
@@ -4764,11 +4691,9 @@ $_authorizations_map"
_debug "sleep 2 secs to verify"
_debug "sleep 2 secs to verify"
sleep 2
sleep 2
_debug "checking"
_debug "checking"
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_send_signed_request "$uri"
_send_signed_request "$uri"
else
response
=
"
$(
_get
"
$uri
"
)
"
fi
if [ "$?" != "0" ]; then
if [ "$?" != "0" ]; then
_err "$d:Verify error:$response"
_err "$d:Verify error:$response"
_clearupwebbroot "$_currentRoot" "$removelevel" "$token"
_clearupwebbroot "$_currentRoot" "$removelevel" "$token"
...
@@ -4833,7 +4758,7 @@ $_authorizations_map"
...
@@ -4833,7 +4758,7 @@ $_authorizations_map"
_info "Verify finished, start to sign."
_info "Verify finished, start to sign."
der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_info "Lets finalize the order."
_info "Lets finalize the order."
_info "Le_OrderFinalize" "$Le_OrderFinalize"
_info "Le_OrderFinalize" "$Le_OrderFinalize"
if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
...
@@ -4956,28 +4881,6 @@ $_authorizations_map"
...
@@ -4956,28 +4881,6 @@ $_authorizations_map"
done
done
fi
fi
fi
fi
else
if
!
_send_signed_request
"
${
ACME_NEW_ORDER
}
"
"{
\"
resource
\"
:
\"
$ACME_NEW_ORDER_RES
\"
,
\"
csr
\"
:
\"
$der
\"
}"
"needbase64"
;
then
_err
"Sign failed.
$response
"
_on_issue_err
"
$_post_hook
"
return
1
fi
_rcert
=
"
$response
"
Le_LinkCert
=
"
$(
grep
-i
'^Location.*$'
"
$HTTP_HEADER
"
| _tail_n 1 |
tr
-d
"
\r\n
"
|
cut
-d
" "
-f
2
)
"
echo
"
$BEGIN_CERT
"
>
"
$CERT_PATH
"
#if ! _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH" ; then
# _debug "Get cert failed. Let's try last response."
# printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >> "$CERT_PATH"
#fi
if
!
printf
--
"%s"
"
$_rcert
"
| _dbase64
"multiline"
| _base64
"multiline"
>>
"
$CERT_PATH
"
;
then
_debug
"Try cert link."
_get
"
$Le_LinkCert
"
| _base64
"multiline"
>>
"
$CERT_PATH
"
fi
echo
"
$END_CERT
"
>>
"
$CERT_PATH
"
fi
_debug "Le_LinkCert" "$Le_LinkCert"
_debug "Le_LinkCert" "$Le_LinkCert"
_savedomainconf "Le_LinkCert" "$Le_LinkCert"
_savedomainconf "Le_LinkCert" "$Le_LinkCert"
...
@@ -5005,53 +4908,6 @@ $_authorizations_map"
...
@@ -5005,53 +4908,6 @@ $_authorizations_map"
fi
fi
fi
fi
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_debug
"v2 chain."
else
cp
"
$CERT_PATH
"
"
$CERT_FULLCHAIN_PATH
"
Le_LinkIssuer
=
$(
grep
-i
'^Link'
"
$HTTP_HEADER
"
| _head_n 1 |
cut
-d
" "
-f
2 |
cut
-d
';'
-f
1 |
tr
-d
'<>'
)
if
[
"
$Le_LinkIssuer
"
]
;
then
if
!
_contains
"
$Le_LinkIssuer
"
":"
;
then
_info
"
$(
__red
"Relative issuer link found."
)
"
Le_LinkIssuer
=
"
$_ACME_SERVER_HOST$Le_LinkIssuer
"
fi
_debug Le_LinkIssuer
"
$Le_LinkIssuer
"
_savedomainconf
"Le_LinkIssuer"
"
$Le_LinkIssuer
"
_link_issuer_retry
=
0
_MAX_ISSUER_RETRY
=
5
while
[
"
$_link_issuer_retry
"
-lt
"
$_MAX_ISSUER_RETRY
"
]
;
do
_debug _link_issuer_retry
"
$_link_issuer_retry
"
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
if
_send_signed_request
"
$Le_LinkIssuer
"
;
then
echo
"
$response
"
>
"
$CA_CERT_PATH
"
break
fi
else
if
_get
"
$Le_LinkIssuer
"
>
"
$CA_CERT_PATH
.der"
;
then
echo
"
$BEGIN_CERT
"
>
"
$CA_CERT_PATH
"
_base64
"multiline"
<
"
$CA_CERT_PATH
.der"
>>
"
$CA_CERT_PATH
"
echo
"
$END_CERT
"
>>
"
$CA_CERT_PATH
"
if
!
_checkcert
"
$CA_CERT_PATH
"
;
then
_err
"Can not get the ca cert."
break
fi
cat
"
$CA_CERT_PATH
"
>>
"
$CERT_FULLCHAIN_PATH
"
rm
-f
"
$CA_CERT_PATH
.der"
break
fi
fi
_link_issuer_retry
=
$(
_math
$_link_issuer_retry
+ 1
)
_sleep
"
$_link_issuer_retry
"
done
if
[
"
$_link_issuer_retry
"
=
"
$_MAX_ISSUER_RETRY
"
]
;
then
_err
"Max retry for issuer ca cert is reached."
fi
else
_debug
"No Le_LinkIssuer header found."
fi
fi
[ -f "$CA_CERT_PATH" ] && _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
[ -f "$CA_CERT_PATH" ] && _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
[ -f "$CERT_FULLCHAIN_PATH" ] && _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
[ -f "$CERT_FULLCHAIN_PATH" ] && _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
...
@@ -5165,15 +5021,6 @@ renew() {
...
@@ -5165,15 +5021,6 @@ renew() {
. "$DOMAIN_CONF"
. "$DOMAIN_CONF"
_debug Le_API "$Le_API"
_debug Le_API "$Le_API"
if
[
"
$Le_API
"
=
"
$LETSENCRYPT_CA_V1
"
]
;
then
_cleardomainconf Le_API
Le_API
=
"
$DEFAULT_CA
"
fi
if
[
"
$Le_API
"
=
"
$LETSENCRYPT_STAGING_CA_V1
"
]
;
then
_cleardomainconf Le_API
Le_API
=
"
$DEFAULT_STAGING_CA
"
fi
if [ "$Le_API" ]; then
if [ "$Le_API" ]; then
export ACME_DIRECTORY="$Le_API"
export ACME_DIRECTORY="$Le_API"
#reload ca configs
#reload ca configs
...
@@ -5388,9 +5235,6 @@ signcsr() {
...
@@ -5388,9 +5235,6 @@ signcsr() {
return 1
return 1
fi
fi
if
[
-z
"
$ACME_VERSION
"
]
&&
_contains
"
$_csrsubj
,
$_csrdomainlist
"
"*."
;
then
export
ACME_VERSION
=
2
fi
_initpath "$_csrsubj" "$_csrkeylength"
_initpath "$_csrsubj" "$_csrkeylength"
mkdir -p "$DOMAIN_PATH"
mkdir -p "$DOMAIN_PATH"
...
@@ -5851,11 +5695,8 @@ revoke() {
...
@@ -5851,11 +5695,8 @@ revoke() {
_initAPI
_initAPI
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
data="{\"certificate\": \"$cert\",\"reason\":$_reason}"
data="{\"certificate\": \"$cert\",\"reason\":$_reason}"
else
data
=
"{
\"
resource
\"
:
\"
revoke-cert
\"
,
\"
certificate
\"
:
\"
$cert
\"
}"
fi
uri="${ACME_REVOKE_CERT}"
uri="${ACME_REVOKE_CERT}"
if [ -f "$CERT_KEY_PATH" ]; then
if [ -f "$CERT_KEY_PATH" ]; then
...
@@ -5926,7 +5767,6 @@ _deactivate() {
...
@@ -5926,7 +5767,6 @@ _deactivate() {
_d_type="$2"
_d_type="$2"
_initpath
_initpath
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_identifiers="{\"type\":\"dns\",\"value\":\"$_d_domain\"}"
_identifiers="{\"type\":\"dns\",\"value\":\"$_d_domain\"}"
if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
_err "Can not get domain new order."
_err "Can not get domain new order."
...
@@ -5955,20 +5795,6 @@ _deactivate() {
...
@@ -5955,20 +5795,6 @@ _deactivate() {
response="$(echo "$response" | _normalizeJson)"
response="$(echo "$response" | _normalizeJson)"
_debug2 response "$response"
_debug2 response "$response"
_URL_NAME="url"
_URL_NAME="url"
else
if
!
__get_domain_new_authz
"
$_d_domain
"
;
then
_err
"Can not get domain new authz token."
return
1
fi
authzUri
=
"
$(
echo
"
$responseHeaders
"
|
grep
"^Location:"
| _head_n 1 |
cut
-d
':'
-f
2- |
tr
-d
"
\r\n
"
)
"
_debug
"authzUri"
"
$authzUri
"
if
[
"
$code
"
]
&&
[
!
"
$code
"
=
'201'
]
;
then
_err
"new-authz error:
$response
"
return
1
fi
_URL_NAME
=
"uri"
fi
entries="$(echo "$response" | tr '][' '==' | _egrep_o "challenges\": *=[^=]*=" | tr '}{' '\n' | grep "\"status\": *\"valid\"")"
entries="$(echo "$response" | tr '][' '==' | _egrep_o "challenges\": *=[^=]*=" | tr '}{' '\n' | grep "\"status\": *\"valid\"")"
if [ -z "$entries" ]; then
if [ -z "$entries" ]; then
...
@@ -6023,11 +5849,7 @@ _deactivate() {
...
@@ -6023,11 +5849,7 @@ _deactivate() {
_info "Deactivate: $_vtype"
_info "Deactivate: $_vtype"
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_djson="{\"status\":\"deactivated\"}"
_djson="{\"status\":\"deactivated\"}"
else
_djson
=
"{
\"
resource
\"
:
\"
authz
\"
,
\"
status
\"
:
\"
deactivated
\"
}"
fi
if _send_signed_request "$authzUri" "$_djson" && _contains "$response" '"deactivated"'; then
if _send_signed_request "$authzUri" "$_djson" && _contains "$response" '"deactivated"'; then
_info "Deactivate: $_vtype success."
_info "Deactivate: $_vtype success."
...
@@ -7033,10 +6855,6 @@ _process() {
...
@@ -7033,10 +6855,6 @@ _process() {
return 1
return 1
fi
fi
if
_startswith
"
$_dvalue
"
"*."
;
then
_debug
"Wildcard domain"
export
ACME_VERSION
=
2
fi
if [ -z "$_domain" ]; then
if [ -z "$_domain" ]; then
_domain="$_dvalue"
_domain="$_dvalue"
else
else
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment