Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
c7068171
Unverified
Commit
c7068171
authored
Feb 22, 2020
by
neil
Committed by
GitHub
Feb 22, 2020
Browse files
Merge pull request #2746 from acmesh-official/dev
sync
parents
c7685818
80ca6de5
Changes
4
Hide whitespace changes
Inline
Side-by-side
README.md
View file @
c7068171
...
@@ -257,7 +257,7 @@ acme.sh --issue --apache -d example.com -d www.example.com -d cp.example.com
...
@@ -257,7 +257,7 @@ acme.sh --issue --apache -d example.com -d www.example.com -d cp.example.com
**
This apache mode is only to issue the cert, it will not change your apache config files.
**
This apache mode is only to issue the cert, it will not change your apache config files.
You will need to configure your website config files to use the cert by yourself.
You will need to configure your website config files to use the cert by yourself.
We don't want to mess your apache server, don't worry.
**
We don't want to mess
with
your apache server, don't worry.
**
More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
...
@@ -281,7 +281,7 @@ acme.sh --issue --nginx -d example.com -d www.example.com -d cp.example.com
...
@@ -281,7 +281,7 @@ acme.sh --issue --nginx -d example.com -d www.example.com -d cp.example.com
**
This nginx mode is only to issue the cert, it will not change your nginx config files.
**
This nginx mode is only to issue the cert, it will not change your nginx config files.
You will need to configure your website config files to use the cert by yourself.
You will need to configure your website config files to use the cert by yourself.
We don't want to mess your nginx server, don't worry.
**
We don't want to mess
with
your nginx server, don't worry.
**
More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
...
...
acme.sh
View file @
c7068171
...
@@ -207,7 +207,7 @@ _dlg_versions() {
...
@@ -207,7 +207,7 @@ _dlg_versions() {
echo "socat:"
echo "socat:"
if _exists "socat"; then
if _exists "socat"; then
socat
-
h
2>&1
socat -
V
2>&1
else
else
_debug "socat doesn't exists."
_debug "socat doesn't exists."
fi
fi
...
...
deploy/haproxy.sh
View file @
c7068171
...
@@ -208,33 +208,37 @@ haproxy_deploy() {
...
@@ -208,33 +208,37 @@ haproxy_deploy() {
_issuerdn
=
$(
openssl x509
-in
"
${
_issuer
}
"
-issuer
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_issuerdn
=
$(
openssl x509
-in
"
${
_issuer
}
"
-issuer
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_debug _issuerdn
"
${
_issuerdn
}
"
_debug _issuerdn
"
${
_issuerdn
}
"
_info
"Requesting OCSP response"
_info
"Requesting OCSP response"
#
Request the OCSP response from the issuer and store it
#
If the issuer is a CA cert then our command line has "-CAfile" added
if
[
"
${
_subjectdn
}
"
=
"
${
_issuerdn
}
"
]
;
then
if
[
"
${
_subjectdn
}
"
=
"
${
_issuerdn
}
"
]
;
then
# If the issuer is a CA cert then our command line has "-CAfile" added
_cafile_argument
=
"-CAfile
\"
${
_issuer
}
\"
"
openssl ocsp
\
else
-issuer
"
${
_issuer
}
"
\
_cafile_argument
=
""
-cert
"
${
_pem
}
"
\
fi
-url
"
${
_ocsp_url
}
"
\
_debug _cafile_argument
"
${
_cafile_argument
}
"
-header
Host
"
${
_ocsp_host
}
"
\
# if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
-respout
"
${
_ocsp
}
"
\
_openssl_version
=
$(
openssl version |
cut
-d
' '
-f2
)
-verify_other
"
${
_issuer
}
"
\
_debug _openssl_version
"
${
_openssl_version
}
"
-no_nonce
\
_openssl_major
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f1
)
-CAfile
"
${
_issuer
}
"
\
_openssl_minor
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f2
)
|
grep
-q
"
${
_pe
m
}
: good"
if
[
"
${
_openssl_major
}
"
-eq
"1"
]
&&
[
"
${
_openssl_minor
}
"
-ge
"1"
]
||
[
"
${
_
o
pe
nssl_major
}
"
-ge
"2"
]
;
then
_
ret
=
$?
_
header_sep
=
"="
else
else
# Issuer is not a root CA so no "-CAfile" option
_header_sep
=
" "
openssl ocsp
\
-issuer
"
${
_issuer
}
"
\
-cert
"
${
_pem
}
"
\
-url
"
${
_ocsp_url
}
"
\
-header
Host
"
${
_ocsp_host
}
"
\
-respout
"
${
_ocsp
}
"
\
-verify_other
"
${
_issuer
}
"
\
-no_nonce
\
|
grep
-q
"
${
_pem
}
: good"
_ret
=
$?
fi
fi
# Request the OCSP response from the issuer and store it
_openssl_ocsp_cmd
=
"openssl ocsp
\
-issuer
\"
${
_issuer
}
\"
\
-cert
\"
${
_pem
}
\"
\
-url
\"
${
_ocsp_url
}
\"
\
-header Host
${
_header_sep
}
\"
${
_ocsp_host
}
\"
\
-respout
\"
${
_ocsp
}
\"
\
-verify_other
\"
${
_issuer
}
\"
\
-no_nonce
\
${
_cafile_argument
}
\
| grep -q
\"
${
_pem
}
: good
\"
"
_debug _openssl_ocsp_cmd
"
${
_openssl_ocsp_cmd
}
"
eval
"
${
_openssl_ocsp_cmd
}
"
_ret
=
$?
else
else
# Non fatal: No issuer file was present so no OCSP stapling file created
# Non fatal: No issuer file was present so no OCSP stapling file created
_err
"OCSP stapling in use but no .issuer file was present"
_err
"OCSP stapling in use but no .issuer file was present"
...
...
dnsapi/dns_cf.sh
View file @
c7068171
...
@@ -7,6 +7,7 @@
...
@@ -7,6 +7,7 @@
#CF_Token="xxxx"
#CF_Token="xxxx"
#CF_Account_ID="xxxx"
#CF_Account_ID="xxxx"
#CF_Zone_ID="xxxx"
CF_Api
=
"https://api.cloudflare.com/client/v4"
CF_Api
=
"https://api.cloudflare.com/client/v4"
...
@@ -19,12 +20,14 @@ dns_cf_add() {
...
@@ -19,12 +20,14 @@ dns_cf_add() {
CF_Token
=
"
${
CF_Token
:-
$(
_readaccountconf_mutable CF_Token
)
}
"
CF_Token
=
"
${
CF_Token
:-
$(
_readaccountconf_mutable CF_Token
)
}
"
CF_Account_ID
=
"
${
CF_Account_ID
:-
$(
_readaccountconf_mutable CF_Account_ID
)
}
"
CF_Account_ID
=
"
${
CF_Account_ID
:-
$(
_readaccountconf_mutable CF_Account_ID
)
}
"
CF_Zone_ID
=
"
${
CF_Zone_ID
:-
$(
_readaccountconf_mutable CF_Zone_ID
)
}
"
CF_Key
=
"
${
CF_Key
:-
$(
_readaccountconf_mutable CF_Key
)
}
"
CF_Key
=
"
${
CF_Key
:-
$(
_readaccountconf_mutable CF_Key
)
}
"
CF_Email
=
"
${
CF_Email
:-
$(
_readaccountconf_mutable CF_Email
)
}
"
CF_Email
=
"
${
CF_Email
:-
$(
_readaccountconf_mutable CF_Email
)
}
"
if
[
"
$CF_Token
"
]
;
then
if
[
"
$CF_Token
"
]
;
then
_saveaccountconf_mutable CF_Token
"
$CF_Token
"
_saveaccountconf_mutable CF_Token
"
$CF_Token
"
_saveaccountconf_mutable CF_Account_ID
"
$CF_Account_ID
"
_saveaccountconf_mutable CF_Account_ID
"
$CF_Account_ID
"
_saveaccountconf_mutable CF_Zone_ID
"
$CF_Zone_ID
"
else
else
if
[
-z
"
$CF_Key
"
]
||
[
-z
"
$CF_Email
"
]
;
then
if
[
-z
"
$CF_Key
"
]
||
[
-z
"
$CF_Email
"
]
;
then
CF_Key
=
""
CF_Key
=
""
...
@@ -141,6 +144,28 @@ _get_root() {
...
@@ -141,6 +144,28 @@ _get_root() {
domain
=
$1
domain
=
$1
i
=
1
i
=
1
p
=
1
p
=
1
# Use Zone ID directly if provided
if
[
"
$CF_Zone_ID
"
]
;
then
if
!
_cf_rest GET
"zones/
$CF_Zone_ID
"
;
then
return
1
else
if
_contains
"
$response
"
'"success":true'
;
then
_domain
=
$(
printf
"%s
\n
"
"
$response
"
| _egrep_o
"
\"
name
\"
:
\"
[^
\"
]*
\"
"
|
cut
-d
:
-f
2 |
tr
-d
\"
|
head
-n
1
)
if
[
"
$_domain
"
]
;
then
_cutlength
=
$((${#
domain
}
-
${#
_domain
}
-
1
))
_sub_domain
=
$(
printf
"%s"
"
$domain
"
|
cut
-c
"1-
$_cutlength
"
)
_domain_id
=
$CF_Zone_ID
return
0
else
return
1
fi
else
return
1
fi
fi
fi
while
true
;
do
while
true
;
do
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
h
=
$(
printf
"%s"
"
$domain
"
|
cut
-d
.
-f
$i
-100
)
_debug h
"
$h
"
_debug h
"
$h
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment