Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
d2cde379
Commit
d2cde379
authored
Jan 06, 2018
by
neilpang
Browse files
fix ACME v2: deactivate/deactivate-account/revoke
parent
506c41cb
Changes
1
Hide whitespace changes
Inline
Side-by-side
acme.sh
View file @
d2cde379
...
...
@@ -1784,7 +1784,7 @@ _send_signed_request() {
_debug2 nonce
"
$nonce
"
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
if
[
"
$url
"
=
"
$ACME_NEW_ACCOUNT
"
]
;
then
if
[
"
$url
"
=
"
$ACME_NEW_ACCOUNT
"
]
||
[
"
$url
"
=
"
$ACME_REVOKE_CERT
"
]
;
then
protected
=
"
$JWK_HEADERPLACE_PART1$nonce
\"
,
\"
url
\"
:
\"
${
url
}
$JWK_HEADERPLACE_PART2
,
\"
jwk
\"
:
$jwk
"
'}'
else
protected
=
"
$JWK_HEADERPLACE_PART1$nonce
\"
,
\"
url
\"
:
\"
${
url
}
$JWK_HEADERPLACE_PART2
,
\"
kid
\"
:
\"
$ACCOUNT_URL
\"
"
'}'
...
...
@@ -3005,7 +3005,7 @@ _on_issue_err() {
_chk_post_hook
=
"
$1
"
_chk_vlist
=
"
$2
"
_debug _on_issue_err
_cleardomainconf
"
ORDER_FINALIZE
"
_cleardomainconf
"
Le_OrderFinalize
"
if
[
"
$LOG_FILE
"
]
;
then
_err
"Please check log file for more details:
$LOG_FILE
"
else
...
...
@@ -3212,7 +3212,12 @@ deactivateaccount() {
fi
_initAPI
if
_send_signed_request
"
$_accUri
"
"{
\"
resource
\"
:
\"
reg
\"
,
\"
status
\"
:
\"
deactivated
\"
}"
&&
_contains
"
$response
"
'"deactivated"'
;
then
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_djson
=
"{
\"
status
\"
:
\"
deactivated
\"
}"
else
_djson
=
"{
\"
resource
\"
:
\"
reg
\"
,
\"
status
\"
:
\"
deactivated
\"
}"
fi
if
_send_signed_request
"
$_accUri
"
"
$_djson
"
&&
_contains
"
$response
"
'"deactivated"'
;
then
_info
"Deactivate account success for
$_accUri
."
_accid
=
$(
echo
"
$response
"
| _egrep_o
"
\"
id
\"
*: *[^,]*,"
|
cut
-d
:
-f
2 |
tr
-d
' ,'
)
elif
[
"
$code
"
=
"403"
]
;
then
...
...
@@ -3334,6 +3339,11 @@ issue() {
_web_roots
=
"
$1
"
_main_domain
=
"
$2
"
_alt_domains
=
"
$3
"
if
_startswith
"
$_main_domain
"
"*."
;
then
_err
"The first domain can not be wildcard, '
$_main_domain
' is a wildcard domain."
return
1
fi
if
_contains
"
$_main_domain
"
","
;
then
_main_domain
=
$(
echo
"
$2
,
$3
"
|
cut
-d
,
-f
1
)
_alt_domains
=
$(
echo
"
$2
,
$3
"
|
cut
-d
,
-f
2- |
sed
"s/,
${
NO_VALUE
}
$/
/"
)
...
...
@@ -3460,7 +3470,7 @@ issue() {
sep
=
'#'
dvsep
=
','
if
[
-z
"
$vlist
"
]
;
then
if
[
"
$ACME_VERSION
"
=
"2"
]
&&
[
-z
"
$ORDER_FINALIZE
"
]
;
then
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
#make new order request
_identifiers
=
"{
\"
type
\"
:
\"
dns
\"
,
\"
value
\"
:
\"
$_main_domain
\"
}"
for
d
in
$(
echo
"
$_alt_domains
"
|
tr
','
' '
)
;
do
...
...
@@ -3477,17 +3487,17 @@ issue() {
return
1
fi
ORDER_FINALIZE
=
"
$(
echo
"
$response
"
|
tr
-d
'\r\n'
| _egrep_o
'"finalize" *: *"[^"]*"'
|
cut
-d
'"'
-f
4
)
"
_debug
ORDER_FINALIZE
"
$ORDER_FINALIZE
"
if
[
-z
"
$
ORDER_FINALIZE
"
]
;
then
_err
"
ORDER_FINALIZE
not found."
Le_OrderFinalize
=
"
$(
echo
"
$response
"
|
tr
-d
'\r\n'
| _egrep_o
'"finalize" *: *"[^"]*"'
|
cut
-d
'"'
-f
4
)
"
_debug
Le_OrderFinalize
"
$Le_OrderFinalize
"
if
[
-z
"
$
Le_OrderFinalize
"
]
;
then
_err
"
Le_OrderFinalize
not found."
_clearup
_on_issue_err
"
$_post_hook
"
return
1
fi
#for dns manual mode
_savedomainconf
"
ORDER_FINALIZE"
"
$ORDER_FINALIZE
"
_savedomainconf
"
Le_OrderFinalize"
"
$Le_OrderFinalize
"
_authorizations_seg
=
"
$(
echo
"
$response
"
|
tr
-d
'\r\n'
| _egrep_o
'"authorizations" *: *\[[^\]*\]'
|
cut
-d
'['
-f
2 |
tr
-d
']'
|
tr
-d
'"'
)
"
_debug2 _authorizations_seg
"
$_authorizations_seg
"
...
...
@@ -3931,7 +3941,7 @@ $_authorizations_map"
der
=
"
$(
_getfile
"
${
CSR_PATH
}
"
"
${
BEGIN_CSR
}
"
"
${
END_CSR
}
"
|
tr
-d
"
\r\n
"
| _url_replace
)
"
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
if
!
_send_signed_request
"
${
ORDER_FINALIZE
}
"
"{
\"
csr
\"
:
\"
$der
\"
}"
;
then
if
!
_send_signed_request
"
${
Le_OrderFinalize
}
"
"{
\"
csr
\"
:
\"
$der
\"
}"
;
then
_err
"Sign failed."
_on_issue_err
"
$_post_hook
"
return
1
...
...
@@ -4632,7 +4642,11 @@ revoke() {
_initAPI
data
=
"{
\"
resource
\"
:
\"
revoke-cert
\"
,
\"
certificate
\"
:
\"
$cert
\"
}"
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
data
=
"{
\"
certificate
\"
:
\"
$cert
\"
}"
else
data
=
"{
\"
resource
\"
:
\"
revoke-cert
\"
,
\"
certificate
\"
:
\"
$cert
\"
}"
fi
uri
=
"
${
ACME_REVOKE_CERT
}
"
if
[
-f
"
$CERT_KEY_PATH
"
]
;
then
...
...
@@ -4703,27 +4717,56 @@ _deactivate() {
_d_type
=
"
$2
"
_initpath
if
!
__get_domain_new_authz
"
$_d_domain
"
;
then
_err
"Can not get domain new authz token."
return
1
fi
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_identifiers
=
"{
\"
type
\"
:
\"
dns
\"
,
\"
value
\"
:
\"
$_d_domain
\"
}"
if
!
_send_signed_request
"
$ACME_NEW_ORDER
"
"{
\"
identifiers
\"
: [
$_identifiers
]}"
;
then
_err
"Can not get domain new order."
return
1
fi
_authorizations_seg
=
"
$(
echo
"
$response
"
|
tr
-d
'\r\n'
| _egrep_o
'"authorizations" *: *\[[^\]*\]'
|
cut
-d
'['
-f
2 |
tr
-d
']'
|
tr
-d
'"'
)
"
_debug2 _authorizations_seg
"
$_authorizations_seg
"
if
[
-z
"
$_authorizations_seg
"
]
;
then
_err
"_authorizations_seg not found."
_clearup
_on_issue_err
"
$_post_hook
"
return
1
fi
authzUri
=
"
$(
echo
"
$responseHeaders
"
|
grep
"^Location:"
| _head_n 1 |
cut
-d
' '
-f
2 |
tr
-d
"
\r\n
"
)
"
_debug
"authzUri"
"
$authzUri
"
authzUri
=
"
$_authorizations_seg
"
_debug2
"authzUri"
"
$authzUri
"
if
!
response
=
"
$(
_get
"
$authzUri
"
)
"
;
then
_err
"get to authz error."
_clearup
_on_issue_err
"
$_post_hook
"
return
1
fi
if
[
"
$code
"
]
&&
[
!
"
$code
"
=
'201'
]
;
then
_err
"new-authz error:
$response
"
return
1
response
=
"
$(
echo
"
$response
"
| _normalizeJson
)
"
_debug2 response
"
$response
"
_URL_NAME
=
"url"
else
if
!
__get_domain_new_authz
"
$_d_domain
"
;
then
_err
"Can not get domain new authz token."
return
1
fi
authzUri
=
"
$(
echo
"
$responseHeaders
"
|
grep
"^Location:"
| _head_n 1 |
cut
-d
' '
-f
2 |
tr
-d
"
\r\n
"
)
"
_debug
"authzUri"
"
$authzUri
"
if
[
"
$code
"
]
&&
[
!
"
$code
"
=
'201'
]
;
then
_err
"new-authz error:
$response
"
return
1
fi
_URL_NAME
=
"uri"
fi
entries
=
"
$(
echo
"
$response
"
| _egrep_o
'
{ *"type":"[^"]*", *"status": *"valid", *
"uri
"[^}]*
'
)
"
entries
=
"
$(
echo
"
$response
"
| _egrep_o
"
{ *
\
"
type
\
"
:
\
"
[^
\
"
]*
\
"
, *
\
"
status
\
"
: *
\
"
valid
\
"
, *
\"
$_URL_NAME
\
"
[^}]*
"
)
"
if
[
-z
"
$entries
"
]
;
then
_info
"No valid entries found."
if
[
-z
"
$thumbprint
"
]
;
then
thumbprint
=
"
$(
__calc_account_thumbprint
)
"
fi
_debug
"Trigger validation."
vtype
=
"
$VTYPE_
HTTP
"
vtype
=
"
$VTYPE_
DNS
"
entry
=
"
$(
printf
"%s
\n
"
"
$response
"
| _egrep_o
'[^\{]*"type":"'
$vtype
'"[^\}]*'
)
"
_debug entry
"
$entry
"
if
[
-z
"
$entry
"
]
;
then
...
...
@@ -4733,7 +4776,7 @@ _deactivate() {
token
=
"
$(
printf
"%s
\n
"
"
$entry
"
| _egrep_o
'"token":"[^"]*'
|
cut
-d
:
-f
2 |
tr
-d
'"'
)
"
_debug token
"
$token
"
uri
=
"
$(
printf
"%s
\n
"
"
$entry
"
| _egrep_o
'"uri
":"[^"]*
'
|
cut
-d
:
-f
2,3 |
tr
-d
'"'
)
"
uri
=
"
$(
printf
"%s
\n
"
"
$entry
"
| _egrep_o
"
\"
$_URL_NAME
\
"
:
\
"
[^
\
"
]*
"
|
cut
-d
:
-f
2,3 |
tr
-d
'"'
)
"
_debug uri
"
$uri
"
keyauthorization
=
"
$token
.
$thumbprint
"
...
...
@@ -4759,7 +4802,7 @@ _deactivate() {
_debug _vtype
"
$_vtype
"
_info
"Found
$_vtype
"
uri
=
"
$(
printf
"%s
\n
"
"
$entry
"
| _egrep_o
'"uri
":"[^"]*
'
|
cut
-d
:
-f
2,3 |
tr
-d
'"'
)
"
uri
=
"
$(
printf
"%s
\n
"
"
$entry
"
| _egrep_o
"
\"
$_URL_NAME
\
"
:
\
"
[^
\
"
]*
"
|
cut
-d
:
-f
2,3 |
tr
-d
'"'
)
"
_debug uri
"
$uri
"
if
[
"
$_d_type
"
]
&&
[
"
$_d_type
"
!=
"
$_vtype
"
]
;
then
...
...
@@ -4769,7 +4812,13 @@ _deactivate() {
_info
"Deactivate:
$_vtype
"
if
_send_signed_request
"
$authzUri
"
"{
\"
resource
\"
:
\"
authz
\"
,
\"
status
\"
:
\"
deactivated
\"
}"
&&
_contains
"
$response
"
'"deactivated"'
;
then
if
[
"
$ACME_VERSION
"
=
"2"
]
;
then
_djson
=
"{
\"
status
\"
:
\"
deactivated
\"
}"
else
_djson
=
"{
\"
resource
\"
:
\"
authz
\"
,
\"
status
\"
:
\"
deactivated
\"
}"
fi
if
_send_signed_request
"
$authzUri
"
"
$_djson
"
&&
_contains
"
$response
"
'"deactivated"'
;
then
_info
"Deactivate:
$_vtype
success."
else
_err
"Can not deactivate
$_vtype
."
...
...
@@ -5492,10 +5541,6 @@ _process() {
fi
if
[
-z
"
$_domain
"
]
;
then
if
_startswith
"
$_dvalue
"
"*."
;
then
_err
"The first domain can not be wildcard, '
$_dvalue
' is a wildcard domain."
return
1
fi
_domain
=
"
$_dvalue
"
else
if
_startswith
"
$_dvalue
"
"*."
;
then
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment