Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
d5d38b33
Commit
d5d38b33
authored
Aug 17, 2020
by
neil
Browse files
support multiple intermediate CA matching for `--preferred-chain`
parent
bd04638d
Changes
1
Hide whitespace changes
Inline
Side-by-side
acme.sh
View file @
d5d38b33
...
@@ -3990,17 +3990,22 @@ _check_dns_entries() {
...
@@ -3990,17 +3990,22 @@ _check_dns_entries() {
}
}
#file
#file
_get_cert_issuer
()
{
_get_cert_issuer
s
()
{
_cfile
=
"
$1
"
_cfile
=
"
$1
"
echo
$(
openssl x509
-in
$_cfile
-text
-noout
|
grep
'Issuer:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2
)
if
_contains
"
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
help
crl2pkcs7 2>&1
)
"
"Usage: crl2pkcs7"
;
then
${
ACME_OPENSSL_BIN
:-
openssl
}
crl2pkcs7
-nocrl
-certfile
$_cfile
| openssl pkcs7
-print_certs
-text
-noout
|
grep
'Issuer:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2
else
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-in
$_cfile
-text
-noout
|
grep
'Issuer:'
| _egrep_o
"CN *=[^,]*"
|
cut
-d
=
-f
2
fi
}
}
#cert issuer
#cert issuer
_match_issuer
()
{
_match_issuer
()
{
_cfile
=
"
$1
"
_cfile
=
"
$1
"
_missuer
=
"
$2
"
_missuer
=
"
$2
"
_fissuer
=
$(
_get_cert_issuer
$_cfile
)
_fissuers
=
"
$(
_get_cert_issuers
$_cfile
)
"
[
"
$_missuer
"
=
"
$_fissuer
"
]
_debug2 _fissuers
"
$_fissuers
"
_contains
"
$_fissuers
"
"
$_missuer
"
}
}
#webroot, domain domainlist keylength
#webroot, domain domainlist keylength
...
@@ -4773,10 +4778,8 @@ $_authorizations_map"
...
@@ -4773,10 +4778,8 @@ $_authorizations_map"
echo
"
$response
"
>
"
$CERT_PATH
"
echo
"
$response
"
>
"
$CERT_PATH
"
_split_cert_chain
"
$CERT_PATH
"
"
$CERT_FULLCHAIN_PATH
"
"
$CA_CERT_PATH
"
_split_cert_chain
"
$CERT_PATH
"
"
$CERT_FULLCHAIN_PATH
"
"
$CA_CERT_PATH
"
if
[
"
$_preferred_chain
"
]
;
then
if
[
"
$_preferred_chain
"
]
&&
[
-f
"
$CERT_FULLCHAIN_PATH
"
]
;
then
_cert_issuer
=
$(
_get_cert_issuer
"
$CA_CERT_PATH
"
)
if
!
_match_issuer
"
$CERT_FULLCHAIN_PATH
"
"
$_preferred_chain
"
;
then
_debug _cert_issuer
"
$_cert_issuer
"
if
!
_match_issuer
"
$CA_CERT_PATH
"
"
$_preferred_chain
"
;
then
rels
=
"
$(
echo
"
$responseHeaders
"
|
tr
-d
' <>'
|
grep
-i
"^link:"
|
grep
-i
'rel="alternate"'
|
cut
-d
:
-f
2- |
cut
-d
';'
-f
1
)
"
rels
=
"
$(
echo
"
$responseHeaders
"
|
tr
-d
' <>'
|
grep
-i
"^link:"
|
grep
-i
'rel="alternate"'
|
cut
-d
:
-f
2- |
cut
-d
';'
-f
1
)
"
_debug2
"rels"
"
$rels
"
_debug2
"rels"
"
$rels
"
for
rel
in
$rels
;
do
for
rel
in
$rels
;
do
...
@@ -4791,7 +4794,7 @@ $_authorizations_map"
...
@@ -4791,7 +4794,7 @@ $_authorizations_map"
_relca
=
"
$CA_CERT_PATH
.alt"
_relca
=
"
$CA_CERT_PATH
.alt"
echo
"
$response
"
>
"
$_relcert
"
echo
"
$response
"
>
"
$_relcert
"
_split_cert_chain
"
$_relcert
"
"
$_relfullchain
"
"
$_relca
"
_split_cert_chain
"
$_relcert
"
"
$_relfullchain
"
"
$_relca
"
if
_match_issuer
"
$_rel
ca
"
"
$_preferred_chain
"
;
then
if
_match_issuer
"
$_rel
fullchain
"
"
$_preferred_chain
"
;
then
_info
"Matched issuer in:
$rel
"
_info
"Matched issuer in:
$rel
"
cat
$_relcert
>
"
$CERT_PATH
"
cat
$_relcert
>
"
$CERT_PATH
"
cat
$_relfullchain
>
"
$CERT_FULLCHAIN_PATH
"
cat
$_relfullchain
>
"
$CERT_FULLCHAIN_PATH
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment