Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
dcbbee8a
Unverified
Commit
dcbbee8a
authored
Apr 03, 2022
by
neil
Committed by
GitHub
Apr 03, 2022
Browse files
Merge pull request #4012 from acmesh-official/dev
Support "NotBefore" and NotAfter
parents
61454658
225adcc8
Changes
2
Show whitespace changes
Inline
Side-by-side
README.md
View file @
dcbbee8a
...
@@ -95,6 +95,7 @@ https://github.com/acmesh-official/acmetest
...
@@ -95,6 +95,7 @@ https://github.com/acmesh-official/acmetest
-
Letsencrypt.org CA
-
Letsencrypt.org CA
-
[
BuyPass.com CA
](
https://github.com/acmesh-official/acme.sh/wiki/BuyPass.com-CA
)
-
[
BuyPass.com CA
](
https://github.com/acmesh-official/acme.sh/wiki/BuyPass.com-CA
)
-
[
SSL.com CA
](
https://github.com/acmesh-official/acme.sh/wiki/SSL.com-CA
)
-
[
SSL.com CA
](
https://github.com/acmesh-official/acme.sh/wiki/SSL.com-CA
)
-
[
Google.com Public CA
](
https://github.com/acmesh-official/acme.sh/wiki/Google-Public-CA
)
-
[
Pebble strict Mode
](
https://github.com/letsencrypt/pebble
)
-
[
Pebble strict Mode
](
https://github.com/letsencrypt/pebble
)
-
Any other
[
RFC8555
](
https://tools.ietf.org/html/rfc8555
)
-compliant CA
-
Any other
[
RFC8555
](
https://tools.ietf.org/html/rfc8555
)
-compliant CA
...
...
acme.sh
View file @
dcbbee8a
...
@@ -177,6 +177,8 @@ _SERVER_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Server"
...
@@ -177,6 +177,8 @@ _SERVER_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Server"
_PREFERRED_CHAIN_WIKI
=
"https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain"
_PREFERRED_CHAIN_WIKI
=
"https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain"
_VALIDITY_WIKI
=
"https://github.com/acmesh-official/acme.sh/wiki/Validity"
_DNSCHECK_WIKI
=
"https://github.com/acmesh-official/acme.sh/wiki/dnscheck"
_DNSCHECK_WIKI
=
"https://github.com/acmesh-official/acme.sh/wiki/dnscheck"
_DNS_MANUAL_ERR
=
"The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
_DNS_MANUAL_ERR
=
"The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
...
@@ -1603,23 +1605,22 @@ _durl_replace_base64() {
...
@@ -1603,23 +1605,22 @@ _durl_replace_base64() {
_time2str
()
{
_time2str
()
{
#BSD
#BSD
if
date
-u
-r
"
$1
"
2>/dev/null
;
then
if
date
-u
-r
"
$1
"
-j
"+%Y-%m-%dT%H:%M:%SZ"
2>/dev/null
;
then
return
return
fi
fi
#Linux
#Linux
if
date
-u
-
d
@
"
$1
"
2>/dev/null
;
then
if
date
-u
-
-date
=
@
"
$1
"
"+%Y-%m-%dT%H:%M:%SZ
"
2>/dev/null
;
then
return
return
fi
fi
#Solaris
#Solaris
if
_exists adb
;
then
if
printf
"%(%Y-%m-%dT%H:%M:%SZ)T
\n
"
$1
2>/dev/null
;
then
_t_s_a
=
$(
echo
"0t
${
1
}
=Y"
| adb
)
return
echo
"
$_t_s_a
"
fi
fi
#Busybox
#Busybox
if
echo
"
$1
"
|
awk
'{ print strftime("%
c
", $0); }'
2>/dev/null
;
then
if
echo
"
$1
"
|
awk
'{ print strftime("%
Y-%m-%dT%H:%M:%SZ
", $0); }'
2>/dev/null
;
then
return
return
fi
fi
}
}
...
@@ -1778,6 +1779,27 @@ _time() {
...
@@ -1778,6 +1779,27 @@ _time() {
date
-u
"+%s"
date
-u
"+%s"
}
}
#support 2 formats:
# 2022-04-01 08:10:33 to 1648800633
#or 2022-04-01T08:10:33Z to 1648800633
_date2time
()
{
#Linux
if
date
-u
-d
"
$(
echo
"
$1
"
|
tr
-d
"Z"
|
tr
"T"
' '
)
"
+
"%s"
2>/dev/null
;
then
return
fi
#Solaris
if
gdate
-u
-d
"
$(
echo
"
$1
"
|
tr
-d
"Z"
|
tr
"T"
' '
)
"
+
"%s"
2>/dev/null
;
then
return
fi
#Mac/BSD
if
date
-u
-j
-f
"%Y-%m-%d %H:%M:%S"
"
$(
echo
"
$1
"
|
tr
-d
"Z"
|
tr
"T"
' '
)
"
+
"%s"
2>/dev/null
;
then
return
fi
_err
"Can not parse _date2time
$1
"
return
1
}
_utc_date
()
{
_utc_date
()
{
date
-u
"+%Y-%m-%d %H:%M:%S"
date
-u
"+%Y-%m-%d %H:%M:%S"
}
}
...
@@ -3758,7 +3780,7 @@ updateaccount() {
...
@@ -3758,7 +3780,7 @@ updateaccount() {
_email
=
"
$(
_getAccountEmail
)
"
_email
=
"
$(
_getAccountEmail
)
"
if
[
"
$
ACCOUNT_EMAIL
"
]
;
then
if
[
"
$
_email
"
]
;
then
updjson
=
'{"contact": ["mailto:'
$_email
'"]}'
updjson
=
'{"contact": ["mailto:'
$_email
'"]}'
else
else
updjson
=
'{"contact": []}'
updjson
=
'{"contact": []}'
...
@@ -3768,7 +3790,7 @@ updateaccount() {
...
@@ -3768,7 +3790,7 @@ updateaccount() {
if
[
"
$code
"
=
'200'
]
;
then
if
[
"
$code
"
=
'200'
]
;
then
echo
"
$response
"
>
"
$ACCOUNT_JSON_PATH
"
echo
"
$response
"
>
"
$ACCOUNT_JSON_PATH
"
_info
"
a
ccount update success for
$_accUri
."
_info
"
A
ccount update success for
$_accUri
."
else
else
_info
"Error. The account was not updated."
_info
"Error. The account was not updated."
return
1
return
1
...
@@ -4207,6 +4229,40 @@ _getIdType() {
...
@@ -4207,6 +4229,40 @@ _getIdType() {
fi
fi
}
}
# beginTime dateTo
# beginTime is full string format("2022-04-01T08:10:33Z"), beginTime can be empty, to use current time
# dateTo can be ether in full string format("2022-04-01T08:10:33Z") or in delta format(+5d or +20h)
_convertValidaty
()
{
_beginTime
=
"
$1
"
_dateTo
=
"
$2
"
_debug2
"_beginTime"
"
$_beginTime
"
_debug2
"_dateTo"
"
$_dateTo
"
if
_startswith
"
$_dateTo
"
"+"
;
then
_v_begin
=
$(
_time
)
if
[
"
$_beginTime
"
]
;
then
_v_begin
=
"
$(
_date2time
"
$_beginTime
"
)
"
fi
_debug2
"_v_begin"
"
$_v_begin
"
if
_endswith
"
$_dateTo
"
"h"
;
then
_v_end
=
$(
_math
"
$_v_begin
+ 60 * 60 *
$(
echo
"
$_dateTo
"
|
tr
-d
'+h'
)
"
)
elif
_endswith
"
$_dateTo
"
"d"
;
then
_v_end
=
$(
_math
"
$_v_begin
+ 60 * 60 * 24 *
$(
echo
"
$_dateTo
"
|
tr
-d
'+d'
)
"
)
else
_err
"Not recognized format for _dateTo:
$_dateTo
"
return
1
fi
_debug2
"_v_end"
"
$_v_end
"
_time2str
"
$_v_end
"
else
if
[
"
$(
_time
)
"
-gt
"
$(
_date2time
"
$_dateTo
"
)
"
]
;
then
_err
"The validaty to is in the past: _dateTo =
$_dateTo
"
return
1
fi
echo
"
$_dateTo
"
fi
}
#webroot, domain domainlist keylength
#webroot, domain domainlist keylength
issue
()
{
issue
()
{
if
[
-z
"
$2
"
]
;
then
if
[
-z
"
$2
"
]
;
then
...
@@ -4240,6 +4296,8 @@ issue() {
...
@@ -4240,6 +4296,8 @@ issue() {
_local_addr
=
"
${
13
}
"
_local_addr
=
"
${
13
}
"
_challenge_alias
=
"
${
14
}
"
_challenge_alias
=
"
${
14
}
"
_preferred_chain
=
"
${
15
}
"
_preferred_chain
=
"
${
15
}
"
_valid_from
=
"
${
16
}
"
_valid_to
=
"
${
17
}
"
if
[
-z
"
$_ACME_IS_RENEW
"
]
;
then
if
[
-z
"
$_ACME_IS_RENEW
"
]
;
then
_initpath
"
$_main_domain
"
"
$_key_length
"
_initpath
"
$_main_domain
"
"
$_key_length
"
...
@@ -4263,7 +4321,13 @@ issue() {
...
@@ -4263,7 +4321,13 @@ issue() {
_debug _saved_domain
"
$_saved_domain
"
_debug _saved_domain
"
$_saved_domain
"
_saved_alt
=
$(
_readdomainconf Le_Alt
)
_saved_alt
=
$(
_readdomainconf Le_Alt
)
_debug _saved_alt
"
$_saved_alt
"
_debug _saved_alt
"
$_saved_alt
"
if
[
"
$_saved_domain
,
$_saved_alt
"
=
"
$_main_domain
,
$_alt_domains
"
]
;
then
_normized_saved_domains
=
"
$(
echo
"
$_saved_domain
,
$_saved_alt
"
|
tr
","
"
\n
"
|
sort
|
tr
'\n'
','
)
"
_debug _normized_saved_domains
"
$_normized_saved_domains
"
_normized_domains
=
"
$(
echo
"
$_main_domain
,
$_alt_domains
"
|
tr
","
"
\n
"
|
sort
|
tr
'\n'
','
)
"
_debug _normized_domains
"
$_normized_domains
"
if
[
"
$_normized_saved_domains
"
=
"
$_normized_domains
"
]
;
then
_info
"Domains not changed."
_info
"Domains not changed."
_info
"Skip, Next renewal time is:
$(
__green
"
$(
_readdomainconf Le_NextRenewTimeStr
)
"
)
"
_info
"Skip, Next renewal time is:
$(
__green
"
$(
_readdomainconf Le_NextRenewTimeStr
)
"
)
"
_info
"Add '
$(
__red
'--force'
)
' to force to renew."
_info
"Add '
$(
__red
'--force'
)
' to force to renew."
...
@@ -4375,12 +4439,52 @@ issue() {
...
@@ -4375,12 +4439,52 @@ issue() {
_identifiers
=
"
$_identifiers
,{
\"
type
\"
:
\"
$(
_getIdType
"
$d
"
)
\"
,
\"
value
\"
:
\"
$(
_idn
"
$d
"
)
\"
}"
_identifiers
=
"
$_identifiers
,{
\"
type
\"
:
\"
$(
_getIdType
"
$d
"
)
\"
,
\"
value
\"
:
\"
$(
_idn
"
$d
"
)
\"
}"
done
done
_debug2 _identifiers
"
$_identifiers
"
_debug2 _identifiers
"
$_identifiers
"
if
!
_send_signed_request
"
$ACME_NEW_ORDER
"
"{
\"
identifiers
\"
: [
$_identifiers
]}"
;
then
_notBefore
=
""
_notAfter
=
""
if
[
"
$_valid_from
"
]
;
then
_savedomainconf
"Le_Valid_From"
"
$_valid_from
"
_debug2
"_valid_from"
"
$_valid_from
"
_notBefore
=
"
$(
_convertValidaty
""
"
$_valid_from
"
)
"
if
[
"
$?
"
!=
"0"
]
;
then
_err
"Can not parse _valid_from:
$_valid_from
"
return
1
fi
if
[
"
$(
_time
)
"
-gt
"
$(
_date2time
"
$_notBefore
"
)
"
]
;
then
_notBefore
=
""
fi
else
_cleardomainconf
"Le_Valid_From"
fi
_debug2 _notBefore
"
$_notBefore
"
if
[
"
$_valid_to
"
]
;
then
_debug2
"_valid_to"
"
$_valid_to
"
_savedomainconf
"Le_Valid_To"
"
$_valid_to
"
_notAfter
=
"
$(
_convertValidaty
"
$_notBefore
"
"
$_valid_to
"
)
"
if
[
"
$?
"
!=
"0"
]
;
then
_err
"Can not parse _valid_to:
$_valid_to
"
return
1
fi
else
_cleardomainconf
"Le_Valid_To"
fi
_debug2
"_notAfter"
"
$_notAfter
"
_newOrderObj
=
"{
\"
identifiers
\"
: [
$_identifiers
]"
if
[
"
$_notBefore
"
]
;
then
_newOrderObj
=
"
$_newOrderObj
,
\"
notBefore
\"
:
\"
$_notBefore
\"
"
fi
if
[
"
$_notAfter
"
]
;
then
_newOrderObj
=
"
$_newOrderObj
,
\"
notAfter
\"
:
\"
$_notAfter
\"
"
fi
if
!
_send_signed_request
"
$ACME_NEW_ORDER
"
"
$_newOrderObj
}"
;
then
_err
"Create new order error."
_err
"Create new order error."
_clearup
_clearup
_on_issue_err
"
$_post_hook
"
_on_issue_err
"
$_post_hook
"
return
1
return
1
fi
fi
Le_LinkOrder
=
"
$(
echo
"
$responseHeaders
"
|
grep
-i
'^Location.*$'
| _tail_n 1 |
tr
-d
"
\r\n
"
|
cut
-d
":"
-f
2-
)
"
Le_LinkOrder
=
"
$(
echo
"
$responseHeaders
"
|
grep
-i
'^Location.*$'
| _tail_n 1 |
tr
-d
"
\r\n
"
|
cut
-d
":"
-f
2-
)
"
_debug Le_LinkOrder
"
$Le_LinkOrder
"
_debug Le_LinkOrder
"
$Le_LinkOrder
"
Le_OrderFinalize
=
"
$(
echo
"
$response
"
| _egrep_o
'"finalize" *: *"[^"]*"'
|
cut
-d
'"'
-f
4
)
"
Le_OrderFinalize
=
"
$(
echo
"
$response
"
| _egrep_o
'"finalize" *: *"[^"]*"'
|
cut
-d
'"'
-f
4
)
"
...
@@ -5080,13 +5184,15 @@ $_authorizations_map"
...
@@ -5080,13 +5184,15 @@ $_authorizations_map"
else
else
_cleardomainconf Le_ForceNewDomainKey
_cleardomainconf Le_ForceNewDomainKey
fi
fi
if
[
"
$_notAfter
"
]
;
then
Le_NextRenewTime
=
$(
_date2time
"
$_notAfter
"
)
Le_NextRenewTimeStr
=
"
$_notAfter
"
else
Le_NextRenewTime
=
$(
_math
"
$Le_CertCreateTime
"
+
"
$Le_RenewalDays
"
\*
24
\*
60
\*
60
)
Le_NextRenewTime
=
$(
_math
"
$Le_CertCreateTime
"
+
"
$Le_RenewalDays
"
\*
24
\*
60
\*
60
)
Le_NextRenewTimeStr
=
$(
_time2str
"
$Le_NextRenewTime
"
)
Le_NextRenewTimeStr
=
$(
_time2str
"
$Le_NextRenewTime
"
)
_savedomainconf
"Le_NextRenewTimeStr"
"
$Le_NextRenewTimeStr
"
Le_NextRenewTime
=
$(
_math
"
$Le_NextRenewTime
"
- 86400
)
Le_NextRenewTime
=
$(
_math
"
$Le_NextRenewTime
"
- 86400
)
fi
_savedomainconf
"Le_NextRenewTimeStr"
"
$Le_NextRenewTimeStr
"
_savedomainconf
"Le_NextRenewTime"
"
$Le_NextRenewTime
"
_savedomainconf
"Le_NextRenewTime"
"
$Le_NextRenewTime
"
if
[
"
$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain
"
]
;
then
if
[
"
$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain
"
]
;
then
...
@@ -5187,7 +5293,7 @@ renew() {
...
@@ -5187,7 +5293,7 @@ renew() {
Le_PostHook
=
"
$(
_readdomainconf Le_PostHook
)
"
Le_PostHook
=
"
$(
_readdomainconf Le_PostHook
)
"
Le_RenewHook
=
"
$(
_readdomainconf Le_RenewHook
)
"
Le_RenewHook
=
"
$(
_readdomainconf Le_RenewHook
)
"
Le_Preferred_Chain
=
"
$(
_readdomainconf Le_Preferred_Chain
)
"
Le_Preferred_Chain
=
"
$(
_readdomainconf Le_Preferred_Chain
)
"
issue
"
$Le_Webroot
"
"
$Le_Domain
"
"
$Le_Alt
"
"
$Le_Keylength
"
"
$Le_RealCertPath
"
"
$Le_RealKeyPath
"
"
$Le_RealCACertPath
"
"
$Le_ReloadCmd
"
"
$Le_RealFullChainPath
"
"
$Le_PreHook
"
"
$Le_PostHook
"
"
$Le_RenewHook
"
"
$Le_LocalAddress
"
"
$Le_ChallengeAlias
"
"
$Le_Preferred_Chain
"
issue
"
$Le_Webroot
"
"
$Le_Domain
"
"
$Le_Alt
"
"
$Le_Keylength
"
"
$Le_RealCertPath
"
"
$Le_RealKeyPath
"
"
$Le_RealCACertPath
"
"
$Le_ReloadCmd
"
"
$Le_RealFullChainPath
"
"
$Le_PreHook
"
"
$Le_PostHook
"
"
$Le_RenewHook
"
"
$Le_LocalAddress
"
"
$Le_ChallengeAlias
"
"
$Le_Preferred_Chain
"
"
$Le_Valid_From
"
"
$Le_Valid_To
"
res
=
"
$?
"
res
=
"
$?
"
if
[
"
$res
"
!=
"0"
]
;
then
if
[
"
$res
"
!=
"0"
]
;
then
return
"
$res
"
return
"
$res
"
...
@@ -6623,6 +6729,11 @@ Parameters:
...
@@ -6623,6 +6729,11 @@ Parameters:
If no match, the default offered chain will be used. (default: empty)
If no match, the default offered chain will be used. (default: empty)
See:
$_PREFERRED_CHAIN_WIKI
See:
$_PREFERRED_CHAIN_WIKI
--valid-to <date-time> Request the NotAfter field of the cert.
See:
$_VALIDITY_WIKI
--valid-from <date-time> Request the NotBefore field of the cert.
See:
$_VALIDITY_WIKI
-f, --force Force install, force cert renewal or override sudo restrictions.
-f, --force Force install, force cert renewal or override sudo restrictions.
--staging, --test Use staging server, for testing.
--staging, --test Use staging server, for testing.
--debug [0|1|2|3] Output debug info. Defaults to 1 if argument is omitted.
--debug [0|1|2|3] Output debug info. Defaults to 1 if argument is omitted.
...
@@ -6983,6 +7094,8 @@ _process() {
...
@@ -6983,6 +7094,8 @@ _process() {
_eab_kid
=
""
_eab_kid
=
""
_eab_hmac_key
=
""
_eab_hmac_key
=
""
_preferred_chain
=
""
_preferred_chain
=
""
_valid_from
=
""
_valid_to
=
""
while
[
${#}
-gt
0
]
;
do
while
[
${#}
-gt
0
]
;
do
case
"
${
1
}
"
in
case
"
${
1
}
"
in
...
@@ -7290,6 +7403,14 @@ _process() {
...
@@ -7290,6 +7403,14 @@ _process() {
Le_RenewalDays
=
"
$_days
"
Le_RenewalDays
=
"
$_days
"
shift
shift
;;
;;
--valid-from
)
_valid_from
=
"
$2
"
shift
;;
--valid-to
)
_valid_to
=
"
$2
"
shift
;;
--httpport
)
--httpport
)
_httpport
=
"
$2
"
_httpport
=
"
$2
"
Le_HTTPPort
=
"
$_httpport
"
Le_HTTPPort
=
"
$_httpport
"
...
@@ -7551,7 +7672,7 @@ _process() {
...
@@ -7551,7 +7672,7 @@ _process() {
uninstall
)
uninstall
"
$_nocron
"
;;
uninstall
)
uninstall
"
$_nocron
"
;;
upgrade
)
upgrade
;;
upgrade
)
upgrade
;;
issue
)
issue
)
issue
"
$_webroot
"
"
$_domain
"
"
$_altdomains
"
"
$_keylength
"
"
$_cert_file
"
"
$_key_file
"
"
$_ca_file
"
"
$_reloadcmd
"
"
$_fullchain_file
"
"
$_pre_hook
"
"
$_post_hook
"
"
$_renew_hook
"
"
$_local_address
"
"
$_challenge_alias
"
"
$_preferred_chain
"
issue
"
$_webroot
"
"
$_domain
"
"
$_altdomains
"
"
$_keylength
"
"
$_cert_file
"
"
$_key_file
"
"
$_ca_file
"
"
$_reloadcmd
"
"
$_fullchain_file
"
"
$_pre_hook
"
"
$_post_hook
"
"
$_renew_hook
"
"
$_local_address
"
"
$_challenge_alias
"
"
$_preferred_chain
"
"
$_valid_from
"
"
$_valid_to
"
;;
;;
deploy
)
deploy
)
deploy
"
$_domain
"
"
$_deploy_hook
"
"
$_ecc
"
deploy
"
$_domain
"
"
$_deploy_hook
"
"
$_ecc
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment