Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
dff4d03b
Unverified
Commit
dff4d03b
authored
Mar 14, 2018
by
neil
Committed by
GitHub
Mar 14, 2018
Browse files
Merge pull request #1376 from Neilpang/dev
sync
parents
14bb60c6
28d83d42
Changes
2
Show whitespace changes
Inline
Side-by-side
README.md
View file @
dff4d03b
...
...
@@ -220,22 +220,7 @@ acme.sh --issue --standalone -d example.com -d www.example.com -d cp.example.com
More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
# 5. Use Standalone TLS server to issue cert
**(requires you to be root/sudoer or have permission to listen on port 443 (TCP))**
acme.sh supports
`tls-sni-01`
validation.
Port
`443`
(TCP)
**MUST**
be free to listen on, otherwise you will be prompted to free it and try again.
```
bash
acme.sh
--issue
--tls
-d
example.com
-d
www.example.com
-d
cp.example.com
```
More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
# 6. Use Apache mode
# 5. Use Apache mode
**(requires you to be root/sudoer, since it is required to interact with Apache server)**
...
...
@@ -255,7 +240,7 @@ We don't want to mess your apache server, don't worry.**
More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
#
7
. Use Nginx mode
#
6
. Use Nginx mode
**(requires you to be root/sudoer, since it is required to interact with Nginx server)**
...
...
@@ -279,7 +264,7 @@ We don't want to mess your nginx server, don't worry.**
More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
#
8
. Automatic DNS API integration
#
7
. Automatic DNS API integration
If your DNS provider supports API access, we can use that API to automatically issue the certs.
...
...
@@ -342,7 +327,7 @@ If your DNS provider is not on the supported list above, you can write your own
For more details:
[
How to use DNS API
](
dnsapi
)
#
9
. Use DNS manual mode:
#
8
. Use DNS manual mode:
If your dns provider doesn't support any api access, you can add the txt record by your hand.
...
...
@@ -376,7 +361,7 @@ Ok, it's done.
**Please use dns api mode instead.**
#
10
. Issue ECC certificates
#
9
. Issue ECC certificates
`Let's Encrypt`
can now issue
**ECDSA**
certificates.
...
...
@@ -408,7 +393,7 @@ Valid values are:
# 1
1
. Issue Wildcard certificates
# 1
0
. Issue Wildcard certificates
It's simple, just give a wildcard domain as the
`-d`
parameter.
...
...
@@ -418,7 +403,7 @@ acme.sh --issue -d example.com -d *.example.com --dns dns_cf
# 1
2
. How to renew the certs
# 1
1
. How to renew the certs
No, you don't need to renew the certs manually. All the certs will be renewed automatically every
**60**
days.
...
...
@@ -435,7 +420,7 @@ acme.sh --renew -d example.com --force --ecc
```
# 1
3
. How to stop cert renewal
# 1
2
. How to stop cert renewal
To stop renewal of a cert, you can execute the following to remove the cert from the renewal list:
...
...
@@ -448,7 +433,7 @@ The cert/key file is not removed from the disk.
You can remove the respective directory (e.g.
`~/.acme.sh/example.com`
) by yourself.
# 1
4
. How to upgrade `acme.sh`
# 1
3
. How to upgrade `acme.sh`
acme.sh is in constant development, so it's strongly recommended to use the latest code.
...
...
@@ -473,25 +458,25 @@ acme.sh --upgrade --auto-upgrade 0
```
# 1
5
. Issue a cert from an existing CSR
# 1
4
. Issue a cert from an existing CSR
https://github.com/Neilpang/acme.sh/wiki/Issue-a-cert-from-existing-CSR
# 1
6
. Under the Hood
# 1
5
. Under the Hood
Speak ACME language using shell, directly to "Let's Encrypt".
TODO:
# 1
7
. Acknowledgments
# 1
6
. Acknowledgments
1.
Acme-tiny: https://github.com/diafygi/acme-tiny
2.
ACME protocol: https://github.com/ietf-wg-acme/acme
# 1
8
. License & Others
# 1
7
. License & Others
License is GPLv3
...
...
@@ -500,7 +485,7 @@ Please Star and Fork me.
[
Issues
](
https://github.com/Neilpang/acme.sh/issues
)
and
[
pull requests
](
https://github.com/Neilpang/acme.sh/pulls
)
are welcome.
# 1
9
. Donate
# 1
8
. Donate
Your donation makes
**acme.sh**
better:
1.
PayPal/Alipay(支付宝)/Wechat(微信):
[
https://donate.acme.sh/
](
https://donate.acme.sh/
)
...
...
acme.sh
View file @
dff4d03b
#!/usr/bin/env sh
VER=2.7.
7
VER=2.7.
8
PROJECT_NAME="acme.sh"
...
...
@@ -47,6 +47,7 @@ DEFAULT_DNS_SLEEP=120
NO_VALUE="no"
W_TLS="tls"
W_DNS="dns"
DNS_ALIAS_PREFIX="="
MODE_STATELESS="stateless"
...
...
@@ -2341,7 +2342,7 @@ _initpath() {
fi
fi
_debug
2
ACME_DIRECTORY "$ACME_DIRECTORY"
_debug ACME_DIRECTORY "$ACME_DIRECTORY"
_ACME_SERVER_HOST="$(echo "$ACME_DIRECTORY" | cut -d : -f 2 | tr -s / | cut -d / -f 2)"
_debug2 "_ACME_SERVER_HOST" "$_ACME_SERVER_HOST"
...
...
@@ -2998,6 +2999,8 @@ _on_before_issue() {
_chk_pre_hook="$4"
_chk_local_addr="$5"
_debug _on_before_issue
_debug _chk_main_domain "$_chk_main_domain"
_debug _chk_alt_domains "$_chk_alt_domains"
#run pre hook
if [ "$_chk_pre_hook" ]; then
_info "Run pre hook:'$_chk_pre_hook'"
...
...
@@ -3018,11 +3021,17 @@ _on_before_issue() {
_debug Le_LocalAddress "$_chk_local_addr"
alldomains=$(echo "$_chk_main_domain,$_chk_alt_domains" | tr ',' ' ')
_index=1
_currentRoot=""
_addrIndex=1
for d in $alldomains; do
_w_index=1
while true; do
d="$(echo "$_chk_main_domain,$_chk_alt_domains," | cut -d , -f "$_w_index")"
_w_index="$(_math "$_w_index" + 1)"
_debug d "$d"
if [ -z "$d" ]; then
break
fi
_debug "Check for domain" "$d"
_currentRoot="$(_getfield "$_chk_web_roots" $_index)"
_debug "_currentRoot" "$_currentRoot"
...
...
@@ -3118,7 +3127,7 @@ _on_issue_err() {
)
fi
if [ "$IS_RENEW" = "1" ] && _hasfield "$Le_Webroot" "
dns
"; then
if [ "$IS_RENEW" = "1" ] && _hasfield "$Le_Webroot" "
$W_DNS
"; then
_err "$_DNS_MANUAL_ERR"
fi
...
...
@@ -3154,7 +3163,7 @@ _on_issue_success() {
fi
fi
if _hasfield "$Le_Webroot" "
dns
"; then
if _hasfield "$Le_Webroot" "
$W_DNS
"; then
_err "$_DNS_MANUAL_WARN"
fi
...
...
@@ -3421,6 +3430,9 @@ issue() {
_main_domain=$(echo "$2,$3" | cut -d , -f 1)
_alt_domains=$(echo "$2,$3" | cut -d , -f 2- | sed "s/,${NO_VALUE}$//")
fi
_debug _main_domain "$_main_domain"
_debug _alt_domains "$_alt_domains"
_key_length="$4"
_real_cert="$5"
_real_key="$6"
...
...
@@ -3551,10 +3563,15 @@ issue() {
if [ "$ACME_VERSION" = "2" ]; then
#make new order request
_identifiers="{\"type\":\"dns\",\"value\":\"$_main_domain\"}"
for d in $(echo "$_alt_domains" | tr ',' ' '); do
if [ "$d" ]; then
_identifiers="$_identifiers,{\"type\":\"dns\",\"value\":\"$d\"}"
_w_index=1
while true; do
d="$(echo "$_alt_domains," | cut -d , -f "$_w_index")"
_w_index="$(_math "$_w_index" + 1)"
_debug d "$d"
if [ -z "$d" ]; then
break
fi
_identifiers="$_identifiers,{\"type\":\"dns\",\"value\":\"$d\"}"
done
_debug2 _identifiers "$_identifiers"
if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
...
...
@@ -3591,6 +3608,8 @@ issue() {
_debug2 "_authz_url" "$_authz_url"
if ! response="$(_get "$_authz_url")"; then
_err "get to authz error."
_err "_authorizations_seg" "$_authorizations_seg"
_err "_authz_url" "$_authz_url"
_clearup
_on_issue_err "$_post_hook"
return 1
...
...
@@ -3609,10 +3628,16 @@ $_authorizations_map"
_debug2 _authorizations_map "$_authorizations_map"
fi
alldomains=$(echo "$_main_domain,$_alt_domains" | tr ',' ' ')
_index=0
_currentRoot=""
for d in $alldomains; do
_w_index=1
while true; do
d="$(echo "$_main_domain,$_alt_domains," | cut -d , -f "$_w_index")"
_w_index="$(_math "$_w_index" + 1)"
_debug d "$d"
if [ -z "$d" ]; then
break
fi
_info "Getting webroot for domain" "$d"
_index=$(_math $_index + 1)
_w="$(echo $_web_roots | cut -d , -f $_index)"
...
...
@@ -3624,7 +3649,7 @@ $_authorizations_map"
vtype="$VTYPE_HTTP"
#todo, v2 wildcard force to use dns
if _startswith "$_currentRoot" "
dns
"; then
if _startswith "$_currentRoot" "
$W_DNS
"; then
vtype="$VTYPE_DNS"
fi
...
...
@@ -3641,6 +3666,7 @@ $_authorizations_map"
_debug2 "response" "$response"
if [ -z "$response" ]; then
_err "get to authz error."
_err "_authorizations_map" "$_authorizations_map"
_clearup
_on_issue_err "$_post_hook"
return 1
...
...
@@ -3751,6 +3777,10 @@ $_authorizations_map"
if [ "$d_api" ]; then
_info "Found domain api file: $d_api"
else
if [ "$_currentRoot" != "$W_DNS" ]; then
_err "Can not find dns api hook for: $_currentRoot"
_info "You need to add the txt record manually."
fi
_info "$(__red "Add the following TXT record:")"
_info "$(__red "Domain: '$(__green "$txtdomain")'")"
_info "$(__red "TXT value: '$(__green "$txt")'")"
...
...
@@ -4264,7 +4294,7 @@ renew() {
fi
. "$DOMAIN_CONF"
_debug Le_API "$Le_API"
if [ "$Le_API" ]; then
if [ "$_OLD_CA_HOST" = "$Le_API" ]; then
export Le_API="$DEFAULT_CA"
...
...
@@ -4868,6 +4898,8 @@ _deactivate() {
_debug2 "authzUri" "$authzUri"
if ! response="$(_get "$authzUri")"; then
_err "get to authz error."
_err "_authorizations_seg" "$_authorizations_seg"
_err "authzUri" "$authzUri"
_clearup
_on_issue_err "$_post_hook"
return 1
...
...
@@ -5779,7 +5811,7 @@ _process() {
fi
;;
--dns)
wvalue="
dns
"
wvalue="
$W_DNS
"
if [ "$2" ] && ! _startswith "$2" "-"; then
wvalue="$2"
shift
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment