Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
fba6de76
Unverified
Commit
fba6de76
authored
Oct 01, 2021
by
neil
Committed by
GitHub
Oct 01, 2021
Browse files
Merge pull request #3687 from gstrauss/use-getdeployconf
use _getdeployconf instead of sourcing DOMAIN_CONF
parents
5f38c15b
8419b42e
Changes
3
Hide whitespace changes
Inline
Side-by-side
deploy/haproxy.sh
View file @
fba6de76
...
@@ -54,11 +54,6 @@ haproxy_deploy() {
...
@@ -54,11 +54,6 @@ haproxy_deploy() {
DEPLOY_HAPROXY_ISSUER_DEFAULT
=
"no"
DEPLOY_HAPROXY_ISSUER_DEFAULT
=
"no"
DEPLOY_HAPROXY_RELOAD_DEFAULT
=
"true"
DEPLOY_HAPROXY_RELOAD_DEFAULT
=
"true"
if
[
-f
"
${
DOMAIN_CONF
}
"
]
;
then
# shellcheck disable=SC1090
.
"
${
DOMAIN_CONF
}
"
fi
_debug _cdomain
"
${
_cdomain
}
"
_debug _cdomain
"
${
_cdomain
}
"
_debug _ckey
"
${
_ckey
}
"
_debug _ckey
"
${
_ckey
}
"
_debug _ccert
"
${
_ccert
}
"
_debug _ccert
"
${
_ccert
}
"
...
@@ -66,6 +61,8 @@ haproxy_deploy() {
...
@@ -66,6 +61,8 @@ haproxy_deploy() {
_debug _cfullchain
"
${
_cfullchain
}
"
_debug _cfullchain
"
${
_cfullchain
}
"
# PEM_PATH is optional. If not provided then assume "${DEPLOY_HAPROXY_PEM_PATH_DEFAULT}"
# PEM_PATH is optional. If not provided then assume "${DEPLOY_HAPROXY_PEM_PATH_DEFAULT}"
_getdeployconf DEPLOY_HAPROXY_PEM_PATH
_debug2 DEPLOY_HAPROXY_PEM_PATH
"
${
DEPLOY_HAPROXY_PEM_PATH
}
"
if
[
-n
"
${
DEPLOY_HAPROXY_PEM_PATH
}
"
]
;
then
if
[
-n
"
${
DEPLOY_HAPROXY_PEM_PATH
}
"
]
;
then
Le_Deploy_haproxy_pem_path
=
"
${
DEPLOY_HAPROXY_PEM_PATH
}
"
Le_Deploy_haproxy_pem_path
=
"
${
DEPLOY_HAPROXY_PEM_PATH
}
"
_savedomainconf Le_Deploy_haproxy_pem_path
"
${
Le_Deploy_haproxy_pem_path
}
"
_savedomainconf Le_Deploy_haproxy_pem_path
"
${
Le_Deploy_haproxy_pem_path
}
"
...
@@ -82,6 +79,8 @@ haproxy_deploy() {
...
@@ -82,6 +79,8 @@ haproxy_deploy() {
fi
fi
# PEM_NAME is optional. If not provided then assume "${DEPLOY_HAPROXY_PEM_NAME_DEFAULT}"
# PEM_NAME is optional. If not provided then assume "${DEPLOY_HAPROXY_PEM_NAME_DEFAULT}"
_getdeployconf DEPLOY_HAPROXY_PEM_NAME
_debug2 DEPLOY_HAPROXY_PEM_NAME
"
${
DEPLOY_HAPROXY_PEM_NAME
}
"
if
[
-n
"
${
DEPLOY_HAPROXY_PEM_NAME
}
"
]
;
then
if
[
-n
"
${
DEPLOY_HAPROXY_PEM_NAME
}
"
]
;
then
Le_Deploy_haproxy_pem_name
=
"
${
DEPLOY_HAPROXY_PEM_NAME
}
"
Le_Deploy_haproxy_pem_name
=
"
${
DEPLOY_HAPROXY_PEM_NAME
}
"
_savedomainconf Le_Deploy_haproxy_pem_name
"
${
Le_Deploy_haproxy_pem_name
}
"
_savedomainconf Le_Deploy_haproxy_pem_name
"
${
Le_Deploy_haproxy_pem_name
}
"
...
@@ -90,6 +89,8 @@ haproxy_deploy() {
...
@@ -90,6 +89,8 @@ haproxy_deploy() {
fi
fi
# BUNDLE is optional. If not provided then assume "${DEPLOY_HAPROXY_BUNDLE_DEFAULT}"
# BUNDLE is optional. If not provided then assume "${DEPLOY_HAPROXY_BUNDLE_DEFAULT}"
_getdeployconf DEPLOY_HAPROXY_BUNDLE
_debug2 DEPLOY_HAPROXY_BUNDLE
"
${
DEPLOY_HAPROXY_BUNDLE
}
"
if
[
-n
"
${
DEPLOY_HAPROXY_BUNDLE
}
"
]
;
then
if
[
-n
"
${
DEPLOY_HAPROXY_BUNDLE
}
"
]
;
then
Le_Deploy_haproxy_bundle
=
"
${
DEPLOY_HAPROXY_BUNDLE
}
"
Le_Deploy_haproxy_bundle
=
"
${
DEPLOY_HAPROXY_BUNDLE
}
"
_savedomainconf Le_Deploy_haproxy_bundle
"
${
Le_Deploy_haproxy_bundle
}
"
_savedomainconf Le_Deploy_haproxy_bundle
"
${
Le_Deploy_haproxy_bundle
}
"
...
@@ -98,6 +99,8 @@ haproxy_deploy() {
...
@@ -98,6 +99,8 @@ haproxy_deploy() {
fi
fi
# ISSUER is optional. If not provided then assume "${DEPLOY_HAPROXY_ISSUER_DEFAULT}"
# ISSUER is optional. If not provided then assume "${DEPLOY_HAPROXY_ISSUER_DEFAULT}"
_getdeployconf DEPLOY_HAPROXY_ISSUER
_debug2 DEPLOY_HAPROXY_ISSUER
"
${
DEPLOY_HAPROXY_ISSUER
}
"
if
[
-n
"
${
DEPLOY_HAPROXY_ISSUER
}
"
]
;
then
if
[
-n
"
${
DEPLOY_HAPROXY_ISSUER
}
"
]
;
then
Le_Deploy_haproxy_issuer
=
"
${
DEPLOY_HAPROXY_ISSUER
}
"
Le_Deploy_haproxy_issuer
=
"
${
DEPLOY_HAPROXY_ISSUER
}
"
_savedomainconf Le_Deploy_haproxy_issuer
"
${
Le_Deploy_haproxy_issuer
}
"
_savedomainconf Le_Deploy_haproxy_issuer
"
${
Le_Deploy_haproxy_issuer
}
"
...
@@ -106,6 +109,8 @@ haproxy_deploy() {
...
@@ -106,6 +109,8 @@ haproxy_deploy() {
fi
fi
# RELOAD is optional. If not provided then assume "${DEPLOY_HAPROXY_RELOAD_DEFAULT}"
# RELOAD is optional. If not provided then assume "${DEPLOY_HAPROXY_RELOAD_DEFAULT}"
_getdeployconf DEPLOY_HAPROXY_RELOAD
_debug2 DEPLOY_HAPROXY_RELOAD
"
${
DEPLOY_HAPROXY_RELOAD
}
"
if
[
-n
"
${
DEPLOY_HAPROXY_RELOAD
}
"
]
;
then
if
[
-n
"
${
DEPLOY_HAPROXY_RELOAD
}
"
]
;
then
Le_Deploy_haproxy_reload
=
"
${
DEPLOY_HAPROXY_RELOAD
}
"
Le_Deploy_haproxy_reload
=
"
${
DEPLOY_HAPROXY_RELOAD
}
"
_savedomainconf Le_Deploy_haproxy_reload
"
${
Le_Deploy_haproxy_reload
}
"
_savedomainconf Le_Deploy_haproxy_reload
"
${
Le_Deploy_haproxy_reload
}
"
...
@@ -190,7 +195,7 @@ haproxy_deploy() {
...
@@ -190,7 +195,7 @@ haproxy_deploy() {
_info
"Updating OCSP stapling info"
_info
"Updating OCSP stapling info"
_debug _ocsp
"
${
_ocsp
}
"
_debug _ocsp
"
${
_ocsp
}
"
_info
"Extracting OCSP URL"
_info
"Extracting OCSP URL"
_ocsp_url
=
$(
openssl x509
-noout
-ocsp_uri
-in
"
${
_pem
}
"
)
_ocsp_url
=
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-noout
-ocsp_uri
-in
"
${
_pem
}
"
)
_debug _ocsp_url
"
${
_ocsp_url
}
"
_debug _ocsp_url
"
${
_ocsp_url
}
"
# Only process OCSP if URL was present
# Only process OCSP if URL was present
...
@@ -203,9 +208,9 @@ haproxy_deploy() {
...
@@ -203,9 +208,9 @@ haproxy_deploy() {
# Only process the certificate if we have a .issuer file
# Only process the certificate if we have a .issuer file
if
[
-r
"
${
_issuer
}
"
]
;
then
if
[
-r
"
${
_issuer
}
"
]
;
then
# Check if issuer cert is also a root CA cert
# Check if issuer cert is also a root CA cert
_subjectdn
=
$(
openssl x509
-in
"
${
_issuer
}
"
-subject
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_subjectdn
=
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-in
"
${
_issuer
}
"
-subject
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_debug _subjectdn
"
${
_subjectdn
}
"
_debug _subjectdn
"
${
_subjectdn
}
"
_issuerdn
=
$(
openssl x509
-in
"
${
_issuer
}
"
-issuer
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_issuerdn
=
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-in
"
${
_issuer
}
"
-issuer
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_debug _issuerdn
"
${
_issuerdn
}
"
_debug _issuerdn
"
${
_issuerdn
}
"
_info
"Requesting OCSP response"
_info
"Requesting OCSP response"
# If the issuer is a CA cert then our command line has "-CAfile" added
# If the issuer is a CA cert then our command line has "-CAfile" added
...
@@ -216,7 +221,7 @@ haproxy_deploy() {
...
@@ -216,7 +221,7 @@ haproxy_deploy() {
fi
fi
_debug _cafile_argument
"
${
_cafile_argument
}
"
_debug _cafile_argument
"
${
_cafile_argument
}
"
# if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
# if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
_openssl_version
=
$(
openssl version |
cut
-d
' '
-f2
)
_openssl_version
=
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
version |
cut
-d
' '
-f2
)
_debug _openssl_version
"
${
_openssl_version
}
"
_debug _openssl_version
"
${
_openssl_version
}
"
_openssl_major
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f1
)
_openssl_major
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f1
)
_openssl_minor
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f2
)
_openssl_minor
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f2
)
...
@@ -226,7 +231,7 @@ haproxy_deploy() {
...
@@ -226,7 +231,7 @@ haproxy_deploy() {
_header_sep
=
" "
_header_sep
=
" "
fi
fi
# Request the OCSP response from the issuer and store it
# Request the OCSP response from the issuer and store it
_openssl_ocsp_cmd
=
"openssl ocsp
\
_openssl_ocsp_cmd
=
"
${
ACME_OPENSSL_BIN
:-
openssl
}
ocsp
\
-issuer
\"
${
_issuer
}
\"
\
-issuer
\"
${
_issuer
}
\"
\
-cert
\"
${
_pem
}
\"
\
-cert
\"
${
_pem
}
\"
\
-url
\"
${
_ocsp_url
}
\"
\
-url
\"
${
_ocsp_url
}
\"
\
...
...
deploy/lighttpd.sh
0 → 100644
View file @
fba6de76
#!/usr/bin/env sh
# Script for acme.sh to deploy certificates to lighttpd
#
# The following variables can be exported:
#
# export DEPLOY_LIGHTTPD_PEM_NAME="${domain}.pem"
#
# Defines the name of the PEM file.
# Defaults to "<domain>.pem"
#
# export DEPLOY_LIGHTTPD_PEM_PATH="/etc/lighttpd"
#
# Defines location of PEM file for Lighttpd.
# Defaults to /etc/lighttpd
#
# export DEPLOY_LIGHTTPD_RELOAD="systemctl reload lighttpd"
#
# OPTIONAL: Reload command used post deploy
# This defaults to be a no-op (ie "true").
# It is strongly recommended to set this something that makes sense
# for your distro.
#
# export DEPLOY_LIGHTTPD_ISSUER="yes"
#
# OPTIONAL: Places CA file as "${DEPLOY_LIGHTTPD_PEM}.issuer"
# Note: Required for OCSP stapling to work
#
# export DEPLOY_LIGHTTPD_BUNDLE="no"
#
# OPTIONAL: Deploy this certificate as part of a multi-cert bundle
# This adds a suffix to the certificate based on the certificate type
# eg RSA certificates will have .rsa as a suffix to the file name
# Lighttpd will load all certificates and provide one or the other
# depending on client capabilities
# Note: This functionality requires Lighttpd was compiled against
# a version of OpenSSL that supports this.
#
######## Public functions #####################
#domain keyfile certfile cafile fullchain
lighttpd_deploy
()
{
_cdomain
=
"
$1
"
_ckey
=
"
$2
"
_ccert
=
"
$3
"
_cca
=
"
$4
"
_cfullchain
=
"
$5
"
# Some defaults
DEPLOY_LIGHTTPD_PEM_PATH_DEFAULT
=
"/etc/lighttpd"
DEPLOY_LIGHTTPD_PEM_NAME_DEFAULT
=
"
${
_cdomain
}
.pem"
DEPLOY_LIGHTTPD_BUNDLE_DEFAULT
=
"no"
DEPLOY_LIGHTTPD_ISSUER_DEFAULT
=
"yes"
DEPLOY_LIGHTTPD_RELOAD_DEFAULT
=
"true"
_debug _cdomain
"
${
_cdomain
}
"
_debug _ckey
"
${
_ckey
}
"
_debug _ccert
"
${
_ccert
}
"
_debug _cca
"
${
_cca
}
"
_debug _cfullchain
"
${
_cfullchain
}
"
# PEM_PATH is optional. If not provided then assume "${DEPLOY_LIGHTTPD_PEM_PATH_DEFAULT}"
_getdeployconf DEPLOY_LIGHTTPD_PEM_PATH
_debug2 DEPLOY_LIGHTTPD_PEM_PATH
"
${
DEPLOY_LIGHTTPD_PEM_PATH
}
"
if
[
-n
"
${
DEPLOY_LIGHTTPD_PEM_PATH
}
"
]
;
then
Le_Deploy_lighttpd_pem_path
=
"
${
DEPLOY_LIGHTTPD_PEM_PATH
}
"
_savedomainconf Le_Deploy_lighttpd_pem_path
"
${
Le_Deploy_lighttpd_pem_path
}
"
elif
[
-z
"
${
Le_Deploy_lighttpd_pem_path
}
"
]
;
then
Le_Deploy_lighttpd_pem_path
=
"
${
DEPLOY_LIGHTTPD_PEM_PATH_DEFAULT
}
"
fi
# Ensure PEM_PATH exists
if
[
-d
"
${
Le_Deploy_lighttpd_pem_path
}
"
]
;
then
_debug
"PEM_PATH
${
Le_Deploy_lighttpd_pem_path
}
exists"
else
_err
"PEM_PATH
${
Le_Deploy_lighttpd_pem_path
}
does not exist"
return
1
fi
# PEM_NAME is optional. If not provided then assume "${DEPLOY_LIGHTTPD_PEM_NAME_DEFAULT}"
_getdeployconf DEPLOY_LIGHTTPD_PEM_NAME
_debug2 DEPLOY_LIGHTTPD_PEM_NAME
"
${
DEPLOY_LIGHTTPD_PEM_NAME
}
"
if
[
-n
"
${
DEPLOY_LIGHTTPD_PEM_NAME
}
"
]
;
then
Le_Deploy_lighttpd_pem_name
=
"
${
DEPLOY_LIGHTTPD_PEM_NAME
}
"
_savedomainconf Le_Deploy_lighttpd_pem_name
"
${
Le_Deploy_lighttpd_pem_name
}
"
elif
[
-z
"
${
Le_Deploy_lighttpd_pem_name
}
"
]
;
then
Le_Deploy_lighttpd_pem_name
=
"
${
DEPLOY_LIGHTTPD_PEM_NAME_DEFAULT
}
"
fi
# BUNDLE is optional. If not provided then assume "${DEPLOY_LIGHTTPD_BUNDLE_DEFAULT}"
_getdeployconf DEPLOY_LIGHTTPD_BUNDLE
_debug2 DEPLOY_LIGHTTPD_BUNDLE
"
${
DEPLOY_LIGHTTPD_BUNDLE
}
"
if
[
-n
"
${
DEPLOY_LIGHTTPD_BUNDLE
}
"
]
;
then
Le_Deploy_lighttpd_bundle
=
"
${
DEPLOY_LIGHTTPD_BUNDLE
}
"
_savedomainconf Le_Deploy_lighttpd_bundle
"
${
Le_Deploy_lighttpd_bundle
}
"
elif
[
-z
"
${
Le_Deploy_lighttpd_bundle
}
"
]
;
then
Le_Deploy_lighttpd_bundle
=
"
${
DEPLOY_LIGHTTPD_BUNDLE_DEFAULT
}
"
fi
# ISSUER is optional. If not provided then assume "${DEPLOY_LIGHTTPD_ISSUER_DEFAULT}"
_getdeployconf DEPLOY_LIGHTTPD_ISSUER
_debug2 DEPLOY_LIGHTTPD_ISSUER
"
${
DEPLOY_LIGHTTPD_ISSUER
}
"
if
[
-n
"
${
DEPLOY_LIGHTTPD_ISSUER
}
"
]
;
then
Le_Deploy_lighttpd_issuer
=
"
${
DEPLOY_LIGHTTPD_ISSUER
}
"
_savedomainconf Le_Deploy_lighttpd_issuer
"
${
Le_Deploy_lighttpd_issuer
}
"
elif
[
-z
"
${
Le_Deploy_lighttpd_issuer
}
"
]
;
then
Le_Deploy_lighttpd_issuer
=
"
${
DEPLOY_LIGHTTPD_ISSUER_DEFAULT
}
"
fi
# RELOAD is optional. If not provided then assume "${DEPLOY_LIGHTTPD_RELOAD_DEFAULT}"
_getdeployconf DEPLOY_LIGHTTPD_RELOAD
_debug2 DEPLOY_LIGHTTPD_RELOAD
"
${
DEPLOY_LIGHTTPD_RELOAD
}
"
if
[
-n
"
${
DEPLOY_LIGHTTPD_RELOAD
}
"
]
;
then
Le_Deploy_lighttpd_reload
=
"
${
DEPLOY_LIGHTTPD_RELOAD
}
"
_savedomainconf Le_Deploy_lighttpd_reload
"
${
Le_Deploy_lighttpd_reload
}
"
elif
[
-z
"
${
Le_Deploy_lighttpd_reload
}
"
]
;
then
Le_Deploy_lighttpd_reload
=
"
${
DEPLOY_LIGHTTPD_RELOAD_DEFAULT
}
"
fi
# Set the suffix depending if we are creating a bundle or not
if
[
"
${
Le_Deploy_lighttpd_bundle
}
"
=
"yes"
]
;
then
_info
"Bundle creation requested"
# Initialise $Le_Keylength if its not already set
if
[
-z
"
${
Le_Keylength
}
"
]
;
then
Le_Keylength
=
""
fi
if
_isEccKey
"
${
Le_Keylength
}
"
;
then
_info
"ECC key type detected"
_suffix
=
".ecdsa"
else
_info
"RSA key type detected"
_suffix
=
".rsa"
fi
else
_suffix
=
""
fi
_debug _suffix
"
${
_suffix
}
"
# Set variables for later
_pem
=
"
${
Le_Deploy_lighttpd_pem_path
}
/
${
Le_Deploy_lighttpd_pem_name
}${
_suffix
}
"
_issuer
=
"
${
_pem
}
.issuer"
_ocsp
=
"
${
_pem
}
.ocsp"
_reload
=
"
${
Le_Deploy_lighttpd_reload
}
"
_info
"Deploying PEM file"
# Create a temporary PEM file
_temppem
=
"
$(
_mktemp
)
"
_debug _temppem
"
${
_temppem
}
"
cat
"
${
_ckey
}
"
"
${
_ccert
}
"
"
${
_cca
}
"
>
"
${
_temppem
}
"
_ret
=
"
$?
"
# Check that we could create the temporary file
if
[
"
${
_ret
}
"
!=
"0"
]
;
then
_err
"Error code
${
_ret
}
returned during PEM file creation"
[
-f
"
${
_temppem
}
"
]
&&
rm
-f
"
${
_temppem
}
"
return
${
_ret
}
fi
# Move PEM file into place
_info
"Moving new certificate into place"
_debug _pem
"
${
_pem
}
"
cat
"
${
_temppem
}
"
>
"
${
_pem
}
"
_ret
=
$?
# Clean up temp file
[
-f
"
${
_temppem
}
"
]
&&
rm
-f
"
${
_temppem
}
"
# Deal with any failure of moving PEM file into place
if
[
"
${
_ret
}
"
!=
"0"
]
;
then
_err
"Error code
${
_ret
}
returned while moving new certificate into place"
return
${
_ret
}
fi
# Update .issuer file if requested
if
[
"
${
Le_Deploy_lighttpd_issuer
}
"
=
"yes"
]
;
then
_info
"Updating .issuer file"
_debug _issuer
"
${
_issuer
}
"
cat
"
${
_cca
}
"
>
"
${
_issuer
}
"
_ret
=
"
$?
"
if
[
"
${
_ret
}
"
!=
"0"
]
;
then
_err
"Error code
${
_ret
}
returned while copying issuer/CA certificate into place"
return
${
_ret
}
fi
else
[
-f
"
${
_issuer
}
"
]
&&
_err
"Issuer file update not requested but .issuer file exists"
fi
# Update .ocsp file if certificate was requested with --ocsp/--ocsp-must-staple option
if
[
-z
"
${
Le_OCSP_Staple
}
"
]
;
then
Le_OCSP_Staple
=
"0"
fi
if
[
"
${
Le_OCSP_Staple
}
"
=
"1"
]
;
then
_info
"Updating OCSP stapling info"
_debug _ocsp
"
${
_ocsp
}
"
_info
"Extracting OCSP URL"
_ocsp_url
=
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-noout
-ocsp_uri
-in
"
${
_pem
}
"
)
_debug _ocsp_url
"
${
_ocsp_url
}
"
# Only process OCSP if URL was present
if
[
"
${
_ocsp_url
}
"
!=
""
]
;
then
# Extract the hostname from the OCSP URL
_info
"Extracting OCSP URL"
_ocsp_host
=
$(
echo
"
${
_ocsp_url
}
"
|
cut
-d
/
-f3
)
_debug _ocsp_host
"
${
_ocsp_host
}
"
# Only process the certificate if we have a .issuer file
if
[
-r
"
${
_issuer
}
"
]
;
then
# Check if issuer cert is also a root CA cert
_subjectdn
=
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-in
"
${
_issuer
}
"
-subject
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_debug _subjectdn
"
${
_subjectdn
}
"
_issuerdn
=
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
x509
-in
"
${
_issuer
}
"
-issuer
-noout
|
cut
-d
'/'
-f2
,3,4,5,6,7,8,9,10
)
_debug _issuerdn
"
${
_issuerdn
}
"
_info
"Requesting OCSP response"
# If the issuer is a CA cert then our command line has "-CAfile" added
if
[
"
${
_subjectdn
}
"
=
"
${
_issuerdn
}
"
]
;
then
_cafile_argument
=
"-CAfile
\"
${
_issuer
}
\"
"
else
_cafile_argument
=
""
fi
_debug _cafile_argument
"
${
_cafile_argument
}
"
# if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
_openssl_version
=
$(
${
ACME_OPENSSL_BIN
:-
openssl
}
version |
cut
-d
' '
-f2
)
_debug _openssl_version
"
${
_openssl_version
}
"
_openssl_major
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f1
)
_openssl_minor
=
$(
echo
"
${
_openssl_version
}
"
|
cut
-d
'.'
-f2
)
if
[
"
${
_openssl_major
}
"
-eq
"1"
]
&&
[
"
${
_openssl_minor
}
"
-ge
"1"
]
||
[
"
${
_openssl_major
}
"
-ge
"2"
]
;
then
_header_sep
=
"="
else
_header_sep
=
" "
fi
# Request the OCSP response from the issuer and store it
_openssl_ocsp_cmd
=
"
${
ACME_OPENSSL_BIN
:-
openssl
}
ocsp
\
-issuer
\"
${
_issuer
}
\"
\
-cert
\"
${
_pem
}
\"
\
-url
\"
${
_ocsp_url
}
\"
\
-header Host
${
_header_sep
}
\"
${
_ocsp_host
}
\"
\
-respout
\"
${
_ocsp
}
\"
\
-verify_other
\"
${
_issuer
}
\"
\
${
_cafile_argument
}
\
| grep -q
\"
${
_pem
}
: good
\"
"
_debug _openssl_ocsp_cmd
"
${
_openssl_ocsp_cmd
}
"
eval
"
${
_openssl_ocsp_cmd
}
"
_ret
=
$?
else
# Non fatal: No issuer file was present so no OCSP stapling file created
_err
"OCSP stapling in use but no .issuer file was present"
fi
else
# Non fatal: No OCSP url was found int the certificate
_err
"OCSP update requested but no OCSP URL was found in certificate"
fi
# Non fatal: Check return code of openssl command
if
[
"
${
_ret
}
"
!=
"0"
]
;
then
_err
"Updating OCSP stapling failed with return code
${
_ret
}
"
fi
else
# An OCSP file was already present but certificate did not have OCSP extension
if
[
-f
"
${
_ocsp
}
"
]
;
then
_err
"OCSP was not requested but .ocsp file exists."
# Could remove the file at this step, although Lighttpd just ignores it in this case
# rm -f "${_ocsp}" || _err "Problem removing stale .ocsp file"
fi
fi
# Reload Lighttpd
_debug _reload
"
${
_reload
}
"
eval
"
${
_reload
}
"
_ret
=
$?
if
[
"
${
_ret
}
"
!=
"0"
]
;
then
_err
"Error code
${
_ret
}
during reload"
return
${
_ret
}
else
_info
"Reload successful"
fi
return
0
}
deploy/ssh.sh
View file @
fba6de76
...
@@ -35,11 +35,6 @@ ssh_deploy() {
...
@@ -35,11 +35,6 @@ ssh_deploy() {
_cfullchain
=
"
$5
"
_cfullchain
=
"
$5
"
_deploy_ssh_servers
=
""
_deploy_ssh_servers
=
""
if
[
-f
"
$DOMAIN_CONF
"
]
;
then
# shellcheck disable=SC1090
.
"
$DOMAIN_CONF
"
fi
_debug _cdomain
"
$_cdomain
"
_debug _cdomain
"
$_cdomain
"
_debug _ckey
"
$_ckey
"
_debug _ckey
"
$_ckey
"
_debug _ccert
"
$_ccert
"
_debug _ccert
"
$_ccert
"
...
@@ -47,6 +42,8 @@ ssh_deploy() {
...
@@ -47,6 +42,8 @@ ssh_deploy() {
_debug _cfullchain
"
$_cfullchain
"
_debug _cfullchain
"
$_cfullchain
"
# USER is required to login by SSH to remote host.
# USER is required to login by SSH to remote host.
_getdeployconf DEPLOY_SSH_USER
_debug2 DEPLOY_SSH_USER
"
$DEPLOY_SSH_USER
"
if
[
-z
"
$DEPLOY_SSH_USER
"
]
;
then
if
[
-z
"
$DEPLOY_SSH_USER
"
]
;
then
if
[
-z
"
$Le_Deploy_ssh_user
"
]
;
then
if
[
-z
"
$Le_Deploy_ssh_user
"
]
;
then
_err
"DEPLOY_SSH_USER not defined."
_err
"DEPLOY_SSH_USER not defined."
...
@@ -58,6 +55,8 @@ ssh_deploy() {
...
@@ -58,6 +55,8 @@ ssh_deploy() {
fi
fi
# SERVER is optional. If not provided then use _cdomain
# SERVER is optional. If not provided then use _cdomain
_getdeployconf DEPLOY_SSH_SERVER
_debug2 DEPLOY_SSH_SERVER
"
$DEPLOY_SSH_SERVER
"
if
[
-n
"
$DEPLOY_SSH_SERVER
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_SERVER
"
]
;
then
Le_Deploy_ssh_server
=
"
$DEPLOY_SSH_SERVER
"
Le_Deploy_ssh_server
=
"
$DEPLOY_SSH_SERVER
"
_savedomainconf Le_Deploy_ssh_server
"
$Le_Deploy_ssh_server
"
_savedomainconf Le_Deploy_ssh_server
"
$Le_Deploy_ssh_server
"
...
@@ -66,6 +65,8 @@ ssh_deploy() {
...
@@ -66,6 +65,8 @@ ssh_deploy() {
fi
fi
# CMD is optional. If not provided then use ssh
# CMD is optional. If not provided then use ssh
_getdeployconf DEPLOY_SSH_CMD
_debug2 DEPLOY_SSH_CMD
"
$DEPLOY_SSH_CMD
"
if
[
-n
"
$DEPLOY_SSH_CMD
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_CMD
"
]
;
then
Le_Deploy_ssh_cmd
=
"
$DEPLOY_SSH_CMD
"
Le_Deploy_ssh_cmd
=
"
$DEPLOY_SSH_CMD
"
_savedomainconf Le_Deploy_ssh_cmd
"
$Le_Deploy_ssh_cmd
"
_savedomainconf Le_Deploy_ssh_cmd
"
$Le_Deploy_ssh_cmd
"
...
@@ -74,6 +75,8 @@ ssh_deploy() {
...
@@ -74,6 +75,8 @@ ssh_deploy() {
fi
fi
# BACKUP is optional. If not provided then default to previously saved value or yes.
# BACKUP is optional. If not provided then default to previously saved value or yes.
_getdeployconf DEPLOY_SSH_BACKUP
_debug2 DEPLOY_SSH_BACKUP
"
$DEPLOY_SSH_BACKUP
"
if
[
"
$DEPLOY_SSH_BACKUP
"
=
"no"
]
;
then
if
[
"
$DEPLOY_SSH_BACKUP
"
=
"no"
]
;
then
Le_Deploy_ssh_backup
=
"no"
Le_Deploy_ssh_backup
=
"no"
elif
[
-z
"
$Le_Deploy_ssh_backup
"
]
||
[
"
$DEPLOY_SSH_BACKUP
"
=
"yes"
]
;
then
elif
[
-z
"
$Le_Deploy_ssh_backup
"
]
||
[
"
$DEPLOY_SSH_BACKUP
"
=
"yes"
]
;
then
...
@@ -82,6 +85,8 @@ ssh_deploy() {
...
@@ -82,6 +85,8 @@ ssh_deploy() {
_savedomainconf Le_Deploy_ssh_backup
"
$Le_Deploy_ssh_backup
"
_savedomainconf Le_Deploy_ssh_backup
"
$Le_Deploy_ssh_backup
"
# BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
# BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
_getdeployconf DEPLOY_SSH_BACKUP_PATH
_debug2 DEPLOY_SSH_BACKUP_PATH
"
$DEPLOY_SSH_BACKUP_PATH
"
if
[
-n
"
$DEPLOY_SSH_BACKUP_PATH
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_BACKUP_PATH
"
]
;
then
Le_Deploy_ssh_backup_path
=
"
$DEPLOY_SSH_BACKUP_PATH
"
Le_Deploy_ssh_backup_path
=
"
$DEPLOY_SSH_BACKUP_PATH
"
elif
[
-z
"
$Le_Deploy_ssh_backup_path
"
]
;
then
elif
[
-z
"
$Le_Deploy_ssh_backup_path
"
]
;
then
...
@@ -91,6 +96,8 @@ ssh_deploy() {
...
@@ -91,6 +96,8 @@ ssh_deploy() {
# MULTI_CALL is optional. If not provided then default to previously saved
# MULTI_CALL is optional. If not provided then default to previously saved
# value (which may be undefined... equivalent to "no").
# value (which may be undefined... equivalent to "no").
_getdeployconf DEPLOY_SSH_MULTI_CALL
_debug2 DEPLOY_SSH_MULTI_CALL
"
$DEPLOY_SSH_MULTI_CALL
"
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
if
[
"
$DEPLOY_SSH_MULTI_CALL
"
=
"yes"
]
;
then
Le_Deploy_ssh_multi_call
=
"yes"
Le_Deploy_ssh_multi_call
=
"yes"
_savedomainconf Le_Deploy_ssh_multi_call
"
$Le_Deploy_ssh_multi_call
"
_savedomainconf Le_Deploy_ssh_multi_call
"
$Le_Deploy_ssh_multi_call
"
...
@@ -141,6 +148,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
...
@@ -141,6 +148,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
# KEYFILE is optional.
# KEYFILE is optional.
# If provided then private key will be copied to provided filename.
# If provided then private key will be copied to provided filename.
_getdeployconf DEPLOY_SSH_KEYFILE
_debug2 DEPLOY_SSH_KEYFILE
"
$DEPLOY_SSH_KEYFILE
"
if
[
-n
"
$DEPLOY_SSH_KEYFILE
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_KEYFILE
"
]
;
then
Le_Deploy_ssh_keyfile
=
"
$DEPLOY_SSH_KEYFILE
"
Le_Deploy_ssh_keyfile
=
"
$DEPLOY_SSH_KEYFILE
"
_savedomainconf Le_Deploy_ssh_keyfile
"
$Le_Deploy_ssh_keyfile
"
_savedomainconf Le_Deploy_ssh_keyfile
"
$Le_Deploy_ssh_keyfile
"
...
@@ -163,6 +172,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
...
@@ -163,6 +172,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
# CERTFILE is optional.
# CERTFILE is optional.
# If provided then certificate will be copied or appended to provided filename.
# If provided then certificate will be copied or appended to provided filename.
_getdeployconf DEPLOY_SSH_CERTFILE
_debug2 DEPLOY_SSH_CERTFILE
"
$DEPLOY_SSH_CERTFILE
"
if
[
-n
"
$DEPLOY_SSH_CERTFILE
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_CERTFILE
"
]
;
then
Le_Deploy_ssh_certfile
=
"
$DEPLOY_SSH_CERTFILE
"
Le_Deploy_ssh_certfile
=
"
$DEPLOY_SSH_CERTFILE
"
_savedomainconf Le_Deploy_ssh_certfile
"
$Le_Deploy_ssh_certfile
"
_savedomainconf Le_Deploy_ssh_certfile
"
$Le_Deploy_ssh_certfile
"
...
@@ -189,6 +200,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
...
@@ -189,6 +200,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
# CAFILE is optional.
# CAFILE is optional.
# If provided then CA intermediate certificate will be copied or appended to provided filename.
# If provided then CA intermediate certificate will be copied or appended to provided filename.
_getdeployconf DEPLOY_SSH_CAFILE
_debug2 DEPLOY_SSH_CAFILE
"
$DEPLOY_SSH_CAFILE
"
if
[
-n
"
$DEPLOY_SSH_CAFILE
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_CAFILE
"
]
;
then
Le_Deploy_ssh_cafile
=
"
$DEPLOY_SSH_CAFILE
"
Le_Deploy_ssh_cafile
=
"
$DEPLOY_SSH_CAFILE
"
_savedomainconf Le_Deploy_ssh_cafile
"
$Le_Deploy_ssh_cafile
"
_savedomainconf Le_Deploy_ssh_cafile
"
$Le_Deploy_ssh_cafile
"
...
@@ -216,6 +229,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
...
@@ -216,6 +229,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
# FULLCHAIN is optional.
# FULLCHAIN is optional.
# If provided then fullchain certificate will be copied or appended to provided filename.
# If provided then fullchain certificate will be copied or appended to provided filename.
_getdeployconf DEPLOY_SSH_FULLCHAIN
_debug2 DEPLOY_SSH_FULLCHAIN
"
$DEPLOY_SSH_FULLCHAIN
"
if
[
-n
"
$DEPLOY_SSH_FULLCHAIN
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_FULLCHAIN
"
]
;
then
Le_Deploy_ssh_fullchain
=
"
$DEPLOY_SSH_FULLCHAIN
"
Le_Deploy_ssh_fullchain
=
"
$DEPLOY_SSH_FULLCHAIN
"
_savedomainconf Le_Deploy_ssh_fullchain
"
$Le_Deploy_ssh_fullchain
"
_savedomainconf Le_Deploy_ssh_fullchain
"
$Le_Deploy_ssh_fullchain
"
...
@@ -244,6 +259,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
...
@@ -244,6 +259,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
# REMOTE_CMD is optional.
# REMOTE_CMD is optional.
# If provided then this command will be executed on remote host.
# If provided then this command will be executed on remote host.
_getdeployconf DEPLOY_SSH_REMOTE_CMD
_debug2 DEPLOY_SSH_REMOTE_CMD
"
$DEPLOY_SSH_REMOTE_CMD
"
if
[
-n
"
$DEPLOY_SSH_REMOTE_CMD
"
]
;
then
if
[
-n
"
$DEPLOY_SSH_REMOTE_CMD
"
]
;
then
Le_Deploy_ssh_remote_cmd
=
"
$DEPLOY_SSH_REMOTE_CMD
"
Le_Deploy_ssh_remote_cmd
=
"
$DEPLOY_SSH_REMOTE_CMD
"
_savedomainconf Le_Deploy_ssh_remote_cmd
"
$Le_Deploy_ssh_remote_cmd
"
_savedomainconf Le_Deploy_ssh_remote_cmd
"
$Le_Deploy_ssh_remote_cmd
"
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment