Mirror of acme.sh — A pure Unix shell script implementing ACME client protocol
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

acme.sh 186KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754475547564757475847594760476147624763476447654766476747684769477047714772477347744775477647774778477947804781478247834784478547864787478847894790479147924793479447954796479747984799480048014802480348044805480648074808480948104811481248134814481548164817481848194820482148224823482448254826482748284829483048314832483348344835483648374838483948404841484248434844484548464847484848494850485148524853485448554856485748584859486048614862486348644865486648674868486948704871487248734874487548764877487848794880488148824883488448854886488748884889489048914892489348944895489648974898489949004901490249034904490549064907490849094910491149124913491449154916491749184919492049214922492349244925492649274928492949304931493249334934493549364937493849394940494149424943494449454946494749484949495049514952495349544955495649574958495949604961496249634964496549664967496849694970497149724973497449754976497749784979498049814982498349844985498649874988498949904991499249934994499549964997499849995000500150025003500450055006500750085009501050115012501350145015501650175018501950205021502250235024502550265027502850295030503150325033503450355036503750385039504050415042504350445045504650475048504950505051505250535054505550565057505850595060506150625063506450655066506750685069507050715072507350745075507650775078507950805081508250835084508550865087508850895090509150925093509450955096509750985099510051015102510351045105510651075108510951105111511251135114511551165117511851195120512151225123512451255126512751285129513051315132513351345135513651375138513951405141514251435144514551465147514851495150515151525153515451555156515751585159516051615162516351645165516651675168516951705171517251735174517551765177517851795180518151825183518451855186518751885189519051915192519351945195519651975198519952005201520252035204520552065207520852095210521152125213521452155216521752185219522052215222522352245225522652275228522952305231523252335234523552365237523852395240524152425243524452455246524752485249525052515252525352545255525652575258525952605261526252635264526552665267526852695270527152725273527452755276527752785279528052815282528352845285528652875288528952905291529252935294529552965297529852995300530153025303530453055306530753085309531053115312531353145315531653175318531953205321532253235324532553265327532853295330533153325333533453355336533753385339534053415342534353445345534653475348534953505351535253535354535553565357535853595360536153625363536453655366536753685369537053715372537353745375537653775378537953805381538253835384538553865387538853895390539153925393539453955396539753985399540054015402540354045405540654075408540954105411541254135414541554165417541854195420542154225423542454255426542754285429543054315432543354345435543654375438543954405441544254435444544554465447544854495450545154525453545454555456545754585459546054615462546354645465546654675468546954705471547254735474547554765477547854795480548154825483548454855486548754885489549054915492549354945495549654975498549955005501550255035504550555065507550855095510551155125513551455155516551755185519552055215522552355245525552655275528552955305531553255335534553555365537553855395540554155425543554455455546554755485549555055515552555355545555555655575558555955605561556255635564556555665567556855695570557155725573557455755576557755785579558055815582558355845585558655875588558955905591559255935594559555965597559855995600560156025603560456055606560756085609561056115612561356145615561656175618561956205621562256235624562556265627562856295630563156325633563456355636563756385639564056415642564356445645564656475648564956505651565256535654565556565657565856595660566156625663566456655666566756685669567056715672567356745675567656775678567956805681568256835684568556865687568856895690569156925693569456955696569756985699570057015702570357045705570657075708570957105711571257135714571557165717571857195720572157225723572457255726572757285729573057315732573357345735573657375738573957405741574257435744574557465747574857495750575157525753575457555756575757585759576057615762576357645765576657675768576957705771577257735774577557765777577857795780578157825783578457855786578757885789579057915792579357945795579657975798579958005801580258035804580558065807580858095810581158125813581458155816581758185819582058215822582358245825582658275828582958305831583258335834583558365837583858395840584158425843584458455846584758485849585058515852585358545855585658575858585958605861586258635864586558665867586858695870587158725873587458755876587758785879588058815882588358845885588658875888588958905891589258935894589558965897589858995900590159025903590459055906590759085909591059115912591359145915591659175918591959205921592259235924592559265927592859295930593159325933593459355936593759385939594059415942594359445945594659475948594959505951595259535954595559565957595859595960596159625963596459655966596759685969597059715972597359745975597659775978597959805981598259835984598559865987598859895990599159925993599459955996599759985999600060016002600360046005600660076008600960106011601260136014601560166017601860196020602160226023602460256026602760286029603060316032603360346035603660376038603960406041604260436044604560466047604860496050605160526053605460556056605760586059606060616062606360646065606660676068606960706071607260736074607560766077607860796080608160826083608460856086608760886089609060916092609360946095609660976098609961006101610261036104610561066107610861096110611161126113611461156116611761186119612061216122612361246125612661276128612961306131613261336134613561366137613861396140614161426143614461456146614761486149615061516152615361546155615661576158615961606161616261636164616561666167616861696170617161726173617461756176617761786179618061816182618361846185618661876188618961906191619261936194619561966197619861996200620162026203620462056206620762086209621062116212621362146215621662176218621962206221622262236224622562266227622862296230623162326233623462356236623762386239624062416242624362446245624662476248624962506251625262536254625562566257625862596260626162626263626462656266626762686269627062716272627362746275627662776278627962806281628262836284628562866287628862896290629162926293629462956296629762986299630063016302630363046305630663076308630963106311631263136314631563166317631863196320632163226323632463256326632763286329633063316332633363346335633663376338633963406341634263436344634563466347634863496350635163526353635463556356635763586359636063616362636363646365636663676368636963706371637263736374637563766377637863796380638163826383638463856386638763886389639063916392639363946395639663976398639964006401640264036404640564066407640864096410641164126413641464156416641764186419642064216422642364246425642664276428642964306431643264336434643564366437643864396440644164426443644464456446644764486449645064516452645364546455645664576458645964606461646264636464646564666467646864696470647164726473647464756476647764786479648064816482648364846485648664876488648964906491649264936494649564966497649864996500650165026503650465056506650765086509651065116512651365146515651665176518651965206521652265236524652565266527652865296530653165326533653465356536653765386539654065416542654365446545654665476548654965506551655265536554655565566557655865596560656165626563656465656566656765686569657065716572657365746575657665776578657965806581658265836584658565866587658865896590659165926593659465956596659765986599660066016602660366046605660666076608660966106611661266136614661566166617661866196620662166226623662466256626662766286629663066316632663366346635663666376638663966406641664266436644664566466647664866496650665166526653665466556656665766586659666066616662666366646665666666676668666966706671667266736674667566766677667866796680668166826683668466856686668766886689669066916692669366946695669666976698669967006701670267036704670567066707670867096710671167126713671467156716671767186719672067216722672367246725672667276728672967306731673267336734673567366737673867396740674167426743674467456746674767486749675067516752675367546755675667576758675967606761676267636764676567666767676867696770677167726773677467756776677767786779678067816782678367846785678667876788678967906791679267936794679567966797679867996800680168026803680468056806680768086809681068116812681368146815681668176818681968206821682268236824682568266827682868296830683168326833683468356836683768386839684068416842684368446845684668476848684968506851685268536854685568566857685868596860686168626863686468656866686768686869687068716872687368746875687668776878687968806881688268836884688568866887688868896890689168926893689468956896689768986899690069016902690369046905690669076908690969106911691269136914691569166917691869196920692169226923692469256926692769286929693069316932693369346935693669376938693969406941694269436944694569466947694869496950695169526953695469556956695769586959696069616962696369646965
  1. #!/usr/bin/env sh
  2. VER=2.8.3
  3. PROJECT_NAME="acme.sh"
  4. PROJECT_ENTRY="acme.sh"
  5. PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
  6. DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
  7. _WINDOWS_SCHEDULER_NAME="$PROJECT_NAME.cron"
  8. _SCRIPT_="$0"
  9. _SUB_FOLDER_NOTIFY="notify"
  10. _SUB_FOLDER_DNSAPI="dnsapi"
  11. _SUB_FOLDER_DEPLOY="deploy"
  12. _SUB_FOLDERS="$_SUB_FOLDER_DNSAPI $_SUB_FOLDER_DEPLOY $_SUB_FOLDER_NOTIFY"
  13. LETSENCRYPT_CA_V1="https://acme-v01.api.letsencrypt.org/directory"
  14. LETSENCRYPT_STAGING_CA_V1="https://acme-staging.api.letsencrypt.org/directory"
  15. LETSENCRYPT_CA_V2="https://acme-v02.api.letsencrypt.org/directory"
  16. LETSENCRYPT_STAGING_CA_V2="https://acme-staging-v02.api.letsencrypt.org/directory"
  17. DEFAULT_CA=$LETSENCRYPT_CA_V2
  18. DEFAULT_STAGING_CA=$LETSENCRYPT_STAGING_CA_V2
  19. DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
  20. DEFAULT_ACCOUNT_EMAIL=""
  21. DEFAULT_ACCOUNT_KEY_LENGTH=2048
  22. DEFAULT_DOMAIN_KEY_LENGTH=2048
  23. DEFAULT_OPENSSL_BIN="openssl"
  24. _OLD_CA_HOST="https://acme-v01.api.letsencrypt.org"
  25. _OLD_STAGE_CA_HOST="https://acme-staging.api.letsencrypt.org"
  26. VTYPE_HTTP="http-01"
  27. VTYPE_DNS="dns-01"
  28. VTYPE_ALPN="tls-alpn-01"
  29. LOCAL_ANY_ADDRESS="0.0.0.0"
  30. DEFAULT_RENEW=60
  31. DEFAULT_DNS_SLEEP=120
  32. NO_VALUE="no"
  33. W_DNS="dns"
  34. W_ALPN="alpn"
  35. DNS_ALIAS_PREFIX="="
  36. MODE_STATELESS="stateless"
  37. STATE_VERIFIED="verified_ok"
  38. NGINX="nginx:"
  39. NGINX_START="#ACME_NGINX_START"
  40. NGINX_END="#ACME_NGINX_END"
  41. BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  42. END_CSR="-----END CERTIFICATE REQUEST-----"
  43. BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  44. END_CERT="-----END CERTIFICATE-----"
  45. CONTENT_TYPE_JSON="application/jose+json"
  46. RENEW_SKIP=2
  47. B64CONF_START="__ACME_BASE64__START_"
  48. B64CONF_END="__ACME_BASE64__END_"
  49. ECC_SEP="_"
  50. ECC_SUFFIX="${ECC_SEP}ecc"
  51. LOG_LEVEL_1=1
  52. LOG_LEVEL_2=2
  53. LOG_LEVEL_3=3
  54. DEFAULT_LOG_LEVEL="$LOG_LEVEL_1"
  55. DEBUG_LEVEL_1=1
  56. DEBUG_LEVEL_2=2
  57. DEBUG_LEVEL_3=3
  58. DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
  59. DEBUG_LEVEL_NONE=0
  60. HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
  61. SYSLOG_ERROR="user.error"
  62. SYSLOG_INFO="user.info"
  63. SYSLOG_DEBUG="user.debug"
  64. #error
  65. SYSLOG_LEVEL_ERROR=3
  66. #info
  67. SYSLOG_LEVEL_INFO=6
  68. #debug
  69. SYSLOG_LEVEL_DEBUG=7
  70. #debug2
  71. SYSLOG_LEVEL_DEBUG_2=8
  72. #debug3
  73. SYSLOG_LEVEL_DEBUG_3=9
  74. SYSLOG_LEVEL_DEFAULT=$SYSLOG_LEVEL_ERROR
  75. #none
  76. SYSLOG_LEVEL_NONE=0
  77. NOTIFY_LEVEL_DISABLE=0
  78. NOTIFY_LEVEL_ERROR=1
  79. NOTIFY_LEVEL_RENEW=2
  80. NOTIFY_LEVEL_SKIP=3
  81. NOTIFY_LEVEL_DEFAULT=$NOTIFY_LEVEL_RENEW
  82. NOTIFY_MODE_BULK=0
  83. NOTIFY_MODE_CERT=1
  84. NOTIFY_MODE_DEFAULT=$NOTIFY_MODE_BULK
  85. _DEBUG_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh"
  86. _PREPARE_LINK="https://github.com/Neilpang/acme.sh/wiki/Install-preparations"
  87. _STATELESS_WIKI="https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode"
  88. _DNS_ALIAS_WIKI="https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode"
  89. _DNS_MANUAL_WIKI="https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode"
  90. _NOTIFY_WIKI="https://github.com/Neilpang/acme.sh/wiki/notify"
  91. _SUDO_WIKI="https://github.com/Neilpang/acme.sh/wiki/sudo"
  92. _DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
  93. _DNS_MANUAL_WARN="It seems that you are using dns manual mode. please take care: $_DNS_MANUAL_ERR"
  94. _DNS_MANUAL_ERROR="It seems that you are using dns manual mode. Read this link first: $_DNS_MANUAL_WIKI"
  95. __INTERACTIVE=""
  96. if [ -t 1 ]; then
  97. __INTERACTIVE="1"
  98. fi
  99. __green() {
  100. if [ "${__INTERACTIVE}${ACME_NO_COLOR:-0}" = "10" -o "${ACME_FORCE_COLOR}" = "1" ]; then
  101. printf '\033[1;31;32m%b\033[0m' "$1"
  102. return
  103. fi
  104. printf -- "%b" "$1"
  105. }
  106. __red() {
  107. if [ "${__INTERACTIVE}${ACME_NO_COLOR:-0}" = "10" -o "${ACME_FORCE_COLOR}" = "1" ]; then
  108. printf '\033[1;31;40m%b\033[0m' "$1"
  109. return
  110. fi
  111. printf -- "%b" "$1"
  112. }
  113. _printargs() {
  114. _exitstatus="$?"
  115. if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
  116. printf -- "%s" "[$(date)] "
  117. fi
  118. if [ -z "$2" ]; then
  119. printf -- "%s" "$1"
  120. else
  121. printf -- "%s" "$1='$2'"
  122. fi
  123. printf "\n"
  124. # return the saved exit status
  125. return "$_exitstatus"
  126. }
  127. _dlg_versions() {
  128. echo "Diagnosis versions: "
  129. echo "openssl:$ACME_OPENSSL_BIN"
  130. if _exists "${ACME_OPENSSL_BIN:-openssl}"; then
  131. ${ACME_OPENSSL_BIN:-openssl} version 2>&1
  132. else
  133. echo "$ACME_OPENSSL_BIN doesn't exists."
  134. fi
  135. echo "apache:"
  136. if [ "$_APACHECTL" ] && _exists "$_APACHECTL"; then
  137. $_APACHECTL -V 2>&1
  138. else
  139. echo "apache doesn't exists."
  140. fi
  141. echo "nginx:"
  142. if _exists "nginx"; then
  143. nginx -V 2>&1
  144. else
  145. echo "nginx doesn't exists."
  146. fi
  147. echo "socat:"
  148. if _exists "socat"; then
  149. socat -h 2>&1
  150. else
  151. _debug "socat doesn't exists."
  152. fi
  153. }
  154. #class
  155. _syslog() {
  156. _exitstatus="$?"
  157. if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" = "$SYSLOG_LEVEL_NONE" ]; then
  158. return
  159. fi
  160. _logclass="$1"
  161. shift
  162. if [ -z "$__logger_i" ]; then
  163. if _contains "$(logger --help 2>&1)" "-i"; then
  164. __logger_i="logger -i"
  165. else
  166. __logger_i="logger"
  167. fi
  168. fi
  169. $__logger_i -t "$PROJECT_NAME" -p "$_logclass" "$(_printargs "$@")" >/dev/null 2>&1
  170. return "$_exitstatus"
  171. }
  172. _log() {
  173. [ -z "$LOG_FILE" ] && return
  174. _printargs "$@" >>"$LOG_FILE"
  175. }
  176. _info() {
  177. _log "$@"
  178. if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_INFO" ]; then
  179. _syslog "$SYSLOG_INFO" "$@"
  180. fi
  181. _printargs "$@"
  182. }
  183. _err() {
  184. _syslog "$SYSLOG_ERROR" "$@"
  185. _log "$@"
  186. if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
  187. printf -- "%s" "[$(date)] " >&2
  188. fi
  189. if [ -z "$2" ]; then
  190. __red "$1" >&2
  191. else
  192. __red "$1='$2'" >&2
  193. fi
  194. printf "\n" >&2
  195. return 1
  196. }
  197. _usage() {
  198. __red "$@" >&2
  199. printf "\n" >&2
  200. }
  201. _debug() {
  202. if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
  203. _log "$@"
  204. fi
  205. if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
  206. _syslog "$SYSLOG_DEBUG" "$@"
  207. fi
  208. if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
  209. _printargs "$@" >&2
  210. fi
  211. }
  212. #output the sensitive messages
  213. _secure_debug() {
  214. if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
  215. if [ "$OUTPUT_INSECURE" = "1" ]; then
  216. _log "$@"
  217. else
  218. _log "$1" "$HIDDEN_VALUE"
  219. fi
  220. fi
  221. if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
  222. _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
  223. fi
  224. if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
  225. if [ "$OUTPUT_INSECURE" = "1" ]; then
  226. _printargs "$@" >&2
  227. else
  228. _printargs "$1" "$HIDDEN_VALUE" >&2
  229. fi
  230. fi
  231. }
  232. _debug2() {
  233. if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
  234. _log "$@"
  235. fi
  236. if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
  237. _syslog "$SYSLOG_DEBUG" "$@"
  238. fi
  239. if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
  240. _printargs "$@" >&2
  241. fi
  242. }
  243. _secure_debug2() {
  244. if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
  245. if [ "$OUTPUT_INSECURE" = "1" ]; then
  246. _log "$@"
  247. else
  248. _log "$1" "$HIDDEN_VALUE"
  249. fi
  250. fi
  251. if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
  252. _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
  253. fi
  254. if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
  255. if [ "$OUTPUT_INSECURE" = "1" ]; then
  256. _printargs "$@" >&2
  257. else
  258. _printargs "$1" "$HIDDEN_VALUE" >&2
  259. fi
  260. fi
  261. }
  262. _debug3() {
  263. if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
  264. _log "$@"
  265. fi
  266. if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
  267. _syslog "$SYSLOG_DEBUG" "$@"
  268. fi
  269. if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
  270. _printargs "$@" >&2
  271. fi
  272. }
  273. _secure_debug3() {
  274. if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
  275. if [ "$OUTPUT_INSECURE" = "1" ]; then
  276. _log "$@"
  277. else
  278. _log "$1" "$HIDDEN_VALUE"
  279. fi
  280. fi
  281. if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
  282. _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
  283. fi
  284. if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
  285. if [ "$OUTPUT_INSECURE" = "1" ]; then
  286. _printargs "$@" >&2
  287. else
  288. _printargs "$1" "$HIDDEN_VALUE" >&2
  289. fi
  290. fi
  291. }
  292. _upper_case() {
  293. # shellcheck disable=SC2018,SC2019
  294. tr 'a-z' 'A-Z'
  295. }
  296. _lower_case() {
  297. # shellcheck disable=SC2018,SC2019
  298. tr 'A-Z' 'a-z'
  299. }
  300. _startswith() {
  301. _str="$1"
  302. _sub="$2"
  303. echo "$_str" | grep "^$_sub" >/dev/null 2>&1
  304. }
  305. _endswith() {
  306. _str="$1"
  307. _sub="$2"
  308. echo "$_str" | grep -- "$_sub\$" >/dev/null 2>&1
  309. }
  310. _contains() {
  311. _str="$1"
  312. _sub="$2"
  313. echo "$_str" | grep -- "$_sub" >/dev/null 2>&1
  314. }
  315. _hasfield() {
  316. _str="$1"
  317. _field="$2"
  318. _sep="$3"
  319. if [ -z "$_field" ]; then
  320. _usage "Usage: str field [sep]"
  321. return 1
  322. fi
  323. if [ -z "$_sep" ]; then
  324. _sep=","
  325. fi
  326. for f in $(echo "$_str" | tr "$_sep" ' '); do
  327. if [ "$f" = "$_field" ]; then
  328. _debug2 "'$_str' contains '$_field'"
  329. return 0 #contains ok
  330. fi
  331. done
  332. _debug2 "'$_str' does not contain '$_field'"
  333. return 1 #not contains
  334. }
  335. # str index [sep]
  336. _getfield() {
  337. _str="$1"
  338. _findex="$2"
  339. _sep="$3"
  340. if [ -z "$_findex" ]; then
  341. _usage "Usage: str field [sep]"
  342. return 1
  343. fi
  344. if [ -z "$_sep" ]; then
  345. _sep=","
  346. fi
  347. _ffi="$_findex"
  348. while [ "$_ffi" -gt "0" ]; do
  349. _fv="$(echo "$_str" | cut -d "$_sep" -f "$_ffi")"
  350. if [ "$_fv" ]; then
  351. printf -- "%s" "$_fv"
  352. return 0
  353. fi
  354. _ffi="$(_math "$_ffi" - 1)"
  355. done
  356. printf -- "%s" "$_str"
  357. }
  358. _exists() {
  359. cmd="$1"
  360. if [ -z "$cmd" ]; then
  361. _usage "Usage: _exists cmd"
  362. return 1
  363. fi
  364. if eval type type >/dev/null 2>&1; then
  365. eval type "$cmd" >/dev/null 2>&1
  366. elif command >/dev/null 2>&1; then
  367. command -v "$cmd" >/dev/null 2>&1
  368. else
  369. which "$cmd" >/dev/null 2>&1
  370. fi
  371. ret="$?"
  372. _debug3 "$cmd exists=$ret"
  373. return $ret
  374. }
  375. #a + b
  376. _math() {
  377. _m_opts="$@"
  378. printf "%s" "$(($_m_opts))"
  379. }
  380. _h_char_2_dec() {
  381. _ch=$1
  382. case "${_ch}" in
  383. a | A)
  384. printf "10"
  385. ;;
  386. b | B)
  387. printf "11"
  388. ;;
  389. c | C)
  390. printf "12"
  391. ;;
  392. d | D)
  393. printf "13"
  394. ;;
  395. e | E)
  396. printf "14"
  397. ;;
  398. f | F)
  399. printf "15"
  400. ;;
  401. *)
  402. printf "%s" "$_ch"
  403. ;;
  404. esac
  405. }
  406. _URGLY_PRINTF=""
  407. if [ "$(printf '\x41')" != 'A' ]; then
  408. _URGLY_PRINTF=1
  409. fi
  410. _ESCAPE_XARGS=""
  411. if _exists xargs && [ "$(printf %s '\\x41' | xargs printf)" = 'A' ]; then
  412. _ESCAPE_XARGS=1
  413. fi
  414. _h2b() {
  415. if _exists xxd && xxd -r -p 2>/dev/null; then
  416. return
  417. fi
  418. hex=$(cat)
  419. ic=""
  420. jc=""
  421. _debug2 _URGLY_PRINTF "$_URGLY_PRINTF"
  422. if [ -z "$_URGLY_PRINTF" ]; then
  423. if [ "$_ESCAPE_XARGS" ] && _exists xargs; then
  424. _debug2 "xargs"
  425. echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/g' | xargs printf
  426. else
  427. for h in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/ \1/g'); do
  428. if [ -z "$h" ]; then
  429. break
  430. fi
  431. printf "\x$h%s"
  432. done
  433. fi
  434. else
  435. for c in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\)/ \1/g'); do
  436. if [ -z "$ic" ]; then
  437. ic=$c
  438. continue
  439. fi
  440. jc=$c
  441. ic="$(_h_char_2_dec "$ic")"
  442. jc="$(_h_char_2_dec "$jc")"
  443. printf '\'"$(printf "%o" "$(_math "$ic" \* 16 + $jc)")""%s"
  444. ic=""
  445. jc=""
  446. done
  447. fi
  448. }
  449. _is_solaris() {
  450. _contains "${__OS__:=$(uname -a)}" "solaris" || _contains "${__OS__:=$(uname -a)}" "SunOS"
  451. }
  452. #_ascii_hex str
  453. #this can only process ascii chars, should only be used when od command is missing as a backup way.
  454. _ascii_hex() {
  455. _debug2 "Using _ascii_hex"
  456. _str="$1"
  457. _str_len=${#_str}
  458. _h_i=1
  459. while [ "$_h_i" -le "$_str_len" ]; do
  460. _str_c="$(printf "%s" "$_str" | cut -c "$_h_i")"
  461. printf " %02x" "'$_str_c"
  462. _h_i="$(_math "$_h_i" + 1)"
  463. done
  464. }
  465. #stdin output hexstr splited by one space
  466. #input:"abc"
  467. #output: " 61 62 63"
  468. _hex_dump() {
  469. if _exists od; then
  470. od -A n -v -t x1 | tr -s " " | sed 's/ $//' | tr -d "\r\t\n"
  471. elif _exists hexdump; then
  472. _debug3 "using hexdump"
  473. hexdump -v -e '/1 ""' -e '/1 " %02x" ""'
  474. elif _exists xxd; then
  475. _debug3 "using xxd"
  476. xxd -ps -c 20 -i | sed "s/ 0x/ /g" | tr -d ",\n" | tr -s " "
  477. else
  478. _debug3 "using _ascii_hex"
  479. str=$(cat)
  480. _ascii_hex "$str"
  481. fi
  482. }
  483. #url encode, no-preserved chars
  484. #A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
  485. #41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a
  486. #a b c d e f g h i j k l m n o p q r s t u v w x y z
  487. #61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a
  488. #0 1 2 3 4 5 6 7 8 9 - _ . ~
  489. #30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e
  490. #stdin stdout
  491. _url_encode() {
  492. _hex_str=$(_hex_dump)
  493. _debug3 "_url_encode"
  494. _debug3 "_hex_str" "$_hex_str"
  495. for _hex_code in $_hex_str; do
  496. #upper case
  497. case "${_hex_code}" in
  498. "41")
  499. printf "%s" "A"
  500. ;;
  501. "42")
  502. printf "%s" "B"
  503. ;;
  504. "43")
  505. printf "%s" "C"
  506. ;;
  507. "44")
  508. printf "%s" "D"
  509. ;;
  510. "45")
  511. printf "%s" "E"
  512. ;;
  513. "46")
  514. printf "%s" "F"
  515. ;;
  516. "47")
  517. printf "%s" "G"
  518. ;;
  519. "48")
  520. printf "%s" "H"
  521. ;;
  522. "49")
  523. printf "%s" "I"
  524. ;;
  525. "4a")
  526. printf "%s" "J"
  527. ;;
  528. "4b")
  529. printf "%s" "K"
  530. ;;
  531. "4c")
  532. printf "%s" "L"
  533. ;;
  534. "4d")
  535. printf "%s" "M"
  536. ;;
  537. "4e")
  538. printf "%s" "N"
  539. ;;
  540. "4f")
  541. printf "%s" "O"
  542. ;;
  543. "50")
  544. printf "%s" "P"
  545. ;;
  546. "51")
  547. printf "%s" "Q"
  548. ;;
  549. "52")
  550. printf "%s" "R"
  551. ;;
  552. "53")
  553. printf "%s" "S"
  554. ;;
  555. "54")
  556. printf "%s" "T"
  557. ;;
  558. "55")
  559. printf "%s" "U"
  560. ;;
  561. "56")
  562. printf "%s" "V"
  563. ;;
  564. "57")
  565. printf "%s" "W"
  566. ;;
  567. "58")
  568. printf "%s" "X"
  569. ;;
  570. "59")
  571. printf "%s" "Y"
  572. ;;
  573. "5a")
  574. printf "%s" "Z"
  575. ;;
  576. #lower case
  577. "61")
  578. printf "%s" "a"
  579. ;;
  580. "62")
  581. printf "%s" "b"
  582. ;;
  583. "63")
  584. printf "%s" "c"
  585. ;;
  586. "64")
  587. printf "%s" "d"
  588. ;;
  589. "65")
  590. printf "%s" "e"
  591. ;;
  592. "66")
  593. printf "%s" "f"
  594. ;;
  595. "67")
  596. printf "%s" "g"
  597. ;;
  598. "68")
  599. printf "%s" "h"
  600. ;;
  601. "69")
  602. printf "%s" "i"
  603. ;;
  604. "6a")
  605. printf "%s" "j"
  606. ;;
  607. "6b")
  608. printf "%s" "k"
  609. ;;
  610. "6c")
  611. printf "%s" "l"
  612. ;;
  613. "6d")
  614. printf "%s" "m"
  615. ;;
  616. "6e")
  617. printf "%s" "n"
  618. ;;
  619. "6f")
  620. printf "%s" "o"
  621. ;;
  622. "70")
  623. printf "%s" "p"
  624. ;;
  625. "71")
  626. printf "%s" "q"
  627. ;;
  628. "72")
  629. printf "%s" "r"
  630. ;;
  631. "73")
  632. printf "%s" "s"
  633. ;;
  634. "74")
  635. printf "%s" "t"
  636. ;;
  637. "75")
  638. printf "%s" "u"
  639. ;;
  640. "76")
  641. printf "%s" "v"
  642. ;;
  643. "77")
  644. printf "%s" "w"
  645. ;;
  646. "78")
  647. printf "%s" "x"
  648. ;;
  649. "79")
  650. printf "%s" "y"
  651. ;;
  652. "7a")
  653. printf "%s" "z"
  654. ;;
  655. #numbers
  656. "30")
  657. printf "%s" "0"
  658. ;;
  659. "31")
  660. printf "%s" "1"
  661. ;;
  662. "32")
  663. printf "%s" "2"
  664. ;;
  665. "33")
  666. printf "%s" "3"
  667. ;;
  668. "34")
  669. printf "%s" "4"
  670. ;;
  671. "35")
  672. printf "%s" "5"
  673. ;;
  674. "36")
  675. printf "%s" "6"
  676. ;;
  677. "37")
  678. printf "%s" "7"
  679. ;;
  680. "38")
  681. printf "%s" "8"
  682. ;;
  683. "39")
  684. printf "%s" "9"
  685. ;;
  686. "2d")
  687. printf "%s" "-"
  688. ;;
  689. "5f")
  690. printf "%s" "_"
  691. ;;
  692. "2e")
  693. printf "%s" "."
  694. ;;
  695. "7e")
  696. printf "%s" "~"
  697. ;;
  698. #other hex
  699. *)
  700. printf '%%%s' "$_hex_code"
  701. ;;
  702. esac
  703. done
  704. }
  705. _json_encode() {
  706. _j_str="$(sed 's/"/\\"/g' | sed "s/\r/\\r/g")"
  707. _debug3 "_json_encode"
  708. _debug3 "_j_str" "$_j_str"
  709. echo "$_j_str" | _hex_dump | _lower_case | sed 's/0a/5c 6e/g' | tr -d ' ' | _h2b | tr -d "\r\n"
  710. }
  711. #options file
  712. _sed_i() {
  713. options="$1"
  714. filename="$2"
  715. if [ -z "$filename" ]; then
  716. _usage "Usage:_sed_i options filename"
  717. return 1
  718. fi
  719. _debug2 options "$options"
  720. if sed -h 2>&1 | grep "\-i\[SUFFIX]" >/dev/null 2>&1; then
  721. _debug "Using sed -i"
  722. sed -i "$options" "$filename"
  723. else
  724. _debug "No -i support in sed"
  725. text="$(cat "$filename")"
  726. echo "$text" | sed "$options" >"$filename"
  727. fi
  728. }
  729. _egrep_o() {
  730. if ! egrep -o "$1" 2>/dev/null; then
  731. sed -n 's/.*\('"$1"'\).*/\1/p'
  732. fi
  733. }
  734. #Usage: file startline endline
  735. _getfile() {
  736. filename="$1"
  737. startline="$2"
  738. endline="$3"
  739. if [ -z "$endline" ]; then
  740. _usage "Usage: file startline endline"
  741. return 1
  742. fi
  743. i="$(grep -n -- "$startline" "$filename" | cut -d : -f 1)"
  744. if [ -z "$i" ]; then
  745. _err "Can not find start line: $startline"
  746. return 1
  747. fi
  748. i="$(_math "$i" + 1)"
  749. _debug i "$i"
  750. j="$(grep -n -- "$endline" "$filename" | cut -d : -f 1)"
  751. if [ -z "$j" ]; then
  752. _err "Can not find end line: $endline"
  753. return 1
  754. fi
  755. j="$(_math "$j" - 1)"
  756. _debug j "$j"
  757. sed -n "$i,${j}p" "$filename"
  758. }
  759. #Usage: multiline
  760. _base64() {
  761. [ "" ] #urgly
  762. if [ "$1" ]; then
  763. _debug3 "base64 multiline:'$1'"
  764. ${ACME_OPENSSL_BIN:-openssl} base64 -e
  765. else
  766. _debug3 "base64 single line."
  767. ${ACME_OPENSSL_BIN:-openssl} base64 -e | tr -d '\r\n'
  768. fi
  769. }
  770. #Usage: multiline
  771. _dbase64() {
  772. if [ "$1" ]; then
  773. ${ACME_OPENSSL_BIN:-openssl} base64 -d -A
  774. else
  775. ${ACME_OPENSSL_BIN:-openssl} base64 -d
  776. fi
  777. }
  778. #file
  779. _checkcert() {
  780. _cf="$1"
  781. if [ "$DEBUG" ]; then
  782. openssl x509 -noout -text -in "$_cf"
  783. else
  784. openssl x509 -noout -text -in "$_cf" >/dev/null 2>&1
  785. fi
  786. }
  787. #Usage: hashalg [outputhex]
  788. #Output Base64-encoded digest
  789. _digest() {
  790. alg="$1"
  791. if [ -z "$alg" ]; then
  792. _usage "Usage: _digest hashalg"
  793. return 1
  794. fi
  795. outputhex="$2"
  796. if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ] || [ "$alg" = "md5" ]; then
  797. if [ "$outputhex" ]; then
  798. ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hex | cut -d = -f 2 | tr -d ' '
  799. else
  800. ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -binary | _base64
  801. fi
  802. else
  803. _err "$alg is not supported yet"
  804. return 1
  805. fi
  806. }
  807. #Usage: hashalg secret_hex [outputhex]
  808. #Output binary hmac
  809. _hmac() {
  810. alg="$1"
  811. secret_hex="$2"
  812. outputhex="$3"
  813. if [ -z "$secret_hex" ]; then
  814. _usage "Usage: _hmac hashalg secret [outputhex]"
  815. return 1
  816. fi
  817. if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ]; then
  818. if [ "$outputhex" ]; then
  819. (${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)") | cut -d = -f 2 | tr -d ' '
  820. else
  821. ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" -binary 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)" -binary
  822. fi
  823. else
  824. _err "$alg is not supported yet"
  825. return 1
  826. fi
  827. }
  828. #Usage: keyfile hashalg
  829. #Output: Base64-encoded signature value
  830. _sign() {
  831. keyfile="$1"
  832. alg="$2"
  833. if [ -z "$alg" ]; then
  834. _usage "Usage: _sign keyfile hashalg"
  835. return 1
  836. fi
  837. _sign_openssl="${ACME_OPENSSL_BIN:-openssl} dgst -sign $keyfile "
  838. if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
  839. $_sign_openssl -$alg | _base64
  840. elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
  841. if ! _signedECText="$($_sign_openssl -sha$__ECC_KEY_LEN | ${ACME_OPENSSL_BIN:-openssl} asn1parse -inform DER)"; then
  842. _err "Sign failed: $_sign_openssl"
  843. _err "Key file: $keyfile"
  844. _err "Key content:$(wc -l <"$keyfile") lines"
  845. return 1
  846. fi
  847. _debug3 "_signedECText" "$_signedECText"
  848. _ec_r="$(echo "$_signedECText" | _head_n 2 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
  849. _debug3 "_ec_r" "$_ec_r"
  850. _ec_s="$(echo "$_signedECText" | _head_n 3 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
  851. _debug3 "_ec_s" "$_ec_s"
  852. printf "%s" "$_ec_r$_ec_s" | _h2b | _base64
  853. else
  854. _err "Unknown key file format."
  855. return 1
  856. fi
  857. }
  858. #keylength or isEcc flag (empty str => not ecc)
  859. _isEccKey() {
  860. _length="$1"
  861. if [ -z "$_length" ]; then
  862. return 1
  863. fi
  864. [ "$_length" != "1024" ] \
  865. && [ "$_length" != "2048" ] \
  866. && [ "$_length" != "3072" ] \
  867. && [ "$_length" != "4096" ] \
  868. && [ "$_length" != "8192" ]
  869. }
  870. # _createkey 2048|ec-256 file
  871. _createkey() {
  872. length="$1"
  873. f="$2"
  874. _debug2 "_createkey for file:$f"
  875. eccname="$length"
  876. if _startswith "$length" "ec-"; then
  877. length=$(printf "%s" "$length" | cut -d '-' -f 2-100)
  878. if [ "$length" = "256" ]; then
  879. eccname="prime256v1"
  880. fi
  881. if [ "$length" = "384" ]; then
  882. eccname="secp384r1"
  883. fi
  884. if [ "$length" = "521" ]; then
  885. eccname="secp521r1"
  886. fi
  887. fi
  888. if [ -z "$length" ]; then
  889. length=2048
  890. fi
  891. _debug "Use length $length"
  892. if ! touch "$f" >/dev/null 2>&1; then
  893. _f_path="$(dirname "$f")"
  894. _debug _f_path "$_f_path"
  895. if ! mkdir -p "$_f_path"; then
  896. _err "Can not create path: $_f_path"
  897. return 1
  898. fi
  899. fi
  900. if _isEccKey "$length"; then
  901. _debug "Using ec name: $eccname"
  902. if _opkey="$(${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -genkey 2>/dev/null)"; then
  903. echo "$_opkey" >"$f"
  904. else
  905. _err "error ecc key name: $eccname"
  906. return 1
  907. fi
  908. else
  909. _debug "Using RSA: $length"
  910. if _opkey="$(${ACME_OPENSSL_BIN:-openssl} genrsa "$length" 2>/dev/null)"; then
  911. echo "$_opkey" >"$f"
  912. else
  913. _err "error rsa key: $length"
  914. return 1
  915. fi
  916. fi
  917. if [ "$?" != "0" ]; then
  918. _err "Create key error."
  919. return 1
  920. fi
  921. }
  922. #domain
  923. _is_idn() {
  924. _is_idn_d="$1"
  925. _debug2 _is_idn_d "$_is_idn_d"
  926. _idn_temp=$(printf "%s" "$_is_idn_d" | tr -d '0-9' | tr -d 'a-z' | tr -d 'A-Z' | tr -d '*.,-_')
  927. _debug2 _idn_temp "$_idn_temp"
  928. [ "$_idn_temp" ]
  929. }
  930. #aa.com
  931. #aa.com,bb.com,cc.com
  932. _idn() {
  933. __idn_d="$1"
  934. if ! _is_idn "$__idn_d"; then
  935. printf "%s" "$__idn_d"
  936. return 0
  937. fi
  938. if _exists idn; then
  939. if _contains "$__idn_d" ','; then
  940. _i_first="1"
  941. for f in $(echo "$__idn_d" | tr ',' ' '); do
  942. [ -z "$f" ] && continue
  943. if [ -z "$_i_first" ]; then
  944. printf "%s" ","
  945. else
  946. _i_first=""
  947. fi
  948. idn --quiet "$f" | tr -d "\r\n"
  949. done
  950. else
  951. idn "$__idn_d" | tr -d "\r\n"
  952. fi
  953. else
  954. _err "Please install idn to process IDN names."
  955. fi
  956. }
  957. #_createcsr cn san_list keyfile csrfile conf acmeValidationv1
  958. _createcsr() {
  959. _debug _createcsr
  960. domain="$1"
  961. domainlist="$2"
  962. csrkey="$3"
  963. csr="$4"
  964. csrconf="$5"
  965. acmeValidationv1="$6"
  966. _debug2 domain "$domain"
  967. _debug2 domainlist "$domainlist"
  968. _debug2 csrkey "$csrkey"
  969. _debug2 csr "$csr"
  970. _debug2 csrconf "$csrconf"
  971. printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" >"$csrconf"
  972. if [ "$acmeValidationv1" ]; then
  973. domainlist="$(_idn "$domainlist")"
  974. printf -- "\nsubjectAltName=DNS:$domainlist" >>"$csrconf"
  975. elif [ -z "$domainlist" ] || [ "$domainlist" = "$NO_VALUE" ]; then
  976. #single domain
  977. _info "Single domain" "$domain"
  978. printf -- "\nsubjectAltName=DNS:$(_idn "$domain")" >>"$csrconf"
  979. else
  980. domainlist="$(_idn "$domainlist")"
  981. _debug2 domainlist "$domainlist"
  982. if _contains "$domainlist" ","; then
  983. alt="DNS:$(_idn "$domain"),DNS:$(echo "$domainlist" | sed "s/,,/,/g" | sed "s/,/,DNS:/g")"
  984. else
  985. alt="DNS:$(_idn "$domain"),DNS:$domainlist"
  986. fi
  987. #multi
  988. _info "Multi domain" "$alt"
  989. printf -- "\nsubjectAltName=$alt" >>"$csrconf"
  990. fi
  991. if [ "$Le_OCSP_Staple" ] || [ "$Le_OCSP_Stable" ]; then
  992. _savedomainconf Le_OCSP_Staple "$Le_OCSP_Staple"
  993. _cleardomainconf Le_OCSP_Stable
  994. printf -- "\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >>"$csrconf"
  995. fi
  996. if [ "$acmeValidationv1" ]; then
  997. printf "\n1.3.6.1.5.5.7.1.31=critical,DER:04:20:${acmeValidationv1}" >>"${csrconf}"
  998. fi
  999. _csr_cn="$(_idn "$domain")"
  1000. _debug2 _csr_cn "$_csr_cn"
  1001. if _contains "$(uname -a)" "MINGW"; then
  1002. ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "//CN=$_csr_cn" -config "$csrconf" -out "$csr"
  1003. else
  1004. ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "/CN=$_csr_cn" -config "$csrconf" -out "$csr"
  1005. fi
  1006. }
  1007. #_signcsr key csr conf cert
  1008. _signcsr() {
  1009. key="$1"
  1010. csr="$2"
  1011. conf="$3"
  1012. cert="$4"
  1013. _debug "_signcsr"
  1014. _msg="$(${ACME_OPENSSL_BIN:-openssl} x509 -req -days 365 -in "$csr" -signkey "$key" -extensions v3_req -extfile "$conf" -out "$cert" 2>&1)"
  1015. _ret="$?"
  1016. _debug "$_msg"
  1017. return $_ret
  1018. }
  1019. #_csrfile
  1020. _readSubjectFromCSR() {
  1021. _csrfile="$1"
  1022. if [ -z "$_csrfile" ]; then
  1023. _usage "_readSubjectFromCSR mycsr.csr"
  1024. return 1
  1025. fi
  1026. ${ACME_OPENSSL_BIN:-openssl} req -noout -in "$_csrfile" -subject | tr ',' "\n" | _egrep_o "CN *=.*" | cut -d = -f 2 | cut -d / -f 1 | tr -d ' \n'
  1027. }
  1028. #_csrfile
  1029. #echo comma separated domain list
  1030. _readSubjectAltNamesFromCSR() {
  1031. _csrfile="$1"
  1032. if [ -z "$_csrfile" ]; then
  1033. _usage "_readSubjectAltNamesFromCSR mycsr.csr"
  1034. return 1
  1035. fi
  1036. _csrsubj="$(_readSubjectFromCSR "$_csrfile")"
  1037. _debug _csrsubj "$_csrsubj"
  1038. _dnsAltnames="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile" | grep "^ *DNS:.*" | tr -d ' \n')"
  1039. _debug _dnsAltnames "$_dnsAltnames"
  1040. if _contains "$_dnsAltnames," "DNS:$_csrsubj,"; then
  1041. _debug "AltNames contains subject"
  1042. _excapedAlgnames="$(echo "$_dnsAltnames" | tr '*' '#')"
  1043. _debug _excapedAlgnames "$_excapedAlgnames"
  1044. _escapedSubject="$(echo "$_csrsubj" | tr '*' '#')"
  1045. _debug _escapedSubject "$_escapedSubject"
  1046. _dnsAltnames="$(echo "$_excapedAlgnames," | sed "s/DNS:$_escapedSubject,//g" | tr '#' '*' | sed "s/,\$//g")"
  1047. _debug _dnsAltnames "$_dnsAltnames"
  1048. else
  1049. _debug "AltNames doesn't contain subject"
  1050. fi
  1051. echo "$_dnsAltnames" | sed "s/DNS://g"
  1052. }
  1053. #_csrfile
  1054. _readKeyLengthFromCSR() {
  1055. _csrfile="$1"
  1056. if [ -z "$_csrfile" ]; then
  1057. _usage "_readKeyLengthFromCSR mycsr.csr"
  1058. return 1
  1059. fi
  1060. _outcsr="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile")"
  1061. _debug2 _outcsr "$_outcsr"
  1062. if _contains "$_outcsr" "Public Key Algorithm: id-ecPublicKey"; then
  1063. _debug "ECC CSR"
  1064. echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *ASN1 OID:.*" | cut -d ':' -f 2 | tr -d ' '
  1065. else
  1066. _debug "RSA CSR"
  1067. _rkl="$(echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1)"
  1068. if [ "$_rkl" ]; then
  1069. echo "$_rkl"
  1070. else
  1071. echo "$_outcsr" | tr "\t" " " | _egrep_o "RSA Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1
  1072. fi
  1073. fi
  1074. }
  1075. _ss() {
  1076. _port="$1"
  1077. if _exists "ss"; then
  1078. _debug "Using: ss"
  1079. ss -ntpl 2>/dev/null | grep ":$_port "
  1080. return 0
  1081. fi
  1082. if _exists "netstat"; then
  1083. _debug "Using: netstat"
  1084. if netstat -help 2>&1 | grep "\-p proto" >/dev/null; then
  1085. #for windows version netstat tool
  1086. netstat -an -p tcp | grep "LISTENING" | grep ":$_port "
  1087. else
  1088. if netstat -help 2>&1 | grep "\-p protocol" >/dev/null; then
  1089. netstat -an -p tcp | grep LISTEN | grep ":$_port "
  1090. elif netstat -help 2>&1 | grep -- '-P protocol' >/dev/null; then
  1091. #for solaris
  1092. netstat -an -P tcp | grep "\.$_port " | grep "LISTEN"
  1093. elif netstat -help 2>&1 | grep "\-p" >/dev/null; then
  1094. #for full linux
  1095. netstat -ntpl | grep ":$_port "
  1096. else
  1097. #for busybox (embedded linux; no pid support)
  1098. netstat -ntl 2>/dev/null | grep ":$_port "
  1099. fi
  1100. fi
  1101. return 0
  1102. fi
  1103. return 1
  1104. }
  1105. #outfile key cert cacert [password [name [caname]]]
  1106. _toPkcs() {
  1107. _cpfx="$1"
  1108. _ckey="$2"
  1109. _ccert="$3"
  1110. _cca="$4"
  1111. pfxPassword="$5"
  1112. pfxName="$6"
  1113. pfxCaname="$7"
  1114. if [ "$pfxCaname" ]; then
  1115. ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName" -caname "$pfxCaname"
  1116. elif [ "$pfxName" ]; then
  1117. ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName"
  1118. elif [ "$pfxPassword" ]; then
  1119. ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword"
  1120. else
  1121. ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca"
  1122. fi
  1123. }
  1124. #domain [password] [isEcc]
  1125. toPkcs() {
  1126. domain="$1"
  1127. pfxPassword="$2"
  1128. if [ -z "$domain" ]; then
  1129. _usage "Usage: $PROJECT_ENTRY --toPkcs -d domain [--password pfx-password]"
  1130. return 1
  1131. fi
  1132. _isEcc="$3"
  1133. _initpath "$domain" "$_isEcc"
  1134. _toPkcs "$CERT_PFX_PATH" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$pfxPassword"
  1135. if [ "$?" = "0" ]; then
  1136. _info "Success, Pfx is exported to: $CERT_PFX_PATH"
  1137. fi
  1138. }
  1139. #domain [isEcc]
  1140. toPkcs8() {
  1141. domain="$1"
  1142. if [ -z "$domain" ]; then
  1143. _usage "Usage: $PROJECT_ENTRY --toPkcs8 -d domain [--ecc]"
  1144. return 1
  1145. fi
  1146. _isEcc="$2"
  1147. _initpath "$domain" "$_isEcc"
  1148. ${ACME_OPENSSL_BIN:-openssl} pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in "$CERT_KEY_PATH" -out "$CERT_PKCS8_PATH"
  1149. if [ "$?" = "0" ]; then
  1150. _info "Success, $CERT_PKCS8_PATH"
  1151. fi
  1152. }
  1153. #[2048]
  1154. createAccountKey() {
  1155. _info "Creating account key"
  1156. if [ -z "$1" ]; then
  1157. _usage "Usage: $PROJECT_ENTRY --createAccountKey --accountkeylength 2048"
  1158. return
  1159. fi
  1160. length=$1
  1161. _create_account_key "$length"
  1162. }
  1163. _create_account_key() {
  1164. length=$1
  1165. if [ -z "$length" ] || [ "$length" = "$NO_VALUE" ]; then
  1166. _debug "Use default length $DEFAULT_ACCOUNT_KEY_LENGTH"
  1167. length="$DEFAULT_ACCOUNT_KEY_LENGTH"
  1168. fi
  1169. _debug length "$length"
  1170. _initpath
  1171. mkdir -p "$CA_DIR"
  1172. if [ -s "$ACCOUNT_KEY_PATH" ]; then
  1173. _info "Account key exists, skip"
  1174. return 0
  1175. else
  1176. #generate account key
  1177. if _createkey "$length" "$ACCOUNT_KEY_PATH"; then
  1178. chmod 600 "$ACCOUNT_KEY_PATH"
  1179. _info "Create account key ok."
  1180. return 0
  1181. else
  1182. _err "Create account key error."
  1183. return 1
  1184. fi
  1185. fi
  1186. }
  1187. #domain [length]
  1188. createDomainKey() {
  1189. _info "Creating domain key"
  1190. if [ -z "$1" ]; then
  1191. _usage "Usage: $PROJECT_ENTRY --createDomainKey -d domain.com [ --keylength 2048 ]"
  1192. return
  1193. fi
  1194. domain=$1
  1195. _cdl=$2
  1196. if [ -z "$_cdl" ]; then
  1197. _debug "Use DEFAULT_DOMAIN_KEY_LENGTH=$DEFAULT_DOMAIN_KEY_LENGTH"
  1198. _cdl="$DEFAULT_DOMAIN_KEY_LENGTH"
  1199. fi
  1200. _initpath "$domain" "$_cdl"
  1201. if [ ! -f "$CERT_KEY_PATH" ] || [ ! -s "$CERT_KEY_PATH" ] || ([ "$FORCE" ] && ! [ "$IS_RENEW" ]) || [ "$Le_ForceNewDomainKey" = "1" ]; then
  1202. if _createkey "$_cdl" "$CERT_KEY_PATH"; then
  1203. _savedomainconf Le_Keylength "$_cdl"
  1204. _info "The domain key is here: $(__green $CERT_KEY_PATH)"
  1205. return 0
  1206. else
  1207. _err "Can not create domain key"
  1208. return 1
  1209. fi
  1210. else
  1211. if [ "$IS_RENEW" ]; then
  1212. _info "Domain key exists, skip"
  1213. return 0
  1214. else
  1215. _err "Domain key exists, do you want to overwrite the key?"
  1216. _err "Add '--force', and try again."
  1217. return 1
  1218. fi
  1219. fi
  1220. }
  1221. # domain domainlist isEcc
  1222. createCSR() {
  1223. _info "Creating csr"
  1224. if [ -z "$1" ]; then
  1225. _usage "Usage: $PROJECT_ENTRY --createCSR -d domain1.com [-d domain2.com -d domain3.com ... ]"
  1226. return
  1227. fi
  1228. domain="$1"
  1229. domainlist="$2"
  1230. _isEcc="$3"
  1231. _initpath "$domain" "$_isEcc"
  1232. if [ -f "$CSR_PATH" ] && [ "$IS_RENEW" ] && [ -z "$FORCE" ]; then
  1233. _info "CSR exists, skip"
  1234. return
  1235. fi
  1236. if [ ! -f "$CERT_KEY_PATH" ]; then
  1237. _err "The key file is not found: $CERT_KEY_PATH"
  1238. _err "Please create the key file first."
  1239. return 1
  1240. fi
  1241. _createcsr "$domain" "$domainlist" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"
  1242. }
  1243. _url_replace() {
  1244. tr '/+' '_-' | tr -d '= '
  1245. }
  1246. _time2str() {
  1247. #BSD
  1248. if date -u -r "$1" 2>/dev/null; then
  1249. return
  1250. fi
  1251. #Linux
  1252. if date -u -d@"$1" 2>/dev/null; then
  1253. return
  1254. fi
  1255. #Solaris
  1256. if _exists adb; then
  1257. _t_s_a=$(echo "0t${1}=Y" | adb)
  1258. echo "$_t_s_a"
  1259. fi
  1260. #Busybox
  1261. if echo "$1" | awk '{ print strftime("%c", $0); }' 2>/dev/null; then
  1262. return
  1263. fi
  1264. }
  1265. _normalizeJson() {
  1266. sed "s/\" *: *\([\"{\[]\)/\":\1/g" | sed "s/^ *\([^ ]\)/\1/" | tr -d "\r\n"
  1267. }
  1268. _stat() {
  1269. #Linux
  1270. if stat -c '%U:%G' "$1" 2>/dev/null; then
  1271. return
  1272. fi
  1273. #BSD
  1274. if stat -f '%Su:%Sg' "$1" 2>/dev/null; then
  1275. return
  1276. fi
  1277. return 1 #error, 'stat' not found
  1278. }
  1279. #keyfile
  1280. _calcjwk() {
  1281. keyfile="$1"
  1282. if [ -z "$keyfile" ]; then
  1283. _usage "Usage: _calcjwk keyfile"
  1284. return 1
  1285. fi
  1286. if [ "$JWK_HEADER" ] && [ "$__CACHED_JWK_KEY_FILE" = "$keyfile" ]; then
  1287. _debug2 "Use cached jwk for file: $__CACHED_JWK_KEY_FILE"
  1288. return 0
  1289. fi
  1290. if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
  1291. _debug "RSA key"
  1292. pub_exp=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -noout -text | grep "^publicExponent:" | cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
  1293. if [ "${#pub_exp}" = "5" ]; then
  1294. pub_exp=0$pub_exp
  1295. fi
  1296. _debug3 pub_exp "$pub_exp"
  1297. e=$(echo "$pub_exp" | _h2b | _base64)
  1298. _debug3 e "$e"
  1299. modulus=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -modulus -noout | cut -d '=' -f 2)
  1300. _debug3 modulus "$modulus"
  1301. n="$(printf "%s" "$modulus" | _h2b | _base64 | _url_replace)"
  1302. _debug3 n "$n"
  1303. jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
  1304. _debug3 jwk "$jwk"
  1305. JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
  1306. JWK_HEADERPLACE_PART1='{"nonce": "'
  1307. JWK_HEADERPLACE_PART2='", "alg": "RS256"'
  1308. elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
  1309. _debug "EC key"
  1310. crv="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
  1311. _debug3 crv "$crv"
  1312. __ECC_KEY_LEN=$(echo "$crv" | cut -d "-" -f 2)
  1313. if [ "$__ECC_KEY_LEN" = "521" ]; then
  1314. __ECC_KEY_LEN=512
  1315. fi
  1316. _debug3 __ECC_KEY_LEN "$__ECC_KEY_LEN"
  1317. if [ -z "$crv" ]; then
  1318. _debug "Let's try ASN1 OID"
  1319. crv_oid="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^ASN1 OID:" | cut -d ":" -f 2 | tr -d " \r\n")"
  1320. _debug3 crv_oid "$crv_oid"
  1321. case "${crv_oid}" in
  1322. "prime256v1")
  1323. crv="P-256"
  1324. __ECC_KEY_LEN=256
  1325. ;;
  1326. "secp384r1")
  1327. crv="P-384"
  1328. __ECC_KEY_LEN=384
  1329. ;;
  1330. "secp521r1")
  1331. crv="P-521"
  1332. __ECC_KEY_LEN=512
  1333. ;;
  1334. *)
  1335. _err "ECC oid : $crv_oid"
  1336. return 1
  1337. ;;
  1338. esac
  1339. _debug3 crv "$crv"
  1340. fi
  1341. pubi="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
  1342. pubi=$(_math "$pubi" + 1)
  1343. _debug3 pubi "$pubi"
  1344. pubj="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
  1345. pubj=$(_math "$pubj" - 1)
  1346. _debug3 pubj "$pubj"
  1347. pubtext="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
  1348. _debug3 pubtext "$pubtext"
  1349. xlen="$(printf "%s" "$pubtext" | tr -d ':' | wc -c)"
  1350. xlen=$(_math "$xlen" / 4)
  1351. _debug3 xlen "$xlen"
  1352. xend=$(_math "$xlen" + 1)
  1353. x="$(printf "%s" "$pubtext" | cut -d : -f 2-"$xend")"
  1354. _debug3 x "$x"
  1355. x64="$(printf "%s" "$x" | tr -d : | _h2b | _base64 | _url_replace)"
  1356. _debug3 x64 "$x64"
  1357. xend=$(_math "$xend" + 1)
  1358. y="$(printf "%s" "$pubtext" | cut -d : -f "$xend"-10000)"
  1359. _debug3 y "$y"
  1360. y64="$(printf "%s" "$y" | tr -d : | _h2b | _base64 | _url_replace)"
  1361. _debug3 y64 "$y64"
  1362. jwk='{"crv": "'$crv'", "kty": "EC", "x": "'$x64'", "y": "'$y64'"}'
  1363. _debug3 jwk "$jwk"
  1364. JWK_HEADER='{"alg": "ES'$__ECC_KEY_LEN'", "jwk": '$jwk'}'
  1365. JWK_HEADERPLACE_PART1='{"nonce": "'
  1366. JWK_HEADERPLACE_PART2='", "alg": "ES'$__ECC_KEY_LEN'"'
  1367. else
  1368. _err "Only RSA or EC key is supported. keyfile=$keyfile"
  1369. _debug2 "$(cat "$keyfile")"
  1370. return 1
  1371. fi
  1372. _debug3 JWK_HEADER "$JWK_HEADER"
  1373. __CACHED_JWK_KEY_FILE="$keyfile"
  1374. }
  1375. _time() {
  1376. date -u "+%s"
  1377. }
  1378. _utc_date() {
  1379. date -u "+%Y-%m-%d %H:%M:%S"
  1380. }
  1381. _mktemp() {
  1382. if _exists mktemp; then
  1383. if mktemp 2>/dev/null; then
  1384. return 0
  1385. elif _contains "$(mktemp 2>&1)" "-t prefix" && mktemp -t "$PROJECT_NAME" 2>/dev/null; then
  1386. #for Mac osx
  1387. return 0
  1388. fi
  1389. fi
  1390. if [ -d "/tmp" ]; then
  1391. echo "/tmp/${PROJECT_NAME}wefADf24sf.$(_time).tmp"
  1392. return 0
  1393. elif [ "$LE_TEMP_DIR" ] && mkdir -p "$LE_TEMP_DIR"; then
  1394. echo "/$LE_TEMP_DIR/wefADf24sf.$(_time).tmp"
  1395. return 0
  1396. fi
  1397. _err "Can not create temp file."
  1398. }
  1399. _inithttp() {
  1400. if [ -z "$HTTP_HEADER" ] || ! touch "$HTTP_HEADER"; then
  1401. HTTP_HEADER="$(_mktemp)"
  1402. _debug2 HTTP_HEADER "$HTTP_HEADER"
  1403. fi
  1404. if [ "$__HTTP_INITIALIZED" ]; then
  1405. if [ "$_ACME_CURL$_ACME_WGET" ]; then
  1406. _debug2 "Http already initialized."
  1407. return 0
  1408. fi
  1409. fi
  1410. if [ -z "$_ACME_CURL" ] && _exists "curl"; then
  1411. _ACME_CURL="curl -L --silent --dump-header $HTTP_HEADER "
  1412. if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
  1413. _CURL_DUMP="$(_mktemp)"
  1414. _ACME_CURL="$_ACME_CURL --trace-ascii $_CURL_DUMP "
  1415. fi
  1416. if [ "$CA_PATH" ]; then
  1417. _ACME_CURL="$_ACME_CURL --capath $CA_PATH "
  1418. elif [ "$CA_BUNDLE" ]; then
  1419. _ACME_CURL="$_ACME_CURL --cacert $CA_BUNDLE "
  1420. fi
  1421. if _contains "$(curl --help 2>&1)" "--globoff"; then
  1422. _ACME_CURL="$_ACME_CURL -g "
  1423. fi
  1424. fi
  1425. if [ -z "$_ACME_WGET" ] && _exists "wget"; then
  1426. _ACME_WGET="wget -q"
  1427. if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
  1428. _ACME_WGET="$_ACME_WGET -d "
  1429. fi
  1430. if [ "$CA_PATH" ]; then
  1431. _ACME_WGET="$_ACME_WGET --ca-directory=$CA_PATH "
  1432. elif [ "$CA_BUNDLE" ]; then
  1433. _ACME_WGET="$_ACME_WGET --ca-certificate=$CA_BUNDLE "
  1434. fi
  1435. fi
  1436. #from wget 1.14: do not skip body on 404 error
  1437. if [ "$_ACME_WGET" ] && _contains "$($_ACME_WGET --help 2>&1)" "--content-on-error"; then
  1438. _ACME_WGET="$_ACME_WGET --content-on-error "
  1439. fi
  1440. __HTTP_INITIALIZED=1
  1441. }
  1442. # body url [needbase64] [POST|PUT|DELETE] [ContentType]
  1443. _post() {
  1444. body="$1"
  1445. _post_url="$2"
  1446. needbase64="$3"
  1447. httpmethod="$4"
  1448. _postContentType="$5"
  1449. if [ -z "$httpmethod" ]; then
  1450. httpmethod="POST"
  1451. fi
  1452. _debug $httpmethod
  1453. _debug "_post_url" "$_post_url"
  1454. _debug2 "body" "$body"
  1455. _debug2 "_postContentType" "$_postContentType"
  1456. _inithttp
  1457. if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
  1458. _CURL="$_ACME_CURL"
  1459. if [ "$HTTPS_INSECURE" ]; then
  1460. _CURL="$_CURL --insecure "
  1461. fi
  1462. _debug "_CURL" "$_CURL"
  1463. if [ "$needbase64" ]; then
  1464. if [ "$_postContentType" ]; then
  1465. response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
  1466. else
  1467. response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
  1468. fi
  1469. else
  1470. if [ "$_postContentType" ]; then
  1471. response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
  1472. else
  1473. response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
  1474. fi
  1475. fi
  1476. _ret="$?"
  1477. if [ "$_ret" != "0" ]; then
  1478. _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
  1479. if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
  1480. _err "Here is the curl dump log:"
  1481. _err "$(cat "$_CURL_DUMP")"
  1482. fi
  1483. fi
  1484. elif [ "$_ACME_WGET" ]; then
  1485. _WGET="$_ACME_WGET"
  1486. if [ "$HTTPS_INSECURE" ]; then
  1487. _WGET="$_WGET --no-check-certificate "
  1488. fi
  1489. _debug "_WGET" "$_WGET"
  1490. if [ "$needbase64" ]; then
  1491. if [ "$httpmethod" = "POST" ]; then
  1492. if [ "$_postContentType" ]; then
  1493. response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
  1494. else
  1495. response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
  1496. fi
  1497. else
  1498. if [ "$_postContentType" ]; then
  1499. response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
  1500. else
  1501. response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
  1502. fi
  1503. fi
  1504. else
  1505. if [ "$httpmethod" = "POST" ]; then
  1506. if [ "$_postContentType" ]; then
  1507. response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
  1508. else
  1509. response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
  1510. fi
  1511. else
  1512. if [ "$_postContentType" ]; then
  1513. response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
  1514. else
  1515. response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
  1516. fi
  1517. fi
  1518. fi
  1519. _ret="$?"
  1520. if [ "$_ret" = "8" ]; then
  1521. _ret=0
  1522. _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
  1523. fi
  1524. if [ "$_ret" != "0" ]; then
  1525. _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
  1526. fi
  1527. _sed_i "s/^ *//g" "$HTTP_HEADER"
  1528. else
  1529. _ret="$?"
  1530. _err "Neither curl nor wget is found, can not do $httpmethod."
  1531. fi
  1532. _debug "_ret" "$_ret"
  1533. printf "%s" "$response"
  1534. return $_ret
  1535. }
  1536. # url getheader timeout
  1537. _get() {
  1538. _debug GET
  1539. url="$1"
  1540. onlyheader="$2"
  1541. t="$3"
  1542. _debug url "$url"
  1543. _debug "timeout=$t"
  1544. _inithttp
  1545. if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
  1546. _CURL="$_ACME_CURL"
  1547. if [ "$HTTPS_INSECURE" ]; then
  1548. _CURL="$_CURL --insecure "
  1549. fi
  1550. if [ "$t" ]; then
  1551. _CURL="$_CURL --connect-timeout $t"
  1552. fi
  1553. _debug "_CURL" "$_CURL"
  1554. if [ "$onlyheader" ]; then
  1555. $_CURL -I --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
  1556. else
  1557. $_CURL --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
  1558. fi
  1559. ret=$?
  1560. if [ "$ret" != "0" ]; then
  1561. _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
  1562. if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
  1563. _err "Here is the curl dump log:"
  1564. _err "$(cat "$_CURL_DUMP")"
  1565. fi
  1566. fi
  1567. elif [ "$_ACME_WGET" ]; then
  1568. _WGET="$_ACME_WGET"
  1569. if [ "$HTTPS_INSECURE" ]; then
  1570. _WGET="$_WGET --no-check-certificate "
  1571. fi
  1572. if [ "$t" ]; then
  1573. _WGET="$_WGET --timeout=$t"
  1574. fi
  1575. _debug "_WGET" "$_WGET"
  1576. if [ "$onlyheader" ]; then
  1577. $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -S -O /dev/null "$url" 2>&1 | sed 's/^[ ]*//g'
  1578. else
  1579. $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -O - "$url"
  1580. fi
  1581. ret=$?
  1582. if [ "$ret" = "8" ]; then
  1583. ret=0
  1584. _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
  1585. fi
  1586. if [ "$ret" != "0" ]; then
  1587. _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
  1588. fi
  1589. else
  1590. ret=$?
  1591. _err "Neither curl nor wget is found, can not do GET."
  1592. fi
  1593. _debug "ret" "$ret"
  1594. return $ret
  1595. }
  1596. _head_n() {
  1597. head -n "$1"
  1598. }
  1599. _tail_n() {
  1600. if ! tail -n "$1" 2>/dev/null; then
  1601. #fix for solaris
  1602. tail -"$1"
  1603. fi
  1604. }
  1605. # url payload needbase64 keyfile
  1606. _send_signed_request() {
  1607. url=$1
  1608. payload=$2
  1609. needbase64=$3
  1610. keyfile=$4
  1611. if [ -z "$keyfile" ]; then
  1612. keyfile="$ACCOUNT_KEY_PATH"
  1613. fi
  1614. _debug url "$url"
  1615. _debug payload "$payload"
  1616. if ! _calcjwk "$keyfile"; then
  1617. return 1
  1618. fi
  1619. __request_conent_type="$CONTENT_TYPE_JSON"
  1620. payload64=$(printf "%s" "$payload" | _base64 | _url_replace)
  1621. _debug3 payload64 "$payload64"
  1622. MAX_REQUEST_RETRY_TIMES=20
  1623. _sleep_retry_sec=1
  1624. _request_retry_times=0
  1625. while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
  1626. _request_retry_times=$(_math "$_request_retry_times" + 1)
  1627. _debug3 _request_retry_times "$_request_retry_times"
  1628. if [ -z "$_CACHED_NONCE" ]; then
  1629. _headers=""
  1630. if [ "$ACME_NEW_NONCE" ]; then
  1631. _debug2 "Get nonce with HEAD. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
  1632. nonceurl="$ACME_NEW_NONCE"
  1633. if _post "" "$nonceurl" "" "HEAD" "$__request_conent_type"; then
  1634. _headers="$(cat "$HTTP_HEADER")"
  1635. _debug2 _headers "$_headers"
  1636. _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
  1637. fi
  1638. fi
  1639. if [ -z "$_CACHED_NONCE" ]; then
  1640. _debug2 "Get nonce with GET. ACME_DIRECTORY" "$ACME_DIRECTORY"
  1641. nonceurl="$ACME_DIRECTORY"
  1642. _headers="$(_get "$nonceurl" "onlyheader")"
  1643. _debug2 _headers "$_headers"
  1644. _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
  1645. fi
  1646. if [ -z "$_CACHED_NONCE" ] && [ "$ACME_NEW_NONCE" ]; then
  1647. _debug2 "Get nonce with GET. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
  1648. nonceurl="$ACME_NEW_NONCE"
  1649. _headers="$(_get "$nonceurl" "onlyheader")"
  1650. _debug2 _headers "$_headers"
  1651. _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
  1652. fi
  1653. _debug2 _CACHED_NONCE "$_CACHED_NONCE"
  1654. if [ "$?" != "0" ]; then
  1655. _err "Can not connect to $nonceurl to get nonce."
  1656. return 1
  1657. fi
  1658. else
  1659. _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
  1660. fi
  1661. nonce="$_CACHED_NONCE"
  1662. _debug2 nonce "$nonce"
  1663. if [ -z "$nonce" ]; then
  1664. _info "Could not get nonce, let's try again."
  1665. _sleep 2
  1666. continue
  1667. fi
  1668. if [ "$ACME_VERSION" = "2" ]; then
  1669. if [ "$url" = "$ACME_NEW_ACCOUNT" ] || [ "$url" = "$ACME_REVOKE_CERT" ]; then
  1670. protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
  1671. else
  1672. protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"${ACCOUNT_URL}\""'}'
  1673. fi
  1674. else
  1675. protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
  1676. fi
  1677. _debug3 protected "$protected"
  1678. protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
  1679. _debug3 protected64 "$protected64"
  1680. if ! _sig_t="$(printf "%s" "$protected64.$payload64" | _sign "$keyfile" "sha256")"; then
  1681. _err "Sign request failed."
  1682. return 1
  1683. fi
  1684. _debug3 _sig_t "$_sig_t"
  1685. sig="$(printf "%s" "$_sig_t" | _url_replace)"
  1686. _debug3 sig "$sig"
  1687. body="{\"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
  1688. _debug3 body "$body"
  1689. response="$(_post "$body" "$url" "$needbase64" "POST" "$__request_conent_type")"
  1690. _CACHED_NONCE=""
  1691. if [ "$?" != "0" ]; then
  1692. _err "Can not post to $url"
  1693. return 1
  1694. fi
  1695. responseHeaders="$(cat "$HTTP_HEADER")"
  1696. _debug2 responseHeaders "$responseHeaders"
  1697. code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
  1698. _debug code "$code"
  1699. _debug2 original "$response"
  1700. if echo "$responseHeaders" | grep -i "Content-Type: application/json" >/dev/null 2>&1; then
  1701. response="$(echo "$response" | _normalizeJson)"
  1702. fi
  1703. _debug2 response "$response"
  1704. _CACHED_NONCE="$(echo "$responseHeaders" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
  1705. if ! _startswith "$code" "2"; then
  1706. _body="$response"
  1707. if [ "$needbase64" ]; then
  1708. _body="$(echo "$_body" | _dbase64 multiline)"
  1709. _debug3 _body "$_body"
  1710. fi
  1711. if _contains "$_body" "JWS has invalid anti-replay nonce" || _contains "$_body" "JWS has an invalid anti-replay nonce"; then
  1712. _info "It seems the CA server is busy now, let's wait and retry. Sleeping $_sleep_retry_sec seconds."
  1713. _CACHED_NONCE=""
  1714. _sleep $_sleep_retry_sec
  1715. continue
  1716. fi
  1717. fi
  1718. break
  1719. done
  1720. }
  1721. #setopt "file" "opt" "=" "value" [";"]
  1722. _setopt() {
  1723. __conf="$1"
  1724. __opt="$2"
  1725. __sep="$3"
  1726. __val="$4"
  1727. __end="$5"
  1728. if [ -z "$__opt" ]; then
  1729. _usage usage: _setopt '"file" "opt" "=" "value" [";"]'
  1730. return
  1731. fi
  1732. if [ ! -f "$__conf" ]; then
  1733. touch "$__conf"
  1734. fi
  1735. if grep -n "^$__opt$__sep" "$__conf" >/dev/null; then
  1736. _debug3 OK
  1737. if _contains "$__val" "&"; then
  1738. __val="$(echo "$__val" | sed 's/&/\\&/g')"
  1739. fi
  1740. text="$(cat "$__conf")"
  1741. printf -- "%s\n" "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
  1742. elif grep -n "^#$__opt$__sep" "$__conf" >/dev/null; then
  1743. if _contains "$__val" "&"; then
  1744. __val="$(echo "$__val" | sed 's/&/\\&/g')"
  1745. fi
  1746. text="$(cat "$__conf")"
  1747. printf -- "%s\n" "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
  1748. else
  1749. _debug3 APP
  1750. echo "$__opt$__sep$__val$__end" >>"$__conf"
  1751. fi
  1752. _debug3 "$(grep -n "^$__opt$__sep" "$__conf")"
  1753. }
  1754. #_save_conf file key value base64encode
  1755. #save to conf
  1756. _save_conf() {
  1757. _s_c_f="$1"
  1758. _sdkey="$2"
  1759. _sdvalue="$3"
  1760. _b64encode="$4"
  1761. if [ "$_sdvalue" ] && [ "$_b64encode" ]; then
  1762. _sdvalue="${B64CONF_START}$(printf "%s" "${_sdvalue}" | _base64)${B64CONF_END}"
  1763. fi
  1764. if [ "$_s_c_f" ]; then
  1765. _setopt "$_s_c_f" "$_sdkey" "=" "'$_sdvalue'"
  1766. else
  1767. _err "config file is empty, can not save $_sdkey=$_sdvalue"
  1768. fi
  1769. }
  1770. #_clear_conf file key
  1771. _clear_conf() {
  1772. _c_c_f="$1"
  1773. _sdkey="$2"
  1774. if [ "$_c_c_f" ]; then
  1775. _conf_data="$(cat "$_c_c_f")"
  1776. echo "$_conf_data" | sed "s/^$_sdkey *=.*$//" >"$_c_c_f"
  1777. else
  1778. _err "config file is empty, can not clear"
  1779. fi
  1780. }
  1781. #_read_conf file key
  1782. _read_conf() {
  1783. _r_c_f="$1"
  1784. _sdkey="$2"
  1785. if [ -f "$_r_c_f" ]; then
  1786. _sdv="$(
  1787. eval "$(grep "^$_sdkey *=" "$_r_c_f")"
  1788. eval "printf \"%s\" \"\$$_sdkey\""
  1789. )"
  1790. if _startswith "$_sdv" "${B64CONF_START}" && _endswith "$_sdv" "${B64CONF_END}"; then
  1791. _sdv="$(echo "$_sdv" | sed "s/${B64CONF_START}//" | sed "s/${B64CONF_END}//" | _dbase64)"
  1792. fi
  1793. printf "%s" "$_sdv"
  1794. else
  1795. _debug "config file is empty, can not read $_sdkey"
  1796. fi
  1797. }
  1798. #_savedomainconf key value base64encode
  1799. #save to domain.conf
  1800. _savedomainconf() {
  1801. _save_conf "$DOMAIN_CONF" "$@"
  1802. }
  1803. #_cleardomainconf key
  1804. _cleardomainconf() {
  1805. _clear_conf "$DOMAIN_CONF" "$1"
  1806. }
  1807. #_readdomainconf key
  1808. _readdomainconf() {
  1809. _read_conf "$DOMAIN_CONF" "$1"
  1810. }
  1811. #key value base64encode
  1812. _savedeployconf() {
  1813. _savedomainconf "SAVED_$1" "$2" "$3"
  1814. #remove later
  1815. _cleardomainconf "$1"
  1816. }
  1817. #key
  1818. _getdeployconf() {
  1819. _rac_key="$1"
  1820. _rac_value="$(eval echo \$"$_rac_key")"
  1821. if [ "$_rac_value" ]; then
  1822. if _startswith "$_rac_value" '"' && _endswith "$_rac_value" '"'; then
  1823. _debug2 "trim quotation marks"
  1824. eval "export $_rac_key=$_rac_value"
  1825. fi
  1826. return 0 # do nothing
  1827. fi
  1828. _saved=$(_readdomainconf "SAVED_$_rac_key")
  1829. eval "export $_rac_key=$_saved"
  1830. }
  1831. #_saveaccountconf key value base64encode
  1832. _saveaccountconf() {
  1833. _save_conf "$ACCOUNT_CONF_PATH" "$@"
  1834. }
  1835. #key value base64encode
  1836. _saveaccountconf_mutable() {
  1837. _save_conf "$ACCOUNT_CONF_PATH" "SAVED_$1" "$2" "$3"
  1838. #remove later
  1839. _clearaccountconf "$1"
  1840. }
  1841. #key
  1842. _readaccountconf() {
  1843. _read_conf "$ACCOUNT_CONF_PATH" "$1"
  1844. }
  1845. #key
  1846. _readaccountconf_mutable() {
  1847. _rac_key="$1"
  1848. _readaccountconf "SAVED_$_rac_key"
  1849. }
  1850. #_clearaccountconf key
  1851. _clearaccountconf() {
  1852. _clear_conf "$ACCOUNT_CONF_PATH" "$1"
  1853. }
  1854. #_savecaconf key value
  1855. _savecaconf() {
  1856. _save_conf "$CA_CONF" "$1" "$2"
  1857. }
  1858. #_readcaconf key
  1859. _readcaconf() {
  1860. _read_conf "$CA_CONF" "$1"
  1861. }
  1862. #_clearaccountconf key
  1863. _clearcaconf() {
  1864. _clear_conf "$CA_CONF" "$1"
  1865. }
  1866. # content localaddress
  1867. _startserver() {
  1868. content="$1"
  1869. ncaddr="$2"
  1870. _debug "content" "$content"
  1871. _debug "ncaddr" "$ncaddr"
  1872. _debug "startserver: $$"
  1873. _debug Le_HTTPPort "$Le_HTTPPort"
  1874. _debug Le_Listen_V4 "$Le_Listen_V4"
  1875. _debug Le_Listen_V6 "$Le_Listen_V6"
  1876. _NC="socat"
  1877. if [ "$Le_Listen_V4" ]; then
  1878. _NC="$_NC -4"
  1879. elif [ "$Le_Listen_V6" ]; then
  1880. _NC="$_NC -6"
  1881. fi
  1882. if [ "$DEBUG" ] && [ "$DEBUG" -gt "1" ]; then
  1883. _NC="$_NC -d -d -v"
  1884. fi
  1885. SOCAT_OPTIONS=TCP-LISTEN:$Le_HTTPPort,crlf,reuseaddr,fork
  1886. #Adding bind to local-address
  1887. if [ "$ncaddr" ]; then
  1888. SOCAT_OPTIONS="$SOCAT_OPTIONS,bind=${ncaddr}"
  1889. fi
  1890. _content_len="$(printf "%s" "$content" | wc -c)"
  1891. _debug _content_len "$_content_len"
  1892. _debug "_NC" "$_NC $SOCAT_OPTIONS"
  1893. $_NC $SOCAT_OPTIONS SYSTEM:"sleep 1; \
  1894. echo 'HTTP/1.0 200 OK'; \
  1895. echo 'Content-Length\: $_content_len'; \
  1896. echo ''; \
  1897. printf -- '$content';" &
  1898. serverproc="$!"
  1899. }
  1900. _stopserver() {
  1901. pid="$1"
  1902. _debug "pid" "$pid"
  1903. if [ -z "$pid" ]; then
  1904. return
  1905. fi
  1906. kill $pid
  1907. }
  1908. # sleep sec
  1909. _sleep() {
  1910. _sleep_sec="$1"
  1911. if [ "$__INTERACTIVE" ]; then
  1912. _sleep_c="$_sleep_sec"
  1913. while [ "$_sleep_c" -ge "0" ]; do
  1914. printf "\r \r"
  1915. __green "$_sleep_c"
  1916. _sleep_c="$(_math "$_sleep_c" - 1)"
  1917. sleep 1
  1918. done
  1919. printf "\r"
  1920. else
  1921. sleep "$_sleep_sec"
  1922. fi
  1923. }
  1924. # _starttlsserver san_a san_b port content _ncaddr acmeValidationv1
  1925. _starttlsserver() {
  1926. _info "Starting tls server."
  1927. san_a="$1"
  1928. san_b="$2"
  1929. port="$3"
  1930. content="$4"
  1931. opaddr="$5"
  1932. acmeValidationv1="$6"
  1933. _debug san_a "$san_a"
  1934. _debug san_b "$san_b"
  1935. _debug port "$port"
  1936. _debug acmeValidationv1 "$acmeValidationv1"
  1937. #create key TLS_KEY
  1938. if ! _createkey "2048" "$TLS_KEY"; then
  1939. _err "Create tls validation key error."
  1940. return 1
  1941. fi
  1942. #create csr
  1943. alt="$san_a"
  1944. if [ "$san_b" ]; then
  1945. alt="$alt,$san_b"
  1946. fi
  1947. if ! _createcsr "tls.acme.sh" "$alt" "$TLS_KEY" "$TLS_CSR" "$TLS_CONF" "$acmeValidationv1"; then
  1948. _err "Create tls validation csr error."
  1949. return 1
  1950. fi
  1951. #self signed
  1952. if ! _signcsr "$TLS_KEY" "$TLS_CSR" "$TLS_CONF" "$TLS_CERT"; then
  1953. _err "Create tls validation cert error."
  1954. return 1
  1955. fi
  1956. __S_OPENSSL="${ACME_OPENSSL_BIN:-openssl} s_server -www -cert $TLS_CERT -key $TLS_KEY "
  1957. if [ "$opaddr" ]; then
  1958. __S_OPENSSL="$__S_OPENSSL -accept $opaddr:$port"
  1959. else
  1960. __S_OPENSSL="$__S_OPENSSL -accept $port"
  1961. fi
  1962. _debug Le_Listen_V4 "$Le_Listen_V4"
  1963. _debug Le_Listen_V6 "$Le_Listen_V6"
  1964. if [ "$Le_Listen_V4" ]; then
  1965. __S_OPENSSL="$__S_OPENSSL -4"
  1966. elif [ "$Le_Listen_V6" ]; then
  1967. __S_OPENSSL="$__S_OPENSSL -6"
  1968. fi
  1969. if [ "$acmeValidationv1" ]; then
  1970. __S_OPENSSL="$__S_OPENSSL -alpn acme-tls/1"
  1971. fi
  1972. _debug "$__S_OPENSSL"
  1973. if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
  1974. $__S_OPENSSL -tlsextdebug &
  1975. else
  1976. $__S_OPENSSL >/dev/null 2>&1 &
  1977. fi
  1978. serverproc="$!"
  1979. sleep 1
  1980. _debug serverproc "$serverproc"
  1981. }
  1982. #file
  1983. _readlink() {
  1984. _rf="$1"
  1985. if ! readlink -f "$_rf" 2>/dev/null; then
  1986. if _startswith "$_rf" "/"; then
  1987. echo "$_rf"
  1988. return 0
  1989. fi
  1990. echo "$(pwd)/$_rf" | _conapath
  1991. fi
  1992. }
  1993. _conapath() {
  1994. sed "s#/\./#/#g"
  1995. }
  1996. __initHome() {
  1997. if [ -z "$_SCRIPT_HOME" ]; then
  1998. if _exists readlink && _exists dirname; then
  1999. _debug "Lets find script dir."
  2000. _debug "_SCRIPT_" "$_SCRIPT_"
  2001. _script="$(_readlink "$_SCRIPT_")"
  2002. _debug "_script" "$_script"
  2003. _script_home="$(dirname "$_script")"
  2004. _debug "_script_home" "$_script_home"
  2005. if [ -d "$_script_home" ]; then
  2006. _SCRIPT_HOME="$_script_home"
  2007. else
  2008. _err "It seems the script home is not correct:$_script_home"
  2009. fi
  2010. fi
  2011. fi
  2012. # if [ -z "$LE_WORKING_DIR" ]; then
  2013. # if [ -f "$DEFAULT_INSTALL_HOME/account.conf" ]; then
  2014. # _debug "It seems that $PROJECT_NAME is already installed in $DEFAULT_INSTALL_HOME"
  2015. # LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
  2016. # else
  2017. # LE_WORKING_DIR="$_SCRIPT_HOME"
  2018. # fi
  2019. # fi
  2020. if [ -z "$LE_WORKING_DIR" ]; then
  2021. _debug "Using default home:$DEFAULT_INSTALL_HOME"
  2022. LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
  2023. fi
  2024. export LE_WORKING_DIR
  2025. if [ -z "$LE_CONFIG_HOME" ]; then
  2026. LE_CONFIG_HOME="$LE_WORKING_DIR"
  2027. fi
  2028. _debug "Using config home:$LE_CONFIG_HOME"
  2029. export LE_CONFIG_HOME
  2030. _DEFAULT_ACCOUNT_CONF_PATH="$LE_CONFIG_HOME/account.conf"
  2031. if [ -z "$ACCOUNT_CONF_PATH" ]; then
  2032. if [ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ]; then
  2033. . "$_DEFAULT_ACCOUNT_CONF_PATH"
  2034. fi
  2035. fi
  2036. if [ -z "$ACCOUNT_CONF_PATH" ]; then
  2037. ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
  2038. fi
  2039. DEFAULT_LOG_FILE="$LE_CONFIG_HOME/$PROJECT_NAME.log"
  2040. DEFAULT_CA_HOME="$LE_CONFIG_HOME/ca"
  2041. if [ -z "$LE_TEMP_DIR" ]; then
  2042. LE_TEMP_DIR="$LE_CONFIG_HOME/tmp"
  2043. fi
  2044. }
  2045. #server
  2046. _initAPI() {
  2047. _api_server="${1:-$ACME_DIRECTORY}"
  2048. _debug "_init api for server: $_api_server"
  2049. if [ -z "$ACME_NEW_ACCOUNT" ]; then
  2050. response=$(_get "$_api_server")
  2051. if [ "$?" != "0" ]; then
  2052. _debug2 "response" "$response"
  2053. _err "Can not init api."
  2054. return 1
  2055. fi
  2056. _debug2 "response" "$response"
  2057. ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'key-change" *: *"[^"]*"' | cut -d '"' -f 3)
  2058. if [ -z "$ACME_KEY_CHANGE" ]; then
  2059. ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
  2060. fi
  2061. export ACME_KEY_CHANGE
  2062. ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'new-authz" *: *"[^"]*"' | cut -d '"' -f 3)
  2063. if [ -z "$ACME_NEW_AUTHZ" ]; then
  2064. ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
  2065. fi
  2066. export ACME_NEW_AUTHZ
  2067. ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-cert" *: *"[^"]*"' | cut -d '"' -f 3)
  2068. ACME_NEW_ORDER_RES="new-cert"
  2069. if [ -z "$ACME_NEW_ORDER" ]; then
  2070. ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-order" *: *"[^"]*"' | cut -d '"' -f 3)
  2071. ACME_NEW_ORDER_RES="new-order"
  2072. if [ -z "$ACME_NEW_ORDER" ]; then
  2073. ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
  2074. fi
  2075. fi
  2076. export ACME_NEW_ORDER
  2077. export ACME_NEW_ORDER_RES
  2078. ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-reg" *: *"[^"]*"' | cut -d '"' -f 3)
  2079. ACME_NEW_ACCOUNT_RES="new-reg"
  2080. if [ -z "$ACME_NEW_ACCOUNT" ]; then
  2081. ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-account" *: *"[^"]*"' | cut -d '"' -f 3)
  2082. ACME_NEW_ACCOUNT_RES="new-account"
  2083. if [ -z "$ACME_NEW_ACCOUNT" ]; then
  2084. ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
  2085. if [ "$ACME_NEW_ACCOUNT" ]; then
  2086. export ACME_VERSION=2
  2087. fi
  2088. fi
  2089. fi
  2090. export ACME_NEW_ACCOUNT
  2091. export ACME_NEW_ACCOUNT_RES
  2092. ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revoke-cert" *: *"[^"]*"' | cut -d '"' -f 3)
  2093. if [ -z "$ACME_REVOKE_CERT" ]; then
  2094. ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
  2095. fi
  2096. export ACME_REVOKE_CERT
  2097. ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'new-nonce" *: *"[^"]*"' | cut -d '"' -f 3)
  2098. if [ -z "$ACME_NEW_NONCE" ]; then
  2099. ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
  2100. fi
  2101. export ACME_NEW_NONCE
  2102. ACME_AGREEMENT=$(echo "$response" | _egrep_o 'terms-of-service" *: *"[^"]*"' | cut -d '"' -f 3)
  2103. if [ -z "$ACME_AGREEMENT" ]; then
  2104. ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
  2105. fi
  2106. export ACME_AGREEMENT
  2107. _debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
  2108. _debug "ACME_NEW_AUTHZ" "$ACME_NEW_AUTHZ"
  2109. _debug "ACME_NEW_ORDER" "$ACME_NEW_ORDER"
  2110. _debug "ACME_NEW_ACCOUNT" "$ACME_NEW_ACCOUNT"
  2111. _debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
  2112. _debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
  2113. _debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
  2114. _debug "ACME_VERSION" "$ACME_VERSION"
  2115. fi
  2116. }
  2117. #[domain] [keylength or isEcc flag]
  2118. _initpath() {
  2119. domain="$1"
  2120. _ilength="$2"
  2121. __initHome
  2122. if [ -f "$ACCOUNT_CONF_PATH" ]; then
  2123. . "$ACCOUNT_CONF_PATH"
  2124. fi
  2125. if [ "$ACME_IN_CRON" ]; then
  2126. if [ ! "$_USER_PATH_EXPORTED" ]; then
  2127. _USER_PATH_EXPORTED=1
  2128. export PATH="$USER_PATH:$PATH"
  2129. fi
  2130. fi
  2131. if [ -z "$CA_HOME" ]; then
  2132. CA_HOME="$DEFAULT_CA_HOME"
  2133. fi
  2134. if [ "$ACME_VERSION" = "2" ]; then
  2135. DEFAULT_CA="$LETSENCRYPT_CA_V2"
  2136. DEFAULT_STAGING_CA="$LETSENCRYPT_STAGING_CA_V2"
  2137. fi
  2138. if [ -z "$ACME_DIRECTORY" ]; then
  2139. if [ -z "$STAGE" ]; then
  2140. ACME_DIRECTORY="$DEFAULT_CA"
  2141. else
  2142. ACME_DIRECTORY="$DEFAULT_STAGING_CA"
  2143. _info "Using stage ACME_DIRECTORY: $ACME_DIRECTORY"
  2144. fi
  2145. fi
  2146. _debug ACME_DIRECTORY "$ACME_DIRECTORY"
  2147. _ACME_SERVER_HOST="$(echo "$ACME_DIRECTORY" | cut -d : -f 2 | tr -s / | cut -d / -f 2)"
  2148. _debug2 "_ACME_SERVER_HOST" "$_ACME_SERVER_HOST"
  2149. CA_DIR="$CA_HOME/$_ACME_SERVER_HOST"
  2150. _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
  2151. if [ -z "$CA_CONF" ]; then
  2152. CA_CONF="$_DEFAULT_CA_CONF"
  2153. fi
  2154. _debug3 CA_CONF "$CA_CONF"
  2155. if [ -f "$CA_CONF" ]; then
  2156. . "$CA_CONF"
  2157. fi
  2158. if [ -z "$ACME_DIR" ]; then
  2159. ACME_DIR="/home/.acme"
  2160. fi
  2161. if [ -z "$APACHE_CONF_BACKUP_DIR" ]; then
  2162. APACHE_CONF_BACKUP_DIR="$LE_CONFIG_HOME"
  2163. fi
  2164. if [ -z "$USER_AGENT" ]; then
  2165. USER_AGENT="$DEFAULT_USER_AGENT"
  2166. fi
  2167. if [ -z "$HTTP_HEADER" ]; then
  2168. HTTP_HEADER="$LE_CONFIG_HOME/http.header"
  2169. fi
  2170. _OLD_ACCOUNT_KEY="$LE_WORKING_DIR/account.key"
  2171. _OLD_ACCOUNT_JSON="$LE_WORKING_DIR/account.json"
  2172. _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
  2173. _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
  2174. if [ -z "$ACCOUNT_KEY_PATH" ]; then
  2175. ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
  2176. fi
  2177. if [ -z "$ACCOUNT_JSON_PATH" ]; then
  2178. ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
  2179. fi
  2180. _DEFAULT_CERT_HOME="$LE_CONFIG_HOME"
  2181. if [ -z "$CERT_HOME" ]; then
  2182. CERT_HOME="$_DEFAULT_CERT_HOME"
  2183. fi
  2184. if [ -z "$ACME_OPENSSL_BIN" ] || [ ! -f "$ACME_OPENSSL_BIN" ] || [ ! -x "$ACME_OPENSSL_BIN" ]; then
  2185. ACME_OPENSSL_BIN="$DEFAULT_OPENSSL_BIN"
  2186. fi
  2187. if [ -z "$domain" ]; then
  2188. return 0
  2189. fi
  2190. if [ -z "$DOMAIN_PATH" ]; then
  2191. domainhome="$CERT_HOME/$domain"
  2192. domainhomeecc="$CERT_HOME/$domain$ECC_SUFFIX"
  2193. DOMAIN_PATH="$domainhome"
  2194. if _isEccKey "$_ilength"; then
  2195. DOMAIN_PATH="$domainhomeecc"
  2196. else
  2197. if [ ! -d "$domainhome" ] && [ -d "$domainhomeecc" ]; then
  2198. _info "The domain '$domain' seems to have a ECC cert already, please add '$(__red "--ecc")' parameter if you want to use that cert."
  2199. fi
  2200. fi
  2201. _debug DOMAIN_PATH "$DOMAIN_PATH"
  2202. fi
  2203. if [ -z "$DOMAIN_BACKUP_PATH" ]; then
  2204. DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup"
  2205. fi
  2206. if [ -z "$DOMAIN_CONF" ]; then
  2207. DOMAIN_CONF="$DOMAIN_PATH/$domain.conf"
  2208. fi
  2209. if [ -z "$DOMAIN_SSL_CONF" ]; then
  2210. DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf"
  2211. fi
  2212. if [ -z "$CSR_PATH" ]; then
  2213. CSR_PATH="$DOMAIN_PATH/$domain.csr"
  2214. fi
  2215. if [ -z "$CERT_KEY_PATH" ]; then
  2216. CERT_KEY_PATH="$DOMAIN_PATH/$domain.key"
  2217. fi
  2218. if [ -z "$CERT_PATH" ]; then
  2219. CERT_PATH="$DOMAIN_PATH/$domain.cer"
  2220. fi
  2221. if [ -z "$CA_CERT_PATH" ]; then
  2222. CA_CERT_PATH="$DOMAIN_PATH/ca.cer"
  2223. fi
  2224. if [ -z "$CERT_FULLCHAIN_PATH" ]; then
  2225. CERT_FULLCHAIN_PATH="$DOMAIN_PATH/fullchain.cer"
  2226. fi
  2227. if [ -z "$CERT_PFX_PATH" ]; then
  2228. CERT_PFX_PATH="$DOMAIN_PATH/$domain.pfx"
  2229. fi
  2230. if [ -z "$CERT_PKCS8_PATH" ]; then
  2231. CERT_PKCS8_PATH="$DOMAIN_PATH/$domain.pkcs8"
  2232. fi
  2233. if [ -z "$TLS_CONF" ]; then
  2234. TLS_CONF="$DOMAIN_PATH/tls.validation.conf"
  2235. fi
  2236. if [ -z "$TLS_CERT" ]; then
  2237. TLS_CERT="$DOMAIN_PATH/tls.validation.cert"
  2238. fi
  2239. if [ -z "$TLS_KEY" ]; then
  2240. TLS_KEY="$DOMAIN_PATH/tls.validation.key"
  2241. fi
  2242. if [ -z "$TLS_CSR" ]; then
  2243. TLS_CSR="$DOMAIN_PATH/tls.validation.csr"
  2244. fi
  2245. }
  2246. _exec() {
  2247. if [ -z "$_EXEC_TEMP_ERR" ]; then
  2248. _EXEC_TEMP_ERR="$(_mktemp)"
  2249. fi
  2250. if [ "$_EXEC_TEMP_ERR" ]; then
  2251. eval "$@ 2>>$_EXEC_TEMP_ERR"
  2252. else
  2253. eval "$@"
  2254. fi
  2255. }
  2256. _exec_err() {
  2257. [ "$_EXEC_TEMP_ERR" ] && _err "$(cat "$_EXEC_TEMP_ERR")" && echo "" >"$_EXEC_TEMP_ERR"
  2258. }
  2259. _apachePath() {
  2260. _APACHECTL="apachectl"
  2261. if ! _exists apachectl; then
  2262. if _exists apache2ctl; then
  2263. _APACHECTL="apache2ctl"
  2264. else
  2265. _err "'apachectl not found. It seems that apache is not installed, or you are not root user.'"
  2266. _err "Please use webroot mode to try again."
  2267. return 1
  2268. fi
  2269. fi
  2270. if ! _exec $_APACHECTL -V >/dev/null; then
  2271. _exec_err
  2272. return 1
  2273. fi
  2274. if [ "$APACHE_HTTPD_CONF" ]; then
  2275. _saveaccountconf APACHE_HTTPD_CONF "$APACHE_HTTPD_CONF"
  2276. httpdconf="$APACHE_HTTPD_CONF"
  2277. httpdconfname="$(basename "$httpdconfname")"
  2278. else
  2279. httpdconfname="$($_APACHECTL -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"')"
  2280. _debug httpdconfname "$httpdconfname"
  2281. if [ -z "$httpdconfname" ]; then
  2282. _err "Can not read apache config file."
  2283. return 1
  2284. fi
  2285. if _startswith "$httpdconfname" '/'; then
  2286. httpdconf="$httpdconfname"
  2287. httpdconfname="$(basename "$httpdconfname")"
  2288. else
  2289. httpdroot="$($_APACHECTL -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"')"
  2290. _debug httpdroot "$httpdroot"
  2291. httpdconf="$httpdroot/$httpdconfname"
  2292. httpdconfname="$(basename "$httpdconfname")"
  2293. fi
  2294. fi
  2295. _debug httpdconf "$httpdconf"
  2296. _debug httpdconfname "$httpdconfname"
  2297. if [ ! -f "$httpdconf" ]; then
  2298. _err "Apache Config file not found" "$httpdconf"
  2299. return 1
  2300. fi
  2301. return 0
  2302. }
  2303. _restoreApache() {
  2304. if [ -z "$usingApache" ]; then
  2305. return 0
  2306. fi
  2307. _initpath
  2308. if ! _apachePath; then
  2309. return 1
  2310. fi
  2311. if [ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ]; then
  2312. _debug "No config file to restore."
  2313. return 0
  2314. fi
  2315. cat "$APACHE_CONF_BACKUP_DIR/$httpdconfname" >"$httpdconf"
  2316. _debug "Restored: $httpdconf."
  2317. if ! _exec $_APACHECTL -t; then
  2318. _exec_err
  2319. _err "Sorry, restore apache config error, please contact me."
  2320. return 1
  2321. fi
  2322. _debug "Restored successfully."
  2323. rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
  2324. return 0
  2325. }
  2326. _setApache() {
  2327. _initpath
  2328. if ! _apachePath; then
  2329. return 1
  2330. fi
  2331. #test the conf first
  2332. _info "Checking if there is an error in the apache config file before starting."
  2333. if ! _exec "$_APACHECTL" -t >/dev/null; then
  2334. _exec_err
  2335. _err "The apache config file has error, please fix it first, then try again."
  2336. _err "Don't worry, there is nothing changed to your system."
  2337. return 1
  2338. else
  2339. _info "OK"
  2340. fi
  2341. #backup the conf
  2342. _debug "Backup apache config file" "$httpdconf"
  2343. if ! cp "$httpdconf" "$APACHE_CONF_BACKUP_DIR/"; then
  2344. _err "Can not backup apache config file, so abort. Don't worry, the apache config is not changed."
  2345. _err "This might be a bug of $PROJECT_NAME , please report issue: $PROJECT"
  2346. return 1
  2347. fi
  2348. _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
  2349. _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
  2350. _info "The backup file will be deleted on success, just forget it."
  2351. #add alias
  2352. apacheVer="$($_APACHECTL -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2)"
  2353. _debug "apacheVer" "$apacheVer"
  2354. apacheMajer="$(echo "$apacheVer" | cut -d . -f 1)"
  2355. apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
  2356. if [ "$apacheVer" ] && [ "$apacheMajer$apacheMinor" -ge "24" ]; then
  2357. echo "
  2358. Alias /.well-known/acme-challenge $ACME_DIR
  2359. <Directory $ACME_DIR >
  2360. Require all granted
  2361. </Directory>
  2362. " >>"$httpdconf"
  2363. else
  2364. echo "
  2365. Alias /.well-known/acme-challenge $ACME_DIR
  2366. <Directory $ACME_DIR >
  2367. Order allow,deny
  2368. Allow from all
  2369. </Directory>
  2370. " >>"$httpdconf"
  2371. fi
  2372. _msg="$($_APACHECTL -t 2>&1)"
  2373. if [ "$?" != "0" ]; then
  2374. _err "Sorry, apache config error"
  2375. if _restoreApache; then
  2376. _err "The apache config file is restored."
  2377. else
  2378. _err "Sorry, The apache config file can not be restored, please report bug."
  2379. fi
  2380. return 1
  2381. fi
  2382. if [ ! -d "$ACME_DIR" ]; then
  2383. mkdir -p "$ACME_DIR"
  2384. chmod 755 "$ACME_DIR"
  2385. fi
  2386. if ! _exec "$_APACHECTL" graceful; then
  2387. _exec_err
  2388. _err "$_APACHECTL graceful error, please contact me."
  2389. _restoreApache
  2390. return 1
  2391. fi
  2392. usingApache="1"
  2393. return 0
  2394. }
  2395. #find the real nginx conf file
  2396. #backup
  2397. #set the nginx conf
  2398. #returns the real nginx conf file
  2399. _setNginx() {
  2400. _d="$1"
  2401. _croot="$2"
  2402. _thumbpt="$3"
  2403. FOUND_REAL_NGINX_CONF=""
  2404. FOUND_REAL_NGINX_CONF_LN=""
  2405. BACKUP_NGINX_CONF=""
  2406. _debug _croot "$_croot"
  2407. _start_f="$(echo "$_croot" | cut -d : -f 2)"
  2408. _debug _start_f "$_start_f"
  2409. if [ -z "$_start_f" ]; then
  2410. _debug "find start conf from nginx command"
  2411. if [ -z "$NGINX_CONF" ]; then
  2412. if ! _exists "nginx"; then
  2413. _err "nginx command is not found."
  2414. return 1
  2415. fi
  2416. NGINX_CONF="$(nginx -V 2>&1 | _egrep_o "--conf-path=[^ ]* " | tr -d " ")"
  2417. _debug NGINX_CONF "$NGINX_CONF"
  2418. NGINX_CONF="$(echo "$NGINX_CONF" | cut -d = -f 2)"
  2419. _debug NGINX_CONF "$NGINX_CONF"
  2420. if [ -z "$NGINX_CONF" ]; then
  2421. _err "Can not find nginx conf."
  2422. NGINX_CONF=""
  2423. return 1
  2424. fi
  2425. if [ ! -f "$NGINX_CONF" ]; then
  2426. _err "'$NGINX_CONF' doesn't exist."
  2427. NGINX_CONF=""
  2428. return 1
  2429. fi
  2430. _debug "Found nginx conf file:$NGINX_CONF"
  2431. fi
  2432. _start_f="$NGINX_CONF"
  2433. fi
  2434. _debug "Start detect nginx conf for $_d from:$_start_f"
  2435. if ! _checkConf "$_d" "$_start_f"; then
  2436. _err "Can not find conf file for domain $d"
  2437. return 1
  2438. fi
  2439. _info "Found conf file: $FOUND_REAL_NGINX_CONF"
  2440. _ln=$FOUND_REAL_NGINX_CONF_LN
  2441. _debug "_ln" "$_ln"
  2442. _lnn=$(_math $_ln + 1)
  2443. _debug _lnn "$_lnn"
  2444. _start_tag="$(sed -n "$_lnn,${_lnn}p" "$FOUND_REAL_NGINX_CONF")"
  2445. _debug "_start_tag" "$_start_tag"
  2446. if [ "$_start_tag" = "$NGINX_START" ]; then
  2447. _info "The domain $_d is already configured, skip"
  2448. FOUND_REAL_NGINX_CONF=""
  2449. return 0
  2450. fi
  2451. mkdir -p "$DOMAIN_BACKUP_PATH"
  2452. _backup_conf="$DOMAIN_BACKUP_PATH/$_d.nginx.conf"
  2453. _debug _backup_conf "$_backup_conf"
  2454. BACKUP_NGINX_CONF="$_backup_conf"
  2455. _info "Backup $FOUND_REAL_NGINX_CONF to $_backup_conf"
  2456. if ! cp "$FOUND_REAL_NGINX_CONF" "$_backup_conf"; then
  2457. _err "backup error."
  2458. FOUND_REAL_NGINX_CONF=""
  2459. return 1
  2460. fi
  2461. if ! _exists "nginx"; then
  2462. _err "nginx command is not found."
  2463. return 1
  2464. fi
  2465. _info "Check the nginx conf before setting up."
  2466. if ! _exec "nginx -t" >/dev/null; then
  2467. _exec_err
  2468. return 1
  2469. fi
  2470. _info "OK, Set up nginx config file"
  2471. if ! sed -n "1,${_ln}p" "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"; then
  2472. cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
  2473. _err "write nginx conf error, but don't worry, the file is restored to the original version."
  2474. return 1
  2475. fi
  2476. echo "$NGINX_START
  2477. location ~ \"^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)\$\" {
  2478. default_type text/plain;
  2479. return 200 \"\$1.$_thumbpt\";
  2480. }
  2481. #NGINX_START
  2482. " >>"$FOUND_REAL_NGINX_CONF"
  2483. if ! sed -n "${_lnn},99999p" "$_backup_conf" >>"$FOUND_REAL_NGINX_CONF"; then
  2484. cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
  2485. _err "write nginx conf error, but don't worry, the file is restored."
  2486. return 1
  2487. fi
  2488. _debug3 "Modified config:$(cat $FOUND_REAL_NGINX_CONF)"
  2489. _info "nginx conf is done, let's check it again."
  2490. if ! _exec "nginx -t" >/dev/null; then
  2491. _exec_err
  2492. _err "It seems that nginx conf was broken, let's restore."
  2493. cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
  2494. return 1
  2495. fi
  2496. _info "Reload nginx"
  2497. if ! _exec "nginx -s reload" >/dev/null; then
  2498. _exec_err
  2499. _err "It seems that nginx reload error, let's restore."
  2500. cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
  2501. return 1
  2502. fi
  2503. return 0
  2504. }
  2505. #d , conf
  2506. _checkConf() {
  2507. _d="$1"
  2508. _c_file="$2"
  2509. _debug "Start _checkConf from:$_c_file"
  2510. if [ ! -f "$2" ] && ! echo "$2" | grep '*$' >/dev/null && echo "$2" | grep '*' >/dev/null; then
  2511. _debug "wildcard"
  2512. for _w_f in $2; do
  2513. if [ -f "$_w_f" ] && _checkConf "$1" "$_w_f"; then
  2514. return 0
  2515. fi
  2516. done
  2517. #not found
  2518. return 1
  2519. elif [ -f "$2" ]; then
  2520. _debug "single"
  2521. if _isRealNginxConf "$1" "$2"; then
  2522. _debug "$2 is found."
  2523. FOUND_REAL_NGINX_CONF="$2"
  2524. return 0
  2525. fi
  2526. if cat "$2" | tr "\t" " " | grep "^ *include *.*;" >/dev/null; then
  2527. _debug "Try include files"
  2528. for included in $(cat "$2" | tr "\t" " " | grep "^ *include *.*;" | sed "s/include //" | tr -d " ;"); do
  2529. _debug "check included $included"
  2530. if _checkConf "$1" "$included"; then
  2531. return 0
  2532. fi
  2533. done
  2534. fi
  2535. return 1
  2536. else
  2537. _debug "$2 not found."
  2538. return 1
  2539. fi
  2540. return 1
  2541. }
  2542. #d , conf
  2543. _isRealNginxConf() {
  2544. _debug "_isRealNginxConf $1 $2"
  2545. if [ -f "$2" ]; then
  2546. for _fln in $(tr "\t" ' ' <"$2" | grep -n "^ *server_name.* $1" | cut -d : -f 1); do
  2547. _debug _fln "$_fln"
  2548. if [ "$_fln" ]; then
  2549. _start=$(tr "\t" ' ' <"$2" | _head_n "$_fln" | grep -n "^ *server *" | grep -v server_name | _tail_n 1)
  2550. _debug "_start" "$_start"
  2551. _start_n=$(echo "$_start" | cut -d : -f 1)
  2552. _start_nn=$(_math $_start_n + 1)
  2553. _debug "_start_n" "$_start_n"
  2554. _debug "_start_nn" "$_start_nn"
  2555. _left="$(sed -n "${_start_nn},99999p" "$2")"
  2556. _debug2 _left "$_left"
  2557. _end="$(echo "$_left" | tr "\t" ' ' | grep -n "^ *server *" | grep -v server_name | _head_n 1)"
  2558. _debug "_end" "$_end"
  2559. if [ "$_end" ]; then
  2560. _end_n=$(echo "$_end" | cut -d : -f 1)
  2561. _debug "_end_n" "$_end_n"
  2562. _seg_n=$(echo "$_left" | sed -n "1,${_end_n}p")
  2563. else
  2564. _seg_n="$_left"
  2565. fi
  2566. _debug "_seg_n" "$_seg_n"
  2567. _skip_ssl=1
  2568. for _listen_i in $(echo "$_seg_n" | tr "\t" ' ' | grep "^ *listen" | tr -d " "); do
  2569. if [ "$_listen_i" ]; then
  2570. if [ "$(echo "$_listen_i" | _egrep_o "listen.*ssl")" ]; then
  2571. _debug2 "$_listen_i is ssl"
  2572. else
  2573. _debug2 "$_listen_i is plain text"
  2574. _skip_ssl=""
  2575. break
  2576. fi
  2577. fi
  2578. done
  2579. if [ "$_skip_ssl" = "1" ]; then
  2580. _debug "ssl on, skip"
  2581. else
  2582. FOUND_REAL_NGINX_CONF_LN=$_fln
  2583. _debug3 "found FOUND_REAL_NGINX_CONF_LN" "$FOUND_REAL_NGINX_CONF_LN"
  2584. return 0
  2585. fi
  2586. fi
  2587. done
  2588. fi
  2589. return 1
  2590. }
  2591. #restore all the nginx conf
  2592. _restoreNginx() {
  2593. if [ -z "$NGINX_RESTORE_VLIST" ]; then
  2594. _debug "No need to restore nginx, skip."
  2595. return
  2596. fi
  2597. _debug "_restoreNginx"
  2598. _debug "NGINX_RESTORE_VLIST" "$NGINX_RESTORE_VLIST"
  2599. for ng_entry in $(echo "$NGINX_RESTORE_VLIST" | tr "$dvsep" ' '); do
  2600. _debug "ng_entry" "$ng_entry"
  2601. _nd=$(echo "$ng_entry" | cut -d "$sep" -f 1)
  2602. _ngconf=$(echo "$ng_entry" | cut -d "$sep" -f 2)
  2603. _ngbackupconf=$(echo "$ng_entry" | cut -d "$sep" -f 3)
  2604. _info "Restoring from $_ngbackupconf to $_ngconf"
  2605. cat "$_ngbackupconf" >"$_ngconf"
  2606. done
  2607. _info "Reload nginx"
  2608. if ! _exec "nginx -s reload" >/dev/null; then
  2609. _exec_err
  2610. _err "It seems that nginx reload error, please report bug."
  2611. return 1
  2612. fi
  2613. return 0
  2614. }
  2615. _clearup() {
  2616. _stopserver "$serverproc"
  2617. serverproc=""
  2618. _restoreApache
  2619. _restoreNginx
  2620. _clearupdns
  2621. if [ -z "$DEBUG" ]; then
  2622. rm -f "$TLS_CONF"
  2623. rm -f "$TLS_CERT"
  2624. rm -f "$TLS_KEY"
  2625. rm -f "$TLS_CSR"
  2626. fi
  2627. }
  2628. _clearupdns() {
  2629. _debug "_clearupdns"
  2630. _debug "dns_entries" "$dns_entries"
  2631. if [ -z "$dns_entries" ]; then
  2632. _debug "skip dns."
  2633. return
  2634. fi
  2635. _info "Removing DNS records."
  2636. for entry in $dns_entries; do
  2637. d=$(_getfield "$entry" 1)
  2638. txtdomain=$(_getfield "$entry" 2)
  2639. aliasDomain=$(_getfield "$entry" 3)
  2640. _currentRoot=$(_getfield "$entry" 4)
  2641. txt=$(_getfield "$entry" 5)
  2642. d_api=$(_getfield "$entry" 6)
  2643. _debug "d" "$d"
  2644. _debug "txtdomain" "$txtdomain"
  2645. _debug "aliasDomain" "$aliasDomain"
  2646. _debug "_currentRoot" "$_currentRoot"
  2647. _debug "txt" "$txt"
  2648. _debug "d_api" "$d_api"
  2649. if [ "$d_api" = "$txt" ]; then
  2650. d_api=""
  2651. fi
  2652. if [ -z "$d_api" ]; then
  2653. _info "Not Found domain api file: $d_api"
  2654. continue
  2655. fi
  2656. if [ "$aliasDomain" ]; then
  2657. txtdomain="$aliasDomain"
  2658. fi
  2659. (
  2660. if ! . "$d_api"; then
  2661. _err "Load file $d_api error. Please check your api file and try again."
  2662. return 1
  2663. fi
  2664. rmcommand="${_currentRoot}_rm"
  2665. if ! _exists "$rmcommand"; then
  2666. _err "It seems that your api file doesn't define $rmcommand"
  2667. return 1
  2668. fi
  2669. _info "Removing txt: $txt for domain: $txtdomain"
  2670. if ! $rmcommand "$txtdomain" "$txt"; then
  2671. _err "Error removing txt for domain:$txtdomain"
  2672. return 1
  2673. fi
  2674. _info "Removed: Success"
  2675. )
  2676. done
  2677. }
  2678. # webroot removelevel tokenfile
  2679. _clearupwebbroot() {
  2680. __webroot="$1"
  2681. if [ -z "$__webroot" ]; then
  2682. _debug "no webroot specified, skip"
  2683. return 0
  2684. fi
  2685. _rmpath=""
  2686. if [ "$2" = '1' ]; then
  2687. _rmpath="$__webroot/.well-known"
  2688. elif [ "$2" = '2' ]; then
  2689. _rmpath="$__webroot/.well-known/acme-challenge"
  2690. elif [ "$2" = '3' ]; then
  2691. _rmpath="$__webroot/.well-known/acme-challenge/$3"
  2692. else
  2693. _debug "Skip for removelevel:$2"
  2694. fi
  2695. if [ "$_rmpath" ]; then
  2696. if [ "$DEBUG" ]; then
  2697. _debug "Debugging, skip removing: $_rmpath"
  2698. else
  2699. rm -rf "$_rmpath"
  2700. fi
  2701. fi
  2702. return 0
  2703. }
  2704. _on_before_issue() {
  2705. _chk_web_roots="$1"
  2706. _chk_main_domain="$2"
  2707. _chk_alt_domains="$3"
  2708. _chk_pre_hook="$4"
  2709. _chk_local_addr="$5"
  2710. _debug _on_before_issue
  2711. _debug _chk_main_domain "$_chk_main_domain"
  2712. _debug _chk_alt_domains "$_chk_alt_domains"
  2713. #run pre hook
  2714. if [ "$_chk_pre_hook" ]; then
  2715. _info "Run pre hook:'$_chk_pre_hook'"
  2716. if ! (
  2717. cd "$DOMAIN_PATH" && eval "$_chk_pre_hook"
  2718. ); then
  2719. _err "Error when run pre hook."
  2720. return 1
  2721. fi
  2722. fi
  2723. if _hasfield "$_chk_web_roots" "$NO_VALUE"; then
  2724. if ! _exists "socat"; then
  2725. _err "Please install socat tools first."
  2726. return 1
  2727. fi
  2728. fi
  2729. _debug Le_LocalAddress "$_chk_local_addr"
  2730. _index=1
  2731. _currentRoot=""
  2732. _addrIndex=1
  2733. _w_index=1
  2734. while true; do
  2735. d="$(echo "$_chk_main_domain,$_chk_alt_domains," | cut -d , -f "$_w_index")"
  2736. _w_index="$(_math "$_w_index" + 1)"
  2737. _debug d "$d"
  2738. if [ -z "$d" ]; then
  2739. break
  2740. fi
  2741. _debug "Check for domain" "$d"
  2742. _currentRoot="$(_getfield "$_chk_web_roots" $_index)"
  2743. _debug "_currentRoot" "$_currentRoot"
  2744. _index=$(_math $_index + 1)
  2745. _checkport=""
  2746. if [ "$_currentRoot" = "$NO_VALUE" ]; then
  2747. _info "Standalone mode."
  2748. if [ -z "$Le_HTTPPort" ]; then
  2749. Le_HTTPPort=80
  2750. _cleardomainconf "Le_HTTPPort"
  2751. else
  2752. _savedomainconf "Le_HTTPPort" "$Le_HTTPPort"
  2753. fi
  2754. _checkport="$Le_HTTPPort"
  2755. elif [ "$_currentRoot" = "$W_ALPN" ]; then
  2756. _info "Standalone alpn mode."
  2757. if [ -z "$Le_TLSPort" ]; then
  2758. Le_TLSPort=443
  2759. else
  2760. _savedomainconf "Le_TLSPort" "$Le_TLSPort"
  2761. fi
  2762. _checkport="$Le_TLSPort"
  2763. fi
  2764. if [ "$_checkport" ]; then
  2765. _debug _checkport "$_checkport"
  2766. _checkaddr="$(_getfield "$_chk_local_addr" $_addrIndex)"
  2767. _debug _checkaddr "$_checkaddr"
  2768. _addrIndex="$(_math $_addrIndex + 1)"
  2769. _netprc="$(_ss "$_checkport" | grep "$_checkport")"
  2770. netprc="$(echo "$_netprc" | grep "$_checkaddr")"
  2771. if [ -z "$netprc" ]; then
  2772. netprc="$(echo "$_netprc" | grep "$LOCAL_ANY_ADDRESS")"
  2773. fi
  2774. if [ "$netprc" ]; then
  2775. _err "$netprc"
  2776. _err "tcp port $_checkport is already used by $(echo "$netprc" | cut -d : -f 4)"
  2777. _err "Please stop it first"
  2778. return 1
  2779. fi
  2780. fi
  2781. done
  2782. if _hasfield "$_chk_web_roots" "apache"; then
  2783. if ! _setApache; then
  2784. _err "set up apache error. Report error to me."
  2785. return 1
  2786. fi
  2787. else
  2788. usingApache=""
  2789. fi
  2790. }
  2791. _on_issue_err() {
  2792. _chk_post_hook="$1"
  2793. _chk_vlist="$2"
  2794. _debug _on_issue_err
  2795. if [ "$LOG_FILE" ]; then
  2796. _err "Please check log file for more details: $LOG_FILE"
  2797. else
  2798. _err "Please add '--debug' or '--log' to check more details."
  2799. _err "See: $_DEBUG_WIKI"
  2800. fi
  2801. #run the post hook
  2802. if [ "$_chk_post_hook" ]; then
  2803. _info "Run post hook:'$_chk_post_hook'"
  2804. if ! (
  2805. cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
  2806. ); then
  2807. _err "Error when run post hook."
  2808. return 1
  2809. fi
  2810. fi
  2811. #trigger the validation to flush the pending authz
  2812. _debug2 "_chk_vlist" "$_chk_vlist"
  2813. if [ "$_chk_vlist" ]; then
  2814. (
  2815. _debug2 "start to deactivate authz"
  2816. ventries=$(echo "$_chk_vlist" | tr "$dvsep" ' ')
  2817. for ventry in $ventries; do
  2818. d=$(echo "$ventry" | cut -d "$sep" -f 1)
  2819. keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
  2820. uri=$(echo "$ventry" | cut -d "$sep" -f 3)
  2821. vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
  2822. _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
  2823. __trigger_validation "$uri" "$keyauthorization"
  2824. done
  2825. )
  2826. fi
  2827. if [ "$IS_RENEW" = "1" ] && _hasfield "$Le_Webroot" "$W_DNS"; then
  2828. _err "$_DNS_MANUAL_ERR"
  2829. fi
  2830. if [ "$DEBUG" ] && [ "$DEBUG" -gt "0" ]; then
  2831. _debug "$(_dlg_versions)"
  2832. fi
  2833. }
  2834. _on_issue_success() {
  2835. _chk_post_hook="$1"
  2836. _chk_renew_hook="$2"
  2837. _debug _on_issue_success
  2838. #run the post hook
  2839. if [ "$_chk_post_hook" ]; then
  2840. _info "Run post hook:'$_chk_post_hook'"
  2841. if ! (
  2842. export CERT_PATH
  2843. export CERT_KEY_PATH
  2844. export CA_CERT_PATH
  2845. export CERT_FULLCHAIN_PATH
  2846. export Le_Domain="$_main_domain"
  2847. cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
  2848. ); then
  2849. _err "Error when run post hook."
  2850. return 1
  2851. fi
  2852. fi
  2853. #run renew hook
  2854. if [ "$IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
  2855. _info "Run renew hook:'$_chk_renew_hook'"
  2856. if ! (
  2857. export CERT_PATH
  2858. export CERT_KEY_PATH
  2859. export CA_CERT_PATH
  2860. export CERT_FULLCHAIN_PATH
  2861. export Le_Domain="$_main_domain"
  2862. cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
  2863. ); then
  2864. _err "Error when run renew hook."
  2865. return 1
  2866. fi
  2867. fi
  2868. if _hasfield "$Le_Webroot" "$W_DNS"; then
  2869. _err "$_DNS_MANUAL_WARN"
  2870. fi
  2871. }
  2872. registeraccount() {
  2873. _reg_length="$1"
  2874. _initpath
  2875. _regAccount "$_reg_length"
  2876. }
  2877. __calcAccountKeyHash() {
  2878. [ -f "$ACCOUNT_KEY_PATH" ] && _digest sha256 <"$ACCOUNT_KEY_PATH"
  2879. }
  2880. __calc_account_thumbprint() {
  2881. printf "%s" "$jwk" | tr -d ' ' | _digest "sha256" | _url_replace
  2882. }
  2883. #keylength
  2884. _regAccount() {
  2885. _initpath
  2886. _reg_length="$1"
  2887. _debug3 _regAccount "$_regAccount"
  2888. _initAPI
  2889. mkdir -p "$CA_DIR"
  2890. if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
  2891. _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
  2892. mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
  2893. fi
  2894. if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
  2895. _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
  2896. mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
  2897. fi
  2898. if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
  2899. if ! _create_account_key "$_reg_length"; then
  2900. _err "Create account key error."
  2901. return 1
  2902. fi
  2903. fi
  2904. if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
  2905. return 1
  2906. fi
  2907. if [ "$ACME_VERSION" = "2" ]; then
  2908. regjson='{"termsOfServiceAgreed": true}'
  2909. if [ "$ACCOUNT_EMAIL" ]; then
  2910. regjson='{"contact": ["mailto: '$ACCOUNT_EMAIL'"], "termsOfServiceAgreed": true}'
  2911. fi
  2912. else
  2913. _reg_res="$ACME_NEW_ACCOUNT_RES"
  2914. regjson='{"resource": "'$_reg_res'", "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
  2915. if [ "$ACCOUNT_EMAIL" ]; then
  2916. regjson='{"resource": "'$_reg_res'", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
  2917. fi
  2918. fi
  2919. _info "Registering account"
  2920. if ! _send_signed_request "${ACME_NEW_ACCOUNT}" "$regjson"; then
  2921. _err "Register account Error: $response"
  2922. return 1
  2923. fi
  2924. if [ "$code" = "" ] || [ "$code" = '201' ]; then
  2925. echo "$response" >"$ACCOUNT_JSON_PATH"
  2926. _info "Registered"
  2927. elif [ "$code" = '409' ] || [ "$code" = '200' ]; then
  2928. _info "Already registered"
  2929. else
  2930. _err "Register account Error: $response"
  2931. return 1
  2932. fi
  2933. _debug2 responseHeaders "$responseHeaders"
  2934. _accUri="$(echo "$responseHeaders" | grep -i "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
  2935. _debug "_accUri" "$_accUri"
  2936. if [ -z "$_accUri" ]; then
  2937. _err "Can not find account id url."
  2938. _err "$responseHeaders"
  2939. return 1
  2940. fi
  2941. _savecaconf "ACCOUNT_URL" "$_accUri"
  2942. export ACCOUNT_URL="$_accUri"
  2943. CA_KEY_HASH="$(__calcAccountKeyHash)"
  2944. _debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
  2945. _savecaconf CA_KEY_HASH "$CA_KEY_HASH"
  2946. if [ "$code" = '403' ]; then
  2947. _err "It seems that the account key is already deactivated, please use a new account key."
  2948. return 1
  2949. fi
  2950. ACCOUNT_THUMBPRINT="$(__calc_account_thumbprint)"
  2951. _info "ACCOUNT_THUMBPRINT" "$ACCOUNT_THUMBPRINT"
  2952. }
  2953. #implement updateaccount
  2954. updateaccount() {
  2955. _initpath
  2956. if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
  2957. _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
  2958. mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
  2959. fi
  2960. if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
  2961. _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
  2962. mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
  2963. fi
  2964. if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
  2965. _err "Account key is not found at: $ACCOUNT_KEY_PATH"
  2966. return 1
  2967. fi
  2968. _accUri=$(_readcaconf "ACCOUNT_URL")
  2969. _debug _accUri "$_accUri"
  2970. if [ -z "$_accUri" ]; then
  2971. _err "The account url is empty, please run '--update-account' first to update the account info first,"
  2972. _err "Then try again."
  2973. return 1
  2974. fi
  2975. if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
  2976. return 1
  2977. fi
  2978. _initAPI
  2979. if [ "$ACME_VERSION" = "2" ]; then
  2980. if [ "$ACCOUNT_EMAIL" ]; then
  2981. updjson='{"contact": ["mailto: '$ACCOUNT_EMAIL'"]}'
  2982. fi
  2983. else
  2984. # ACMEv1: Updates happen the same way a registration is done.
  2985. # https://tools.ietf.org/html/draft-ietf-acme-acme-01#section-6.3
  2986. _regAccount
  2987. return
  2988. fi
  2989. # this part handles ACMEv2 account updates.
  2990. _send_signed_request "$_accUri" "$updjson"
  2991. if [ "$code" = '200' ]; then
  2992. _info "account update success for $_accUri."
  2993. else
  2994. _info "Error. The account was not updated."
  2995. return 1
  2996. fi
  2997. }
  2998. #Implement deactivate account
  2999. deactivateaccount() {
  3000. _initpath
  3001. if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
  3002. _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
  3003. mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
  3004. fi
  3005. if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
  3006. _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
  3007. mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
  3008. fi
  3009. if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
  3010. _err "Account key is not found at: $ACCOUNT_KEY_PATH"
  3011. return 1
  3012. fi
  3013. _accUri=$(_readcaconf "ACCOUNT_URL")
  3014. _debug _accUri "$_accUri"
  3015. if [ -z "$_accUri" ]; then
  3016. _err "The account url is empty, please run '--update-account' first to update the account info first,"
  3017. _err "Then try again."
  3018. return 1
  3019. fi
  3020. if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
  3021. return 1
  3022. fi
  3023. _initAPI
  3024. if [ "$ACME_VERSION" = "2" ]; then
  3025. _djson="{\"status\":\"deactivated\"}"
  3026. else
  3027. _djson="{\"resource\": \"reg\", \"status\":\"deactivated\"}"
  3028. fi
  3029. if _send_signed_request "$_accUri" "$_djson" && _contains "$response" '"deactivated"'; then
  3030. _info "Deactivate account success for $_accUri."
  3031. _accid=$(echo "$response" | _egrep_o "\"id\" *: *[^,]*," | cut -d : -f 2 | tr -d ' ,')
  3032. elif [ "$code" = "403" ]; then
  3033. _info "The account is already deactivated."
  3034. _accid=$(_getfield "$_accUri" "999" "/")
  3035. else
  3036. _err "Deactivate: account failed for $_accUri."
  3037. return 1
  3038. fi
  3039. _debug "Account id: $_accid"
  3040. if [ "$_accid" ]; then
  3041. _deactivated_account_path="$CA_DIR/deactivated/$_accid"
  3042. _debug _deactivated_account_path "$_deactivated_account_path"
  3043. if mkdir -p "$_deactivated_account_path"; then
  3044. _info "Moving deactivated account info to $_deactivated_account_path/"
  3045. mv "$CA_CONF" "$_deactivated_account_path/"
  3046. mv "$ACCOUNT_JSON_PATH" "$_deactivated_account_path/"
  3047. mv "$ACCOUNT_KEY_PATH" "$_deactivated_account_path/"
  3048. else
  3049. _err "Can not create dir: $_deactivated_account_path, try to remove the deactivated account key."
  3050. rm -f "$CA_CONF"
  3051. rm -f "$ACCOUNT_JSON_PATH"
  3052. rm -f "$ACCOUNT_KEY_PATH"
  3053. fi
  3054. fi
  3055. }
  3056. # domain folder file
  3057. _findHook() {
  3058. _hookdomain="$1"
  3059. _hookcat="$2"
  3060. _hookname="$3"
  3061. if [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname" ]; then
  3062. d_api="$_SCRIPT_HOME/$_hookcat/$_hookname"
  3063. elif [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname.sh" ]; then
  3064. d_api="$_SCRIPT_HOME/$_hookcat/$_hookname.sh"
  3065. elif [ "$_hookdomain" ] && [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname" ]; then
  3066. d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname"
  3067. elif [ "$_hookdomain" ] && [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname.sh" ]; then
  3068. d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname.sh"
  3069. elif [ -f "$LE_WORKING_DIR/$_hookname" ]; then
  3070. d_api="$LE_WORKING_DIR/$_hookname"
  3071. elif [ -f "$LE_WORKING_DIR/$_hookname.sh" ]; then
  3072. d_api="$LE_WORKING_DIR/$_hookname.sh"
  3073. elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname" ]; then
  3074. d_api="$LE_WORKING_DIR/$_hookcat/$_hookname"
  3075. elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname.sh" ]; then
  3076. d_api="$LE_WORKING_DIR/$_hookcat/$_hookname.sh"
  3077. fi
  3078. printf "%s" "$d_api"
  3079. }
  3080. #domain
  3081. __get_domain_new_authz() {
  3082. _gdnd="$1"
  3083. _info "Getting new-authz for domain" "$_gdnd"
  3084. _initAPI
  3085. _Max_new_authz_retry_times=5
  3086. _authz_i=0
  3087. while [ "$_authz_i" -lt "$_Max_new_authz_retry_times" ]; do
  3088. _debug "Try new-authz for the $_authz_i time."
  3089. if ! _send_signed_request "${ACME_NEW_AUTHZ}" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$(_idn "$_gdnd")\"}}"; then
  3090. _err "Can not get domain new authz."
  3091. return 1
  3092. fi
  3093. if _contains "$response" "No registration exists matching provided key"; then
  3094. _err "It seems there is an error, but it's recovered now, please try again."
  3095. _err "If you see this message for a second time, please report bug: $(__green "$PROJECT")"
  3096. _clearcaconf "CA_KEY_HASH"
  3097. break
  3098. fi
  3099. if ! _contains "$response" "An error occurred while processing your request"; then
  3100. _info "The new-authz request is ok."
  3101. break
  3102. fi
  3103. _authz_i="$(_math "$_authz_i" + 1)"
  3104. _info "The server is busy, Sleep $_authz_i to retry."
  3105. _sleep "$_authz_i"
  3106. done
  3107. if [ "$_authz_i" = "$_Max_new_authz_retry_times" ]; then
  3108. _err "new-authz retry reach the max $_Max_new_authz_retry_times times."
  3109. fi
  3110. if [ "$code" ] && [ "$code" != '201' ]; then
  3111. _err "new-authz error: $response"
  3112. return 1
  3113. fi
  3114. }
  3115. #uri keyAuthorization
  3116. __trigger_validation() {
  3117. _debug2 "Trigger domain validation."
  3118. _t_url="$1"
  3119. _debug2 _t_url "$_t_url"
  3120. _t_key_authz="$2"
  3121. _debug2 _t_key_authz "$_t_key_authz"
  3122. _t_vtype="$3"
  3123. _debug2 _t_vtype "$_t_vtype"
  3124. if [ "$ACME_VERSION" = "2" ]; then
  3125. _send_signed_request "$_t_url" "{}"
  3126. else
  3127. _send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"type\": \"$_t_vtype\", \"keyAuthorization\": \"$_t_key_authz\"}"
  3128. fi
  3129. }
  3130. #endpoint domain type
  3131. _ns_lookup() {
  3132. _ns_ep="$1"
  3133. _ns_domain="$2"
  3134. _ns_type="$3"
  3135. _debug2 "_ns_ep" "$_ns_ep"
  3136. _debug2 "_ns_domain" "$_ns_domain"
  3137. _debug2 "_ns_type" "$_ns_type"
  3138. response="$(_H1="accept: application/dns-json" _get "$_ns_ep?name=$_ns_domain&type=$_ns_type")"
  3139. _ret=$?
  3140. _debug2 "response" "$response"
  3141. if [ "$_ret" != "0" ]; then
  3142. return $_ret
  3143. fi
  3144. _answers="$(echo "$response" | tr '{}' '<>' | _egrep_o '"Answer":\[[^]]*]' | tr '<>' '\n\n')"
  3145. _debug2 "_answers" "$_answers"
  3146. echo "$_answers"
  3147. }
  3148. #domain, type
  3149. _ns_lookup_cf() {
  3150. _cf_ld="$1"
  3151. _cf_ld_type="$2"
  3152. _cf_ep="https://cloudflare-dns.com/dns-query"
  3153. _ns_lookup "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
  3154. }
  3155. #domain, type
  3156. _ns_purge_cf() {
  3157. _cf_d="$1"
  3158. _cf_d_type="$2"
  3159. _debug "Cloudflare purge $_cf_d_type record for domain $_cf_d"
  3160. _cf_purl="https://cloudflare-dns.com/api/v1/purge?domain=$_cf_d&type=$_cf_d_type"
  3161. response="$(_post "" "$_cf_purl")"
  3162. _debug2 response "$response"
  3163. }
  3164. #txtdomain, alias, txt
  3165. __check_txt() {
  3166. _c_txtdomain="$1"
  3167. _c_aliasdomain="$2"
  3168. _c_txt="$3"
  3169. _debug "_c_txtdomain" "$_c_txtdomain"
  3170. _debug "_c_aliasdomain" "$_c_aliasdomain"
  3171. _debug "_c_txt" "$_c_txt"
  3172. _answers="$(_ns_lookup_cf "$_c_aliasdomain" TXT)"
  3173. _contains "$_answers" "$_c_txt"
  3174. }
  3175. #txtdomain
  3176. __purge_txt() {
  3177. _p_txtdomain="$1"
  3178. _debug _p_txtdomain "$_p_txtdomain"
  3179. _ns_purge_cf "$_p_txtdomain" "TXT"
  3180. }
  3181. #wait and check each dns entries
  3182. _check_dns_entries() {
  3183. _success_txt=","
  3184. _end_time="$(_time)"
  3185. _end_time="$(_math "$_end_time" + 1200)" #let's check no more than 20 minutes.
  3186. while [ "$(_time)" -le "$_end_time" ]; do
  3187. _left=""
  3188. for entry in $dns_entries; do
  3189. d=$(_getfield "$entry" 1)
  3190. txtdomain=$(_getfield "$entry" 2)
  3191. txtdomain=$(_idn "$txtdomain")
  3192. aliasDomain=$(_getfield "$entry" 3)
  3193. aliasDomain=$(_idn "$aliasDomain")
  3194. txt=$(_getfield "$entry" 5)
  3195. d_api=$(_getfield "$entry" 6)
  3196. _debug "d" "$d"
  3197. _debug "txtdomain" "$txtdomain"
  3198. _debug "aliasDomain" "$aliasDomain"
  3199. _debug "txt" "$txt"
  3200. _debug "d_api" "$d_api"
  3201. _info "Checking $d for $aliasDomain"
  3202. if _contains "$_success_txt" ",$txt,"; then
  3203. _info "Already success, continue next one."
  3204. continue
  3205. fi
  3206. if __check_txt "$txtdomain" "$aliasDomain" "$txt"; then
  3207. _info "Domain $d '$aliasDomain' success."
  3208. _success_txt="$_success_txt,$txt,"
  3209. continue
  3210. fi
  3211. _left=1
  3212. _info "Not valid yet, let's wait 10 seconds and check next one."
  3213. __purge_txt "$txtdomain"
  3214. if [ "$txtdomain" != "$aliasDomain" ]; then
  3215. __purge_txt "$aliasDomain"
  3216. fi
  3217. _sleep 10
  3218. done
  3219. if [ "$_left" ]; then
  3220. _info "Let's wait 10 seconds and check again".
  3221. _sleep 10
  3222. else
  3223. _info "All success, let's return"
  3224. break
  3225. fi
  3226. done
  3227. }
  3228. #webroot, domain domainlist keylength
  3229. issue() {
  3230. if [ -z "$2" ]; then
  3231. _usage "Usage: $PROJECT_ENTRY --issue -d a.com -w /path/to/webroot/a.com/ "
  3232. return 1
  3233. fi
  3234. if [ -z "$1" ]; then
  3235. _usage "Please specify at least one validation method: '--webroot', '--standalone', '--apache', '--nginx' or '--dns' etc."
  3236. return 1
  3237. fi
  3238. _web_roots="$1"
  3239. _main_domain="$2"
  3240. _alt_domains="$3"
  3241. if _contains "$_main_domain" ","; then
  3242. _main_domain=$(echo "$2,$3" | cut -d , -f 1)
  3243. _alt_domains=$(echo "$2,$3" | cut -d , -f 2- | sed "s/,${NO_VALUE}$//")
  3244. fi
  3245. _debug _main_domain "$_main_domain"
  3246. _debug _alt_domains "$_alt_domains"
  3247. _key_length="$4"
  3248. _real_cert="$5"
  3249. _real_key="$6"
  3250. _real_ca="$7"
  3251. _reload_cmd="$8"
  3252. _real_fullchain="$9"
  3253. _pre_hook="${10}"
  3254. _post_hook="${11}"
  3255. _renew_hook="${12}"
  3256. _local_addr="${13}"
  3257. _challenge_alias="${14}"
  3258. #remove these later.
  3259. if [ "$_web_roots" = "dns-cf" ]; then
  3260. _web_roots="dns_cf"
  3261. fi
  3262. if [ "$_web_roots" = "dns-dp" ]; then
  3263. _web_roots="dns_dp"
  3264. fi
  3265. if [ "$_web_roots" = "dns-cx" ]; then
  3266. _web_roots="dns_cx"
  3267. fi
  3268. if [ ! "$IS_RENEW" ]; then
  3269. _initpath "$_main_domain" "$_key_length"
  3270. mkdir -p "$DOMAIN_PATH"
  3271. fi
  3272. if _hasfield "$_web_roots" "$W_DNS" && [ -z "$FORCE_DNS_MANUAL" ]; then
  3273. _err "$_DNS_MANUAL_ERROR"
  3274. return 1
  3275. fi
  3276. _debug "Using ACME_DIRECTORY: $ACME_DIRECTORY"
  3277. _initAPI
  3278. if [ -f "$DOMAIN_CONF" ]; then
  3279. Le_NextRenewTime=$(_readdomainconf Le_NextRenewTime)
  3280. _debug Le_NextRenewTime "$Le_NextRenewTime"
  3281. if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
  3282. _saved_domain=$(_readdomainconf Le_Domain)
  3283. _debug _saved_domain "$_saved_domain"
  3284. _saved_alt=$(_readdomainconf Le_Alt)
  3285. _debug _saved_alt "$_saved_alt"
  3286. if [ "$_saved_domain,$_saved_alt" = "$_main_domain,$_alt_domains" ]; then
  3287. _info "Domains not changed."
  3288. _info "Skip, Next renewal time is: $(__green "$(_readdomainconf Le_NextRenewTimeStr)")"
  3289. _info "Add '$(__red '--force')' to force to renew."
  3290. return $RENEW_SKIP
  3291. else
  3292. _info "Domains have changed."
  3293. fi
  3294. fi
  3295. fi
  3296. _savedomainconf "Le_Domain" "$_main_domain"
  3297. _savedomainconf "Le_Alt" "$_alt_domains"
  3298. _savedomainconf "Le_Webroot" "$_web_roots"
  3299. _savedomainconf "Le_PreHook" "$_pre_hook" "base64"
  3300. _savedomainconf "Le_PostHook" "$_post_hook" "base64"
  3301. _savedomainconf "Le_RenewHook" "$_renew_hook" "base64"
  3302. if [ "$_local_addr" ]; then
  3303. _savedomainconf "Le_LocalAddress" "$_local_addr"
  3304. else
  3305. _cleardomainconf "Le_LocalAddress"
  3306. fi
  3307. if [ "$_challenge_alias" ]; then
  3308. _savedomainconf "Le_ChallengeAlias" "$_challenge_alias"
  3309. else
  3310. _cleardomainconf "Le_ChallengeAlias"
  3311. fi
  3312. if [ "$ACME_DIRECTORY" != "$DEFAULT_CA" ]; then
  3313. Le_API="$ACME_DIRECTORY"
  3314. _savedomainconf "Le_API" "$Le_API"
  3315. else
  3316. _cleardomainconf Le_API
  3317. fi
  3318. if [ "$_alt_domains" = "$NO_VALUE" ]; then
  3319. _alt_domains=""
  3320. fi
  3321. if [ "$_key_length" = "$NO_VALUE" ]; then
  3322. _key_length=""
  3323. fi
  3324. if ! _on_before_issue "$_web_roots" "$_main_domain" "$_alt_domains" "$_pre_hook" "$_local_addr"; then
  3325. _err "_on_before_issue."
  3326. return 1
  3327. fi
  3328. _saved_account_key_hash="$(_readcaconf "CA_KEY_HASH")"
  3329. _debug2 _saved_account_key_hash "$_saved_account_key_hash"
  3330. if [ -z "$ACCOUNT_URL" ] || [ -z "$_saved_account_key_hash" ] || [ "$_saved_account_key_hash" != "$(__calcAccountKeyHash)" ]; then
  3331. if ! _regAccount "$_accountkeylength"; then
  3332. _on_issue_err "$_post_hook"
  3333. return 1
  3334. fi
  3335. else
  3336. _debug "_saved_account_key_hash is not changed, skip register account."
  3337. fi
  3338. if [ -f "$CSR_PATH" ] && [ ! -f "$CERT_KEY_PATH" ]; then
  3339. _info "Signing from existing CSR."
  3340. else
  3341. _key=$(_readdomainconf Le_Keylength)
  3342. _debug "Read key length:$_key"
  3343. if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ] || [ "$Le_ForceNewDomainKey" = "1" ]; then
  3344. if ! createDomainKey "$_main_domain" "$_key_length"; then
  3345. _err "Create domain key error."
  3346. _clearup
  3347. _on_issue_err "$_post_hook"
  3348. return 1
  3349. fi
  3350. fi
  3351. if ! _createcsr "$_main_domain" "$_alt_domains" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"; then
  3352. _err "Create CSR error."
  3353. _clearup
  3354. _on_issue_err "$_post_hook"
  3355. return 1
  3356. fi
  3357. fi
  3358. _savedomainconf "Le_Keylength" "$_key_length"
  3359. vlist="$Le_Vlist"
  3360. _cleardomainconf "Le_Vlist"
  3361. _info "Getting domain auth token for each domain"
  3362. sep='#'
  3363. dvsep=','
  3364. if [ -z "$vlist" ]; then
  3365. if [ "$ACME_VERSION" = "2" ]; then
  3366. #make new order request
  3367. _identifiers="{\"type\":\"dns\",\"value\":\"$(_idn "$_main_domain")\"}"
  3368. _w_index=1
  3369. while true; do
  3370. d="$(echo "$_alt_domains," | cut -d , -f "$_w_index")"
  3371. _w_index="$(_math "$_w_index" + 1)"
  3372. _debug d "$d"
  3373. if [ -z "$d" ]; then
  3374. break
  3375. fi
  3376. _identifiers="$_identifiers,{\"type\":\"dns\",\"value\":\"$(_idn "$d")\"}"
  3377. done
  3378. _debug2 _identifiers "$_identifiers"
  3379. if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
  3380. _err "Create new order error."
  3381. _clearup
  3382. _on_issue_err "$_post_hook"
  3383. return 1
  3384. fi
  3385. Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
  3386. _debug Le_LinkOrder "$Le_LinkOrder"
  3387. Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
  3388. _debug Le_OrderFinalize "$Le_OrderFinalize"
  3389. if [ -z "$Le_OrderFinalize" ]; then
  3390. _err "Create new order error. Le_OrderFinalize not found. $response"
  3391. _clearup
  3392. _on_issue_err "$_post_hook"
  3393. return 1
  3394. fi
  3395. #for dns manual mode
  3396. _savedomainconf "Le_OrderFinalize" "$Le_OrderFinalize"
  3397. _authorizations_seg="$(echo "$response" | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
  3398. _debug2 _authorizations_seg "$_authorizations_seg"
  3399. if [ -z "$_authorizations_seg" ]; then
  3400. _err "_authorizations_seg not found."
  3401. _clearup
  3402. _on_issue_err "$_post_hook"
  3403. return 1
  3404. fi
  3405. #domain and authz map
  3406. _authorizations_map=""
  3407. for _authz_url in $(echo "$_authorizations_seg" | tr ',' ' '); do
  3408. _debug2 "_authz_url" "$_authz_url"
  3409. if ! _send_signed_request "$_authz_url"; then
  3410. _err "get to authz error."
  3411. _err "_authorizations_seg" "$_authorizations_seg"
  3412. _err "_authz_url" "$_authz_url"
  3413. _clearup
  3414. _on_issue_err "$_post_hook"
  3415. return 1
  3416. fi
  3417. response="$(echo "$response" | _normalizeJson)"
  3418. _debug2 response "$response"
  3419. _d="$(echo "$response" | _egrep_o '"value" *: *"[^"]*"' | cut -d : -f 2 | tr -d ' "')"
  3420. if _contains "$response" "\"wildcard\" *: *true"; then
  3421. _d="*.$_d"
  3422. fi
  3423. _debug2 _d "$_d"
  3424. _authorizations_map="$_d,$response
  3425. $_authorizations_map"
  3426. done
  3427. _debug2 _authorizations_map "$_authorizations_map"
  3428. fi
  3429. _index=0
  3430. _currentRoot=""
  3431. _w_index=1
  3432. while true; do
  3433. d="$(echo "$_main_domain,$_alt_domains," | cut -d , -f "$_w_index")"
  3434. _w_index="$(_math "$_w_index" + 1)"
  3435. _debug d "$d"
  3436. if [ -z "$d" ]; then
  3437. break
  3438. fi
  3439. _info "Getting webroot for domain" "$d"
  3440. _index=$(_math $_index + 1)
  3441. _w="$(echo $_web_roots | cut -d , -f $_index)"
  3442. _debug _w "$_w"
  3443. if [ "$_w" ]; then
  3444. _currentRoot="$_w"
  3445. fi
  3446. _debug "_currentRoot" "$_currentRoot"
  3447. vtype="$VTYPE_HTTP"
  3448. #todo, v2 wildcard force to use dns
  3449. if _startswith "$_currentRoot" "$W_DNS"; then
  3450. vtype="$VTYPE_DNS"
  3451. fi
  3452. if [ "$_currentRoot" = "$W_ALPN" ]; then
  3453. vtype="$VTYPE_ALPN"
  3454. fi
  3455. if [ "$ACME_VERSION" = "2" ]; then
  3456. response="$(echo "$_authorizations_map" | grep "^$(_idn "$d")," | sed "s/$d,//")"
  3457. _debug2 "response" "$response"
  3458. if [ -z "$response" ]; then
  3459. _err "get to authz error."
  3460. _err "_authorizations_map" "$_authorizations_map"
  3461. _clearup
  3462. _on_issue_err "$_post_hook"
  3463. return 1
  3464. fi
  3465. else
  3466. if ! __get_domain_new_authz "$d"; then
  3467. _clearup
  3468. _on_issue_err "$_post_hook"
  3469. return 1
  3470. fi
  3471. fi
  3472. if [ -z "$thumbprint" ]; then
  3473. thumbprint="$(__calc_account_thumbprint)"
  3474. fi
  3475. entry="$(echo "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
  3476. _debug entry "$entry"
  3477. if [ -z "$entry" ]; then
  3478. _err "Error, can not get domain token entry $d"
  3479. _supported_vtypes="$(echo "$response" | _egrep_o "\"challenges\":\[[^]]*]" | tr '{' "\n" | grep type | cut -d '"' -f 4 | tr "\n" ' ')"
  3480. if [ "$_supported_vtypes" ]; then
  3481. _err "The supported validation types are: $_supported_vtypes, but you specified: $vtype"
  3482. fi
  3483. _clearup
  3484. _on_issue_err "$_post_hook"
  3485. return 1
  3486. fi
  3487. token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
  3488. _debug token "$token"
  3489. if [ -z "$token" ]; then
  3490. _err "Error, can not get domain token $entry"
  3491. _clearup
  3492. _on_issue_err "$_post_hook"
  3493. return 1
  3494. fi
  3495. if [ "$ACME_VERSION" = "2" ]; then
  3496. uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
  3497. else
  3498. uri="$(echo "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
  3499. fi
  3500. _debug uri "$uri"
  3501. if [ -z "$uri" ]; then
  3502. _err "Error, can not get domain uri. $entry"
  3503. _clearup
  3504. _on_issue_err "$_post_hook"
  3505. return 1
  3506. fi
  3507. keyauthorization="$token.$thumbprint"
  3508. _debug keyauthorization "$keyauthorization"
  3509. if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
  3510. _debug "$d is already verified."
  3511. keyauthorization="$STATE_VERIFIED"
  3512. _debug keyauthorization "$keyauthorization"
  3513. fi
  3514. dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
  3515. _debug dvlist "$dvlist"
  3516. vlist="$vlist$dvlist$dvsep"
  3517. done
  3518. _debug vlist "$vlist"
  3519. #add entry
  3520. dns_entries=""
  3521. dnsadded=""
  3522. ventries=$(echo "$vlist" | tr "$dvsep" ' ')
  3523. _alias_index=1
  3524. for ventry in $ventries; do
  3525. d=$(echo "$ventry" | cut -d "$sep" -f 1)
  3526. keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
  3527. vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
  3528. _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
  3529. _debug d "$d"
  3530. if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
  3531. _debug "$d is already verified, skip $vtype."
  3532. _alias_index="$(_math "$_alias_index" + 1)"
  3533. continue
  3534. fi
  3535. if [ "$vtype" = "$VTYPE_DNS" ]; then
  3536. dnsadded='0'
  3537. _dns_root_d="$d"
  3538. if _startswith "$_dns_root_d" "*."; then
  3539. _dns_root_d="$(echo "$_dns_root_d" | sed 's/*.//')"
  3540. fi
  3541. _d_alias="$(_getfield "$_challenge_alias" "$_alias_index")"
  3542. _alias_index="$(_math "$_alias_index" + 1)"
  3543. _debug "_d_alias" "$_d_alias"
  3544. if [ "$_d_alias" ]; then
  3545. if _startswith "$_d_alias" "$DNS_ALIAS_PREFIX"; then
  3546. txtdomain="$(echo "$_d_alias" | sed "s/$DNS_ALIAS_PREFIX//")"
  3547. else
  3548. txtdomain="_acme-challenge.$_d_alias"
  3549. fi
  3550. dns_entry="${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$txtdomain$dvsep$_currentRoot"
  3551. else
  3552. txtdomain="_acme-challenge.$_dns_root_d"
  3553. dns_entry="${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$dvsep$_currentRoot"
  3554. fi
  3555. _debug txtdomain "$txtdomain"
  3556. txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
  3557. _debug txt "$txt"
  3558. d_api="$(_findHook "$_dns_root_d" $_SUB_FOLDER_DNSAPI "$_currentRoot")"
  3559. _debug d_api "$d_api"
  3560. dns_entry="$dns_entry$dvsep$txt${dvsep}$d_api"
  3561. _debug2 dns_entry "$dns_entry"
  3562. if [ "$d_api" ]; then
  3563. _debug "Found domain api file: $d_api"
  3564. else
  3565. if [ "$_currentRoot" != "$W_DNS" ]; then
  3566. _err "Can not find dns api hook for: $_currentRoot"
  3567. _info "You need to add the txt record manually."
  3568. fi
  3569. _info "$(__red "Add the following TXT record:")"
  3570. _info "$(__red "Domain: '$(__green "$txtdomain")'")"
  3571. _info "$(__red "TXT value: '$(__green "$txt")'")"
  3572. _info "$(__red "Please be aware that you prepend _acme-challenge. before your domain")"
  3573. _info "$(__red "so the resulting subdomain will be: $txtdomain")"
  3574. continue
  3575. fi
  3576. (
  3577. if ! . "$d_api"; then
  3578. _err "Load file $d_api error. Please check your api file and try again."
  3579. return 1
  3580. fi
  3581. addcommand="${_currentRoot}_add"
  3582. if ! _exists "$addcommand"; then
  3583. _err "It seems that your api file is not correct, it must have a function named: $addcommand"
  3584. return 1
  3585. fi
  3586. _info "Adding txt value: $txt for domain: $txtdomain"
  3587. if ! $addcommand "$txtdomain" "$txt"; then
  3588. _err "Error add txt for domain:$txtdomain"
  3589. return 1
  3590. fi
  3591. _info "The txt record is added: Success."
  3592. )
  3593. if [ "$?" != "0" ]; then
  3594. _on_issue_err "$_post_hook" "$vlist"
  3595. _clearup
  3596. return 1
  3597. fi
  3598. dns_entries="$dns_entries$dns_entry
  3599. "
  3600. _debug2 "$dns_entries"
  3601. dnsadded='1'
  3602. fi
  3603. done
  3604. if [ "$dnsadded" = '0' ]; then
  3605. _savedomainconf "Le_Vlist" "$vlist"
  3606. _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
  3607. _err "Please add the TXT records to the domains, and re-run with --renew."
  3608. _on_issue_err "$_post_hook"
  3609. _clearup
  3610. return 1
  3611. fi
  3612. fi
  3613. if [ "$dns_entries" ]; then
  3614. if [ -z "$Le_DNSSleep" ]; then
  3615. _info "Let's check each dns records now. Sleep 20 seconds first."
  3616. _sleep 20
  3617. if ! _check_dns_entries; then
  3618. _err "check dns error."
  3619. _on_issue_err "$_post_hook"
  3620. _clearup
  3621. return 1
  3622. fi
  3623. else
  3624. _savedomainconf "Le_DNSSleep" "$Le_DNSSleep"
  3625. _info "Sleep $(__green $Le_DNSSleep) seconds for the txt records to take effect"
  3626. _sleep "$Le_DNSSleep"
  3627. fi
  3628. fi
  3629. NGINX_RESTORE_VLIST=""
  3630. _debug "ok, let's start to verify"
  3631. _ncIndex=1
  3632. ventries=$(echo "$vlist" | tr "$dvsep" ' ')
  3633. for ventry in $ventries; do
  3634. d=$(echo "$ventry" | cut -d "$sep" -f 1)
  3635. keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
  3636. uri=$(echo "$ventry" | cut -d "$sep" -f 3)
  3637. vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
  3638. _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
  3639. if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
  3640. _info "$d is already verified, skip $vtype."
  3641. continue
  3642. fi
  3643. _info "Verifying: $d"
  3644. _debug "d" "$d"
  3645. _debug "keyauthorization" "$keyauthorization"
  3646. _debug "uri" "$uri"
  3647. removelevel=""
  3648. token="$(printf "%s" "$keyauthorization" | cut -d '.' -f 1)"
  3649. _debug "_currentRoot" "$_currentRoot"
  3650. if [ "$vtype" = "$VTYPE_HTTP" ]; then
  3651. if [ "$_currentRoot" = "$NO_VALUE" ]; then
  3652. _info "Standalone mode server"
  3653. _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
  3654. _ncIndex="$(_math $_ncIndex + 1)"
  3655. _startserver "$keyauthorization" "$_ncaddr"
  3656. if [ "$?" != "0" ]; then
  3657. _clearup
  3658. _on_issue_err "$_post_hook" "$vlist"
  3659. return 1
  3660. fi
  3661. sleep 1
  3662. _debug serverproc "$serverproc"
  3663. elif [ "$_currentRoot" = "$MODE_STATELESS" ]; then
  3664. _info "Stateless mode for domain:$d"
  3665. _sleep 1
  3666. elif _startswith "$_currentRoot" "$NGINX"; then
  3667. _info "Nginx mode for domain:$d"
  3668. #set up nginx server
  3669. FOUND_REAL_NGINX_CONF=""
  3670. BACKUP_NGINX_CONF=""
  3671. if ! _setNginx "$d" "$_currentRoot" "$thumbprint"; then
  3672. _clearup
  3673. _on_issue_err "$_post_hook" "$vlist"
  3674. return 1
  3675. fi
  3676. if [ "$FOUND_REAL_NGINX_CONF" ]; then
  3677. _realConf="$FOUND_REAL_NGINX_CONF"
  3678. _backup="$BACKUP_NGINX_CONF"
  3679. _debug _realConf "$_realConf"
  3680. NGINX_RESTORE_VLIST="$d$sep$_realConf$sep$_backup$dvsep$NGINX_RESTORE_VLIST"
  3681. fi
  3682. _sleep 1
  3683. else
  3684. if [ "$_currentRoot" = "apache" ]; then
  3685. wellknown_path="$ACME_DIR"
  3686. else
  3687. wellknown_path="$_currentRoot/.well-known/acme-challenge"
  3688. if [ ! -d "$_currentRoot/.well-known" ]; then
  3689. removelevel='1'
  3690. elif [ ! -d "$_currentRoot/.well-known/acme-challenge" ]; then
  3691. removelevel='2'
  3692. else
  3693. removelevel='3'
  3694. fi
  3695. fi
  3696. _debug wellknown_path "$wellknown_path"
  3697. _debug "writing token:$token to $wellknown_path/$token"
  3698. mkdir -p "$wellknown_path"
  3699. if ! printf "%s" "$keyauthorization" >"$wellknown_path/$token"; then
  3700. _err "$d:Can not write token to file : $wellknown_path/$token"
  3701. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  3702. _clearup
  3703. _on_issue_err "$_post_hook" "$vlist"
  3704. return 1
  3705. fi
  3706. if [ ! "$usingApache" ]; then
  3707. if webroot_owner=$(_stat "$_currentRoot"); then
  3708. _debug "Changing owner/group of .well-known to $webroot_owner"
  3709. if ! _exec "chown -R \"$webroot_owner\" \"$_currentRoot/.well-known\""; then
  3710. _debug "$(cat "$_EXEC_TEMP_ERR")"
  3711. _exec_err >/dev/null 2>&1
  3712. fi
  3713. else
  3714. _debug "not changing owner/group of webroot"
  3715. fi
  3716. fi
  3717. fi
  3718. elif [ "$vtype" = "$VTYPE_ALPN" ]; then
  3719. acmevalidationv1="$(printf "%s" "$keyauthorization" | _digest "sha256" "hex")"
  3720. _debug acmevalidationv1 "$acmevalidationv1"
  3721. if ! _starttlsserver "$d" "" "$Le_TLSPort" "$keyauthorization" "$_ncaddr" "$acmevalidationv1"; then
  3722. _err "Start tls server error."
  3723. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  3724. _clearup
  3725. _on_issue_err "$_post_hook" "$vlist"
  3726. return 1
  3727. fi
  3728. fi
  3729. if ! __trigger_validation "$uri" "$keyauthorization" "$vtype"; then
  3730. _err "$d:Can not get challenge: $response"
  3731. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  3732. _clearup
  3733. _on_issue_err "$_post_hook" "$vlist"
  3734. return 1
  3735. fi
  3736. if [ "$code" ] && [ "$code" != '202' ]; then
  3737. if [ "$code" = '200' ]; then
  3738. _debug "trigger validation code: $code"
  3739. else
  3740. _err "$d:Challenge error: $response"
  3741. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  3742. _clearup
  3743. _on_issue_err "$_post_hook" "$vlist"
  3744. return 1
  3745. fi
  3746. fi
  3747. waittimes=0
  3748. if [ -z "$MAX_RETRY_TIMES" ]; then
  3749. MAX_RETRY_TIMES=30
  3750. fi
  3751. while true; do
  3752. waittimes=$(_math "$waittimes" + 1)
  3753. if [ "$waittimes" -ge "$MAX_RETRY_TIMES" ]; then
  3754. _err "$d:Timeout"
  3755. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  3756. _clearup
  3757. _on_issue_err "$_post_hook" "$vlist"
  3758. return 1
  3759. fi
  3760. _debug "sleep 2 secs to verify"
  3761. sleep 2
  3762. _debug "checking"
  3763. if [ "$ACME_VERSION" = "2" ]; then
  3764. _send_signed_request "$uri"
  3765. else
  3766. response="$(_get "$uri")"
  3767. fi
  3768. if [ "$?" != "0" ]; then
  3769. _err "$d:Verify error:$response"
  3770. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  3771. _clearup
  3772. _on_issue_err "$_post_hook" "$vlist"
  3773. return 1
  3774. fi
  3775. _debug2 original "$response"
  3776. response="$(echo "$response" | _normalizeJson)"
  3777. _debug2 response "$response"
  3778. status=$(echo "$response" | _egrep_o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
  3779. if [ "$status" = "valid" ]; then
  3780. _info "$(__green Success)"
  3781. _stopserver "$serverproc"
  3782. serverproc=""
  3783. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  3784. break
  3785. fi
  3786. if [ "$status" = "invalid" ]; then
  3787. error="$(echo "$response" | _egrep_o '"error":\{[^\}]*')"
  3788. _debug2 error "$error"
  3789. errordetail="$(echo "$error" | _egrep_o '"detail": *"[^"]*' | cut -d '"' -f 4)"
  3790. _debug2 errordetail "$errordetail"
  3791. if [ "$errordetail" ]; then
  3792. _err "$d:Verify error:$errordetail"
  3793. else
  3794. _err "$d:Verify error:$error"
  3795. fi
  3796. if [ "$DEBUG" ]; then
  3797. if [ "$vtype" = "$VTYPE_HTTP" ]; then
  3798. _debug "Debug: get token url."
  3799. _get "http://$d/.well-known/acme-challenge/$token" "" 1
  3800. fi
  3801. fi
  3802. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  3803. _clearup
  3804. _on_issue_err "$_post_hook" "$vlist"
  3805. return 1
  3806. fi
  3807. if [ "$status" = "pending" ]; then
  3808. _info "Pending"
  3809. elif [ "$status" = "processing" ]; then
  3810. _info "Processing"
  3811. else
  3812. _err "$d:Verify error:$response"
  3813. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  3814. _clearup
  3815. _on_issue_err "$_post_hook" "$vlist"
  3816. return 1
  3817. fi
  3818. done
  3819. done
  3820. _clearup
  3821. _info "Verify finished, start to sign."
  3822. der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
  3823. if [ "$ACME_VERSION" = "2" ]; then
  3824. _info "Lets finalize the order, Le_OrderFinalize: $Le_OrderFinalize"
  3825. if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
  3826. _err "Sign failed."
  3827. _on_issue_err "$_post_hook"
  3828. return 1
  3829. fi
  3830. if [ "$code" != "200" ]; then
  3831. _err "Sign failed, finalize code is not 200."
  3832. _err "$response"
  3833. _on_issue_err "$_post_hook"
  3834. return 1
  3835. fi
  3836. if [ -z "$Le_LinkOrder" ]; then
  3837. Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
  3838. fi
  3839. _savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
  3840. _link_cert_retry=0
  3841. _MAX_CERT_RETRY=5
  3842. while [ "$_link_cert_retry" -lt "$_MAX_CERT_RETRY" ]; do
  3843. if _contains "$response" "\"status\":\"valid\""; then
  3844. _debug "Order status is valid."
  3845. Le_LinkCert="$(echo "$response" | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
  3846. _debug Le_LinkCert "$Le_LinkCert"
  3847. if [ -z "$Le_LinkCert" ]; then
  3848. _err "Sign error, can not find Le_LinkCert"
  3849. _err "$response"
  3850. _on_issue_err "$_post_hook"
  3851. return 1
  3852. fi
  3853. break
  3854. elif _contains "$response" "\"processing\""; then
  3855. _info "Order status is processing, lets sleep and retry."
  3856. _sleep 2
  3857. else
  3858. _err "Sign error, wrong status"
  3859. _err "$response"
  3860. _on_issue_err "$_post_hook"
  3861. return 1
  3862. fi
  3863. #the order is processing, so we are going to poll order status
  3864. if [ -z "$Le_LinkOrder" ]; then
  3865. _err "Sign error, can not get order link location header"
  3866. _err "responseHeaders" "$responseHeaders"
  3867. _on_issue_err "$_post_hook"
  3868. return 1
  3869. fi
  3870. _info "Polling order status: $Le_LinkOrder"
  3871. if ! _send_signed_request "$Le_LinkOrder"; then
  3872. _err "Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder."
  3873. _err "$response"
  3874. _on_issue_err "$_post_hook"
  3875. return 1
  3876. fi
  3877. _link_cert_retry="$(_math $_link_cert_retry + 1)"
  3878. done
  3879. if [ -z "$Le_LinkCert" ]; then
  3880. _err "Sign failed, can not get Le_LinkCert, retry time limit."
  3881. _err "$response"
  3882. _on_issue_err "$_post_hook"
  3883. return 1
  3884. fi
  3885. _info "Download cert, Le_LinkCert: $Le_LinkCert"
  3886. if ! _send_signed_request "$Le_LinkCert"; then
  3887. _err "Sign failed, can not download cert:$Le_LinkCert."
  3888. _err "$response"
  3889. _on_issue_err "$_post_hook"
  3890. return 1
  3891. fi
  3892. echo "$response" >"$CERT_PATH"
  3893. if [ "$(grep -- "$BEGIN_CERT" "$CERT_PATH" | wc -l)" -gt "1" ]; then
  3894. _debug "Found cert chain"
  3895. cat "$CERT_PATH" >"$CERT_FULLCHAIN_PATH"
  3896. _end_n="$(grep -n -- "$END_CERT" "$CERT_FULLCHAIN_PATH" | _head_n 1 | cut -d : -f 1)"
  3897. _debug _end_n "$_end_n"
  3898. sed -n "1,${_end_n}p" "$CERT_FULLCHAIN_PATH" >"$CERT_PATH"
  3899. _end_n="$(_math $_end_n + 1)"
  3900. sed -n "${_end_n},9999p" "$CERT_FULLCHAIN_PATH" >"$CA_CERT_PATH"
  3901. fi
  3902. else
  3903. if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
  3904. _err "Sign failed. $response"
  3905. _on_issue_err "$_post_hook"
  3906. return 1
  3907. fi
  3908. _rcert="$response"
  3909. Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
  3910. echo "$BEGIN_CERT" >"$CERT_PATH"
  3911. #if ! _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH" ; then
  3912. # _debug "Get cert failed. Let's try last response."
  3913. # printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >> "$CERT_PATH"
  3914. #fi
  3915. if ! printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >>"$CERT_PATH"; then
  3916. _debug "Try cert link."
  3917. _get "$Le_LinkCert" | _base64 "multiline" >>"$CERT_PATH"
  3918. fi
  3919. echo "$END_CERT" >>"$CERT_PATH"
  3920. fi
  3921. _debug "Le_LinkCert" "$Le_LinkCert"
  3922. _savedomainconf "Le_LinkCert" "$Le_LinkCert"
  3923. if [ -z "$Le_LinkCert" ] || ! _checkcert "$CERT_PATH"; then
  3924. response="$(echo "$response" | _dbase64 "multiline" | tr -d '\0' | _normalizeJson)"
  3925. _err "Sign failed: $(echo "$response" | _egrep_o '"detail":"[^"]*"')"
  3926. _on_issue_err "$_post_hook"
  3927. return 1
  3928. fi
  3929. if [ "$Le_LinkCert" ]; then
  3930. _info "$(__green "Cert success.")"
  3931. cat "$CERT_PATH"
  3932. _info "Your cert is in $(__green " $CERT_PATH ")"
  3933. if [ -f "$CERT_KEY_PATH" ]; then
  3934. _info "Your cert key is in $(__green " $CERT_KEY_PATH ")"
  3935. fi
  3936. if [ ! "$USER_PATH" ] || [ ! "$ACME_IN_CRON" ]; then
  3937. USER_PATH="$PATH"
  3938. _saveaccountconf "USER_PATH" "$USER_PATH"
  3939. fi
  3940. fi
  3941. if [ "$ACME_VERSION" = "2" ]; then
  3942. _debug "v2 chain."
  3943. else
  3944. cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
  3945. Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
  3946. if [ "$Le_LinkIssuer" ]; then
  3947. if ! _contains "$Le_LinkIssuer" ":"; then
  3948. _info "$(__red "Relative issuer link found.")"
  3949. Le_LinkIssuer="$_ACME_SERVER_HOST$Le_LinkIssuer"
  3950. fi
  3951. _debug Le_LinkIssuer "$Le_LinkIssuer"
  3952. _savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
  3953. _link_issuer_retry=0
  3954. _MAX_ISSUER_RETRY=5
  3955. while [ "$_link_issuer_retry" -lt "$_MAX_ISSUER_RETRY" ]; do
  3956. _debug _link_issuer_retry "$_link_issuer_retry"
  3957. if [ "$ACME_VERSION" = "2" ]; then
  3958. if _send_signed_request "$Le_LinkIssuer"; then
  3959. echo "$response" >"$CA_CERT_PATH"
  3960. break
  3961. fi
  3962. else
  3963. if _get "$Le_LinkIssuer" >"$CA_CERT_PATH.der"; then
  3964. echo "$BEGIN_CERT" >"$CA_CERT_PATH"
  3965. _base64 "multiline" <"$CA_CERT_PATH.der" >>"$CA_CERT_PATH"
  3966. echo "$END_CERT" >>"$CA_CERT_PATH"
  3967. if ! _checkcert "$CA_CERT_PATH"; then
  3968. _err "Can not get the ca cert."
  3969. break
  3970. fi
  3971. cat "$CA_CERT_PATH" >>"$CERT_FULLCHAIN_PATH"
  3972. rm -f "$CA_CERT_PATH.der"
  3973. break
  3974. fi
  3975. fi
  3976. _link_issuer_retry=$(_math $_link_issuer_retry + 1)
  3977. _sleep "$_link_issuer_retry"
  3978. done
  3979. if [ "$_link_issuer_retry" = "$_MAX_ISSUER_RETRY" ]; then
  3980. _err "Max retry for issuer ca cert is reached."
  3981. fi
  3982. else
  3983. _debug "No Le_LinkIssuer header found."
  3984. fi
  3985. fi
  3986. [ -f "$CA_CERT_PATH" ] && _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
  3987. [ -f "$CERT_FULLCHAIN_PATH" ] && _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
  3988. Le_CertCreateTime=$(_time)
  3989. _savedomainconf "Le_CertCreateTime" "$Le_CertCreateTime"
  3990. Le_CertCreateTimeStr=$(date -u)
  3991. _savedomainconf "Le_CertCreateTimeStr" "$Le_CertCreateTimeStr"
  3992. if [ -z "$Le_RenewalDays" ] || [ "$Le_RenewalDays" -lt "0" ]; then
  3993. Le_RenewalDays="$DEFAULT_RENEW"
  3994. else
  3995. _savedomainconf "Le_RenewalDays" "$Le_RenewalDays"
  3996. fi
  3997. if [ "$CA_BUNDLE" ]; then
  3998. _saveaccountconf CA_BUNDLE "$CA_BUNDLE"
  3999. else
  4000. _clearaccountconf "CA_BUNDLE"
  4001. fi
  4002. if [ "$CA_PATH" ]; then
  4003. _saveaccountconf CA_PATH "$CA_PATH"
  4004. else
  4005. _clearaccountconf "CA_PATH"
  4006. fi
  4007. if [ "$HTTPS_INSECURE" ]; then
  4008. _saveaccountconf HTTPS_INSECURE "$HTTPS_INSECURE"
  4009. else
  4010. _clearaccountconf "HTTPS_INSECURE"
  4011. fi
  4012. if [ "$Le_Listen_V4" ]; then
  4013. _savedomainconf "Le_Listen_V4" "$Le_Listen_V4"
  4014. _cleardomainconf Le_Listen_V6
  4015. elif [ "$Le_Listen_V6" ]; then
  4016. _savedomainconf "Le_Listen_V6" "$Le_Listen_V6"
  4017. _cleardomainconf Le_Listen_V4
  4018. fi
  4019. if [ "$Le_ForceNewDomainKey" = "1" ]; then
  4020. _savedomainconf "Le_ForceNewDomainKey" "$Le_ForceNewDomainKey"
  4021. else
  4022. _cleardomainconf Le_ForceNewDomainKey
  4023. fi
  4024. Le_NextRenewTime=$(_math "$Le_CertCreateTime" + "$Le_RenewalDays" \* 24 \* 60 \* 60)
  4025. Le_NextRenewTimeStr=$(_time2str "$Le_NextRenewTime")
  4026. _savedomainconf "Le_NextRenewTimeStr" "$Le_NextRenewTimeStr"
  4027. Le_NextRenewTime=$(_math "$Le_NextRenewTime" - 86400)
  4028. _savedomainconf "Le_NextRenewTime" "$Le_NextRenewTime"
  4029. if [ "$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain" ]; then
  4030. _savedomainconf "Le_RealCertPath" "$_real_cert"
  4031. _savedomainconf "Le_RealCACertPath" "$_real_ca"
  4032. _savedomainconf "Le_RealKeyPath" "$_real_key"
  4033. _savedomainconf "Le_ReloadCmd" "$_reload_cmd" "base64"
  4034. _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
  4035. if ! _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"; then
  4036. return 1
  4037. fi
  4038. fi
  4039. if ! _on_issue_success "$_post_hook" "$_renew_hook"; then
  4040. _err "Call hook error."
  4041. return 1
  4042. fi
  4043. }
  4044. #domain [isEcc]
  4045. renew() {
  4046. Le_Domain="$1"
  4047. if [ -z "$Le_Domain" ]; then
  4048. _usage "Usage: $PROJECT_ENTRY --renew -d domain.com [--ecc]"
  4049. return 1
  4050. fi
  4051. _isEcc="$2"
  4052. _initpath "$Le_Domain" "$_isEcc"
  4053. _info "$(__green "Renew: '$Le_Domain'")"
  4054. if [ ! -f "$DOMAIN_CONF" ]; then
  4055. _info "'$Le_Domain' is not a issued domain, skip."
  4056. return $RENEW_SKIP
  4057. fi
  4058. if [ "$Le_RenewalDays" ]; then
  4059. _savedomainconf Le_RenewalDays "$Le_RenewalDays"
  4060. fi
  4061. . "$DOMAIN_CONF"
  4062. _debug Le_API "$Le_API"
  4063. if [ "$Le_API" = "$LETSENCRYPT_CA_V1" ]; then
  4064. _cleardomainconf Le_API
  4065. Le_API="$DEFAULT_CA"
  4066. fi
  4067. if [ "$Le_API" = "$LETSENCRYPT_STAGING_CA_V1" ]; then
  4068. _cleardomainconf Le_API
  4069. Le_API="$DEFAULT_STAGING_CA"
  4070. fi
  4071. if [ "$Le_API" ]; then
  4072. if [ "$_OLD_CA_HOST" = "$Le_API" ]; then
  4073. export Le_API="$DEFAULT_CA"
  4074. _savedomainconf Le_API "$Le_API"
  4075. fi
  4076. if [ "$_OLD_STAGE_CA_HOST" = "$Le_API" ]; then
  4077. export Le_API="$DEFAULT_STAGING_CA"
  4078. _savedomainconf Le_API "$Le_API"
  4079. fi
  4080. export ACME_DIRECTORY="$Le_API"
  4081. #reload ca configs
  4082. ACCOUNT_KEY_PATH=""
  4083. ACCOUNT_JSON_PATH=""
  4084. CA_CONF=""
  4085. _debug3 "initpath again."
  4086. _initpath "$Le_Domain" "$_isEcc"
  4087. fi
  4088. if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
  4089. _info "Skip, Next renewal time is: $(__green "$Le_NextRenewTimeStr")"
  4090. _info "Add '$(__red '--force')' to force to renew."
  4091. return "$RENEW_SKIP"
  4092. fi
  4093. if [ "$ACME_IN_CRON" = "1" ] && [ -z "$Le_CertCreateTime" ]; then
  4094. _info "Skip invalid cert for: $Le_Domain"
  4095. return $RENEW_SKIP
  4096. fi
  4097. IS_RENEW="1"
  4098. Le_ReloadCmd="$(_readdomainconf Le_ReloadCmd)"
  4099. Le_PreHook="$(_readdomainconf Le_PreHook)"
  4100. Le_PostHook="$(_readdomainconf Le_PostHook)"
  4101. Le_RenewHook="$(_readdomainconf Le_RenewHook)"
  4102. issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress" "$Le_ChallengeAlias"
  4103. res="$?"
  4104. if [ "$res" != "0" ]; then
  4105. return "$res"
  4106. fi
  4107. if [ "$Le_DeployHook" ]; then
  4108. _deploy "$Le_Domain" "$Le_DeployHook"
  4109. res="$?"
  4110. fi
  4111. IS_RENEW=""
  4112. return "$res"
  4113. }
  4114. #renewAll [stopRenewOnError]
  4115. renewAll() {
  4116. _initpath
  4117. _stopRenewOnError="$1"
  4118. _debug "_stopRenewOnError" "$_stopRenewOnError"
  4119. _ret="0"
  4120. _success_msg=""
  4121. _error_msg=""
  4122. _skipped_msg=""
  4123. _error_level=$NOTIFY_LEVEL_SKIP
  4124. _notify_code=$RENEW_SKIP
  4125. _set_level=${NOTIFY_LEVEL:-$NOTIFY_LEVEL_DEFAULT}
  4126. _debug "_set_level" "$_set_level"
  4127. for di in "${CERT_HOME}"/*.*/; do
  4128. _debug di "$di"
  4129. if ! [ -d "$di" ]; then
  4130. _debug "Not directory, skip: $di"
  4131. continue
  4132. fi
  4133. d=$(basename "$di")
  4134. _debug d "$d"
  4135. (
  4136. if _endswith "$d" "$ECC_SUFFIX"; then
  4137. _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
  4138. d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
  4139. fi
  4140. renew "$d" "$_isEcc"
  4141. )
  4142. rc="$?"
  4143. _debug "Return code: $rc"
  4144. if [ "$rc" = "0" ]; then
  4145. if [ $_error_level -gt $NOTIFY_LEVEL_RENEW ]; then
  4146. _error_level="$NOTIFY_LEVEL_RENEW"
  4147. _notify_code=0
  4148. fi
  4149. if [ "$ACME_IN_CRON" ]; then
  4150. if [ $_set_level -ge $NOTIFY_LEVEL_RENEW ]; then
  4151. if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
  4152. _send_notify "Renew $d success" "Good, the cert is renewed." "$NOTIFY_HOOK" 0
  4153. fi
  4154. fi
  4155. fi
  4156. _success_msg="${_success_msg} $d
  4157. "
  4158. elif [ "$rc" = "$RENEW_SKIP" ]; then
  4159. if [ $_error_level -gt $NOTIFY_LEVEL_SKIP ]; then
  4160. _error_level="$NOTIFY_LEVEL_SKIP"
  4161. _notify_code=$RENEW_SKIP
  4162. fi
  4163. if [ "$ACME_IN_CRON" ]; then
  4164. if [ $_set_level -ge $NOTIFY_LEVEL_SKIP ]; then
  4165. if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
  4166. _send_notify "Renew $d skipped" "Good, the cert is skipped." "$NOTIFY_HOOK" "$RENEW_SKIP"
  4167. fi
  4168. fi
  4169. fi
  4170. _info "Skipped $d"
  4171. _skipped_msg="${_skipped_msg} $d
  4172. "
  4173. else
  4174. if [ $_error_level -gt $NOTIFY_LEVEL_ERROR ]; then
  4175. _error_level="$NOTIFY_LEVEL_ERROR"
  4176. _notify_code=1
  4177. fi
  4178. if [ "$ACME_IN_CRON" ]; then
  4179. if [ $_set_level -ge $NOTIFY_LEVEL_ERROR ]; then
  4180. if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
  4181. _send_notify "Renew $d error" "There is an error." "$NOTIFY_HOOK" 1
  4182. fi
  4183. fi
  4184. fi
  4185. _error_msg="${_error_msg} $d
  4186. "
  4187. if [ "$_stopRenewOnError" ]; then
  4188. _err "Error renew $d, stop now."
  4189. _ret="$rc"
  4190. break
  4191. else
  4192. _ret="$rc"
  4193. _err "Error renew $d."
  4194. fi
  4195. fi
  4196. done
  4197. _debug _error_level "$_error_level"
  4198. _debug _set_level "$_set_level"
  4199. if [ "$ACME_IN_CRON" ] && [ $_error_level -le $_set_level ]; then
  4200. if [ -z "$NOTIFY_MODE" ] || [ "$NOTIFY_MODE" = "$NOTIFY_MODE_BULK" ]; then
  4201. _msg_subject="Renew"
  4202. if [ "$_error_msg" ]; then
  4203. _msg_subject="${_msg_subject} Error"
  4204. _msg_data="Error certs:
  4205. ${_error_msg}
  4206. "
  4207. fi
  4208. if [ "$_success_msg" ]; then
  4209. _msg_subject="${_msg_subject} Success"
  4210. _msg_data="${_msg_data}Success certs:
  4211. ${_success_msg}
  4212. "
  4213. fi
  4214. if [ "$_skipped_msg" ]; then
  4215. _msg_subject="${_msg_subject} Skipped"
  4216. _msg_data="${_msg_data}Skipped certs:
  4217. ${_skipped_msg}
  4218. "
  4219. fi
  4220. _send_notify "$_msg_subject" "$_msg_data" "$NOTIFY_HOOK" "$_notify_code"
  4221. fi
  4222. fi
  4223. return "$_ret"
  4224. }
  4225. #csr webroot
  4226. signcsr() {
  4227. _csrfile="$1"
  4228. _csrW="$2"
  4229. if [ -z "$_csrfile" ] || [ -z "$_csrW" ]; then
  4230. _usage "Usage: $PROJECT_ENTRY --signcsr --csr mycsr.csr -w /path/to/webroot/a.com/ "
  4231. return 1
  4232. fi
  4233. _real_cert="$3"
  4234. _real_key="$4"
  4235. _real_ca="$5"
  4236. _reload_cmd="$6"
  4237. _real_fullchain="$7"
  4238. _pre_hook="${8}"
  4239. _post_hook="${9}"
  4240. _renew_hook="${10}"
  4241. _local_addr="${11}"
  4242. _challenge_alias="${12}"
  4243. _csrsubj=$(_readSubjectFromCSR "$_csrfile")
  4244. if [ "$?" != "0" ]; then
  4245. _err "Can not read subject from csr: $_csrfile"
  4246. return 1
  4247. fi
  4248. _debug _csrsubj "$_csrsubj"
  4249. if _contains "$_csrsubj" ' ' || ! _contains "$_csrsubj" '.'; then
  4250. _info "It seems that the subject: $_csrsubj is not a valid domain name. Drop it."
  4251. _csrsubj=""
  4252. fi
  4253. _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
  4254. if [ "$?" != "0" ]; then
  4255. _err "Can not read domain list from csr: $_csrfile"
  4256. return 1
  4257. fi
  4258. _debug "_csrdomainlist" "$_csrdomainlist"
  4259. if [ -z "$_csrsubj" ]; then
  4260. _csrsubj="$(_getfield "$_csrdomainlist" 1)"
  4261. _debug _csrsubj "$_csrsubj"
  4262. _csrdomainlist="$(echo "$_csrdomainlist" | cut -d , -f 2-)"
  4263. _debug "_csrdomainlist" "$_csrdomainlist"
  4264. fi
  4265. if [ -z "$_csrsubj" ]; then
  4266. _err "Can not read subject from csr: $_csrfile"
  4267. return 1
  4268. fi
  4269. _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
  4270. if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
  4271. _err "Can not read key length from csr: $_csrfile"
  4272. return 1
  4273. fi
  4274. if [ -z "$ACME_VERSION" ] && _contains "$_csrsubj,$_csrdomainlist" "*."; then
  4275. export ACME_VERSION=2
  4276. fi
  4277. _initpath "$_csrsubj" "$_csrkeylength"
  4278. mkdir -p "$DOMAIN_PATH"
  4279. _info "Copy csr to: $CSR_PATH"
  4280. cp "$_csrfile" "$CSR_PATH"
  4281. issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength" "$_real_cert" "$_real_key" "$_real_ca" "$_reload_cmd" "$_real_fullchain" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_addr" "$_challenge_alias"
  4282. }
  4283. showcsr() {
  4284. _csrfile="$1"
  4285. _csrd="$2"
  4286. if [ -z "$_csrfile" ] && [ -z "$_csrd" ]; then
  4287. _usage "Usage: $PROJECT_ENTRY --showcsr --csr mycsr.csr"
  4288. return 1
  4289. fi
  4290. _initpath
  4291. _csrsubj=$(_readSubjectFromCSR "$_csrfile")
  4292. if [ "$?" != "0" ] || [ -z "$_csrsubj" ]; then
  4293. _err "Can not read subject from csr: $_csrfile"
  4294. return 1
  4295. fi
  4296. _info "Subject=$_csrsubj"
  4297. _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
  4298. if [ "$?" != "0" ]; then
  4299. _err "Can not read domain list from csr: $_csrfile"
  4300. return 1
  4301. fi
  4302. _debug "_csrdomainlist" "$_csrdomainlist"
  4303. _info "SubjectAltNames=$_csrdomainlist"
  4304. _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
  4305. if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
  4306. _err "Can not read key length from csr: $_csrfile"
  4307. return 1
  4308. fi
  4309. _info "KeyLength=$_csrkeylength"
  4310. }
  4311. list() {
  4312. _raw="$1"
  4313. _initpath
  4314. _sep="|"
  4315. if [ "$_raw" ]; then
  4316. printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Created${_sep}Renew"
  4317. for di in "${CERT_HOME}"/*.*/; do
  4318. if ! [ -d "$di" ]; then
  4319. _debug "Not directory, skip: $di"
  4320. continue
  4321. fi
  4322. d=$(basename "$di")
  4323. _debug d "$d"
  4324. (
  4325. if _endswith "$d" "$ECC_SUFFIX"; then
  4326. _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
  4327. d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
  4328. fi
  4329. _initpath "$d" "$_isEcc"
  4330. if [ -f "$DOMAIN_CONF" ]; then
  4331. . "$DOMAIN_CONF"
  4332. printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr"
  4333. fi
  4334. )
  4335. done
  4336. else
  4337. if _exists column; then
  4338. list "raw" | column -t -s "$_sep"
  4339. else
  4340. list "raw" | tr "$_sep" '\t'
  4341. fi
  4342. fi
  4343. }
  4344. _deploy() {
  4345. _d="$1"
  4346. _hooks="$2"
  4347. for _d_api in $(echo "$_hooks" | tr ',' " "); do
  4348. _deployApi="$(_findHook "$_d" $_SUB_FOLDER_DEPLOY "$_d_api")"
  4349. if [ -z "$_deployApi" ]; then
  4350. _err "The deploy hook $_d_api is not found."
  4351. return 1
  4352. fi
  4353. _debug _deployApi "$_deployApi"
  4354. if ! (
  4355. if ! . "$_deployApi"; then
  4356. _err "Load file $_deployApi error. Please check your api file and try again."
  4357. return 1
  4358. fi
  4359. d_command="${_d_api}_deploy"
  4360. if ! _exists "$d_command"; then
  4361. _err "It seems that your api file is not correct, it must have a function named: $d_command"
  4362. return 1
  4363. fi
  4364. if ! $d_command "$_d" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$CERT_FULLCHAIN_PATH"; then
  4365. _err "Error deploy for domain:$_d"
  4366. return 1
  4367. fi
  4368. ); then
  4369. _err "Deploy error."
  4370. return 1
  4371. else
  4372. _info "$(__green Success)"
  4373. fi
  4374. done
  4375. }
  4376. #domain hooks
  4377. deploy() {
  4378. _d="$1"
  4379. _hooks="$2"
  4380. _isEcc="$3"
  4381. if [ -z "$_hooks" ]; then
  4382. _usage "Usage: $PROJECT_ENTRY --deploy -d domain.com --deploy-hook cpanel [--ecc] "
  4383. return 1
  4384. fi
  4385. _initpath "$_d" "$_isEcc"
  4386. if [ ! -d "$DOMAIN_PATH" ]; then
  4387. _err "The domain '$_d' is not a cert name. You must use the cert name to specify the cert to install."
  4388. _err "Can not find path:'$DOMAIN_PATH'"
  4389. return 1
  4390. fi
  4391. . "$DOMAIN_CONF"
  4392. _savedomainconf Le_DeployHook "$_hooks"
  4393. _deploy "$_d" "$_hooks"
  4394. }
  4395. installcert() {
  4396. _main_domain="$1"
  4397. if [ -z "$_main_domain" ]; then
  4398. _usage "Usage: $PROJECT_ENTRY --installcert -d domain.com [--ecc] [--cert-file cert-file-path] [--key-file key-file-path] [--ca-file ca-cert-file-path] [ --reloadCmd reloadCmd] [--fullchain-file fullchain-path]"
  4399. return 1
  4400. fi
  4401. _real_cert="$2"
  4402. _real_key="$3"
  4403. _real_ca="$4"
  4404. _reload_cmd="$5"
  4405. _real_fullchain="$6"
  4406. _isEcc="$7"
  4407. _initpath "$_main_domain" "$_isEcc"
  4408. if [ ! -d "$DOMAIN_PATH" ]; then
  4409. _err "The domain '$_main_domain' is not a cert name. You must use the cert name to specify the cert to install."
  4410. _err "Can not find path:'$DOMAIN_PATH'"
  4411. return 1
  4412. fi
  4413. _savedomainconf "Le_RealCertPath" "$_real_cert"
  4414. _savedomainconf "Le_RealCACertPath" "$_real_ca"
  4415. _savedomainconf "Le_RealKeyPath" "$_real_key"
  4416. _savedomainconf "Le_ReloadCmd" "$_reload_cmd" "base64"
  4417. _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
  4418. _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
  4419. }
  4420. #domain cert key ca fullchain reloadcmd backup-prefix
  4421. _installcert() {
  4422. _main_domain="$1"
  4423. _real_cert="$2"
  4424. _real_key="$3"
  4425. _real_ca="$4"
  4426. _real_fullchain="$5"
  4427. _reload_cmd="$6"
  4428. _backup_prefix="$7"
  4429. if [ "$_real_cert" = "$NO_VALUE" ]; then
  4430. _real_cert=""
  4431. fi
  4432. if [ "$_real_key" = "$NO_VALUE" ]; then
  4433. _real_key=""
  4434. fi
  4435. if [ "$_real_ca" = "$NO_VALUE" ]; then
  4436. _real_ca=""
  4437. fi
  4438. if [ "$_reload_cmd" = "$NO_VALUE" ]; then
  4439. _reload_cmd=""
  4440. fi
  4441. if [ "$_real_fullchain" = "$NO_VALUE" ]; then
  4442. _real_fullchain=""
  4443. fi
  4444. _backup_path="$DOMAIN_BACKUP_PATH/$_backup_prefix"
  4445. mkdir -p "$_backup_path"
  4446. if [ "$_real_cert" ]; then
  4447. _info "Installing cert to:$_real_cert"
  4448. if [ -f "$_real_cert" ] && [ ! "$IS_RENEW" ]; then
  4449. cp "$_real_cert" "$_backup_path/cert.bak"
  4450. fi
  4451. cat "$CERT_PATH" >"$_real_cert" || return 1
  4452. fi
  4453. if [ "$_real_ca" ]; then
  4454. _info "Installing CA to:$_real_ca"
  4455. if [ "$_real_ca" = "$_real_cert" ]; then
  4456. echo "" >>"$_real_ca"
  4457. cat "$CA_CERT_PATH" >>"$_real_ca" || return 1
  4458. else
  4459. if [ -f "$_real_ca" ] && [ ! "$IS_RENEW" ]; then
  4460. cp "$_real_ca" "$_backup_path/ca.bak"
  4461. fi
  4462. cat "$CA_CERT_PATH" >"$_real_ca" || return 1
  4463. fi
  4464. fi
  4465. if [ "$_real_key" ]; then
  4466. _info "Installing key to:$_real_key"
  4467. if [ -f "$_real_key" ] && [ ! "$IS_RENEW" ]; then
  4468. cp "$_real_key" "$_backup_path/key.bak"
  4469. fi
  4470. if [ -f "$_real_key" ]; then
  4471. cat "$CERT_KEY_PATH" >"$_real_key" || return 1
  4472. else
  4473. cat "$CERT_KEY_PATH" >"$_real_key" || return 1
  4474. chmod 600 "$_real_key"
  4475. fi
  4476. fi
  4477. if [ "$_real_fullchain" ]; then
  4478. _info "Installing full chain to:$_real_fullchain"
  4479. if [ -f "$_real_fullchain" ] && [ ! "$IS_RENEW" ]; then
  4480. cp "$_real_fullchain" "$_backup_path/fullchain.bak"
  4481. fi
  4482. cat "$CERT_FULLCHAIN_PATH" >"$_real_fullchain" || return 1
  4483. fi
  4484. if [ "$_reload_cmd" ]; then
  4485. _info "Run reload cmd: $_reload_cmd"
  4486. if (
  4487. export CERT_PATH
  4488. export CERT_KEY_PATH
  4489. export CA_CERT_PATH
  4490. export CERT_FULLCHAIN_PATH
  4491. export Le_Domain="$_main_domain"
  4492. cd "$DOMAIN_PATH" && eval "$_reload_cmd"
  4493. ); then
  4494. _info "$(__green "Reload success")"
  4495. else
  4496. _err "Reload error for :$Le_Domain"
  4497. fi
  4498. fi
  4499. }
  4500. __read_password() {
  4501. unset _pp
  4502. prompt="Enter Password:"
  4503. while IFS= read -p "$prompt" -r -s -n 1 char; do
  4504. if [ "$char" = $'\0' ]; then
  4505. break
  4506. fi
  4507. prompt='*'
  4508. _pp="$_pp$char"
  4509. done
  4510. echo "$_pp"
  4511. }
  4512. _install_win_taskscheduler() {
  4513. _lesh="$1"
  4514. _centry="$2"
  4515. _randomminute="$3"
  4516. if ! _exists cygpath; then
  4517. _err "cygpath not found"
  4518. return 1
  4519. fi
  4520. if ! _exists schtasks; then
  4521. _err "schtasks.exe is not found, are you on Windows?"
  4522. return 1
  4523. fi
  4524. _winbash="$(cygpath -w $(which bash))"
  4525. _debug _winbash "$_winbash"
  4526. if [ -z "$_winbash" ]; then
  4527. _err "can not find bash path"
  4528. return 1
  4529. fi
  4530. _myname="$(whoami)"
  4531. _debug "_myname" "$_myname"
  4532. if [ -z "$_myname" ]; then
  4533. _err "can not find my user name"
  4534. return 1
  4535. fi
  4536. _debug "_lesh" "$_lesh"
  4537. _info "To install scheduler task in your Windows account, you must input your windows password."
  4538. _info "$PROJECT_NAME doesn't save your password."
  4539. _info "Please input your Windows password for: $(__green "$_myname")"
  4540. _password="$(__read_password)"
  4541. #SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' "$_WINDOWS_SCHEDULER_NAME" '/F' '/ST' "00:$_randomminute" '/RU' "$_myname" '/RP' "$_password" '/TR' "$_winbash -l -c '$_lesh --cron --home \"$LE_WORKING_DIR\" $_centry'" >/dev/null
  4542. echo SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' "$_WINDOWS_SCHEDULER_NAME" '/F' '/ST' "00:$_randomminute" '/RU' "$_myname" '/RP' "$_password" '/TR' "\"$_winbash -l -c '$_lesh --cron --home \"$LE_WORKING_DIR\" $_centry'\"" | cmd.exe >/dev/null
  4543. echo
  4544. }
  4545. _uninstall_win_taskscheduler() {
  4546. if ! _exists schtasks; then
  4547. _err "schtasks.exe is not found, are you on Windows?"
  4548. return 1
  4549. fi
  4550. if ! echo SCHTASKS /query /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null; then
  4551. _debug "scheduler $_WINDOWS_SCHEDULER_NAME is not found."
  4552. else
  4553. _info "Removing $_WINDOWS_SCHEDULER_NAME"
  4554. echo SCHTASKS /delete /f /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null
  4555. fi
  4556. }
  4557. #confighome
  4558. installcronjob() {
  4559. _c_home="$1"
  4560. _initpath
  4561. _CRONTAB="crontab"
  4562. if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
  4563. lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
  4564. else
  4565. _err "Can not install cronjob, $PROJECT_ENTRY not found."
  4566. return 1
  4567. fi
  4568. if [ "$_c_home" ]; then
  4569. _c_entry="--config-home \"$_c_home\" "
  4570. fi
  4571. _t=$(_time)
  4572. random_minute=$(_math $_t % 60)
  4573. if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
  4574. _CRONTAB="fcrontab"
  4575. fi
  4576. if ! _exists "$_CRONTAB"; then
  4577. if _exists cygpath && _exists schtasks.exe; then
  4578. _info "It seems you are on Windows, let's install Windows scheduler task."
  4579. if _install_win_taskscheduler "$lesh" "$_c_entry" "$random_minute"; then
  4580. _info "Install Windows scheduler task success."
  4581. return 0
  4582. else
  4583. _err "Install Windows scheduler task failed."
  4584. return 1
  4585. fi
  4586. fi
  4587. _err "crontab/fcrontab doesn't exist, so, we can not install cron jobs."
  4588. _err "All your certs will not be renewed automatically."
  4589. _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
  4590. return 1
  4591. fi
  4592. _info "Installing cron job"
  4593. if ! $_CRONTAB -l | grep "$PROJECT_ENTRY --cron"; then
  4594. if _exists uname && uname -a | grep SunOS >/dev/null; then
  4595. $_CRONTAB -l | {
  4596. cat
  4597. echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
  4598. } | $_CRONTAB --
  4599. else
  4600. $_CRONTAB -l | {
  4601. cat
  4602. echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
  4603. } | $_CRONTAB -
  4604. fi
  4605. fi
  4606. if [ "$?" != "0" ]; then
  4607. _err "Install cron job failed. You need to manually renew your certs."
  4608. _err "Or you can add cronjob by yourself:"
  4609. _err "$lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"
  4610. return 1
  4611. fi
  4612. }
  4613. uninstallcronjob() {
  4614. _CRONTAB="crontab"
  4615. if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
  4616. _CRONTAB="fcrontab"
  4617. fi
  4618. if ! _exists "$_CRONTAB"; then
  4619. if _exists cygpath && _exists schtasks.exe; then
  4620. _info "It seems you are on Windows, let's uninstall Windows scheduler task."
  4621. if _uninstall_win_taskscheduler; then
  4622. _info "Uninstall Windows scheduler task success."
  4623. return 0
  4624. else
  4625. _err "Uninstall Windows scheduler task failed."
  4626. return 1
  4627. fi
  4628. fi
  4629. return
  4630. fi
  4631. _info "Removing cron job"
  4632. cr="$($_CRONTAB -l | grep "$PROJECT_ENTRY --cron")"
  4633. if [ "$cr" ]; then
  4634. if _exists uname && uname -a | grep solaris >/dev/null; then
  4635. $_CRONTAB -l | sed "/$PROJECT_ENTRY --cron/d" | $_CRONTAB --
  4636. else
  4637. $_CRONTAB -l | sed "/$PROJECT_ENTRY --cron/d" | $_CRONTAB -
  4638. fi
  4639. LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 9 | tr -d '"')"
  4640. _info LE_WORKING_DIR "$LE_WORKING_DIR"
  4641. if _contains "$cr" "--config-home"; then
  4642. LE_CONFIG_HOME="$(echo "$cr" | cut -d ' ' -f 11 | tr -d '"')"
  4643. _debug LE_CONFIG_HOME "$LE_CONFIG_HOME"
  4644. fi
  4645. fi
  4646. _initpath
  4647. }
  4648. revoke() {
  4649. Le_Domain="$1"
  4650. if [ -z "$Le_Domain" ]; then
  4651. _usage "Usage: $PROJECT_ENTRY --revoke -d domain.com [--ecc]"
  4652. return 1
  4653. fi
  4654. _isEcc="$2"
  4655. _initpath "$Le_Domain" "$_isEcc"
  4656. if [ ! -f "$DOMAIN_CONF" ]; then
  4657. _err "$Le_Domain is not a issued domain, skip."
  4658. return 1
  4659. fi
  4660. if [ ! -f "$CERT_PATH" ]; then
  4661. _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
  4662. return 1
  4663. fi
  4664. cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}" | tr -d "\r\n" | _url_replace)"
  4665. if [ -z "$cert" ]; then
  4666. _err "Cert for $Le_Domain is empty found, skip."
  4667. return 1
  4668. fi
  4669. _initAPI
  4670. if [ "$ACME_VERSION" = "2" ]; then
  4671. data="{\"certificate\": \"$cert\"}"
  4672. else
  4673. data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
  4674. fi
  4675. uri="${ACME_REVOKE_CERT}"
  4676. if [ -f "$CERT_KEY_PATH" ]; then
  4677. _info "Try domain key first."
  4678. if _send_signed_request "$uri" "$data" "" "$CERT_KEY_PATH"; then
  4679. if [ -z "$response" ]; then
  4680. _info "Revoke success."
  4681. rm -f "$CERT_PATH"
  4682. return 0
  4683. else
  4684. _err "Revoke error by domain key."
  4685. _err "$response"
  4686. fi
  4687. fi
  4688. else
  4689. _info "Domain key file doesn't exists."
  4690. fi
  4691. _info "Try account key."
  4692. if _send_signed_request "$uri" "$data" "" "$ACCOUNT_KEY_PATH"; then
  4693. if [ -z "$response" ]; then
  4694. _info "Revoke success."
  4695. rm -f "$CERT_PATH"
  4696. return 0
  4697. else
  4698. _err "Revoke error."
  4699. _debug "$response"
  4700. fi
  4701. fi
  4702. return 1
  4703. }
  4704. #domain ecc
  4705. remove() {
  4706. Le_Domain="$1"
  4707. if [ -z "$Le_Domain" ]; then
  4708. _usage "Usage: $PROJECT_ENTRY --remove -d domain.com [--ecc]"
  4709. return 1
  4710. fi
  4711. _isEcc="$2"
  4712. _initpath "$Le_Domain" "$_isEcc"
  4713. _removed_conf="$DOMAIN_CONF.removed"
  4714. if [ ! -f "$DOMAIN_CONF" ]; then
  4715. if [ -f "$_removed_conf" ]; then
  4716. _err "$Le_Domain is already removed, You can remove the folder by yourself: $DOMAIN_PATH"
  4717. else
  4718. _err "$Le_Domain is not a issued domain, skip."
  4719. fi
  4720. return 1
  4721. fi
  4722. if mv "$DOMAIN_CONF" "$_removed_conf"; then
  4723. _info "$Le_Domain is removed, the key and cert files are in $(__green $DOMAIN_PATH)"
  4724. _info "You can remove them by yourself."
  4725. return 0
  4726. else
  4727. _err "Remove $Le_Domain failed."
  4728. return 1
  4729. fi
  4730. }
  4731. #domain vtype
  4732. _deactivate() {
  4733. _d_domain="$1"
  4734. _d_type="$2"
  4735. _initpath
  4736. if [ "$ACME_VERSION" = "2" ]; then
  4737. _identifiers="{\"type\":\"dns\",\"value\":\"$_d_domain\"}"
  4738. if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
  4739. _err "Can not get domain new order."
  4740. return 1
  4741. fi
  4742. _authorizations_seg="$(echo "$response" | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
  4743. _debug2 _authorizations_seg "$_authorizations_seg"
  4744. if [ -z "$_authorizations_seg" ]; then
  4745. _err "_authorizations_seg not found."
  4746. _clearup
  4747. _on_issue_err "$_post_hook"
  4748. return 1
  4749. fi
  4750. authzUri="$_authorizations_seg"
  4751. _debug2 "authzUri" "$authzUri"
  4752. if ! _send_signed_request "$authzUri"; then
  4753. _err "get to authz error."
  4754. _err "_authorizations_seg" "$_authorizations_seg"
  4755. _err "authzUri" "$authzUri"
  4756. _clearup
  4757. _on_issue_err "$_post_hook"
  4758. return 1
  4759. fi
  4760. response="$(echo "$response" | _normalizeJson)"
  4761. _debug2 response "$response"
  4762. _URL_NAME="url"
  4763. else
  4764. if ! __get_domain_new_authz "$_d_domain"; then
  4765. _err "Can not get domain new authz token."
  4766. return 1
  4767. fi
  4768. authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
  4769. _debug "authzUri" "$authzUri"
  4770. if [ "$code" ] && [ ! "$code" = '201' ]; then
  4771. _err "new-authz error: $response"
  4772. return 1
  4773. fi
  4774. _URL_NAME="uri"
  4775. fi
  4776. entries="$(echo "$response" | _egrep_o "{ *\"type\":\"[^\"]*\", *\"status\": *\"valid\", *\"$_URL_NAME\"[^}]*")"
  4777. if [ -z "$entries" ]; then
  4778. _info "No valid entries found."
  4779. if [ -z "$thumbprint" ]; then
  4780. thumbprint="$(__calc_account_thumbprint)"
  4781. fi
  4782. _debug "Trigger validation."
  4783. vtype="$VTYPE_DNS"
  4784. entry="$(echo "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
  4785. _debug entry "$entry"
  4786. if [ -z "$entry" ]; then
  4787. _err "Error, can not get domain token $d"
  4788. return 1
  4789. fi
  4790. token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
  4791. _debug token "$token"
  4792. uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
  4793. _debug uri "$uri"
  4794. keyauthorization="$token.$thumbprint"
  4795. _debug keyauthorization "$keyauthorization"
  4796. __trigger_validation "$uri" "$keyauthorization"
  4797. fi
  4798. _d_i=0
  4799. _d_max_retry=$(echo "$entries" | wc -l)
  4800. while [ "$_d_i" -lt "$_d_max_retry" ]; do
  4801. _info "Deactivate: $_d_domain"
  4802. _d_i="$(_math $_d_i + 1)"
  4803. entry="$(echo "$entries" | sed -n "${_d_i}p")"
  4804. _debug entry "$entry"
  4805. if [ -z "$entry" ]; then
  4806. _info "No more valid entry found."
  4807. break
  4808. fi
  4809. _vtype="$(echo "$entry" | _egrep_o '"type": *"[^"]*"' | cut -d : -f 2 | tr -d '"')"
  4810. _debug _vtype "$_vtype"
  4811. _info "Found $_vtype"
  4812. uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
  4813. _debug uri "$uri"
  4814. if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then
  4815. _info "Skip $_vtype"
  4816. continue
  4817. fi
  4818. _info "Deactivate: $_vtype"
  4819. if [ "$ACME_VERSION" = "2" ]; then
  4820. _djson="{\"status\":\"deactivated\"}"
  4821. else
  4822. _djson="{\"resource\": \"authz\", \"status\":\"deactivated\"}"
  4823. fi
  4824. if _send_signed_request "$authzUri" "$_djson" && _contains "$response" '"deactivated"'; then
  4825. _info "Deactivate: $_vtype success."
  4826. else
  4827. _err "Can not deactivate $_vtype."
  4828. break
  4829. fi
  4830. done
  4831. _debug "$_d_i"
  4832. if [ "$_d_i" -eq "$_d_max_retry" ]; then
  4833. _info "Deactivated success!"
  4834. else
  4835. _err "Deactivate failed."
  4836. fi
  4837. }
  4838. deactivate() {
  4839. _d_domain_list="$1"
  4840. _d_type="$2"
  4841. _initpath
  4842. _initAPI
  4843. _debug _d_domain_list "$_d_domain_list"
  4844. if [ -z "$(echo $_d_domain_list | cut -d , -f 1)" ]; then
  4845. _usage "Usage: $PROJECT_ENTRY --deactivate -d domain.com [-d domain.com]"
  4846. return 1
  4847. fi
  4848. for _d_dm in $(echo "$_d_domain_list" | tr ',' ' '); do
  4849. if [ -z "$_d_dm" ] || [ "$_d_dm" = "$NO_VALUE" ]; then
  4850. continue
  4851. fi
  4852. if ! _deactivate "$_d_dm" "$_d_type"; then
  4853. return 1
  4854. fi
  4855. done
  4856. }
  4857. # Detect profile file if not specified as environment variable
  4858. _detect_profile() {
  4859. if [ -n "$PROFILE" -a -f "$PROFILE" ]; then
  4860. echo "$PROFILE"
  4861. return
  4862. fi
  4863. DETECTED_PROFILE=''
  4864. SHELLTYPE="$(basename "/$SHELL")"
  4865. if [ "$SHELLTYPE" = "bash" ]; then
  4866. if [ -f "$HOME/.bashrc" ]; then
  4867. DETECTED_PROFILE="$HOME/.bashrc"
  4868. elif [ -f "$HOME/.bash_profile" ]; then
  4869. DETECTED_PROFILE="$HOME/.bash_profile"
  4870. fi
  4871. elif [ "$SHELLTYPE" = "zsh" ]; then
  4872. DETECTED_PROFILE="$HOME/.zshrc"
  4873. fi
  4874. if [ -z "$DETECTED_PROFILE" ]; then
  4875. if [ -f "$HOME/.profile" ]; then
  4876. DETECTED_PROFILE="$HOME/.profile"
  4877. elif [ -f "$HOME/.bashrc" ]; then
  4878. DETECTED_PROFILE="$HOME/.bashrc"
  4879. elif [ -f "$HOME/.bash_profile" ]; then
  4880. DETECTED_PROFILE="$HOME/.bash_profile"
  4881. elif [ -f "$HOME/.zshrc" ]; then
  4882. DETECTED_PROFILE="$HOME/.zshrc"
  4883. fi
  4884. fi
  4885. echo "$DETECTED_PROFILE"
  4886. }
  4887. _initconf() {
  4888. _initpath
  4889. if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
  4890. echo "
  4891. #LOG_FILE=\"$DEFAULT_LOG_FILE\"
  4892. #LOG_LEVEL=1
  4893. #AUTO_UPGRADE=\"1\"
  4894. #NO_TIMESTAMP=1
  4895. " >"$ACCOUNT_CONF_PATH"
  4896. fi
  4897. }
  4898. # nocron
  4899. _precheck() {
  4900. _nocron="$1"
  4901. if ! _exists "curl" && ! _exists "wget"; then
  4902. _err "Please install curl or wget first, we need to access http resources."
  4903. return 1
  4904. fi
  4905. if [ -z "$_nocron" ]; then
  4906. if ! _exists "crontab" && ! _exists "fcrontab"; then
  4907. if _exists cygpath && _exists schtasks.exe; then
  4908. _info "It seems you are on Windows, we will install Windows scheduler task."
  4909. else
  4910. _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
  4911. _err "We need to set cron job to renew the certs automatically."
  4912. _err "Otherwise, your certs will not be able to be renewed automatically."
  4913. if [ -z "$FORCE" ]; then
  4914. _err "Please add '--force' and try install again to go without crontab."
  4915. _err "./$PROJECT_ENTRY --install --force"
  4916. return 1
  4917. fi
  4918. fi
  4919. fi
  4920. fi
  4921. if ! _exists "${ACME_OPENSSL_BIN:-openssl}"; then
  4922. _err "Please install openssl first. ACME_OPENSSL_BIN=$ACME_OPENSSL_BIN"
  4923. _err "We need openssl to generate keys."
  4924. return 1
  4925. fi
  4926. if ! _exists "socat"; then
  4927. _err "It is recommended to install socat first."
  4928. _err "We use socat for standalone server if you use standalone mode."
  4929. _err "If you don't use standalone mode, just ignore this warning."
  4930. fi
  4931. return 0
  4932. }
  4933. _setShebang() {
  4934. _file="$1"
  4935. _shebang="$2"
  4936. if [ -z "$_shebang" ]; then
  4937. _usage "Usage: file shebang"
  4938. return 1
  4939. fi
  4940. cp "$_file" "$_file.tmp"
  4941. echo "$_shebang" >"$_file"
  4942. sed -n 2,99999p "$_file.tmp" >>"$_file"
  4943. rm -f "$_file.tmp"
  4944. }
  4945. #confighome
  4946. _installalias() {
  4947. _c_home="$1"
  4948. _initpath
  4949. _envfile="$LE_WORKING_DIR/$PROJECT_ENTRY.env"
  4950. if [ "$_upgrading" ] && [ "$_upgrading" = "1" ]; then
  4951. echo "$(cat "$_envfile")" | sed "s|^LE_WORKING_DIR.*$||" >"$_envfile"
  4952. echo "$(cat "$_envfile")" | sed "s|^alias le.*$||" >"$_envfile"
  4953. echo "$(cat "$_envfile")" | sed "s|^alias le.sh.*$||" >"$_envfile"
  4954. fi
  4955. if [ "$_c_home" ]; then
  4956. _c_entry=" --config-home '$_c_home'"
  4957. fi
  4958. _setopt "$_envfile" "export LE_WORKING_DIR" "=" "\"$LE_WORKING_DIR\""
  4959. if [ "$_c_home" ]; then
  4960. _setopt "$_envfile" "export LE_CONFIG_HOME" "=" "\"$LE_CONFIG_HOME\""
  4961. else
  4962. _sed_i "/^export LE_CONFIG_HOME/d" "$_envfile"
  4963. fi
  4964. _setopt "$_envfile" "alias $PROJECT_ENTRY" "=" "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
  4965. _profile="$(_detect_profile)"
  4966. if [ "$_profile" ]; then
  4967. _debug "Found profile: $_profile"
  4968. _info "Installing alias to '$_profile'"
  4969. _setopt "$_profile" ". \"$_envfile\""
  4970. _info "OK, Close and reopen your terminal to start using $PROJECT_NAME"
  4971. else
  4972. _info "No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME"
  4973. fi
  4974. #for csh
  4975. _cshfile="$LE_WORKING_DIR/$PROJECT_ENTRY.csh"
  4976. _csh_profile="$HOME/.cshrc"
  4977. if [ -f "$_csh_profile" ]; then
  4978. _info "Installing alias to '$_csh_profile'"
  4979. _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
  4980. if [ "$_c_home" ]; then
  4981. _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
  4982. else
  4983. _sed_i "/^setenv LE_CONFIG_HOME/d" "$_cshfile"
  4984. fi
  4985. _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
  4986. _setopt "$_csh_profile" "source \"$_cshfile\""
  4987. fi
  4988. #for tcsh
  4989. _tcsh_profile="$HOME/.tcshrc"
  4990. if [ -f "$_tcsh_profile" ]; then
  4991. _info "Installing alias to '$_tcsh_profile'"
  4992. _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
  4993. if [ "$_c_home" ]; then
  4994. _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
  4995. fi
  4996. _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
  4997. _setopt "$_tcsh_profile" "source \"$_cshfile\""
  4998. fi
  4999. }
  5000. # nocron confighome noprofile
  5001. install() {
  5002. if [ -z "$LE_WORKING_DIR" ]; then
  5003. LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
  5004. fi
  5005. _nocron="$1"
  5006. _c_home="$2"
  5007. _noprofile="$3"
  5008. if ! _initpath; then
  5009. _err "Install failed."
  5010. return 1
  5011. fi
  5012. if [ "$_nocron" ]; then
  5013. _debug "Skip install cron job"
  5014. fi
  5015. if [ "$ACME_IN_CRON" != "1" ]; then
  5016. if ! _precheck "$_nocron"; then
  5017. _err "Pre-check failed, can not install."
  5018. return 1
  5019. fi
  5020. fi
  5021. if [ -z "$_c_home" ] && [ "$LE_CONFIG_HOME" != "$LE_WORKING_DIR" ]; then
  5022. _info "Using config home: $LE_CONFIG_HOME"
  5023. _c_home="$LE_CONFIG_HOME"
  5024. fi
  5025. #convert from le
  5026. if [ -d "$HOME/.le" ]; then
  5027. for envfile in "le.env" "le.sh.env"; do
  5028. if [ -f "$HOME/.le/$envfile" ]; then
  5029. if grep "le.sh" "$HOME/.le/$envfile" >/dev/null; then
  5030. _upgrading="1"
  5031. _info "You are upgrading from le.sh"
  5032. _info "Renaming \"$HOME/.le\" to $LE_WORKING_DIR"
  5033. mv "$HOME/.le" "$LE_WORKING_DIR"
  5034. mv "$LE_WORKING_DIR/$envfile" "$LE_WORKING_DIR/$PROJECT_ENTRY.env"
  5035. break
  5036. fi
  5037. fi
  5038. done
  5039. fi
  5040. _info "Installing to $LE_WORKING_DIR"
  5041. if [ ! -d "$LE_WORKING_DIR" ]; then
  5042. if ! mkdir -p "$LE_WORKING_DIR"; then
  5043. _err "Can not create working dir: $LE_WORKING_DIR"
  5044. return 1
  5045. fi
  5046. chmod 700 "$LE_WORKING_DIR"
  5047. fi
  5048. if [ ! -d "$LE_CONFIG_HOME" ]; then
  5049. if ! mkdir -p "$LE_CONFIG_HOME"; then
  5050. _err "Can not create config dir: $LE_CONFIG_HOME"
  5051. return 1
  5052. fi
  5053. chmod 700 "$LE_CONFIG_HOME"
  5054. fi
  5055. cp "$PROJECT_ENTRY" "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
  5056. if [ "$?" != "0" ]; then
  5057. _err "Install failed, can not copy $PROJECT_ENTRY"
  5058. return 1
  5059. fi
  5060. _info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
  5061. if [ "$ACME_IN_CRON" != "1" ] && [ -z "$_noprofile" ]; then
  5062. _installalias "$_c_home"
  5063. fi
  5064. for subf in $_SUB_FOLDERS; do
  5065. if [ -d "$subf" ]; then
  5066. mkdir -p "$LE_WORKING_DIR/$subf"
  5067. cp "$subf"/* "$LE_WORKING_DIR"/"$subf"/
  5068. fi
  5069. done
  5070. if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
  5071. _initconf
  5072. fi
  5073. if [ "$_DEFAULT_ACCOUNT_CONF_PATH" != "$ACCOUNT_CONF_PATH" ]; then
  5074. _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
  5075. fi
  5076. if [ "$_DEFAULT_CERT_HOME" != "$CERT_HOME" ]; then
  5077. _saveaccountconf "CERT_HOME" "$CERT_HOME"
  5078. fi
  5079. if [ "$_DEFAULT_ACCOUNT_KEY_PATH" != "$ACCOUNT_KEY_PATH" ]; then
  5080. _saveaccountconf "ACCOUNT_KEY_PATH" "$ACCOUNT_KEY_PATH"
  5081. fi
  5082. if [ -z "$_nocron" ]; then
  5083. installcronjob "$_c_home"
  5084. fi
  5085. if [ -z "$NO_DETECT_SH" ]; then
  5086. #Modify shebang
  5087. if _exists bash; then
  5088. _bash_path="$(bash -c "command -v bash 2>/dev/null")"
  5089. if [ -z "$_bash_path" ]; then
  5090. _bash_path="$(bash -c 'echo $SHELL')"
  5091. fi
  5092. fi
  5093. if [ "$_bash_path" ]; then
  5094. _info "Good, bash is found, so change the shebang to use bash as preferred."
  5095. _shebang='#!'"$_bash_path"
  5096. _setShebang "$LE_WORKING_DIR/$PROJECT_ENTRY" "$_shebang"
  5097. for subf in $_SUB_FOLDERS; do
  5098. if [ -d "$LE_WORKING_DIR/$subf" ]; then
  5099. for _apifile in "$LE_WORKING_DIR/$subf/"*.sh; do
  5100. _setShebang "$_apifile" "$_shebang"
  5101. done
  5102. fi
  5103. done
  5104. fi
  5105. fi
  5106. _info OK
  5107. }
  5108. # nocron
  5109. uninstall() {
  5110. _nocron="$1"
  5111. if [ -z "$_nocron" ]; then
  5112. uninstallcronjob
  5113. fi
  5114. _initpath
  5115. _uninstallalias
  5116. rm -f "$LE_WORKING_DIR/$PROJECT_ENTRY"
  5117. _info "The keys and certs are in \"$(__green "$LE_CONFIG_HOME")\", you can remove them by yourself."
  5118. }
  5119. _uninstallalias() {
  5120. _initpath
  5121. _profile="$(_detect_profile)"
  5122. if [ "$_profile" ]; then
  5123. _info "Uninstalling alias from: '$_profile'"
  5124. text="$(cat "$_profile")"
  5125. echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.env\"$||" >"$_profile"
  5126. fi
  5127. _csh_profile="$HOME/.cshrc"
  5128. if [ -f "$_csh_profile" ]; then
  5129. _info "Uninstalling alias from: '$_csh_profile'"
  5130. text="$(cat "$_csh_profile")"
  5131. echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_csh_profile"
  5132. fi
  5133. _tcsh_profile="$HOME/.tcshrc"
  5134. if [ -f "$_tcsh_profile" ]; then
  5135. _info "Uninstalling alias from: '$_csh_profile'"
  5136. text="$(cat "$_tcsh_profile")"
  5137. echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_tcsh_profile"
  5138. fi
  5139. }
  5140. cron() {
  5141. export ACME_IN_CRON=1
  5142. _initpath
  5143. _info "$(__green "===Starting cron===")"
  5144. if [ "$AUTO_UPGRADE" = "1" ]; then
  5145. export LE_WORKING_DIR
  5146. (
  5147. if ! upgrade; then
  5148. _err "Cron:Upgrade failed!"
  5149. return 1
  5150. fi
  5151. )
  5152. . "$LE_WORKING_DIR/$PROJECT_ENTRY" >/dev/null
  5153. if [ -t 1 ]; then
  5154. __INTERACTIVE="1"
  5155. fi
  5156. _info "Auto upgraded to: $VER"
  5157. fi
  5158. renewAll
  5159. _ret="$?"
  5160. ACME_IN_CRON=""
  5161. _info "$(__green "===End cron===")"
  5162. exit $_ret
  5163. }
  5164. version() {
  5165. echo "$PROJECT"
  5166. echo "v$VER"
  5167. }
  5168. # subject content hooks code
  5169. _send_notify() {
  5170. _nsubject="$1"
  5171. _ncontent="$2"
  5172. _nhooks="$3"
  5173. _nerror="$4"
  5174. if [ "$NOTIFY_LEVEL" = "$NOTIFY_LEVEL_DISABLE" ]; then
  5175. _debug "The NOTIFY_LEVEL is $NOTIFY_LEVEL, disabled, just return."
  5176. return 0
  5177. fi
  5178. if [ -z "$_nhooks" ]; then
  5179. _debug "The NOTIFY_HOOK is empty, just return."
  5180. return 0
  5181. fi
  5182. _send_err=0
  5183. for _n_hook in $(echo "$_nhooks" | tr ',' " "); do
  5184. _n_hook_file="$(_findHook "" $_SUB_FOLDER_NOTIFY "$_n_hook")"
  5185. _info "Sending via: $_n_hook"
  5186. _debug "Found $_n_hook_file for $_n_hook"
  5187. if [ -z "$_n_hook_file" ]; then
  5188. _err "Can not find the hook file for $_n_hook"
  5189. continue
  5190. fi
  5191. if ! (
  5192. if ! . "$_n_hook_file"; then
  5193. _err "Load file $_n_hook_file error. Please check your api file and try again."
  5194. return 1
  5195. fi
  5196. d_command="${_n_hook}_send"
  5197. if ! _exists "$d_command"; then
  5198. _err "It seems that your api file is not correct, it must have a function named: $d_command"
  5199. return 1
  5200. fi
  5201. if ! $d_command "$_nsubject" "$_ncontent" "$_nerror"; then
  5202. _err "Error send message by $d_command"
  5203. return 1
  5204. fi
  5205. return 0
  5206. ); then
  5207. _err "Set $_n_hook_file error."
  5208. _send_err=1
  5209. else
  5210. _info "$_n_hook $(__green Success)"
  5211. fi
  5212. done
  5213. return $_send_err
  5214. }
  5215. # hook
  5216. _set_notify_hook() {
  5217. _nhooks="$1"
  5218. _test_subject="Hello, this is notification from $PROJECT_NAME"
  5219. _test_content="If you receive this message, your notification works."
  5220. _send_notify "$_test_subject" "$_test_content" "$_nhooks" 0
  5221. }
  5222. #[hook] [level] [mode]
  5223. setnotify() {
  5224. _nhook="$1"
  5225. _nlevel="$2"
  5226. _nmode="$3"
  5227. _initpath
  5228. if [ -z "$_nhook$_nlevel$_nmode" ]; then
  5229. _usage "Usage: $PROJECT_ENTRY --set-notify [--notify-hook mailgun] [--notify-level $NOTIFY_LEVEL_DEFAULT] [--notify-mode $NOTIFY_MODE_DEFAULT]"
  5230. _usage "$_NOTIFY_WIKI"
  5231. return 1
  5232. fi
  5233. if [ "$_nlevel" ]; then
  5234. _info "Set notify level to: $_nlevel"
  5235. export "NOTIFY_LEVEL=$_nlevel"
  5236. _saveaccountconf "NOTIFY_LEVEL" "$NOTIFY_LEVEL"
  5237. fi
  5238. if [ "$_nmode" ]; then
  5239. _info "Set notify mode to: $_nmode"
  5240. export "NOTIFY_MODE=$_nmode"
  5241. _saveaccountconf "NOTIFY_MODE" "$NOTIFY_MODE"
  5242. fi
  5243. if [ "$_nhook" ]; then
  5244. _info "Set notify hook to: $_nhook"
  5245. if [ "$_nhook" = "$NO_VALUE" ]; then
  5246. _info "Clear notify hook"
  5247. _clearaccountconf "NOTIFY_HOOK"
  5248. else
  5249. if _set_notify_hook "$_nhook"; then
  5250. export NOTIFY_HOOK="$_nhook"
  5251. _saveaccountconf "NOTIFY_HOOK" "$NOTIFY_HOOK"
  5252. return 0
  5253. else
  5254. _err "Can not set notify hook to: $_nhook"
  5255. return 1
  5256. fi
  5257. fi
  5258. fi
  5259. }
  5260. showhelp() {
  5261. _initpath
  5262. version
  5263. echo "Usage: $PROJECT_ENTRY command ...[parameters]....
  5264. Commands:
  5265. --help, -h Show this help message.
  5266. --version, -v Show version info.
  5267. --install Install $PROJECT_NAME to your system.
  5268. --uninstall Uninstall $PROJECT_NAME, and uninstall the cron job.
  5269. --upgrade Upgrade $PROJECT_NAME to the latest code from $PROJECT.
  5270. --issue Issue a cert.
  5271. --signcsr Issue a cert from an existing csr.
  5272. --deploy Deploy the cert to your server.
  5273. --install-cert Install the issued cert to apache/nginx or any other server.
  5274. --renew, -r Renew a cert.
  5275. --renew-all Renew all the certs.
  5276. --revoke Revoke a cert.
  5277. --remove Remove the cert from list of certs known to $PROJECT_NAME.
  5278. --list List all the certs.
  5279. --showcsr Show the content of a csr.
  5280. --install-cronjob Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
  5281. --uninstall-cronjob Uninstall the cron job. The 'uninstall' command can do this automatically.
  5282. --cron Run cron job to renew all the certs.
  5283. --toPkcs Export the certificate and key to a pfx file.
  5284. --toPkcs8 Convert to pkcs8 format.
  5285. --update-account Update account info.
  5286. --register-account Register account key.
  5287. --deactivate-account Deactivate the account.
  5288. --create-account-key Create an account private key, professional use.
  5289. --create-domain-key Create an domain private key, professional use.
  5290. --createCSR, -ccsr Create CSR , professional use.
  5291. --deactivate Deactivate the domain authz, professional use.
  5292. --set-notify Set the cron notification hook, level or mode.
  5293. Parameters:
  5294. --domain, -d domain.tld Specifies a domain, used to issue, renew or revoke etc.
  5295. --challenge-alias domain.tld The challenge domain alias for DNS alias mode: $_DNS_ALIAS_WIKI
  5296. --domain-alias domain.tld The domain alias for DNS alias mode: $_DNS_ALIAS_WIKI
  5297. --force, -f Used to force to install or force to renew a cert immediately.
  5298. --staging, --test Use staging server, just for test.
  5299. --debug Output debug info.
  5300. --output-insecure Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
  5301. --webroot, -w /path/to/webroot Specifies the web root folder for web root mode.
  5302. --standalone Use standalone mode.
  5303. --alpn Use standalone alpn mode.
  5304. --stateless Use stateless mode, see: $_STATELESS_WIKI
  5305. --apache Use apache mode.
  5306. --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file] Use dns mode or dns api.
  5307. --dnssleep [$DEFAULT_DNS_SLEEP] The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
  5308. --keylength, -k [2048] Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
  5309. --accountkeylength, -ak [2048] Specifies the account key length.
  5310. --log [/path/to/logfile] Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
  5311. --log-level 1|2 Specifies the log level, default is 1.
  5312. --syslog [0|3|6|7] Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
  5313. These parameters are to install the cert to nginx/apache or any other server after issue/renew a cert:
  5314. --cert-file After issue/renew, the cert will be copied to this path.
  5315. --key-file After issue/renew, the key will be copied to this path.
  5316. --ca-file After issue/renew, the intermediate cert will be copied to this path.
  5317. --fullchain-file After issue/renew, the fullchain cert will be copied to this path.
  5318. --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
  5319. --server SERVER ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
  5320. --accountconf Specifies a customized account config file.
  5321. --home Specifies the home dir for $PROJECT_NAME.
  5322. --cert-home Specifies the home dir to save all the certs, only valid for '--install' command.
  5323. --config-home Specifies the home dir to save all the configurations.
  5324. --useragent Specifies the user agent string. it will be saved for future use too.
  5325. --accountemail Specifies the account email, only valid for the '--install' and '--update-account' command.
  5326. --accountkey Specifies the account key path, only valid for the '--install' command.
  5327. --days Specifies the days to renew the cert when using '--issue' command. The default value is $DEFAULT_RENEW days.
  5328. --httpport Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
  5329. --tlsport Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
  5330. --local-address Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
  5331. --listraw Only used for '--list' command, list the certs in raw format.
  5332. --stopRenewOnError, -se Only valid for '--renew-all' command. Stop if one cert has error in renewal.
  5333. --insecure Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
  5334. --ca-bundle Specifies the path to the CA certificate bundle to verify api server's certificate.
  5335. --ca-path Specifies directory containing CA certificates in PEM format, used by wget or curl.
  5336. --nocron Only valid for '--install' command, which means: do not install the default cron job. In this case, the certs will not be renewed automatically.
  5337. --noprofile Only valid for '--install' command, which means: do not install aliases to user profile.
  5338. --no-color Do not output color text.
  5339. --force-color Force output of color text. Useful for non-interactive use with the aha tool for HTML E-Mails.
  5340. --ecc Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--toPkcs' and '--createCSR'
  5341. --csr Specifies the input csr.
  5342. --pre-hook Command to be run before obtaining any certificates.
  5343. --post-hook Command to be run after attempting to obtain/renew certificates. No matter the obtain/renew is success or failed.
  5344. --renew-hook Command to be run once for each successfully renewed certificate.
  5345. --deploy-hook The hook file to deploy cert
  5346. --ocsp-must-staple, --ocsp Generate ocsp must Staple extension.
  5347. --always-force-new-domain-key Generate new domain key when renewal. Otherwise, the domain key is not changed by default.
  5348. --auto-upgrade [0|1] Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
  5349. --listen-v4 Force standalone/tls server to listen at ipv4.
  5350. --listen-v6 Force standalone/tls server to listen at ipv6.
  5351. --openssl-bin Specifies a custom openssl bin location.
  5352. --use-wget Force to use wget, if you have both curl and wget installed.
  5353. --yes-I-know-dns-manual-mode-enough-go-ahead-please Force to use dns manual mode: $_DNS_MANUAL_WIKI
  5354. --branch, -b Only valid for '--upgrade' command, specifies the branch name to upgrade to.
  5355. --notify-level 0|1|2|3 Set the notification level: Default value is $NOTIFY_LEVEL_DEFAULT.
  5356. 0: disabled, no notification will be sent.
  5357. 1: send notifications only when there is an error.
  5358. 2: send notifications when a cert is successfully renewed, or there is an error.
  5359. 3: send notifications when a cert is skipped, renewed, or error.
  5360. --notify-mode 0|1 Set notification mode. Default value is $NOTIFY_MODE_DEFAULT.
  5361. 0: Bulk mode. Send all the domain's notifications in one message(mail).
  5362. 1: Cert mode. Send a message for every single cert.
  5363. --notify-hook [hookname] Set the notify hook
  5364. "
  5365. }
  5366. # nocron noprofile
  5367. _installOnline() {
  5368. _info "Installing from online archive."
  5369. _nocron="$1"
  5370. _noprofile="$2"
  5371. if [ ! "$BRANCH" ]; then
  5372. BRANCH="master"
  5373. fi
  5374. target="$PROJECT/archive/$BRANCH.tar.gz"
  5375. _info "Downloading $target"
  5376. localname="$BRANCH.tar.gz"
  5377. if ! _get "$target" >$localname; then
  5378. _err "Download error."
  5379. return 1
  5380. fi
  5381. (
  5382. _info "Extracting $localname"
  5383. if ! (tar xzf $localname || gtar xzf $localname); then
  5384. _err "Extraction error."
  5385. exit 1
  5386. fi
  5387. cd "$PROJECT_NAME-$BRANCH"
  5388. chmod +x $PROJECT_ENTRY
  5389. if ./$PROJECT_ENTRY install "$_nocron" "" "$_noprofile"; then
  5390. _info "Install success!"
  5391. fi
  5392. cd ..
  5393. rm -rf "$PROJECT_NAME-$BRANCH"
  5394. rm -f "$localname"
  5395. )
  5396. }
  5397. upgrade() {
  5398. if (
  5399. _initpath
  5400. export LE_WORKING_DIR
  5401. cd "$LE_WORKING_DIR"
  5402. _installOnline "nocron" "noprofile"
  5403. ); then
  5404. _info "Upgrade success!"
  5405. exit 0
  5406. else
  5407. _err "Upgrade failed!"
  5408. exit 1
  5409. fi
  5410. }
  5411. _processAccountConf() {
  5412. if [ "$_useragent" ]; then
  5413. _saveaccountconf "USER_AGENT" "$_useragent"
  5414. elif [ "$USER_AGENT" ] && [ "$USER_AGENT" != "$DEFAULT_USER_AGENT" ]; then
  5415. _saveaccountconf "USER_AGENT" "$USER_AGENT"
  5416. fi
  5417. if [ "$_accountemail" ]; then
  5418. _saveaccountconf "ACCOUNT_EMAIL" "$_accountemail"
  5419. elif [ "$ACCOUNT_EMAIL" ] && [ "$ACCOUNT_EMAIL" != "$DEFAULT_ACCOUNT_EMAIL" ]; then
  5420. _saveaccountconf "ACCOUNT_EMAIL" "$ACCOUNT_EMAIL"
  5421. fi
  5422. if [ "$_openssl_bin" ]; then
  5423. _saveaccountconf "ACME_OPENSSL_BIN" "$_openssl_bin"
  5424. elif [ "$ACME_OPENSSL_BIN" ] && [ "$ACME_OPENSSL_BIN" != "$DEFAULT_OPENSSL_BIN" ]; then
  5425. _saveaccountconf "ACME_OPENSSL_BIN" "$ACME_OPENSSL_BIN"
  5426. fi
  5427. if [ "$_auto_upgrade" ]; then
  5428. _saveaccountconf "AUTO_UPGRADE" "$_auto_upgrade"
  5429. elif [ "$AUTO_UPGRADE" ]; then
  5430. _saveaccountconf "AUTO_UPGRADE" "$AUTO_UPGRADE"
  5431. fi
  5432. if [ "$_use_wget" ]; then
  5433. _saveaccountconf "ACME_USE_WGET" "$_use_wget"
  5434. elif [ "$ACME_USE_WGET" ]; then
  5435. _saveaccountconf "ACME_USE_WGET" "$ACME_USE_WGET"
  5436. fi
  5437. }
  5438. _checkSudo() {
  5439. if [ "$SUDO_GID" ] && [ "$SUDO_COMMAND" ] && [ "$SUDO_USER" ] && [ "$SUDO_UID" ]; then
  5440. if [ "$SUDO_USER" = "root" ] && [ "$SUDO_UID" = "0" ]; then
  5441. #it's root using sudo, no matter it's using sudo or not, just fine
  5442. return 0
  5443. fi
  5444. if [ "$SUDO_COMMAND" = "/bin/su" ] || [ "$SUDO_COMMAND" = "/bin/bash" ]; then
  5445. #it's a normal user doing "sudo su", or `sudo -i` or `sudo -s`
  5446. #fine
  5447. return 0
  5448. fi
  5449. #otherwise
  5450. return 1
  5451. fi
  5452. return 0
  5453. }
  5454. _process() {
  5455. _CMD=""
  5456. _domain=""
  5457. _altdomains="$NO_VALUE"
  5458. _webroot=""
  5459. _challenge_alias=""
  5460. _keylength=""
  5461. _accountkeylength=""
  5462. _cert_file=""
  5463. _key_file=""
  5464. _ca_file=""
  5465. _fullchain_file=""
  5466. _reloadcmd=""
  5467. _password=""
  5468. _accountconf=""
  5469. _useragent=""
  5470. _accountemail=""
  5471. _accountkey=""
  5472. _certhome=""
  5473. _confighome=""
  5474. _httpport=""
  5475. _tlsport=""
  5476. _dnssleep=""
  5477. _listraw=""
  5478. _stopRenewOnError=""
  5479. #_insecure=""
  5480. _ca_bundle=""
  5481. _ca_path=""
  5482. _nocron=""
  5483. _noprofile=""
  5484. _ecc=""
  5485. _csr=""
  5486. _pre_hook=""
  5487. _post_hook=""
  5488. _renew_hook=""
  5489. _deploy_hook=""
  5490. _logfile=""
  5491. _log=""
  5492. _local_address=""
  5493. _log_level=""
  5494. _auto_upgrade=""
  5495. _listen_v4=""
  5496. _listen_v6=""
  5497. _openssl_bin=""
  5498. _syslog=""
  5499. _use_wget=""
  5500. _server=""
  5501. _notify_hook=""
  5502. _notify_level=""
  5503. _notify_mode=""
  5504. while [ ${#} -gt 0 ]; do
  5505. case "${1}" in
  5506. --help | -h)
  5507. showhelp
  5508. return
  5509. ;;
  5510. --version | -v)
  5511. version
  5512. return
  5513. ;;
  5514. --install)
  5515. _CMD="install"
  5516. ;;
  5517. --uninstall)
  5518. _CMD="uninstall"
  5519. ;;
  5520. --upgrade)
  5521. _CMD="upgrade"
  5522. ;;
  5523. --issue)
  5524. _CMD="issue"
  5525. ;;
  5526. --deploy)
  5527. _CMD="deploy"
  5528. ;;
  5529. --signcsr)
  5530. _CMD="signcsr"
  5531. ;;
  5532. --showcsr)
  5533. _CMD="showcsr"
  5534. ;;
  5535. --installcert | -i | --install-cert)
  5536. _CMD="installcert"
  5537. ;;
  5538. --renew | -r)
  5539. _CMD="renew"
  5540. ;;
  5541. --renewAll | --renewall | --renew-all)
  5542. _CMD="renewAll"
  5543. ;;
  5544. --revoke)
  5545. _CMD="revoke"
  5546. ;;
  5547. --remove)
  5548. _CMD="remove"
  5549. ;;
  5550. --list)
  5551. _CMD="list"
  5552. ;;
  5553. --installcronjob | --install-cronjob)
  5554. _CMD="installcronjob"
  5555. ;;
  5556. --uninstallcronjob | --uninstall-cronjob)
  5557. _CMD="uninstallcronjob"
  5558. ;;
  5559. --cron)
  5560. _CMD="cron"
  5561. ;;
  5562. --toPkcs)
  5563. _CMD="toPkcs"
  5564. ;;
  5565. --toPkcs8)
  5566. _CMD="toPkcs8"
  5567. ;;
  5568. --createAccountKey | --createaccountkey | -cak | --create-account-key)
  5569. _CMD="createAccountKey"
  5570. ;;
  5571. --createDomainKey | --createdomainkey | -cdk | --create-domain-key)
  5572. _CMD="createDomainKey"
  5573. ;;
  5574. --createCSR | --createcsr | -ccr)
  5575. _CMD="createCSR"
  5576. ;;
  5577. --deactivate)
  5578. _CMD="deactivate"
  5579. ;;
  5580. --updateaccount | --update-account)
  5581. _CMD="updateaccount"
  5582. ;;
  5583. --registeraccount | --register-account)
  5584. _CMD="registeraccount"
  5585. ;;
  5586. --deactivate-account)
  5587. _CMD="deactivateaccount"
  5588. ;;
  5589. --set-notify)
  5590. _CMD="setnotify"
  5591. ;;
  5592. --domain | -d)
  5593. _dvalue="$2"
  5594. if [ "$_dvalue" ]; then
  5595. if _startswith "$_dvalue" "-"; then
  5596. _err "'$_dvalue' is not a valid domain for parameter '$1'"
  5597. return 1
  5598. fi
  5599. if _is_idn "$_dvalue" && ! _exists idn; then
  5600. _err "It seems that $_dvalue is an IDN( Internationalized Domain Names), please install 'idn' command first."
  5601. return 1
  5602. fi
  5603. if _startswith "$_dvalue" "*."; then
  5604. _debug "Wildcard domain"
  5605. export ACME_VERSION=2
  5606. fi
  5607. if [ -z "$_domain" ]; then
  5608. _domain="$_dvalue"
  5609. else
  5610. if [ "$_altdomains" = "$NO_VALUE" ]; then
  5611. _altdomains="$_dvalue"
  5612. else
  5613. _altdomains="$_altdomains,$_dvalue"
  5614. fi
  5615. fi
  5616. fi
  5617. shift
  5618. ;;
  5619. --force | -f)
  5620. FORCE="1"
  5621. ;;
  5622. --staging | --test)
  5623. STAGE="1"
  5624. ;;
  5625. --server)
  5626. ACME_DIRECTORY="$2"
  5627. _server="$ACME_DIRECTORY"
  5628. export ACME_DIRECTORY
  5629. shift
  5630. ;;
  5631. --debug)
  5632. if [ -z "$2" ] || _startswith "$2" "-"; then
  5633. DEBUG="$DEBUG_LEVEL_DEFAULT"
  5634. else
  5635. DEBUG="$2"
  5636. shift
  5637. fi
  5638. ;;
  5639. --output-insecure)
  5640. export OUTPUT_INSECURE=1
  5641. ;;
  5642. --webroot | -w)
  5643. wvalue="$2"
  5644. if [ -z "$_webroot" ]; then
  5645. _webroot="$wvalue"
  5646. else
  5647. _webroot="$_webroot,$wvalue"
  5648. fi
  5649. shift
  5650. ;;
  5651. --challenge-alias)
  5652. cvalue="$2"
  5653. _challenge_alias="$_challenge_alias$cvalue,"
  5654. shift
  5655. ;;
  5656. --domain-alias)
  5657. cvalue="$DNS_ALIAS_PREFIX$2"
  5658. _challenge_alias="$_challenge_alias$cvalue,"
  5659. shift
  5660. ;;
  5661. --standalone)
  5662. wvalue="$NO_VALUE"
  5663. if [ -z "$_webroot" ]; then
  5664. _webroot="$wvalue"
  5665. else
  5666. _webroot="$_webroot,$wvalue"
  5667. fi
  5668. ;;
  5669. --alpn)
  5670. wvalue="$W_ALPN"
  5671. if [ -z "$_webroot" ]; then
  5672. _webroot="$wvalue"
  5673. else
  5674. _webroot="$_webroot,$wvalue"
  5675. fi
  5676. ;;
  5677. --stateless)
  5678. wvalue="$MODE_STATELESS"
  5679. if [ -z "$_webroot" ]; then
  5680. _webroot="$wvalue"
  5681. else
  5682. _webroot="$_webroot,$wvalue"
  5683. fi
  5684. ;;
  5685. --local-address)
  5686. lvalue="$2"
  5687. _local_address="$_local_address$lvalue,"
  5688. shift
  5689. ;;
  5690. --apache)
  5691. wvalue="apache"
  5692. if [ -z "$_webroot" ]; then
  5693. _webroot="$wvalue"
  5694. else
  5695. _webroot="$_webroot,$wvalue"
  5696. fi
  5697. ;;
  5698. --nginx)
  5699. wvalue="$NGINX"
  5700. if [ "$2" ] && ! _startswith "$2" "-"; then
  5701. wvalue="$NGINX$2"
  5702. shift
  5703. fi
  5704. if [ -z "$_webroot" ]; then
  5705. _webroot="$wvalue"
  5706. else
  5707. _webroot="$_webroot,$wvalue"
  5708. fi
  5709. ;;
  5710. --dns)
  5711. wvalue="$W_DNS"
  5712. if [ "$2" ] && ! _startswith "$2" "-"; then
  5713. wvalue="$2"
  5714. shift
  5715. fi
  5716. if [ -z "$_webroot" ]; then
  5717. _webroot="$wvalue"
  5718. else
  5719. _webroot="$_webroot,$wvalue"
  5720. fi
  5721. ;;
  5722. --dnssleep)
  5723. _dnssleep="$2"
  5724. Le_DNSSleep="$_dnssleep"
  5725. shift
  5726. ;;
  5727. --keylength | -k)
  5728. _keylength="$2"
  5729. shift
  5730. ;;
  5731. --accountkeylength | -ak)
  5732. _accountkeylength="$2"
  5733. shift
  5734. ;;
  5735. --cert-file | --certpath)
  5736. _cert_file="$2"
  5737. shift
  5738. ;;
  5739. --key-file | --keypath)
  5740. _key_file="$2"
  5741. shift
  5742. ;;
  5743. --ca-file | --capath)
  5744. _ca_file="$2"
  5745. shift
  5746. ;;
  5747. --fullchain-file | --fullchainpath)
  5748. _fullchain_file="$2"
  5749. shift
  5750. ;;
  5751. --reloadcmd | --reloadCmd)
  5752. _reloadcmd="$2"
  5753. shift
  5754. ;;
  5755. --password)
  5756. _password="$2"
  5757. shift
  5758. ;;
  5759. --accountconf)
  5760. _accountconf="$2"
  5761. ACCOUNT_CONF_PATH="$_accountconf"
  5762. shift
  5763. ;;
  5764. --home)
  5765. LE_WORKING_DIR="$2"
  5766. shift
  5767. ;;
  5768. --certhome | --cert-home)
  5769. _certhome="$2"
  5770. CERT_HOME="$_certhome"
  5771. shift
  5772. ;;
  5773. --config-home)
  5774. _confighome="$2"
  5775. LE_CONFIG_HOME="$_confighome"
  5776. shift
  5777. ;;
  5778. --useragent)
  5779. _useragent="$2"
  5780. USER_AGENT="$_useragent"
  5781. shift
  5782. ;;
  5783. --accountemail)
  5784. _accountemail="$2"
  5785. ACCOUNT_EMAIL="$_accountemail"
  5786. shift
  5787. ;;
  5788. --accountkey)
  5789. _accountkey="$2"
  5790. ACCOUNT_KEY_PATH="$_accountkey"
  5791. shift
  5792. ;;
  5793. --days)
  5794. _days="$2"
  5795. Le_RenewalDays="$_days"
  5796. shift
  5797. ;;
  5798. --httpport)
  5799. _httpport="$2"
  5800. Le_HTTPPort="$_httpport"
  5801. shift
  5802. ;;
  5803. --tlsport)
  5804. _tlsport="$2"
  5805. Le_TLSPort="$_tlsport"
  5806. shift
  5807. ;;
  5808. --listraw)
  5809. _listraw="raw"
  5810. ;;
  5811. --stopRenewOnError | --stoprenewonerror | -se)
  5812. _stopRenewOnError="1"
  5813. ;;
  5814. --insecure)
  5815. #_insecure="1"
  5816. HTTPS_INSECURE="1"
  5817. ;;
  5818. --ca-bundle)
  5819. _ca_bundle="$(_readlink "$2")"
  5820. CA_BUNDLE="$_ca_bundle"
  5821. shift
  5822. ;;
  5823. --ca-path)
  5824. _ca_path="$2"
  5825. CA_PATH="$_ca_path"
  5826. shift
  5827. ;;
  5828. --nocron)
  5829. _nocron="1"
  5830. ;;
  5831. --noprofile)
  5832. _noprofile="1"
  5833. ;;
  5834. --no-color)
  5835. export ACME_NO_COLOR=1
  5836. ;;
  5837. --force-color)
  5838. export ACME_FORCE_COLOR=1
  5839. ;;
  5840. --ecc)
  5841. _ecc="isEcc"
  5842. ;;
  5843. --csr)
  5844. _csr="$2"
  5845. shift
  5846. ;;
  5847. --pre-hook)
  5848. _pre_hook="$2"
  5849. shift
  5850. ;;
  5851. --post-hook)
  5852. _post_hook="$2"
  5853. shift
  5854. ;;
  5855. --renew-hook)
  5856. _renew_hook="$2"
  5857. shift
  5858. ;;
  5859. --deploy-hook)
  5860. if [ -z "$2" ] || _startswith "$2" "-"; then
  5861. _usage "Please specify a value for '--deploy-hook'"
  5862. return 1
  5863. fi
  5864. _deploy_hook="$_deploy_hook$2,"
  5865. shift
  5866. ;;
  5867. --ocsp-must-staple | --ocsp)
  5868. Le_OCSP_Staple="1"
  5869. ;;
  5870. --always-force-new-domain-key)
  5871. if [ -z "$2" ] || _startswith "$2" "-"; then
  5872. Le_ForceNewDomainKey=1
  5873. else
  5874. Le_ForceNewDomainKey="$2"
  5875. shift
  5876. fi
  5877. ;;
  5878. --yes-I-know-dns-manual-mode-enough-go-ahead-please)
  5879. export FORCE_DNS_MANUAL=1
  5880. ;;
  5881. --log | --logfile)
  5882. _log="1"
  5883. _logfile="$2"
  5884. if _startswith "$_logfile" '-'; then
  5885. _logfile=""
  5886. else
  5887. shift
  5888. fi
  5889. LOG_FILE="$_logfile"
  5890. if [ -z "$LOG_LEVEL" ]; then
  5891. LOG_LEVEL="$DEFAULT_LOG_LEVEL"
  5892. fi
  5893. ;;
  5894. --log-level)
  5895. _log_level="$2"
  5896. LOG_LEVEL="$_log_level"
  5897. shift
  5898. ;;
  5899. --syslog)
  5900. if ! _startswith "$2" '-'; then
  5901. _syslog="$2"
  5902. shift
  5903. fi
  5904. if [ -z "$_syslog" ]; then
  5905. _syslog="$SYSLOG_LEVEL_DEFAULT"
  5906. fi
  5907. ;;
  5908. --auto-upgrade)
  5909. _auto_upgrade="$2"
  5910. if [ -z "$_auto_upgrade" ] || _startswith "$_auto_upgrade" '-'; then
  5911. _auto_upgrade="1"
  5912. else
  5913. shift
  5914. fi
  5915. AUTO_UPGRADE="$_auto_upgrade"
  5916. ;;
  5917. --listen-v4)
  5918. _listen_v4="1"
  5919. Le_Listen_V4="$_listen_v4"
  5920. ;;
  5921. --listen-v6)
  5922. _listen_v6="1"
  5923. Le_Listen_V6="$_listen_v6"
  5924. ;;
  5925. --openssl-bin)
  5926. _openssl_bin="$2"
  5927. ACME_OPENSSL_BIN="$_openssl_bin"
  5928. shift
  5929. ;;
  5930. --use-wget)
  5931. _use_wget="1"
  5932. ACME_USE_WGET="1"
  5933. ;;
  5934. --branch | -b)
  5935. export BRANCH="$2"
  5936. shift
  5937. ;;
  5938. --notify-hook)
  5939. _nhook="$2"
  5940. if _startswith "$_nhook" "-"; then
  5941. _err "'$_nhook' is not a hook name for '$1'"
  5942. return 1
  5943. fi
  5944. if [ "$_notify_hook" ]; then
  5945. _notify_hook="$_notify_hook,$_nhook"
  5946. else
  5947. _notify_hook="$_nhook"
  5948. fi
  5949. shift
  5950. ;;
  5951. --notify-level)
  5952. _nlevel="$2"
  5953. if _startswith "$_nlevel" "-"; then
  5954. _err "'$_nlevel' is not a integer for '$1'"
  5955. return 1
  5956. fi
  5957. _notify_level="$_nlevel"
  5958. shift
  5959. ;;
  5960. --notify-mode)
  5961. _nmode="$2"
  5962. if _startswith "$_nmode" "-"; then
  5963. _err "'$_nmode' is not a integer for '$1'"
  5964. return 1
  5965. fi
  5966. _notify_mode="$_nmode"
  5967. shift
  5968. ;;
  5969. *)
  5970. _err "Unknown parameter : $1"
  5971. return 1
  5972. ;;
  5973. esac
  5974. shift 1
  5975. done
  5976. if [ "${_CMD}" != "install" ]; then
  5977. if [ "$__INTERACTIVE" ] && ! _checkSudo; then
  5978. if [ -z "$FORCE" ]; then
  5979. #Use "echo" here, instead of _info. it's too early
  5980. echo "It seems that you are using sudo, please read this link first:"
  5981. echo "$_SUDO_WIKI"
  5982. return 1
  5983. fi
  5984. fi
  5985. __initHome
  5986. if [ "$_log" ]; then
  5987. if [ -z "$_logfile" ]; then
  5988. _logfile="$DEFAULT_LOG_FILE"
  5989. fi
  5990. fi
  5991. if [ "$_logfile" ]; then
  5992. _saveaccountconf "LOG_FILE" "$_logfile"
  5993. LOG_FILE="$_logfile"
  5994. fi
  5995. if [ "$_log_level" ]; then
  5996. _saveaccountconf "LOG_LEVEL" "$_log_level"
  5997. LOG_LEVEL="$_log_level"
  5998. fi
  5999. if [ "$_syslog" ]; then
  6000. if _exists logger; then
  6001. if [ "$_syslog" = "0" ]; then
  6002. _clearaccountconf "SYS_LOG"
  6003. else
  6004. _saveaccountconf "SYS_LOG" "$_syslog"
  6005. fi
  6006. SYS_LOG="$_syslog"
  6007. else
  6008. _err "The 'logger' command is not found, can not enable syslog."
  6009. _clearaccountconf "SYS_LOG"
  6010. SYS_LOG=""
  6011. fi
  6012. fi
  6013. _processAccountConf
  6014. fi
  6015. _debug2 LE_WORKING_DIR "$LE_WORKING_DIR"
  6016. if [ "$DEBUG" ]; then
  6017. version
  6018. if [ "$_server" ]; then
  6019. _debug "Using server: $_server"
  6020. fi
  6021. fi
  6022. _debug "Running cmd: ${_CMD}"
  6023. case "${_CMD}" in
  6024. install) install "$_nocron" "$_confighome" "$_noprofile" ;;
  6025. uninstall) uninstall "$_nocron" ;;
  6026. upgrade) upgrade ;;
  6027. issue)
  6028. issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias"
  6029. ;;
  6030. deploy)
  6031. deploy "$_domain" "$_deploy_hook" "$_ecc"
  6032. ;;
  6033. signcsr)
  6034. signcsr "$_csr" "$_webroot" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias"
  6035. ;;
  6036. showcsr)
  6037. showcsr "$_csr" "$_domain"
  6038. ;;
  6039. installcert)
  6040. installcert "$_domain" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_ecc"
  6041. ;;
  6042. renew)
  6043. renew "$_domain" "$_ecc"
  6044. ;;
  6045. renewAll)
  6046. renewAll "$_stopRenewOnError"
  6047. ;;
  6048. revoke)
  6049. revoke "$_domain" "$_ecc"
  6050. ;;
  6051. remove)
  6052. remove "$_domain" "$_ecc"
  6053. ;;
  6054. deactivate)
  6055. deactivate "$_domain,$_altdomains"
  6056. ;;
  6057. registeraccount)
  6058. registeraccount "$_accountkeylength"
  6059. ;;
  6060. updateaccount)
  6061. updateaccount
  6062. ;;
  6063. deactivateaccount)
  6064. deactivateaccount
  6065. ;;
  6066. list)
  6067. list "$_listraw"
  6068. ;;
  6069. installcronjob) installcronjob "$_confighome" ;;
  6070. uninstallcronjob) uninstallcronjob ;;
  6071. cron) cron ;;
  6072. toPkcs)
  6073. toPkcs "$_domain" "$_password" "$_ecc"
  6074. ;;
  6075. toPkcs8)
  6076. toPkcs8 "$_domain" "$_ecc"
  6077. ;;
  6078. createAccountKey)
  6079. createAccountKey "$_accountkeylength"
  6080. ;;
  6081. createDomainKey)
  6082. createDomainKey "$_domain" "$_keylength"
  6083. ;;
  6084. createCSR)
  6085. createCSR "$_domain" "$_altdomains" "$_ecc"
  6086. ;;
  6087. setnotify)
  6088. setnotify "$_notify_hook" "$_notify_level" "$_notify_mode"
  6089. ;;
  6090. *)
  6091. if [ "$_CMD" ]; then
  6092. _err "Invalid command: $_CMD"
  6093. fi
  6094. showhelp
  6095. return 1
  6096. ;;
  6097. esac
  6098. _ret="$?"
  6099. if [ "$_ret" != "0" ]; then
  6100. return $_ret
  6101. fi
  6102. if [ "${_CMD}" = "install" ]; then
  6103. if [ "$_log" ]; then
  6104. if [ -z "$LOG_FILE" ]; then
  6105. LOG_FILE="$DEFAULT_LOG_FILE"
  6106. fi
  6107. _saveaccountconf "LOG_FILE" "$LOG_FILE"
  6108. fi
  6109. if [ "$_log_level" ]; then
  6110. _saveaccountconf "LOG_LEVEL" "$_log_level"
  6111. fi
  6112. if [ "$_syslog" ]; then
  6113. if _exists logger; then
  6114. if [ "$_syslog" = "0" ]; then
  6115. _clearaccountconf "SYS_LOG"
  6116. else
  6117. _saveaccountconf "SYS_LOG" "$_syslog"
  6118. fi
  6119. else
  6120. _err "The 'logger' command is not found, can not enable syslog."
  6121. _clearaccountconf "SYS_LOG"
  6122. SYS_LOG=""
  6123. fi
  6124. fi
  6125. _processAccountConf
  6126. fi
  6127. }
  6128. if [ "$INSTALLONLINE" ]; then
  6129. INSTALLONLINE=""
  6130. _installOnline
  6131. exit
  6132. fi
  6133. main() {
  6134. [ -z "$1" ] && showhelp && return
  6135. if _startswith "$1" '-'; then _process "$@"; else "$@"; fi
  6136. }
  6137. main "$@"