You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

2143 lines
53 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. #!/usr/bin/env bash
  2. VER=2.0.1
  3. PROJECT_NAME="le.sh"
  4. PROJECT_ENTRY="le.sh"
  5. PROJECT="https://github.com/Neilpang/le"
  6. DEFAULT_CA="https://acme-v01.api.letsencrypt.org"
  7. DEFAULT_AGREEMENT="https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf"
  8. DEFAULT_USER_AGENT="$PROJECT_ENTRY client: $PROJECT"
  9. STAGE_CA="https://acme-staging.api.letsencrypt.org"
  10. VTYPE_HTTP="http-01"
  11. VTYPE_DNS="dns-01"
  12. BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  13. END_CSR="-----END CERTIFICATE REQUEST-----"
  14. BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  15. END_CERT="-----END CERTIFICATE-----"
  16. if [[ -z "$AGREEMENT" ]] ; then
  17. AGREEMENT="$DEFAULT_AGREEMENT"
  18. fi
  19. _info() {
  20. if [[ -z "$2" ]] ; then
  21. echo "[$(date)] $1"
  22. else
  23. echo "[$(date)] $1"="'$2'"
  24. fi
  25. }
  26. _err() {
  27. _info "$@" >&2
  28. return 1
  29. }
  30. _debug() {
  31. if [[ -z "$DEBUG" ]] ; then
  32. return
  33. fi
  34. _err "$@"
  35. return 0
  36. }
  37. _debug2() {
  38. if [[ "$DEBUG" -ge "2" ]] ; then
  39. _debug "$@"
  40. fi
  41. return
  42. }
  43. _exists() {
  44. cmd="$1"
  45. if [[ -z "$cmd" ]] ; then
  46. _err "Usage: _exists cmd"
  47. return 1
  48. fi
  49. command -v $cmd >/dev/null 2>&1
  50. ret="$?"
  51. _debug2 "$cmd exists=$ret"
  52. return $ret
  53. }
  54. _h2b() {
  55. hex=$(cat)
  56. i=1
  57. j=2
  58. while [ '1' ] ; do
  59. h=$(printf $hex | cut -c $i-$j)
  60. if [[ -z "$h" ]] ; then
  61. break;
  62. fi
  63. printf "\x$h"
  64. let "i+=2"
  65. let "j+=2"
  66. done
  67. }
  68. #options file
  69. _sed_i() {
  70. options="$1"
  71. filename="$2"
  72. if [[ -z "$filename" ]] ; then
  73. _err "Usage:_sed_i options filename"
  74. return 1
  75. fi
  76. if sed -h 2>&1 | grep "\-i[SUFFIX]" ; then
  77. _debug "Using sed -i"
  78. sed -i ""
  79. else
  80. _debug "No -i support in sed"
  81. text="$(cat $filename)"
  82. echo "$text" | sed "$options" > "$filename"
  83. fi
  84. }
  85. #Usage: file startline endline
  86. _getfile() {
  87. filename="$1"
  88. startline="$2"
  89. endline="$3"
  90. if [[ -z "$endline" ]] ; then
  91. _err "Usage: file startline endline"
  92. return 1
  93. fi
  94. i="$(grep -n -- "$startline" $filename | cut -d : -f 1)"
  95. if [[ -z "$i" ]] ; then
  96. _err "Can not find start line: $startline"
  97. return 1
  98. fi
  99. let "i+=1"
  100. _debug i $i
  101. j="$(grep -n -- "$endline" $filename | cut -d : -f 1)"
  102. if [[ -z "$j" ]] ; then
  103. _err "Can not find end line: $endline"
  104. return 1
  105. fi
  106. let "j-=1"
  107. _debug j $j
  108. sed -n $i,${j}p "$filename"
  109. }
  110. #Usage: multiline
  111. _base64() {
  112. if [[ "$1" ]] ; then
  113. openssl base64 -e
  114. else
  115. openssl base64 -e | tr -d '\r\n'
  116. fi
  117. }
  118. #Usage: multiline
  119. _dbase64() {
  120. if [[ "$1" ]] ; then
  121. openssl base64 -d -A
  122. else
  123. openssl base64 -d
  124. fi
  125. }
  126. #Usage: hashalg
  127. #Output Base64-encoded digest
  128. _digest() {
  129. alg="$1"
  130. if [[ -z "$alg" ]] ; then
  131. _err "Usage: _digest hashalg"
  132. return 1
  133. fi
  134. if [[ "$alg" == "sha256" ]] ; then
  135. openssl dgst -sha256 -binary | _base64
  136. else
  137. _err "$alg is not supported yet"
  138. return 1
  139. fi
  140. }
  141. #Usage: keyfile hashalg
  142. #Output: Base64-encoded signature value
  143. _sign() {
  144. keyfile="$1"
  145. alg="$2"
  146. if [[ -z "$alg" ]] ; then
  147. _err "Usage: _sign keyfile hashalg"
  148. return 1
  149. fi
  150. if [[ "$alg" == "sha256" ]] ; then
  151. openssl dgst -sha256 -sign "$keyfile" | _base64
  152. else
  153. _err "$alg is not supported yet"
  154. return 1
  155. fi
  156. }
  157. _ss() {
  158. _port="$1"
  159. if _exists "ss" ; then
  160. _debug "Using: ss"
  161. ss -ntpl | grep :$_port" "
  162. return 0
  163. fi
  164. if _exists "netstat" ; then
  165. _debug "Using: netstat"
  166. if netstat -h 2>&1 | grep "\-p proto" >/dev/null ; then
  167. #for windows version netstat tool
  168. netstat -anb -p tcp | grep "LISTENING" | grep :$_port" "
  169. else
  170. if netstat -help 2>&1 | grep "\-p protocol" >/dev/null ; then
  171. netstat -an -p tcp | grep LISTEN | grep :$_port" "
  172. else
  173. netstat -ntpl | grep :$_port" "
  174. fi
  175. fi
  176. return 0
  177. fi
  178. return 1
  179. }
  180. toPkcs() {
  181. domain="$1"
  182. pfxPassword="$2"
  183. if [[ -z "$domain" ]] ; then
  184. echo "Usage: $PROJECT_ENTRY --toPkcs -d domain [--password pfx-password]"
  185. return 1
  186. fi
  187. _initpath "$domain"
  188. if [[ "$pfxPassword" ]] ; then
  189. openssl pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH" -password "pass:$pfxPassword"
  190. else
  191. openssl pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH"
  192. fi
  193. if [[ "$?" == "0" ]] ; then
  194. _info "Success, Pfx is exported to: $CERT_PFX_PATH"
  195. fi
  196. }
  197. #domain [2048]
  198. createAccountKey() {
  199. _info "Creating account key"
  200. if [[ -z "$1" ]] ; then
  201. echo Usage: $PROJECT_ENTRY --createAccountKey -d domain.com [--accountkeylength 2048]
  202. return
  203. fi
  204. account=$1
  205. length=$2
  206. if [[ "$length" == "ec-"* ]] ; then
  207. length=2048
  208. fi
  209. if [[ -z "$2" ]] ; then
  210. _info "Use default length 2048"
  211. length=2048
  212. fi
  213. _initpath
  214. if [[ -f "$ACCOUNT_KEY_PATH" ]] ; then
  215. _info "Account key exists, skip"
  216. return
  217. else
  218. #generate account key
  219. openssl genrsa $length 2>/dev/null > "$ACCOUNT_KEY_PATH"
  220. fi
  221. }
  222. #domain length
  223. createDomainKey() {
  224. _info "Creating domain key"
  225. if [[ -z "$1" ]] ; then
  226. echo Usage: $PROJECT_ENTRY --createDomainKey -d domain.com [ --keylength 2048 ]
  227. return
  228. fi
  229. domain=$1
  230. length=$2
  231. isec=""
  232. if [[ "$length" == "ec-"* ]] ; then
  233. isec="1"
  234. length=$(printf $length | cut -d '-' -f 2-100)
  235. eccname="$length"
  236. fi
  237. if [[ -z "$length" ]] ; then
  238. if [[ "$isec" ]] ; then
  239. length=256
  240. else
  241. length=2048
  242. fi
  243. fi
  244. _info "Use length $length"
  245. if [[ "$isec" ]] ; then
  246. if [[ "$length" == "256" ]] ; then
  247. eccname="prime256v1"
  248. fi
  249. if [[ "$length" == "384" ]] ; then
  250. eccname="secp384r1"
  251. fi
  252. if [[ "$length" == "521" ]] ; then
  253. eccname="secp521r1"
  254. fi
  255. _info "Using ec name: $eccname"
  256. fi
  257. _initpath $domain
  258. if [[ ! -f "$CERT_KEY_PATH" ]] || ( [[ "$FORCE" ]] && ! [[ "$IS_RENEW" ]] ); then
  259. #generate account key
  260. if [[ "$isec" ]] ; then
  261. openssl ecparam -name $eccname -genkey 2>/dev/null > "$CERT_KEY_PATH"
  262. else
  263. openssl genrsa $length 2>/dev/null > "$CERT_KEY_PATH"
  264. fi
  265. else
  266. if [[ "$IS_RENEW" ]] ; then
  267. _info "Domain key exists, skip"
  268. return 0
  269. else
  270. _err "Domain key exists, do you want to overwrite the key?"
  271. _err "Set FORCE=1, and try again."
  272. return 1
  273. fi
  274. fi
  275. }
  276. # domain domainlist
  277. createCSR() {
  278. _info "Creating csr"
  279. if [[ -z "$1" ]] ; then
  280. echo Usage: $PROJECT_ENTRY --createCSR -d domain1.com [-d domain2.com -d domain3.com ... ]
  281. return
  282. fi
  283. domain=$1
  284. _initpath $domain
  285. domainlist=$2
  286. if [[ -f "$CSR_PATH" ]] && [[ "$IS_RENEW" ]] && [[ -z "$FORCE" ]]; then
  287. _info "CSR exists, skip"
  288. return
  289. fi
  290. if [[ -z "$domainlist" ]] || [[ "$domainlist" == "no" ]]; then
  291. #single domain
  292. _info "Single domain" $domain
  293. printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\n" > "$DOMAIN_SSL_CONF"
  294. openssl req -new -sha256 -key "$CERT_KEY_PATH" -subj "/CN=$domain" -config "$DOMAIN_SSL_CONF" -out "$CSR_PATH"
  295. else
  296. alt="DNS:$(echo $domainlist | sed "s/,/,DNS:/g")"
  297. #multi
  298. _info "Multi domain" "$alt"
  299. printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\n[SAN]\nsubjectAltName=$alt" > "$DOMAIN_SSL_CONF"
  300. openssl req -new -sha256 -key "$CERT_KEY_PATH" -subj "/CN=$domain" -reqexts SAN -config "$DOMAIN_SSL_CONF" -out "$CSR_PATH"
  301. fi
  302. }
  303. _urlencode() {
  304. __n=$(cat)
  305. echo $__n | tr '/+' '_-' | tr -d '= '
  306. }
  307. _time2str() {
  308. #BSD
  309. if date -u -d@$1 2>/dev/null ; then
  310. return
  311. fi
  312. #Linux
  313. if date -u -r $1 2>/dev/null ; then
  314. return
  315. fi
  316. }
  317. _stat() {
  318. #Linux
  319. if stat -c '%U:%G' "$1" 2>/dev/null ; then
  320. return
  321. fi
  322. #BSD
  323. if stat -f '%Su:%Sg' "$1" 2>/dev/null ; then
  324. return
  325. fi
  326. }
  327. #keyfile
  328. _calcjwk() {
  329. keyfile="$1"
  330. if [[ -z "$keyfile" ]] ; then
  331. _err "Usage: _calcjwk keyfile"
  332. return 1
  333. fi
  334. EC_SIGN=""
  335. if grep "BEGIN RSA PRIVATE KEY" "$keyfile" > /dev/null 2>&1 ; then
  336. _debug "RSA key"
  337. pub_exp=$(openssl rsa -in $keyfile -noout -text | grep "^publicExponent:"| cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
  338. if [[ "${#pub_exp}" == "5" ]] ; then
  339. pub_exp=0$pub_exp
  340. fi
  341. _debug2 pub_exp "$pub_exp"
  342. e=$(echo $pub_exp | _h2b | _base64)
  343. _debug2 e "$e"
  344. modulus=$(openssl rsa -in $keyfile -modulus -noout | cut -d '=' -f 2 )
  345. n=$(echo $modulus| _h2b | _base64 | _urlencode )
  346. jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
  347. _debug2 jwk "$jwk"
  348. HEADER='{"alg": "RS256", "jwk": '$jwk'}'
  349. HEADERPLACE='{"nonce": "NONCE", "alg": "RS256", "jwk": '$jwk'}'
  350. elif grep "BEGIN EC PRIVATE KEY" "$keyfile" > /dev/null 2>&1 ; then
  351. _debug "EC key"
  352. EC_SIGN="1"
  353. crv="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
  354. _debug2 crv $crv
  355. pubi="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
  356. _debug2 pubi $pubi
  357. let "pubi=pubi+1"
  358. pubj="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
  359. _debug2 pubj $pubj
  360. let "pubj=pubj-1"
  361. pubtext="$(openssl ec -in $keyfile -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
  362. _debug2 pubtext "$pubtext"
  363. xlen="$(printf "$pubtext" | tr -d ':' | wc -c)"
  364. let "xlen=xlen/4"
  365. _debug2 xlen $xlen
  366. let "xend=xlen+1"
  367. x="$(printf $pubtext | cut -d : -f 2-$xend)"
  368. _debug2 x $x
  369. x64="$(printf $x | tr -d : | _h2b | _base64 | _urlencode)"
  370. _debug2 x64 $x64
  371. let "xend+=1"
  372. y="$(printf $pubtext | cut -d : -f $xend-10000)"
  373. _debug2 y $y
  374. y64="$(printf $y | tr -d : | _h2b | _base64 | _urlencode)"
  375. _debug2 y64 $y64
  376. jwk='{"kty": "EC", "crv": "'$crv'", "x": "'$x64'", "y": "'$y64'"}'
  377. _debug2 jwk "$jwk"
  378. HEADER='{"alg": "ES256", "jwk": '$jwk'}'
  379. HEADERPLACE='{"nonce": "NONCE", "alg": "ES256", "jwk": '$jwk'}'
  380. else
  381. _err "Only RSA or EC key is supported."
  382. return 1
  383. fi
  384. _debug2 HEADER "$HEADER"
  385. }
  386. # body url [needbase64]
  387. _post() {
  388. body="$1"
  389. url="$2"
  390. needbase64="$3"
  391. if _exists "curl" ; then
  392. CURL="$CURL --dump-header $HTTP_HEADER "
  393. if [[ "$needbase64" ]] ; then
  394. response="$($CURL -A "User-Agent: $USER_AGENT" -X POST --data "$body" $url | _base64)"
  395. else
  396. response="$($CURL -A "User-Agent: $USER_AGENT" -X POST --data "$body" $url)"
  397. fi
  398. else
  399. if [[ "$needbase64" ]] ; then
  400. response="$($WGET -S -O - --user-agent="$USER_AGENT" --post-data="$body" $url 2>"$HTTP_HEADER" | _base64)"
  401. else
  402. response="$($WGET -S -O - --user-agent="$USER_AGENT" --post-data="$body" $url 2>"$HTTP_HEADER")"
  403. fi
  404. _sed_i "s/^ *//g" "$HTTP_HEADER"
  405. fi
  406. echo -n "$response"
  407. }
  408. # url getheader
  409. _get() {
  410. url="$1"
  411. onlyheader="$2"
  412. _debug url $url
  413. if _exists "curl" ; then
  414. if [[ "$onlyheader" ]] ; then
  415. $CURL -I -A "User-Agent: $USER_AGENT" $url
  416. else
  417. $CURL -A "User-Agent: $USER_AGENT" $url
  418. fi
  419. else
  420. _debug "WGET" "$WGET"
  421. if [[ "$onlyheader" ]] ; then
  422. eval $WGET --user-agent=\"$USER_AGENT\" -S -O /dev/null $url 2>&1 | sed 's/^[ ]*//g'
  423. else
  424. eval $WGET --user-agent=\"$USER_AGENT\" -O - $url
  425. fi
  426. fi
  427. ret=$?
  428. return $ret
  429. }
  430. # url payload needbase64 keyfile
  431. _send_signed_request() {
  432. url=$1
  433. payload=$2
  434. needbase64=$3
  435. keyfile=$4
  436. if [[ -z "$keyfile" ]] ; then
  437. keyfile="$ACCOUNT_KEY_PATH"
  438. fi
  439. _debug url $url
  440. _debug payload "$payload"
  441. if ! _calcjwk "$keyfile" ; then
  442. return 1
  443. fi
  444. payload64=$(echo -n $payload | _base64 | _urlencode)
  445. _debug2 payload64 $payload64
  446. nonceurl="$API/directory"
  447. nonce="$(_get $nonceurl "onlyheader" | grep -o "Replay-Nonce:.*$" | head -1 | tr -d "\r\n" | cut -d ' ' -f 2)"
  448. _debug nonce "$nonce"
  449. protected="$(printf "$HEADERPLACE" | sed "s/NONCE/$nonce/" )"
  450. _debug2 protected "$protected"
  451. protected64="$(printf "$protected" | _base64 | _urlencode)"
  452. _debug2 protected64 "$protected64"
  453. sig=$(echo -n "$protected64.$payload64" | _sign "$keyfile" "sha256" | _urlencode)
  454. _debug2 sig "$sig"
  455. body="{\"header\": $HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
  456. _debug2 body "$body"
  457. response="$(_post "$body" $url "$needbase64" )"
  458. responseHeaders="$(cat $HTTP_HEADER)"
  459. _debug2 responseHeaders "$responseHeaders"
  460. _debug2 response "$response"
  461. code="$(grep "^HTTP" $HTTP_HEADER | tail -1 | cut -d " " -f 2 | tr -d "\r\n" )"
  462. _debug code $code
  463. }
  464. #setopt "file" "opt" "=" "value" [";"]
  465. _setopt() {
  466. __conf="$1"
  467. __opt="$2"
  468. __sep="$3"
  469. __val="$4"
  470. __end="$5"
  471. if [[ -z "$__opt" ]] ; then
  472. echo usage: _setopt '"file" "opt" "=" "value" [";"]'
  473. return
  474. fi
  475. if [[ ! -f "$__conf" ]] ; then
  476. touch "$__conf"
  477. fi
  478. if grep -H -n "^$__opt$__sep" "$__conf" > /dev/null ; then
  479. _debug2 OK
  480. if [[ "$__val" == *"&"* ]] ; then
  481. __val="$(echo $__val | sed 's/&/\\&/g')"
  482. fi
  483. text="$(cat $__conf)"
  484. echo "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" > "$__conf"
  485. elif grep -H -n "^#$__opt$__sep" "$__conf" > /dev/null ; then
  486. if [[ "$__val" == *"&"* ]] ; then
  487. __val="$(echo $__val | sed 's/&/\\&/g')"
  488. fi
  489. text="$(cat $__conf)"
  490. echo "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" > "$__conf"
  491. else
  492. _debug2 APP
  493. echo "$__opt$__sep$__val$__end" >> "$__conf"
  494. fi
  495. _debug "$(grep -H -n "^$__opt$__sep" $__conf)"
  496. }
  497. #_savedomainconf key value
  498. #save to domain.conf
  499. _savedomainconf() {
  500. key="$1"
  501. value="$2"
  502. if [[ "$DOMAIN_CONF" ]] ; then
  503. _setopt $DOMAIN_CONF "$key" "=" "$value"
  504. else
  505. _err "DOMAIN_CONF is empty, can not save $key=$value"
  506. fi
  507. }
  508. #_saveaccountconf key value
  509. _saveaccountconf() {
  510. key="$1"
  511. value="$2"
  512. if [[ "$ACCOUNT_CONF_PATH" ]] ; then
  513. _setopt $ACCOUNT_CONF_PATH "$key" "=" "\"$value\""
  514. else
  515. _err "ACCOUNT_CONF_PATH is empty, can not save $key=$value"
  516. fi
  517. }
  518. _startserver() {
  519. content="$1"
  520. _debug "startserver: $$"
  521. nchelp="$(nc -h 2>&1)"
  522. if echo "$nchelp" | grep "\-q[ ,]" >/dev/null ; then
  523. _NC="nc -q 1 -l"
  524. else
  525. if echo "$nchelp" | grep "GNU netcat" >/dev/null && echo "$nchelp" | grep "\-c, \-\-close" >/dev/null ; then
  526. _NC="nc -c -l"
  527. elif echo "$nchelp" | grep "\-N" |grep "Shutdown the network socket after EOF on stdin" >/dev/null ; then
  528. _NC="nc -N -l"
  529. else
  530. _NC="nc -l"
  531. fi
  532. fi
  533. _debug "_NC" "$_NC"
  534. # while true ; do
  535. if [[ "$DEBUG" ]] ; then
  536. if ! echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC -p $Le_HTTPPort -vv ; then
  537. echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC $Le_HTTPPort -vv ;
  538. fi
  539. else
  540. if ! echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC -p $Le_HTTPPort > /dev/null 2>&1; then
  541. echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC $Le_HTTPPort > /dev/null 2>&1
  542. fi
  543. fi
  544. if [[ "$?" != "0" ]] ; then
  545. _err "nc listen error."
  546. exit 1
  547. fi
  548. # done
  549. }
  550. _stopserver(){
  551. pid="$1"
  552. _debug "pid" "$pid"
  553. if [[ -z "$pid" ]] ; then
  554. return
  555. fi
  556. if [[ "$(ps | grep "$pid")" ]] ; then
  557. _debug "Found proc process, kill it."
  558. kill -s 9 $pid > /dev/null
  559. fi
  560. for ncid in $(echo $(ps | grep nc) | cut -d " " -f 1) ; do
  561. _debug "kill $ncid"
  562. kill -s 9 $ncid > /dev/null
  563. done
  564. _get "http://localhost:$Le_HTTPPort" >/dev/null 2>&1
  565. }
  566. _initpath() {
  567. if [[ -z "$LE_WORKING_DIR" ]] ; then
  568. LE_WORKING_DIR=$HOME/.le
  569. fi
  570. _DEFAULT_ACCOUNT_CONF_PATH="$LE_WORKING_DIR/account.conf"
  571. if [[ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ]] ; then
  572. source "$_DEFAULT_ACCOUNT_CONF_PATH"
  573. fi
  574. if [[ -z "$ACCOUNT_CONF_PATH" ]] ; then
  575. ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
  576. fi
  577. if [[ -f "$ACCOUNT_CONF_PATH" ]] ; then
  578. source "$ACCOUNT_CONF_PATH"
  579. fi
  580. if [[ "$IN_CRON" ]] ; then
  581. if [[ ! "$_USER_PATH_EXPORTED" ]] ; then
  582. _USER_PATH_EXPORTED=1
  583. export PATH="$USER_PATH:$PATH"
  584. fi
  585. fi
  586. if [[ -z "$API" ]] ; then
  587. if [[ -z "$STAGE" ]] ; then
  588. API="$DEFAULT_CA"
  589. else
  590. API="$STAGE_CA"
  591. _info "Using stage api:$API"
  592. fi
  593. fi
  594. if [[ -z "$ACME_DIR" ]] ; then
  595. ACME_DIR="/home/.acme"
  596. fi
  597. if [[ -z "$APACHE_CONF_BACKUP_DIR" ]] ; then
  598. APACHE_CONF_BACKUP_DIR="$LE_WORKING_DIR"
  599. fi
  600. if [[ -z "$USER_AGENT" ]] ; then
  601. USER_AGENT="$DEFAULT_USER_AGENT"
  602. fi
  603. HTTP_HEADER="$LE_WORKING_DIR/http.header"
  604. WGET="wget -q"
  605. if [[ "$DEBUG" -ge "2" ]] ; then
  606. WGET="$WGET -d "
  607. fi
  608. dp="$LE_WORKING_DIR/curl.dump"
  609. CURL="curl -L --silent"
  610. if [[ "$DEBUG" -ge "2" ]] ; then
  611. CURL="$CURL -L --trace-ascii $dp "
  612. fi
  613. domain="$1"
  614. if [[ -z "$ACCOUNT_KEY_PATH" ]] ; then
  615. ACCOUNT_KEY_PATH="$LE_WORKING_DIR/account.key"
  616. fi
  617. if [[ -z "$domain" ]] ; then
  618. return 0
  619. fi
  620. domainhome="$LE_WORKING_DIR/$domain"
  621. mkdir -p "$domainhome"
  622. if [[ -z "$DOMAIN_PATH" ]] ; then
  623. DOMAIN_PATH="$domainhome"
  624. fi
  625. if [[ -z "$DOMAIN_CONF" ]] ; then
  626. DOMAIN_CONF="$domainhome/$domain.conf"
  627. fi
  628. if [[ -z "$DOMAIN_SSL_CONF" ]] ; then
  629. DOMAIN_SSL_CONF="$domainhome/$domain.ssl.conf"
  630. fi
  631. if [[ -z "$CSR_PATH" ]] ; then
  632. CSR_PATH="$domainhome/$domain.csr"
  633. fi
  634. if [[ -z "$CERT_KEY_PATH" ]] ; then
  635. CERT_KEY_PATH="$domainhome/$domain.key"
  636. fi
  637. if [[ -z "$CERT_PATH" ]] ; then
  638. CERT_PATH="$domainhome/$domain.cer"
  639. fi
  640. if [[ -z "$CA_CERT_PATH" ]] ; then
  641. CA_CERT_PATH="$domainhome/ca.cer"
  642. fi
  643. if [[ -z "$CERT_FULLCHAIN_PATH" ]] ; then
  644. CERT_FULLCHAIN_PATH="$domainhome/fullchain.cer"
  645. fi
  646. if [[ -z "$CERT_PFX_PATH" ]] ; then
  647. CERT_PFX_PATH="$domainhome/$domain.pfx"
  648. fi
  649. }
  650. _apachePath() {
  651. httpdconfname="$(apachectl -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"' )"
  652. if [[ "$httpdconfname" == '/'* ]] ; then
  653. httpdconf="$httpdconfname"
  654. httpdconfname="$(basename $httpdconfname)"
  655. else
  656. httpdroot="$(apachectl -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"' )"
  657. httpdconf="$httpdroot/$httpdconfname"
  658. fi
  659. if [[ ! -f $httpdconf ]] ; then
  660. _err "Apache Config file not found" $httpdconf
  661. return 1
  662. fi
  663. return 0
  664. }
  665. _restoreApache() {
  666. if [[ -z "$usingApache" ]] ; then
  667. return 0
  668. fi
  669. _initpath
  670. if ! _apachePath ; then
  671. return 1
  672. fi
  673. if [[ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ]] ; then
  674. _debug "No config file to restore."
  675. return 0
  676. fi
  677. cp -p "$APACHE_CONF_BACKUP_DIR/$httpdconfname" "$httpdconf"
  678. if ! apachectl -t ; then
  679. _err "Sorry, restore apache config error, please contact me."
  680. return 1;
  681. fi
  682. rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
  683. return 0
  684. }
  685. _setApache() {
  686. _initpath
  687. if ! _apachePath ; then
  688. return 1
  689. fi
  690. #backup the conf
  691. _debug "Backup apache config file" $httpdconf
  692. cp -p $httpdconf $APACHE_CONF_BACKUP_DIR/
  693. _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
  694. _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
  695. _info "The backup file will be deleted on sucess, just forget it."
  696. #add alias
  697. apacheVer="$(apachectl -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2 )"
  698. _debug "apacheVer" "$apacheVer"
  699. apacheMajer="$(echo "$apacheVer" | cut -d . -f 1)"
  700. apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
  701. if [[ "$apacheVer" ]] && [[ "$apacheMajer" -ge "2" ]] && [[ "$apacheMinor" -ge "4" ]] ; then
  702. echo "
  703. Alias /.well-known/acme-challenge $ACME_DIR
  704. <Directory $ACME_DIR >
  705. Require all granted
  706. </Directory>
  707. " >> $httpdconf
  708. else
  709. echo "
  710. Alias /.well-known/acme-challenge $ACME_DIR
  711. <Directory $ACME_DIR >
  712. Order allow,deny
  713. Allow from all
  714. </Directory>
  715. " >> $httpdconf
  716. fi
  717. if ! apachectl -t ; then
  718. _err "Sorry, apache config error, please contact me."
  719. _restoreApache
  720. return 1;
  721. fi
  722. if [[ ! -d "$ACME_DIR" ]] ; then
  723. mkdir -p "$ACME_DIR"
  724. chmod 755 "$ACME_DIR"
  725. fi
  726. if ! apachectl graceful ; then
  727. _err "Sorry, apachectl graceful error, please contact me."
  728. _restoreApache
  729. return 1;
  730. fi
  731. usingApache="1"
  732. return 0
  733. }
  734. _clearup () {
  735. _stopserver $serverproc
  736. serverproc=""
  737. _restoreApache
  738. }
  739. # webroot removelevel tokenfile
  740. _clearupwebbroot() {
  741. __webroot="$1"
  742. if [[ -z "$__webroot" ]] ; then
  743. _debug "no webroot specified, skip"
  744. return 0
  745. fi
  746. if [[ "$2" == '1' ]] ; then
  747. _debug "remove $__webroot/.well-known"
  748. rm -rf "$__webroot/.well-known"
  749. elif [[ "$2" == '2' ]] ; then
  750. _debug "remove $__webroot/.well-known/acme-challenge"
  751. rm -rf "$__webroot/.well-known/acme-challenge"
  752. elif [[ "$2" == '3' ]] ; then
  753. _debug "remove $__webroot/.well-known/acme-challenge/$3"
  754. rm -rf "$__webroot/.well-known/acme-challenge/$3"
  755. else
  756. _info "Skip for removelevel:$2"
  757. fi
  758. return 0
  759. }
  760. issue() {
  761. if [[ -z "$2" ]] ; then
  762. echo "Usage: $PROJECT_ENTRY --issue -d a.com -w /path/to/webroot/a.com/ "
  763. return 1
  764. fi
  765. Le_Webroot="$1"
  766. Le_Domain="$2"
  767. Le_Alt="$3"
  768. Le_Keylength="$4"
  769. Le_RealCertPath="$5"
  770. Le_RealKeyPath="$6"
  771. Le_RealCACertPath="$7"
  772. Le_ReloadCmd="$8"
  773. Le_RealFullChainPath="$9"
  774. _initpath $Le_Domain
  775. if [[ -f "$DOMAIN_CONF" ]] ; then
  776. Le_NextRenewTime=$(grep "^Le_NextRenewTime=" "$DOMAIN_CONF" | cut -d '=' -f 2)
  777. if [[ -z "$FORCE" ]] && [[ "$Le_NextRenewTime" ]] && [[ "$(date -u "+%s" )" -lt "$Le_NextRenewTime" ]] ; then
  778. _info "Skip, Next renewal time is: $(grep "^Le_NextRenewTimeStr" "$DOMAIN_CONF" | cut -d '=' -f 2)"
  779. return 2
  780. fi
  781. fi
  782. _setopt "$DOMAIN_CONF" "Le_Domain" "=" "$Le_Domain"
  783. _setopt "$DOMAIN_CONF" "Le_Alt" "=" "$Le_Alt"
  784. _setopt "$DOMAIN_CONF" "Le_Webroot" "=" "$Le_Webroot"
  785. _setopt "$DOMAIN_CONF" "Le_Keylength" "=" "$Le_Keylength"
  786. _setopt "$DOMAIN_CONF" "Le_RealCertPath" "=" "\"$Le_RealCertPath\""
  787. _setopt "$DOMAIN_CONF" "Le_RealCACertPath" "=" "\"$Le_RealCACertPath\""
  788. _setopt "$DOMAIN_CONF" "Le_RealKeyPath" "=" "\"$Le_RealKeyPath\""
  789. _setopt "$DOMAIN_CONF" "Le_ReloadCmd" "=" "\"$Le_ReloadCmd\""
  790. _setopt "$DOMAIN_CONF" "Le_RealFullChainPath" "=" "\"$Le_RealFullChainPath\""
  791. if [[ "$Le_Alt" == "no" ]] ; then
  792. Le_Alt=""
  793. fi
  794. if [[ "$Le_Keylength" == "no" ]] ; then
  795. Le_Keylength=""
  796. fi
  797. if [[ "$Le_RealCertPath" == "no" ]] ; then
  798. Le_RealCertPath=""
  799. fi
  800. if [[ "$Le_RealKeyPath" == "no" ]] ; then
  801. Le_RealKeyPath=""
  802. fi
  803. if [[ "$Le_RealCACertPath" == "no" ]] ; then
  804. Le_RealCACertPath=""
  805. fi
  806. if [[ "$Le_ReloadCmd" == "no" ]] ; then
  807. Le_ReloadCmd=""
  808. fi
  809. if [[ "$Le_RealFullChainPath" == "no" ]] ; then
  810. Le_RealFullChainPath=""
  811. fi
  812. if [[ "$Le_Webroot" == *"no"* ]] ; then
  813. _info "Standalone mode."
  814. if ! command -v "nc" > /dev/null ; then
  815. _err "Please install netcat(nc) tools first."
  816. return 1
  817. fi
  818. if [[ -z "$Le_HTTPPort" ]] ; then
  819. Le_HTTPPort=80
  820. fi
  821. _setopt "$DOMAIN_CONF" "Le_HTTPPort" "=" "$Le_HTTPPort"
  822. netprc="$(_ss "$Le_HTTPPort" | grep "$Le_HTTPPort")"
  823. if [[ "$netprc" ]] ; then
  824. _err "$netprc"
  825. _err "tcp port $Le_HTTPPort is already used by $(echo "$netprc" | cut -d : -f 4)"
  826. _err "Please stop it first"
  827. return 1
  828. fi
  829. fi
  830. if [[ "$Le_Webroot" == *"apache"* ]] ; then
  831. if ! _setApache ; then
  832. _err "set up apache error. Report error to me."
  833. return 1
  834. fi
  835. wellknown_path="$ACME_DIR"
  836. else
  837. usingApache=""
  838. fi
  839. createAccountKey $Le_Domain $Le_Keylength
  840. if ! _calcjwk "$ACCOUNT_KEY_PATH" ; then
  841. return 1
  842. fi
  843. accountkey_json=$(echo -n "$jwk" | tr -d ' ' )
  844. thumbprint=$(echo -n "$accountkey_json" | _digest "sha256" | _urlencode)
  845. accountkeyhash="$(cat "$ACCOUNT_KEY_PATH" | _digest "sha256" )"
  846. accountkeyhash="$(echo $accountkeyhash$API | _digest "sha256" )"
  847. if [[ "$accountkeyhash" != "$ACCOUNT_KEY_HASH" ]] ; then
  848. _info "Registering account"
  849. regjson='{"resource": "new-reg", "agreement": "'$AGREEMENT'"}'
  850. if [[ "$ACCOUNT_EMAIL" ]] ; then
  851. regjson='{"resource": "new-reg", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
  852. fi
  853. _send_signed_request "$API/acme/new-reg" "$regjson"
  854. if [[ "$code" == "" ]] || [[ "$code" == '201' ]] ; then
  855. _info "Registered"
  856. echo $response > $LE_WORKING_DIR/account.json
  857. elif [[ "$code" == '409' ]] ; then
  858. _info "Already registered"
  859. else
  860. _err "Register account Error: $response"
  861. _clearup
  862. return 1
  863. fi
  864. ACCOUNT_KEY_HASH="$accountkeyhash"
  865. _saveaccountconf "ACCOUNT_KEY_HASH" "$ACCOUNT_KEY_HASH"
  866. else
  867. _info "Skip register account key"
  868. fi
  869. if ! createDomainKey $Le_Domain $Le_Keylength ; then
  870. _err "Create domain key error."
  871. return 1
  872. fi
  873. if ! createCSR $Le_Domain $Le_Alt ; then
  874. _err "Create CSR error."
  875. return 1
  876. fi
  877. vlist="$Le_Vlist"
  878. # verify each domain
  879. _info "Verify each domain"
  880. sep='#'
  881. if [[ -z "$vlist" ]] ; then
  882. alldomains=$(echo "$Le_Domain,$Le_Alt" | tr ',' ' ' )
  883. _index=1
  884. _currentRoot=""
  885. for d in $alldomains
  886. do
  887. _info "Getting webroot for domain" $d
  888. _w="$(echo $Le_Webroot | cut -d , -f $_index)"
  889. _debug _w "$_w"
  890. if [[ "$_w" ]] ; then
  891. _currentRoot="$_w"
  892. fi
  893. _debug "_currentRoot" "$_currentRoot"
  894. let "_index+=1"
  895. vtype="$VTYPE_HTTP"
  896. if [[ "$_currentRoot" == "dns"* ]] ; then
  897. vtype="$VTYPE_DNS"
  898. fi
  899. _info "Getting token for domain" $d
  900. _send_signed_request "$API/acme/new-authz" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$d\"}}"
  901. if [[ ! -z "$code" ]] && [[ ! "$code" == '201' ]] ; then
  902. _err "new-authz error: $response"
  903. _clearup
  904. return 1
  905. fi
  906. entry="$(printf $response | egrep -o '\{[^{]*"type":"'$vtype'"[^}]*')"
  907. _debug entry "$entry"
  908. token="$(printf "$entry" | egrep -o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
  909. _debug token $token
  910. uri="$(printf "$entry" | egrep -o '"uri":"[^"]*'| cut -d : -f 2,3 | tr -d '"' )"
  911. _debug uri $uri
  912. keyauthorization="$token.$thumbprint"
  913. _debug keyauthorization "$keyauthorization"
  914. dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
  915. _debug dvlist "$dvlist"
  916. vlist="$vlist$dvlist,"
  917. done
  918. #add entry
  919. dnsadded=""
  920. ventries=$(echo "$vlist" | tr ',' ' ' )
  921. for ventry in $ventries
  922. do
  923. d=$(echo $ventry | cut -d $sep -f 1)
  924. keyauthorization=$(echo $ventry | cut -d $sep -f 2)
  925. vtype=$(echo $ventry | cut -d $sep -f 4)
  926. _currentRoot=$(echo $ventry | cut -d $sep -f 5)
  927. if [[ "$vtype" == "$VTYPE_DNS" ]] ; then
  928. dnsadded='0'
  929. txtdomain="_acme-challenge.$d"
  930. _debug txtdomain "$txtdomain"
  931. txt="$(echo -e -n $keyauthorization | _digest "sha256" | _urlencode)"
  932. _debug txt "$txt"
  933. #dns
  934. #1. check use api
  935. d_api=""
  936. if [[ -f "$LE_WORKING_DIR/$d/$_currentRoot" ]] ; then
  937. d_api="$LE_WORKING_DIR/$d/$_currentRoot"
  938. elif [[ -f "$LE_WORKING_DIR/$d/$_currentRoot.sh" ]] ; then
  939. d_api="$LE_WORKING_DIR/$d/$_currentRoot.sh"
  940. elif [[ -f "$LE_WORKING_DIR/$_currentRoot" ]] ; then
  941. d_api="$LE_WORKING_DIR/$_currentRoot"
  942. elif [[ -f "$LE_WORKING_DIR/$_currentRoot.sh" ]] ; then
  943. d_api="$LE_WORKING_DIR/$_currentRoot.sh"
  944. elif [[ -f "$LE_WORKING_DIR/dnsapi/$_currentRoot" ]] ; then
  945. d_api="$LE_WORKING_DIR/dnsapi/$_currentRoot"
  946. elif [[ -f "$LE_WORKING_DIR/dnsapi/$_currentRoot.sh" ]] ; then
  947. d_api="$LE_WORKING_DIR/dnsapi/$_currentRoot.sh"
  948. fi
  949. _debug d_api "$d_api"
  950. if [[ "$d_api" ]] ; then
  951. _info "Found domain api file: $d_api"
  952. else
  953. _err "Add the following TXT record:"
  954. _err "Domain: $txtdomain"
  955. _err "TXT value: $txt"
  956. _err "Please be aware that you prepend _acme-challenge. before your domain"
  957. _err "so the resulting subdomain will be: $txtdomain"
  958. continue
  959. fi
  960. (
  961. if ! source $d_api ; then
  962. _err "Load file $d_api error. Please check your api file and try again."
  963. return 1
  964. fi
  965. addcommand="$_currentRoot-add"
  966. if ! _exists $addcommand ; then
  967. _err "It seems that your api file is not correct, it must have a function named: $addcommand"
  968. return 1
  969. fi
  970. if ! $addcommand $txtdomain $txt ; then
  971. _err "Error add txt for domain:$txtdomain"
  972. return 1
  973. fi
  974. )
  975. if [[ "$?" != "0" ]] ; then
  976. return 1
  977. fi
  978. dnsadded='1'
  979. fi
  980. done
  981. if [[ "$dnsadded" == '0' ]] ; then
  982. _setopt "$DOMAIN_CONF" "Le_Vlist" "=" "\"$vlist\""
  983. _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
  984. _err "Please add the TXT records to the domains, and retry again."
  985. return 1
  986. fi
  987. fi
  988. if [[ "$dnsadded" == '1' ]] ; then
  989. _info "Sleep 60 seconds for the txt records to take effect"
  990. sleep 60
  991. fi
  992. _debug "ok, let's start to verify"
  993. ventries=$(echo "$vlist" | tr ',' ' ' )
  994. for ventry in $ventries
  995. do
  996. d=$(echo $ventry | cut -d $sep -f 1)
  997. keyauthorization=$(echo $ventry | cut -d $sep -f 2)
  998. uri=$(echo $ventry | cut -d $sep -f 3)
  999. vtype=$(echo $ventry | cut -d $sep -f 4)
  1000. _currentRoot=$(echo $ventry | cut -d $sep -f 5)
  1001. _info "Verifying:$d"
  1002. _debug "d" "$d"
  1003. _debug "keyauthorization" "$keyauthorization"
  1004. _debug "uri" "$uri"
  1005. removelevel=""
  1006. token=""
  1007. _debug "_currentRoot" "$_currentRoot"
  1008. if [[ "$vtype" == "$VTYPE_HTTP" ]] ; then
  1009. if [[ "$_currentRoot" == "no" ]] ; then
  1010. _info "Standalone mode server"
  1011. _startserver "$keyauthorization" &
  1012. if [[ "$?" != "0" ]] ; then
  1013. return 1
  1014. fi
  1015. serverproc="$!"
  1016. sleep 2
  1017. _debug serverproc $serverproc
  1018. else
  1019. if [[ -z "$wellknown_path" ]] ; then
  1020. wellknown_path="$_currentRoot/.well-known/acme-challenge"
  1021. fi
  1022. _debug wellknown_path "$wellknown_path"
  1023. if [[ ! -d "$_currentRoot/.well-known" ]] ; then
  1024. removelevel='1'
  1025. elif [[ ! -d "$_currentRoot/.well-known/acme-challenge" ]] ; then
  1026. removelevel='2'
  1027. else
  1028. removelevel='3'
  1029. fi
  1030. token="$(echo -e -n "$keyauthorization" | cut -d '.' -f 1)"
  1031. _debug "writing token:$token to $wellknown_path/$token"
  1032. mkdir -p "$wellknown_path"
  1033. echo -n "$keyauthorization" > "$wellknown_path/$token"
  1034. if [[ ! "$usingApache" ]] ; then
  1035. webroot_owner=$(_stat $_currentRoot)
  1036. _debug "Changing owner/group of .well-known to $webroot_owner"
  1037. chown -R $webroot_owner "$_currentRoot/.well-known"
  1038. fi
  1039. fi
  1040. fi
  1041. _send_signed_request $uri "{\"resource\": \"challenge\", \"keyAuthorization\": \"$keyauthorization\"}"
  1042. if [[ ! -z "$code" ]] && [[ ! "$code" == '202' ]] ; then
  1043. _err "$d:Challenge error: $response"
  1044. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1045. _clearup
  1046. return 1
  1047. fi
  1048. waittimes=0
  1049. if [[ -z "$MAX_RETRY_TIMES" ]] ; then
  1050. MAX_RETRY_TIMES=30
  1051. fi
  1052. while [[ "1" ]] ; do
  1053. let "waittimes+=1"
  1054. if [[ "$waittimes" -ge "$MAX_RETRY_TIMES" ]] ; then
  1055. _err "$d:Timeout"
  1056. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1057. _clearup
  1058. return 1
  1059. fi
  1060. _debug "sleep 5 secs to verify"
  1061. sleep 5
  1062. _debug "checking"
  1063. response="$(_get $uri)"
  1064. if [[ "$?" != "0" ]] ; then
  1065. _err "$d:Verify error:$response"
  1066. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1067. _clearup
  1068. return 1
  1069. fi
  1070. status=$(echo $response | egrep -o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
  1071. if [[ "$status" == "valid" ]] ; then
  1072. _info "Success"
  1073. _stopserver $serverproc
  1074. serverproc=""
  1075. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1076. break;
  1077. fi
  1078. if [[ "$status" == "invalid" ]] ; then
  1079. error=$(echo $response | egrep -o '"error":{[^}]*}' | grep -o '"detail":"[^"]*"' | cut -d '"' -f 4)
  1080. _err "$d:Verify error:$error"
  1081. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1082. _clearup
  1083. return 1;
  1084. fi
  1085. if [[ "$status" == "pending" ]] ; then
  1086. _info "Pending"
  1087. else
  1088. _err "$d:Verify error:$response"
  1089. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1090. _clearup
  1091. return 1
  1092. fi
  1093. done
  1094. done
  1095. _clearup
  1096. _info "Verify finished, start to sign."
  1097. der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _urlencode)"
  1098. _send_signed_request "$API/acme/new-cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"
  1099. Le_LinkCert="$(grep -i -o '^Location.*$' $HTTP_HEADER | head -1 | tr -d "\r\n" | cut -d " " -f 2)"
  1100. _setopt "$DOMAIN_CONF" "Le_LinkCert" "=" "$Le_LinkCert"
  1101. if [[ "$Le_LinkCert" ]] ; then
  1102. echo "$BEGIN_CERT" > "$CERT_PATH"
  1103. _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH"
  1104. echo "$END_CERT" >> "$CERT_PATH"
  1105. _info "Cert success."
  1106. cat "$CERT_PATH"
  1107. _info "Your cert is in $CERT_PATH"
  1108. cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
  1109. if [[ ! "$USER_PATH" ]] || [[ ! "$IN_CRON" ]] ; then
  1110. USER_PATH="$PATH"
  1111. _saveaccountconf "USER_PATH" "$USER_PATH"
  1112. fi
  1113. fi
  1114. if [[ -z "$Le_LinkCert" ]] ; then
  1115. response="$(echo $response | _dbase64 "multiline" )"
  1116. _err "Sign failed: $(echo "$response" | grep -o '"detail":"[^"]*"')"
  1117. return 1
  1118. fi
  1119. _setopt "$DOMAIN_CONF" 'Le_Vlist' '=' "\"\""
  1120. Le_LinkIssuer=$(grep -i '^Link' $HTTP_HEADER | head -1 | cut -d " " -f 2| cut -d ';' -f 1 | tr -d '<>' )
  1121. _setopt "$DOMAIN_CONF" "Le_LinkIssuer" "=" "$Le_LinkIssuer"
  1122. if [[ "$Le_LinkIssuer" ]] ; then
  1123. echo "$BEGIN_CERT" > "$CA_CERT_PATH"
  1124. _get "$Le_LinkIssuer" | _base64 "multiline" >> "$CA_CERT_PATH"
  1125. echo "$END_CERT" >> "$CA_CERT_PATH"
  1126. _info "The intermediate CA cert is in $CA_CERT_PATH"
  1127. cat "$CA_CERT_PATH" >> "$CERT_FULLCHAIN_PATH"
  1128. _info "And the full chain certs is there: $CERT_FULLCHAIN_PATH"
  1129. fi
  1130. Le_CertCreateTime=$(date -u "+%s")
  1131. _setopt "$DOMAIN_CONF" "Le_CertCreateTime" "=" "$Le_CertCreateTime"
  1132. Le_CertCreateTimeStr=$(date -u )
  1133. _setopt "$DOMAIN_CONF" "Le_CertCreateTimeStr" "=" "\"$Le_CertCreateTimeStr\""
  1134. if [[ ! "$Le_RenewalDays" ]] ; then
  1135. Le_RenewalDays=80
  1136. fi
  1137. _setopt "$DOMAIN_CONF" "Le_RenewalDays" "=" "$Le_RenewalDays"
  1138. let "Le_NextRenewTime=Le_CertCreateTime+Le_RenewalDays*24*60*60"
  1139. _setopt "$DOMAIN_CONF" "Le_NextRenewTime" "=" "$Le_NextRenewTime"
  1140. Le_NextRenewTimeStr=$( _time2str $Le_NextRenewTime )
  1141. _setopt "$DOMAIN_CONF" "Le_NextRenewTimeStr" "=" "\"$Le_NextRenewTimeStr\""
  1142. installcert $Le_Domain "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath"
  1143. }
  1144. renew() {
  1145. Le_Domain="$1"
  1146. if [[ -z "$Le_Domain" ]] ; then
  1147. _err "Usage: $PROJECT_ENTRY --renew -d domain.com"
  1148. return 1
  1149. fi
  1150. _initpath $Le_Domain
  1151. if [[ ! -f "$DOMAIN_CONF" ]] ; then
  1152. _info "$Le_Domain is not a issued domain, skip."
  1153. return 0;
  1154. fi
  1155. source "$DOMAIN_CONF"
  1156. if [[ -z "$FORCE" ]] && [[ "$Le_NextRenewTime" ]] && [[ "$(date -u "+%s" )" -lt "$Le_NextRenewTime" ]] ; then
  1157. _info "Skip, Next renewal time is: $Le_NextRenewTimeStr"
  1158. return 2
  1159. fi
  1160. IS_RENEW="1"
  1161. issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath"
  1162. local res=$?
  1163. IS_RENEW=""
  1164. return $res
  1165. }
  1166. renewAll() {
  1167. _initpath
  1168. _info "renewAll"
  1169. for d in $(ls -F ${LE_WORKING_DIR}/ | grep [^.].*[.].*/$ ) ; do
  1170. d=$(echo $d | cut -d '/' -f 1)
  1171. _info "renew $d"
  1172. Le_LinkCert=""
  1173. Le_Domain=""
  1174. Le_Alt="no"
  1175. Le_Webroot=""
  1176. Le_Keylength=""
  1177. Le_LinkIssuer=""
  1178. Le_CertCreateTime=""
  1179. Le_CertCreateTimeStr=""
  1180. Le_RenewalDays=""
  1181. Le_NextRenewTime=""
  1182. Le_NextRenewTimeStr=""
  1183. Le_RealCertPath=""
  1184. Le_RealKeyPath=""
  1185. Le_RealCACertPath=""
  1186. Le_ReloadCmd=""
  1187. Le_RealFullChainPath=""
  1188. DOMAIN_PATH=""
  1189. DOMAIN_CONF=""
  1190. DOMAIN_SSL_CONF=""
  1191. CSR_PATH=""
  1192. CERT_KEY_PATH=""
  1193. CERT_PATH=""
  1194. CA_CERT_PATH=""
  1195. CERT_PFX_PATH=""
  1196. CERT_FULLCHAIN_PATH=""
  1197. ACCOUNT_KEY_PATH=""
  1198. wellknown_path=""
  1199. renew "$d"
  1200. done
  1201. }
  1202. installcert() {
  1203. Le_Domain="$1"
  1204. if [[ -z "$Le_Domain" ]] ; then
  1205. echo "Usage: $PROJECT_ENTRY --installcert -d domain.com [--certpath cert-file-path] [--keypath key-file-path] [--capath ca-cert-file-path] [ --reloadCmd reloadCmd] [--fullchainpath fullchain-path]"
  1206. return 1
  1207. fi
  1208. Le_RealCertPath="$2"
  1209. Le_RealKeyPath="$3"
  1210. Le_RealCACertPath="$4"
  1211. Le_ReloadCmd="$5"
  1212. Le_RealFullChainPath="$6"
  1213. _initpath $Le_Domain
  1214. _setopt "$DOMAIN_CONF" "Le_RealCertPath" "=" "\"$Le_RealCertPath\""
  1215. _setopt "$DOMAIN_CONF" "Le_RealCACertPath" "=" "\"$Le_RealCACertPath\""
  1216. _setopt "$DOMAIN_CONF" "Le_RealKeyPath" "=" "\"$Le_RealKeyPath\""
  1217. _setopt "$DOMAIN_CONF" "Le_ReloadCmd" "=" "\"$Le_ReloadCmd\""
  1218. _setopt "$DOMAIN_CONF" "Le_RealFullChainPath" "=" "\"$Le_RealFullChainPath\""
  1219. if [[ "$Le_RealCertPath" ]] ; then
  1220. if [[ -f "$Le_RealCertPath" ]] ; then
  1221. cp -p "$Le_RealCertPath" "$Le_RealCertPath".bak
  1222. fi
  1223. cat "$CERT_PATH" > "$Le_RealCertPath"
  1224. fi
  1225. if [[ "$Le_RealCACertPath" ]] ; then
  1226. if [[ "$Le_RealCACertPath" == "$Le_RealCertPath" ]] ; then
  1227. echo "" >> "$Le_RealCACertPath"
  1228. cat "$CA_CERT_PATH" >> "$Le_RealCACertPath"
  1229. else
  1230. if [[ -f "$Le_RealCACertPath" ]] ; then
  1231. cp -p "$Le_RealCACertPath" "$Le_RealCACertPath".bak
  1232. fi
  1233. cat "$CA_CERT_PATH" > "$Le_RealCACertPath"
  1234. fi
  1235. fi
  1236. if [[ "$Le_RealKeyPath" ]] ; then
  1237. if [[ -f "$Le_RealKeyPath" ]] ; then
  1238. cp -p "$Le_RealKeyPath" "$Le_RealKeyPath".bak
  1239. fi
  1240. cat "$CERT_KEY_PATH" > "$Le_RealKeyPath"
  1241. fi
  1242. if [[ "$Le_RealFullChainPath" ]] ; then
  1243. if [[ -f "$Le_RealFullChainPath" ]] ; then
  1244. cp -p "$Le_RealFullChainPath" "$Le_RealFullChainPath".bak
  1245. fi
  1246. cat "$CERT_FULLCHAIN_PATH" > "$Le_RealFullChainPath"
  1247. fi
  1248. if [[ "$Le_ReloadCmd" ]] ; then
  1249. _info "Run Le_ReloadCmd: $Le_ReloadCmd"
  1250. (cd "$DOMAIN_PATH" && eval "$Le_ReloadCmd")
  1251. fi
  1252. }
  1253. installcronjob() {
  1254. _initpath
  1255. if ! _exists "crontab" ; then
  1256. _err "crontab doesn't exist, so, we can not install cron jobs."
  1257. _err "All your certs will not be renewed automatically."
  1258. _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
  1259. return 1
  1260. fi
  1261. _info "Installing cron job"
  1262. if ! crontab -l | grep "$PROJECT_ENTRY --cron" ; then
  1263. if [[ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]] ; then
  1264. lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
  1265. else
  1266. _err "Can not install cronjob, $PROJECT_ENTRY not found."
  1267. return 1
  1268. fi
  1269. crontab -l | { cat; echo "0 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"; } | crontab -
  1270. fi
  1271. if [[ "$?" != "0" ]] ; then
  1272. _err "Install cron job failed. You need to manually renew your certs."
  1273. _err "Or you can add cronjob by yourself:"
  1274. _err "$lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"
  1275. return 1
  1276. fi
  1277. }
  1278. uninstallcronjob() {
  1279. if ! _exists "crontab" ; then
  1280. return
  1281. fi
  1282. _info "Removing cron job"
  1283. cr="$(crontab -l | grep "$PROJECT_ENTRY --cron")"
  1284. if [[ "$cr" ]] ; then
  1285. crontab -l | sed "/$PROJECT_ENTRY --cron/d" | crontab -
  1286. LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 9 | tr -d '"')"
  1287. _info LE_WORKING_DIR "$LE_WORKING_DIR"
  1288. fi
  1289. _initpath
  1290. }
  1291. revoke() {
  1292. Le_Domain="$1"
  1293. if [[ -z "$Le_Domain" ]] ; then
  1294. echo "Usage: $PROJECT_ENTRY --revoke -d domain.com"
  1295. return 1
  1296. fi
  1297. _initpath $Le_Domain
  1298. if [[ ! -f "$DOMAIN_CONF" ]] ; then
  1299. _err "$Le_Domain is not a issued domain, skip."
  1300. return 1;
  1301. fi
  1302. if [[ ! -f "$CERT_PATH" ]] ; then
  1303. _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
  1304. return 1
  1305. fi
  1306. cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}"| tr -d "\r\n" | _urlencode)"
  1307. if [[ -z "$cert" ]] ; then
  1308. _err "Cert for $Le_Domain is empty found, skip."
  1309. return 1
  1310. fi
  1311. data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
  1312. uri="$API/acme/revoke-cert"
  1313. _info "Try domain key first."
  1314. if _send_signed_request $uri "$data" "" "$CERT_KEY_PATH"; then
  1315. if [[ -z "$response" ]] ; then
  1316. _info "Revoke success."
  1317. rm -f $CERT_PATH
  1318. return 0
  1319. else
  1320. _err "Revoke error by domain key."
  1321. _err "$resource"
  1322. fi
  1323. fi
  1324. _info "Then try account key."
  1325. if _send_signed_request $uri "$data" "" "$ACCOUNT_KEY_PATH" ; then
  1326. if [[ -z "$response" ]] ; then
  1327. _info "Revoke success."
  1328. rm -f $CERT_PATH
  1329. return 0
  1330. else
  1331. _err "Revoke error."
  1332. _debug "$resource"
  1333. fi
  1334. fi
  1335. return 1
  1336. }
  1337. # Detect profile file if not specified as environment variable
  1338. _detect_profile() {
  1339. if [ -n "$PROFILE" -a -f "$PROFILE" ] ; then
  1340. echo "$PROFILE"
  1341. return
  1342. fi
  1343. local DETECTED_PROFILE
  1344. DETECTED_PROFILE=''
  1345. local SHELLTYPE
  1346. SHELLTYPE="$(basename "/$SHELL")"
  1347. if [[ "$SHELLTYPE" = "bash" ]] ; then
  1348. if [[ -f "$HOME/.bashrc" ]] ; then
  1349. DETECTED_PROFILE="$HOME/.bashrc"
  1350. elif [[ -f "$HOME/.bash_profile" ]] ; then
  1351. DETECTED_PROFILE="$HOME/.bash_profile"
  1352. fi
  1353. elif [[ "$SHELLTYPE" = "zsh" ]] ; then
  1354. DETECTED_PROFILE="$HOME/.zshrc"
  1355. fi
  1356. if [[ -z "$DETECTED_PROFILE" ]] ; then
  1357. if [[ -f "$HOME/.profile" ]] ; then
  1358. DETECTED_PROFILE="$HOME/.profile"
  1359. elif [[ -f "$HOME/.bashrc" ]] ; then
  1360. DETECTED_PROFILE="$HOME/.bashrc"
  1361. elif [[ -f "$HOME/.bash_profile" ]] ; then
  1362. DETECTED_PROFILE="$HOME/.bash_profile"
  1363. elif [[ -f "$HOME/.zshrc" ]] ; then
  1364. DETECTED_PROFILE="$HOME/.zshrc"
  1365. fi
  1366. fi
  1367. if [[ ! -z "$DETECTED_PROFILE" ]] ; then
  1368. echo "$DETECTED_PROFILE"
  1369. fi
  1370. }
  1371. _initconf() {
  1372. _initpath
  1373. if [[ ! -f "$ACCOUNT_CONF_PATH" ]] ; then
  1374. echo "#ACCOUNT_CONF_PATH=xxxx
  1375. #Account configurations:
  1376. #Here are the supported macros, uncomment them to make them take effect.
  1377. #ACCOUNT_EMAIL=aaa@aaa.com # the account email used to register account.
  1378. #ACCOUNT_KEY_PATH=\"/path/to/account.key\"
  1379. #STAGE=1 # Use the staging api
  1380. #FORCE=1 # Force to issue cert
  1381. #DEBUG=1 # Debug mode
  1382. #ACCOUNT_KEY_HASH=account key hash
  1383. USER_AGENT=\"$DEFAULT_USER_AGENT\"
  1384. #USER_PATH=""
  1385. #dns api
  1386. #######################
  1387. #Cloudflare:
  1388. #api key
  1389. #CF_Key=\"sdfsdfsdfljlbjkljlkjsdfoiwje\"
  1390. #account email
  1391. #CF_Email=\"xxxx@sss.com\"
  1392. #######################
  1393. #Dnspod.cn:
  1394. #api key id
  1395. #DP_Id=\"1234\"
  1396. #api key
  1397. #DP_Key=\"sADDsdasdgdsf\"
  1398. #######################
  1399. #Cloudxns.com:
  1400. #CX_Key=\"1234\"
  1401. #
  1402. #CX_Secret=\"sADDsdasdgdsf\"
  1403. " > $ACCOUNT_CONF_PATH
  1404. fi
  1405. }
  1406. _precheck() {
  1407. if ! _exists "curl" && ! _exists "wget"; then
  1408. _err "Please install curl or wget first, we need to access http resources."
  1409. return 1
  1410. fi
  1411. if ! _exists "crontab" ; then
  1412. _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
  1413. _err "We need to set cron job to renew the certs automatically."
  1414. _err "Otherwise, your certs will not be able to be renewed automatically."
  1415. if [[ -z "$FORCE" ]] ; then
  1416. _err "Please add '--force' and try install again to go without crontab."
  1417. _err "./$PROJECT_ENTRY --install --force"
  1418. return 1
  1419. fi
  1420. fi
  1421. if ! _exists "openssl" ; then
  1422. _err "Please install openssl first."
  1423. _err "We need openssl to generate keys."
  1424. return 1
  1425. fi
  1426. if ! _exists "nc" ; then
  1427. _err "It is recommended to install nc first, try to install 'nc' or 'netcat'."
  1428. _err "We use nc for standalone server if you use standalone mode."
  1429. _err "If you don't use standalone mode, just ignore this warning."
  1430. fi
  1431. return 0
  1432. }
  1433. install() {
  1434. if ! _initpath ; then
  1435. _err "Install failed."
  1436. return 1
  1437. fi
  1438. if ! _precheck ; then
  1439. _err "Pre-check failed, can not install."
  1440. return 1
  1441. fi
  1442. _info "Installing to $LE_WORKING_DIR"
  1443. if ! mkdir -p "$LE_WORKING_DIR" ; then
  1444. _err "Can not craete working dir: $LE_WORKING_DIR"
  1445. return 1
  1446. fi
  1447. cp $PROJECT_ENTRY "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
  1448. if [[ "$?" != "0" ]] ; then
  1449. _err "Install failed, can not copy $PROJECT_ENTRY"
  1450. return 1
  1451. fi
  1452. _info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
  1453. _profile="$(_detect_profile)"
  1454. if [[ "$_profile" ]] ; then
  1455. _debug "Found profile: $_profile"
  1456. echo "LE_WORKING_DIR=$LE_WORKING_DIR
  1457. alias le=\"$LE_WORKING_DIR/$PROJECT_ENTRY\"
  1458. alias $PROJECT_ENTRY=\"$LE_WORKING_DIR/$PROJECT_ENTRY\"
  1459. " > "$LE_WORKING_DIR/$PROJECT_ENTRY.env"
  1460. echo "" >> "$_profile"
  1461. _setopt "$_profile" "source \"$LE_WORKING_DIR/$PROJECT_NAME.env\""
  1462. _info "OK, Close and reopen your terminal to start using $PROJECT_NAME"
  1463. else
  1464. _info "No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME"
  1465. fi
  1466. mkdir -p $LE_WORKING_DIR/dnsapi
  1467. cp dnsapi/* $LE_WORKING_DIR/dnsapi/
  1468. #to keep compatible mv the .acc file to .key file
  1469. if [[ -f "$LE_WORKING_DIR/account.acc" ]] ; then
  1470. mv "$LE_WORKING_DIR/account.acc" "$LE_WORKING_DIR/account.key"
  1471. fi
  1472. if [[ ! -f "$ACCOUNT_CONF_PATH" ]] ; then
  1473. _initconf
  1474. fi
  1475. _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
  1476. _setopt "$ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
  1477. installcronjob
  1478. _info OK
  1479. }
  1480. uninstall() {
  1481. uninstallcronjob
  1482. _initpath
  1483. _profile="$(_detect_profile)"
  1484. if [[ "$_profile" ]] ; then
  1485. text="$(cat $_profile)"
  1486. echo "$text" | sed "s|^source.*$PROJECT_NAME.env.*$||" > "$_profile"
  1487. fi
  1488. rm -f $LE_WORKING_DIR/$PROJECT_ENTRY
  1489. _info "The keys and certs are in $LE_WORKING_DIR, you can remove them by yourself."
  1490. }
  1491. cron() {
  1492. IN_CRON=1
  1493. renewAll
  1494. IN_CRON=""
  1495. }
  1496. version() {
  1497. echo "$PROJECT"
  1498. echo "v$VER"
  1499. }
  1500. showhelp() {
  1501. version
  1502. echo "Usage: $PROJECT_ENTRY command ...[parameters]....
  1503. Commands:
  1504. --help, -h Show this help message.
  1505. --version, -v Show version info.
  1506. --install Install $PROJECT_NAME to your system.
  1507. --uninstall Uninstall $PROJECT_NAME, and uninstall the cron job.
  1508. --issue Issue a cert.
  1509. --installcert Install the issued cert to apache/nginx or any other server.
  1510. --renew, -r Renew a cert.
  1511. --renewAll Renew all the certs
  1512. --revoke Revoke a cert.
  1513. --installcronjob Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
  1514. --uninstallcronjob Uninstall the cron job. The 'uninstall' command can do this automatically.
  1515. --cron Run cron job to renew all the certs.
  1516. --toPkcs Export the certificate and key to a pfx file.
  1517. --createAccountKey, -cak Create an account private key, professional use.
  1518. --createDomainKey, -cdk Create an domain private key, professional use.
  1519. --createCSR, -ccsr Create CSR , professional use.
  1520. Parameters:
  1521. --domain, -d domain.tld Specifies a domain, used to issue, renew or revoke etc.
  1522. --force, -f Used to force to install or force to renew a cert immediately.
  1523. --staging, --test Use staging server, just for test.
  1524. --debug Output debug info.
  1525. --webroot, -w /path/to/webroot Specifies the web root folder for web root mode.
  1526. --standalone Use standalone mode.
  1527. --apache Use apache mode.
  1528. --dns [dns-cf|dns-dp|dns-cx|/path/to/api/file] Use dns mode or dns api.
  1529. --keylength, -k [2048] Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
  1530. --accountkeylength, -ak [2048] Specifies the account key length.
  1531. These parameters are to install the cert to nginx/apache or anyother server after issue/renew a cert:
  1532. --certpath /path/to/real/cert/file After issue/renew, the cert will be copied to this path.
  1533. --keypath /path/to/real/key/file After issue/renew, the key will be copied to this path.
  1534. --capath /path/to/real/ca/file After issue/renew, the intermediate cert will be copied to this path.
  1535. --fullchainpath /path/to/fullchain/file After issue/renew, the fullchain cert will be copied to this path.
  1536. --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
  1537. --accountconf Specifies a customized account config file.
  1538. --home Specifies the home dir for $PROJECT_NAME
  1539. "
  1540. }
  1541. _installOnline() {
  1542. _info "Installing from online archive."
  1543. if [[ ! "$BRANCH" ]] ; then
  1544. BRANCH="master"
  1545. fi
  1546. _initpath
  1547. target="$PROJECT/archive/$BRANCH.tar.gz"
  1548. _info "Downloading $target"
  1549. localname="$BRANCH.tar.gz"
  1550. if ! _get "$target" > $localname ; then
  1551. _debug "Download error."
  1552. return 1
  1553. fi
  1554. _info "Extracting $localname"
  1555. tar xzf $localname
  1556. cd "le-$BRANCH"
  1557. chmod +x $PROJECT_ENTRY
  1558. if ./$PROJECT_ENTRY install ; then
  1559. _info "Install success!"
  1560. fi
  1561. cd ..
  1562. rm -rf "le-$BRANCH"
  1563. rm -f "$localname"
  1564. }
  1565. _process() {
  1566. _CMD=""
  1567. _domain=""
  1568. _altdomains="no"
  1569. _webroot=""
  1570. _keylength="no"
  1571. _accountkeylength="no"
  1572. _certpath="no"
  1573. _keypath="no"
  1574. _capath="no"
  1575. _fullchainpath="no"
  1576. _reloadcmd="no"
  1577. _password=""
  1578. while (( ${#} )); do
  1579. case "${1}" in
  1580. --help|-h)
  1581. showhelp
  1582. return
  1583. ;;
  1584. --version|-v)
  1585. version
  1586. return
  1587. ;;
  1588. --install)
  1589. _CMD="install"
  1590. ;;
  1591. --uninstall)
  1592. _CMD="uninstall"
  1593. ;;
  1594. --issue)
  1595. _CMD="issue"
  1596. ;;
  1597. --installcert|-i)
  1598. _CMD="installcert"
  1599. ;;
  1600. --renew|-r)
  1601. _CMD="renew"
  1602. ;;
  1603. --renewAll|-renewall)
  1604. _CMD="renewAll"
  1605. ;;
  1606. --revoke)
  1607. _CMD="revoke"
  1608. ;;
  1609. --installcronjob)
  1610. _CMD="installcronjob"
  1611. ;;
  1612. --uninstallcronjob)
  1613. _CMD="uninstallcronjob"
  1614. ;;
  1615. --cron)
  1616. _CMD="cron"
  1617. ;;
  1618. --toPkcs)
  1619. _CMD="toPkcs"
  1620. ;;
  1621. --createAccountKey|--createaccountkey|-cak)
  1622. _CMD="createAccountKey"
  1623. ;;
  1624. --createDomainKey|--createdomainkey|-cdk)
  1625. _CMD="createDomainKey"
  1626. ;;
  1627. --createCSR|--createcsr|-ccr)
  1628. _CMD="createCSR"
  1629. ;;
  1630. --domain|-d)
  1631. _dvalue="$2"
  1632. if [[ -z "$_dvalue" ]] || [[ "$_dvalue" == "-"* ]] ; then
  1633. _err "'$_dvalue' is not a valid domain for parameter '$1'"
  1634. return 1
  1635. fi
  1636. if [[ -z "$_domain" ]] ; then
  1637. _domain="$_dvalue"
  1638. else
  1639. if [[ "$_altdomains" == "no" ]] ; then
  1640. _altdomains="$_dvalue"
  1641. else
  1642. _altdomains="$_altdomains,$_dvalue"
  1643. fi
  1644. fi
  1645. shift
  1646. ;;
  1647. --force|-f)
  1648. FORCE="1"
  1649. ;;
  1650. --staging|--test)
  1651. STAGE="1"
  1652. ;;
  1653. --debug)
  1654. if [[ "$2" == "-"* ]] || [[ -z "$2" ]]; then
  1655. DEBUG="1"
  1656. else
  1657. DEBUG="$2"
  1658. shift
  1659. fi
  1660. ;;
  1661. --webroot|-w)
  1662. wvalue="$2"
  1663. if [[ -z "$_webroot" ]] ; then
  1664. _webroot="$wvalue"
  1665. else
  1666. _webroot="$_webroot,$wvalue"
  1667. fi
  1668. shift
  1669. ;;
  1670. --standalone)
  1671. wvalue="no"
  1672. if [[ -z "$_webroot" ]] ; then
  1673. _webroot="$wvalue"
  1674. else
  1675. _webroot="$_webroot,$wvalue"
  1676. fi
  1677. ;;
  1678. --apache)
  1679. wvalue="apache"
  1680. if [[ -z "$_webroot" ]] ; then
  1681. _webroot="$wvalue"
  1682. else
  1683. _webroot="$_webroot,$wvalue"
  1684. fi
  1685. ;;
  1686. --dns)
  1687. wvalue="dns"
  1688. if [[ "$2" != "-"* ]] ; then
  1689. wvalue="$2"
  1690. shift
  1691. fi
  1692. if [[ -z "$_webroot" ]] ; then
  1693. _webroot="$wvalue"
  1694. else
  1695. _webroot="$_webroot,$wvalue"
  1696. fi
  1697. ;;
  1698. --keylength|-k)
  1699. _keylength="$2"
  1700. accountkeylength="$2"
  1701. shift
  1702. ;;
  1703. --accountkeylength|-ak)
  1704. accountkeylength="$2"
  1705. shift
  1706. ;;
  1707. --certpath)
  1708. _certpath="$2"
  1709. shift
  1710. ;;
  1711. --keypath)
  1712. _keypath="$2"
  1713. shift
  1714. ;;
  1715. --capath)
  1716. _capath="$2"
  1717. shift
  1718. ;;
  1719. --fullchainpath)
  1720. _fullchainpath="$2"
  1721. shift
  1722. ;;
  1723. --reloadcmd)
  1724. _reloadcmd="$2"
  1725. shift
  1726. ;;
  1727. --password)
  1728. _password="$2"
  1729. shift
  1730. ;;
  1731. --accountconf)
  1732. ACCOUNT_CONF_PATH="$2"
  1733. shift
  1734. ;;
  1735. --home)
  1736. LE_WORKING_DIR="$2"
  1737. shift
  1738. ;;
  1739. *)
  1740. _err "Unknown parameter : $1"
  1741. return 1
  1742. ;;
  1743. esac
  1744. shift 1
  1745. done
  1746. case "${_CMD}" in
  1747. install) install ;;
  1748. uninstall) uninstall ;;
  1749. issue)
  1750. issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_certpath" "$_keylength" "$_capath" "$_reloadcmd" "$_fullchainpath"
  1751. ;;
  1752. installcert)
  1753. installcert "$_domain" "$_certpath" "$_keypath" "$_capath" "$_reloadcmd" "$_fullchainpath"
  1754. ;;
  1755. renew)
  1756. renew "$_domain"
  1757. ;;
  1758. renewAll)
  1759. renewAll
  1760. ;;
  1761. revoke)
  1762. revoke "$_domain"
  1763. ;;
  1764. installcronjob) installcronjob ;;
  1765. uninstallcronjob) uninstallcronjob ;;
  1766. cron) cron ;;
  1767. toPkcs)
  1768. toPkcs "$_domain" "$_password"
  1769. ;;
  1770. createAccountKey)
  1771. createAccountKey "$_domain" "$_accountkeylength"
  1772. ;;
  1773. createDomainKey)
  1774. createDomainKey "$_domain" "$_keylength"
  1775. ;;
  1776. createCSR)
  1777. createCSR "$_domain" "$_altdomains"
  1778. ;;
  1779. *)
  1780. _err "Invalid command: $_CMD"
  1781. showhelp;
  1782. return 1
  1783. ;;
  1784. esac
  1785. }
  1786. if [[ "$INSTALLONLINE" ]] ; then
  1787. INSTALLONLINE=""
  1788. _installOnline $BRANCH
  1789. exit
  1790. fi
  1791. if [[ -z "$1" ]] ; then
  1792. showhelp
  1793. else
  1794. if [[ "$1" == "-"* ]] ; then
  1795. _process "$@"
  1796. else
  1797. "$@"
  1798. fi
  1799. fi