You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

2132 lines
53 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. #!/usr/bin/env bash
  2. VER=2.0.0
  3. PROJECT="https://github.com/Neilpang/le"
  4. DEFAULT_CA="https://acme-v01.api.letsencrypt.org"
  5. DEFAULT_AGREEMENT="https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf"
  6. DEFAULT_USER_AGENT="le.sh client: $PROJECT"
  7. STAGE_CA="https://acme-staging.api.letsencrypt.org"
  8. VTYPE_HTTP="http-01"
  9. VTYPE_DNS="dns-01"
  10. BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  11. END_CSR="-----END CERTIFICATE REQUEST-----"
  12. BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  13. END_CERT="-----END CERTIFICATE-----"
  14. if [[ -z "$AGREEMENT" ]] ; then
  15. AGREEMENT="$DEFAULT_AGREEMENT"
  16. fi
  17. _info() {
  18. if [[ -z "$2" ]] ; then
  19. echo "[$(date)] $1"
  20. else
  21. echo "[$(date)] $1"="'$2'"
  22. fi
  23. }
  24. _err() {
  25. _info "$@" >&2
  26. return 1
  27. }
  28. _debug() {
  29. if [[ -z "$DEBUG" ]] ; then
  30. return
  31. fi
  32. _err "$@"
  33. return 0
  34. }
  35. _debug2() {
  36. if [[ "$DEBUG" -ge "2" ]] ; then
  37. _debug "$@"
  38. fi
  39. return
  40. }
  41. _exists() {
  42. cmd="$1"
  43. if [[ -z "$cmd" ]] ; then
  44. _err "Usage: _exists cmd"
  45. return 1
  46. fi
  47. command -v $cmd >/dev/null 2>&1
  48. ret="$?"
  49. _debug2 "$cmd exists=$ret"
  50. return $ret
  51. }
  52. _h2b() {
  53. hex=$(cat)
  54. i=1
  55. j=2
  56. while [ '1' ] ; do
  57. h=$(printf $hex | cut -c $i-$j)
  58. if [[ -z "$h" ]] ; then
  59. break;
  60. fi
  61. printf "\x$h"
  62. let "i+=2"
  63. let "j+=2"
  64. done
  65. }
  66. #options file
  67. _sed_i() {
  68. options="$1"
  69. filename="$2"
  70. if [[ -z "$filename" ]] ; then
  71. _err "Usage:_sed_i options filename"
  72. return 1
  73. fi
  74. if sed -h 2>&1 | grep "\-i[SUFFIX]" ; then
  75. _debug "Using sed -i"
  76. sed -i ""
  77. else
  78. _debug "No -i support in sed"
  79. text="$(cat $filename)"
  80. echo "$text" | sed "$options" > "$filename"
  81. fi
  82. }
  83. #Usage: file startline endline
  84. _getfile() {
  85. filename="$1"
  86. startline="$2"
  87. endline="$3"
  88. if [[ -z "$endline" ]] ; then
  89. _err "Usage: file startline endline"
  90. return 1
  91. fi
  92. i="$(grep -n -- "$startline" $filename | cut -d : -f 1)"
  93. if [[ -z "$i" ]] ; then
  94. _err "Can not find start line: $startline"
  95. return 1
  96. fi
  97. let "i+=1"
  98. _debug i $i
  99. j="$(grep -n -- "$endline" $filename | cut -d : -f 1)"
  100. if [[ -z "$j" ]] ; then
  101. _err "Can not find end line: $endline"
  102. return 1
  103. fi
  104. let "j-=1"
  105. _debug j $j
  106. sed -n $i,${j}p "$filename"
  107. }
  108. #Usage: multiline
  109. _base64() {
  110. if [[ "$1" ]] ; then
  111. openssl base64 -e
  112. else
  113. openssl base64 -e | tr -d '\r\n'
  114. fi
  115. }
  116. #Usage: multiline
  117. _dbase64() {
  118. if [[ "$1" ]] ; then
  119. openssl base64 -d -A
  120. else
  121. openssl base64 -d
  122. fi
  123. }
  124. #Usage: hashalg
  125. #Output Base64-encoded digest
  126. _digest() {
  127. alg="$1"
  128. if [[ -z "$alg" ]] ; then
  129. _err "Usage: _digest hashalg"
  130. return 1
  131. fi
  132. if [[ "$alg" == "sha256" ]] ; then
  133. openssl dgst -sha256 -binary | _base64
  134. else
  135. _err "$alg is not supported yet"
  136. return 1
  137. fi
  138. }
  139. #Usage: keyfile hashalg
  140. #Output: Base64-encoded signature value
  141. _sign() {
  142. keyfile="$1"
  143. alg="$2"
  144. if [[ -z "$alg" ]] ; then
  145. _err "Usage: _sign keyfile hashalg"
  146. return 1
  147. fi
  148. if [[ "$alg" == "sha256" ]] ; then
  149. openssl dgst -sha256 -sign "$keyfile" | _base64
  150. else
  151. _err "$alg is not supported yet"
  152. return 1
  153. fi
  154. }
  155. _ss() {
  156. _port="$1"
  157. if _exists "ss" ; then
  158. _debug "Using: ss"
  159. ss -ntpl | grep :$_port" "
  160. return 0
  161. fi
  162. if _exists "netstat" ; then
  163. _debug "Using: netstat"
  164. if netstat -h 2>&1 | grep "\-p proto" >/dev/null ; then
  165. #for windows version netstat tool
  166. netstat -anb -p tcp | grep "LISTENING" | grep :$_port" "
  167. else
  168. if netstat -help 2>&1 | grep "\-p protocol" >/dev/null ; then
  169. netstat -an -p tcp | grep LISTEN | grep :$_port" "
  170. else
  171. netstat -ntpl | grep :$_port" "
  172. fi
  173. fi
  174. return 0
  175. fi
  176. return 1
  177. }
  178. toPkcs() {
  179. domain="$1"
  180. pfxPassword="$2"
  181. if [[ -z "$domain" ]] ; then
  182. echo "Usage: le.sh --toPkcs -d domain [--password pfx-password]"
  183. return 1
  184. fi
  185. _initpath "$domain"
  186. if [[ "$pfxPassword" ]] ; then
  187. openssl pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH" -password "pass:$pfxPassword"
  188. else
  189. openssl pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH"
  190. fi
  191. if [[ "$?" == "0" ]] ; then
  192. _info "Success, Pfx is exported to: $CERT_PFX_PATH"
  193. fi
  194. }
  195. #domain [2048]
  196. createAccountKey() {
  197. _info "Creating account key"
  198. if [[ -z "$1" ]] ; then
  199. echo Usage: le.sh --createAccountKey -d domain.com [--accountkeylength 2048]
  200. return
  201. fi
  202. account=$1
  203. length=$2
  204. if [[ "$length" == "ec-"* ]] ; then
  205. length=2048
  206. fi
  207. if [[ -z "$2" ]] ; then
  208. _info "Use default length 2048"
  209. length=2048
  210. fi
  211. _initpath
  212. if [[ -f "$ACCOUNT_KEY_PATH" ]] ; then
  213. _info "Account key exists, skip"
  214. return
  215. else
  216. #generate account key
  217. openssl genrsa $length 2>/dev/null > "$ACCOUNT_KEY_PATH"
  218. fi
  219. }
  220. #domain length
  221. createDomainKey() {
  222. _info "Creating domain key"
  223. if [[ -z "$1" ]] ; then
  224. echo Usage: le.sh --createDomainKey -d domain.com [ --keylength 2048 ]
  225. return
  226. fi
  227. domain=$1
  228. length=$2
  229. isec=""
  230. if [[ "$length" == "ec-"* ]] ; then
  231. isec="1"
  232. length=$(printf $length | cut -d '-' -f 2-100)
  233. eccname="$length"
  234. fi
  235. if [[ -z "$length" ]] ; then
  236. if [[ "$isec" ]] ; then
  237. length=256
  238. else
  239. length=2048
  240. fi
  241. fi
  242. _info "Use length $length"
  243. if [[ "$isec" ]] ; then
  244. if [[ "$length" == "256" ]] ; then
  245. eccname="prime256v1"
  246. fi
  247. if [[ "$length" == "384" ]] ; then
  248. eccname="secp384r1"
  249. fi
  250. if [[ "$length" == "521" ]] ; then
  251. eccname="secp521r1"
  252. fi
  253. _info "Using ec name: $eccname"
  254. fi
  255. _initpath $domain
  256. if [[ ! -f "$CERT_KEY_PATH" ]] || ( [[ "$FORCE" ]] && ! [[ "$IS_RENEW" ]] ); then
  257. #generate account key
  258. if [[ "$isec" ]] ; then
  259. openssl ecparam -name $eccname -genkey 2>/dev/null > "$CERT_KEY_PATH"
  260. else
  261. openssl genrsa $length 2>/dev/null > "$CERT_KEY_PATH"
  262. fi
  263. else
  264. if [[ "$IS_RENEW" ]] ; then
  265. _info "Domain key exists, skip"
  266. return 0
  267. else
  268. _err "Domain key exists, do you want to overwrite the key?"
  269. _err "Set FORCE=1, and try again."
  270. return 1
  271. fi
  272. fi
  273. }
  274. # domain domainlist
  275. createCSR() {
  276. _info "Creating csr"
  277. if [[ -z "$1" ]] ; then
  278. echo Usage: le.sh --createCSR -d domain1.com [-d domain2.com -d domain3.com ... ]
  279. return
  280. fi
  281. domain=$1
  282. _initpath $domain
  283. domainlist=$2
  284. if [[ -f "$CSR_PATH" ]] && [[ "$IS_RENEW" ]] && [[ -z "$FORCE" ]]; then
  285. _info "CSR exists, skip"
  286. return
  287. fi
  288. if [[ -z "$domainlist" ]] || [[ "$domainlist" == "no" ]]; then
  289. #single domain
  290. _info "Single domain" $domain
  291. printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\n" > "$DOMAIN_SSL_CONF"
  292. openssl req -new -sha256 -key "$CERT_KEY_PATH" -subj "/CN=$domain" -config "$DOMAIN_SSL_CONF" -out "$CSR_PATH"
  293. else
  294. alt="DNS:$(echo $domainlist | sed "s/,/,DNS:/g")"
  295. #multi
  296. _info "Multi domain" "$alt"
  297. printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\n[SAN]\nsubjectAltName=$alt" > "$DOMAIN_SSL_CONF"
  298. openssl req -new -sha256 -key "$CERT_KEY_PATH" -subj "/CN=$domain" -reqexts SAN -config "$DOMAIN_SSL_CONF" -out "$CSR_PATH"
  299. fi
  300. }
  301. _urlencode() {
  302. __n=$(cat)
  303. echo $__n | tr '/+' '_-' | tr -d '= '
  304. }
  305. _time2str() {
  306. #BSD
  307. if date -u -d@$1 2>/dev/null ; then
  308. return
  309. fi
  310. #Linux
  311. if date -u -r $1 2>/dev/null ; then
  312. return
  313. fi
  314. }
  315. _stat() {
  316. #Linux
  317. if stat -c '%U:%G' "$1" 2>/dev/null ; then
  318. return
  319. fi
  320. #BSD
  321. if stat -f '%Su:%Sg' "$1" 2>/dev/null ; then
  322. return
  323. fi
  324. }
  325. #keyfile
  326. _calcjwk() {
  327. keyfile="$1"
  328. if [[ -z "$keyfile" ]] ; then
  329. _err "Usage: _calcjwk keyfile"
  330. return 1
  331. fi
  332. EC_SIGN=""
  333. if grep "BEGIN RSA PRIVATE KEY" "$keyfile" > /dev/null 2>&1 ; then
  334. _debug "RSA key"
  335. pub_exp=$(openssl rsa -in $keyfile -noout -text | grep "^publicExponent:"| cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
  336. if [[ "${#pub_exp}" == "5" ]] ; then
  337. pub_exp=0$pub_exp
  338. fi
  339. _debug2 pub_exp "$pub_exp"
  340. e=$(echo $pub_exp | _h2b | _base64)
  341. _debug2 e "$e"
  342. modulus=$(openssl rsa -in $keyfile -modulus -noout | cut -d '=' -f 2 )
  343. n=$(echo $modulus| _h2b | _base64 | _urlencode )
  344. jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
  345. _debug2 jwk "$jwk"
  346. HEADER='{"alg": "RS256", "jwk": '$jwk'}'
  347. HEADERPLACE='{"nonce": "NONCE", "alg": "RS256", "jwk": '$jwk'}'
  348. elif grep "BEGIN EC PRIVATE KEY" "$keyfile" > /dev/null 2>&1 ; then
  349. _debug "EC key"
  350. EC_SIGN="1"
  351. crv="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
  352. _debug2 crv $crv
  353. pubi="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
  354. _debug2 pubi $pubi
  355. let "pubi=pubi+1"
  356. pubj="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
  357. _debug2 pubj $pubj
  358. let "pubj=pubj-1"
  359. pubtext="$(openssl ec -in $keyfile -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
  360. _debug2 pubtext "$pubtext"
  361. xlen="$(printf "$pubtext" | tr -d ':' | wc -c)"
  362. let "xlen=xlen/4"
  363. _debug2 xlen $xlen
  364. let "xend=xlen+1"
  365. x="$(printf $pubtext | cut -d : -f 2-$xend)"
  366. _debug2 x $x
  367. x64="$(printf $x | tr -d : | _h2b | _base64 | _urlencode)"
  368. _debug2 x64 $x64
  369. let "xend+=1"
  370. y="$(printf $pubtext | cut -d : -f $xend-10000)"
  371. _debug2 y $y
  372. y64="$(printf $y | tr -d : | _h2b | _base64 | _urlencode)"
  373. _debug2 y64 $y64
  374. jwk='{"kty": "EC", "crv": "'$crv'", "x": "'$x64'", "y": "'$y64'"}'
  375. _debug2 jwk "$jwk"
  376. HEADER='{"alg": "ES256", "jwk": '$jwk'}'
  377. HEADERPLACE='{"nonce": "NONCE", "alg": "ES256", "jwk": '$jwk'}'
  378. else
  379. _err "Only RSA or EC key is supported."
  380. return 1
  381. fi
  382. _debug2 HEADER "$HEADER"
  383. }
  384. # body url [needbase64]
  385. _post() {
  386. body="$1"
  387. url="$2"
  388. needbase64="$3"
  389. if _exists "curl" ; then
  390. CURL="$CURL --dump-header $HTTP_HEADER "
  391. if [[ "$needbase64" ]] ; then
  392. response="$($CURL -A "User-Agent: $USER_AGENT" -X POST --data "$body" $url | _base64)"
  393. else
  394. response="$($CURL -A "User-Agent: $USER_AGENT" -X POST --data "$body" $url)"
  395. fi
  396. else
  397. if [[ "$needbase64" ]] ; then
  398. response="$($WGET -S -O - --user-agent="$USER_AGENT" --post-data="$body" $url 2>"$HTTP_HEADER" | _base64)"
  399. else
  400. response="$($WGET -S -O - --user-agent="$USER_AGENT" --post-data="$body" $url 2>"$HTTP_HEADER")"
  401. fi
  402. _sed_i "s/^ *//g" "$HTTP_HEADER"
  403. fi
  404. echo -n "$response"
  405. }
  406. # url getheader
  407. _get() {
  408. url="$1"
  409. onlyheader="$2"
  410. _debug url $url
  411. if _exists "curl" ; then
  412. if [[ "$onlyheader" ]] ; then
  413. $CURL -I -A "User-Agent: $USER_AGENT" $url
  414. else
  415. $CURL -A "User-Agent: $USER_AGENT" $url
  416. fi
  417. else
  418. _debug "WGET" "$WGET"
  419. if [[ "$onlyheader" ]] ; then
  420. eval $WGET --user-agent=\"$USER_AGENT\" -S -O /dev/null $url 2>&1 | sed 's/^[ ]*//g'
  421. else
  422. eval $WGET --user-agent=\"$USER_AGENT\" -O - $url
  423. fi
  424. fi
  425. ret=$?
  426. return $ret
  427. }
  428. # url payload needbase64 keyfile
  429. _send_signed_request() {
  430. url=$1
  431. payload=$2
  432. needbase64=$3
  433. keyfile=$4
  434. if [[ -z "$keyfile" ]] ; then
  435. keyfile="$ACCOUNT_KEY_PATH"
  436. fi
  437. _debug url $url
  438. _debug payload "$payload"
  439. if ! _calcjwk "$keyfile" ; then
  440. return 1
  441. fi
  442. payload64=$(echo -n $payload | _base64 | _urlencode)
  443. _debug2 payload64 $payload64
  444. nonceurl="$API/directory"
  445. nonce="$(_get $nonceurl "onlyheader" | grep -o "Replay-Nonce:.*$" | head -1 | tr -d "\r\n" | cut -d ' ' -f 2)"
  446. _debug nonce "$nonce"
  447. protected="$(printf "$HEADERPLACE" | sed "s/NONCE/$nonce/" )"
  448. _debug2 protected "$protected"
  449. protected64="$(printf "$protected" | _base64 | _urlencode)"
  450. _debug2 protected64 "$protected64"
  451. sig=$(echo -n "$protected64.$payload64" | _sign "$keyfile" "sha256" | _urlencode)
  452. _debug2 sig "$sig"
  453. body="{\"header\": $HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
  454. _debug2 body "$body"
  455. response="$(_post "$body" $url "$needbase64" )"
  456. responseHeaders="$(cat $HTTP_HEADER)"
  457. _debug2 responseHeaders "$responseHeaders"
  458. _debug2 response "$response"
  459. code="$(grep "^HTTP" $HTTP_HEADER | tail -1 | cut -d " " -f 2 | tr -d "\r\n" )"
  460. _debug code $code
  461. }
  462. #setopt "file" "opt" "=" "value" [";"]
  463. _setopt() {
  464. __conf="$1"
  465. __opt="$2"
  466. __sep="$3"
  467. __val="$4"
  468. __end="$5"
  469. if [[ -z "$__opt" ]] ; then
  470. echo usage: _setopt '"file" "opt" "=" "value" [";"]'
  471. return
  472. fi
  473. if [[ ! -f "$__conf" ]] ; then
  474. touch "$__conf"
  475. fi
  476. if grep -H -n "^$__opt$__sep" "$__conf" > /dev/null ; then
  477. _debug2 OK
  478. if [[ "$__val" == *"&"* ]] ; then
  479. __val="$(echo $__val | sed 's/&/\\&/g')"
  480. fi
  481. text="$(cat $__conf)"
  482. echo "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" > "$__conf"
  483. elif grep -H -n "^#$__opt$__sep" "$__conf" > /dev/null ; then
  484. if [[ "$__val" == *"&"* ]] ; then
  485. __val="$(echo $__val | sed 's/&/\\&/g')"
  486. fi
  487. text="$(cat $__conf)"
  488. echo "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" > "$__conf"
  489. else
  490. _debug2 APP
  491. echo "$__opt$__sep$__val$__end" >> "$__conf"
  492. fi
  493. _debug "$(grep -H -n "^$__opt$__sep" $__conf)"
  494. }
  495. #_savedomainconf key value
  496. #save to domain.conf
  497. _savedomainconf() {
  498. key="$1"
  499. value="$2"
  500. if [[ "$DOMAIN_CONF" ]] ; then
  501. _setopt $DOMAIN_CONF "$key" "=" "$value"
  502. else
  503. _err "DOMAIN_CONF is empty, can not save $key=$value"
  504. fi
  505. }
  506. #_saveaccountconf key value
  507. _saveaccountconf() {
  508. key="$1"
  509. value="$2"
  510. if [[ "$ACCOUNT_CONF_PATH" ]] ; then
  511. _setopt $ACCOUNT_CONF_PATH "$key" "=" "\"$value\""
  512. else
  513. _err "ACCOUNT_CONF_PATH is empty, can not save $key=$value"
  514. fi
  515. }
  516. _startserver() {
  517. content="$1"
  518. _debug "startserver: $$"
  519. nchelp="$(nc -h 2>&1)"
  520. if echo "$nchelp" | grep "\-q[ ,]" >/dev/null ; then
  521. _NC="nc -q 1 -l"
  522. else
  523. if echo "$nchelp" | grep "GNU netcat" >/dev/null && echo "$nchelp" | grep "\-c, \-\-close" >/dev/null ; then
  524. _NC="nc -c -l"
  525. elif echo "$nchelp" | grep "\-N" |grep "Shutdown the network socket after EOF on stdin" >/dev/null ; then
  526. _NC="nc -N -l"
  527. else
  528. _NC="nc -l"
  529. fi
  530. fi
  531. _debug "_NC" "$_NC"
  532. # while true ; do
  533. if [[ "$DEBUG" ]] ; then
  534. if ! echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC -p $Le_HTTPPort -vv ; then
  535. echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC $Le_HTTPPort -vv ;
  536. fi
  537. else
  538. if ! echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC -p $Le_HTTPPort > /dev/null 2>&1; then
  539. echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC $Le_HTTPPort > /dev/null 2>&1
  540. fi
  541. fi
  542. if [[ "$?" != "0" ]] ; then
  543. _err "nc listen error."
  544. exit 1
  545. fi
  546. # done
  547. }
  548. _stopserver(){
  549. pid="$1"
  550. _debug "pid" "$pid"
  551. if [[ -z "$pid" ]] ; then
  552. return
  553. fi
  554. if [[ "$(ps | grep "$pid" | grep "nc")" ]] ; then
  555. _debug "Found nc process, kill it."
  556. kill -s 9 $pid > /dev/null 2>&1
  557. fi
  558. _get "http://localhost:$Le_HTTPPort" >/dev/null 2>$1
  559. }
  560. _initpath() {
  561. if [[ -z "$LE_WORKING_DIR" ]] ; then
  562. LE_WORKING_DIR=$HOME/.le
  563. fi
  564. _DEFAULT_ACCOUNT_CONF_PATH="$LE_WORKING_DIR/account.conf"
  565. if [[ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ]] ; then
  566. source "$_DEFAULT_ACCOUNT_CONF_PATH"
  567. fi
  568. if [[ -z "$ACCOUNT_CONF_PATH" ]] ; then
  569. ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
  570. fi
  571. if [[ -f "$ACCOUNT_CONF_PATH" ]] ; then
  572. source "$ACCOUNT_CONF_PATH"
  573. fi
  574. if [[ "$IN_CRON" ]] ; then
  575. if [[ ! "$_USER_PATH_EXPORTED" ]] ; then
  576. _USER_PATH_EXPORTED=1
  577. export PATH="$USER_PATH:$PATH"
  578. fi
  579. fi
  580. if [[ -z "$API" ]] ; then
  581. if [[ -z "$STAGE" ]] ; then
  582. API="$DEFAULT_CA"
  583. else
  584. API="$STAGE_CA"
  585. _info "Using stage api:$API"
  586. fi
  587. fi
  588. if [[ -z "$ACME_DIR" ]] ; then
  589. ACME_DIR="/home/.acme"
  590. fi
  591. if [[ -z "$APACHE_CONF_BACKUP_DIR" ]] ; then
  592. APACHE_CONF_BACKUP_DIR="$LE_WORKING_DIR"
  593. fi
  594. if [[ -z "$USER_AGENT" ]] ; then
  595. USER_AGENT="$DEFAULT_USER_AGENT"
  596. fi
  597. HTTP_HEADER="$LE_WORKING_DIR/http.header"
  598. WGET="wget -q"
  599. if [[ "$DEBUG" -ge "2" ]] ; then
  600. WGET="$WGET -d "
  601. fi
  602. dp="$LE_WORKING_DIR/curl.dump"
  603. CURL="curl -L --silent"
  604. if [[ "$DEBUG" -ge "2" ]] ; then
  605. CURL="$CURL -L --trace-ascii $dp "
  606. fi
  607. domain="$1"
  608. if [[ -z "$ACCOUNT_KEY_PATH" ]] ; then
  609. ACCOUNT_KEY_PATH="$LE_WORKING_DIR/account.key"
  610. fi
  611. if [[ -z "$domain" ]] ; then
  612. return 0
  613. fi
  614. domainhome="$LE_WORKING_DIR/$domain"
  615. mkdir -p "$domainhome"
  616. if [[ -z "$DOMAIN_PATH" ]] ; then
  617. DOMAIN_PATH="$domainhome"
  618. fi
  619. if [[ -z "$DOMAIN_CONF" ]] ; then
  620. DOMAIN_CONF="$domainhome/$domain.conf"
  621. fi
  622. if [[ -z "$DOMAIN_SSL_CONF" ]] ; then
  623. DOMAIN_SSL_CONF="$domainhome/$domain.ssl.conf"
  624. fi
  625. if [[ -z "$CSR_PATH" ]] ; then
  626. CSR_PATH="$domainhome/$domain.csr"
  627. fi
  628. if [[ -z "$CERT_KEY_PATH" ]] ; then
  629. CERT_KEY_PATH="$domainhome/$domain.key"
  630. fi
  631. if [[ -z "$CERT_PATH" ]] ; then
  632. CERT_PATH="$domainhome/$domain.cer"
  633. fi
  634. if [[ -z "$CA_CERT_PATH" ]] ; then
  635. CA_CERT_PATH="$domainhome/ca.cer"
  636. fi
  637. if [[ -z "$CERT_FULLCHAIN_PATH" ]] ; then
  638. CERT_FULLCHAIN_PATH="$domainhome/fullchain.cer"
  639. fi
  640. if [[ -z "$CERT_PFX_PATH" ]] ; then
  641. CERT_PFX_PATH="$domainhome/$domain.pfx"
  642. fi
  643. }
  644. _apachePath() {
  645. httpdconfname="$(apachectl -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"' )"
  646. if [[ "$httpdconfname" == '/'* ]] ; then
  647. httpdconf="$httpdconfname"
  648. httpdconfname="$(basename $httpdconfname)"
  649. else
  650. httpdroot="$(apachectl -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"' )"
  651. httpdconf="$httpdroot/$httpdconfname"
  652. fi
  653. if [[ ! -f $httpdconf ]] ; then
  654. _err "Apache Config file not found" $httpdconf
  655. return 1
  656. fi
  657. return 0
  658. }
  659. _restoreApache() {
  660. if [[ -z "$usingApache" ]] ; then
  661. return 0
  662. fi
  663. _initpath
  664. if ! _apachePath ; then
  665. return 1
  666. fi
  667. if [[ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ]] ; then
  668. _debug "No config file to restore."
  669. return 0
  670. fi
  671. cp -p "$APACHE_CONF_BACKUP_DIR/$httpdconfname" "$httpdconf"
  672. if ! apachectl -t ; then
  673. _err "Sorry, restore apache config error, please contact me."
  674. return 1;
  675. fi
  676. rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
  677. return 0
  678. }
  679. _setApache() {
  680. _initpath
  681. if ! _apachePath ; then
  682. return 1
  683. fi
  684. #backup the conf
  685. _debug "Backup apache config file" $httpdconf
  686. cp -p $httpdconf $APACHE_CONF_BACKUP_DIR/
  687. _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
  688. _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
  689. _info "The backup file will be deleted on sucess, just forget it."
  690. #add alias
  691. apacheVer="$(apachectl -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2 )"
  692. _debug "apacheVer" "$apacheVer"
  693. apacheMajer="$(echo "$apacheVer" | cut -d . -f 1)"
  694. apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
  695. if [[ "$apacheVer" ]] && [[ "$apacheMajer" -ge "2" ]] && [[ "$apacheMinor" -ge "4" ]] ; then
  696. echo "
  697. Alias /.well-known/acme-challenge $ACME_DIR
  698. <Directory $ACME_DIR >
  699. Require all granted
  700. </Directory>
  701. " >> $httpdconf
  702. else
  703. echo "
  704. Alias /.well-known/acme-challenge $ACME_DIR
  705. <Directory $ACME_DIR >
  706. Order allow,deny
  707. Allow from all
  708. </Directory>
  709. " >> $httpdconf
  710. fi
  711. if ! apachectl -t ; then
  712. _err "Sorry, apache config error, please contact me."
  713. _restoreApache
  714. return 1;
  715. fi
  716. if [[ ! -d "$ACME_DIR" ]] ; then
  717. mkdir -p "$ACME_DIR"
  718. chmod 755 "$ACME_DIR"
  719. fi
  720. if ! apachectl graceful ; then
  721. _err "Sorry, apachectl graceful error, please contact me."
  722. _restoreApache
  723. return 1;
  724. fi
  725. usingApache="1"
  726. return 0
  727. }
  728. _clearup () {
  729. _stopserver $serverproc
  730. serverproc=""
  731. _restoreApache
  732. }
  733. # webroot removelevel tokenfile
  734. _clearupwebbroot() {
  735. __webroot="$1"
  736. if [[ -z "$__webroot" ]] ; then
  737. _debug "no webroot specified, skip"
  738. return 0
  739. fi
  740. if [[ "$2" == '1' ]] ; then
  741. _debug "remove $__webroot/.well-known"
  742. rm -rf "$__webroot/.well-known"
  743. elif [[ "$2" == '2' ]] ; then
  744. _debug "remove $__webroot/.well-known/acme-challenge"
  745. rm -rf "$__webroot/.well-known/acme-challenge"
  746. elif [[ "$2" == '3' ]] ; then
  747. _debug "remove $__webroot/.well-known/acme-challenge/$3"
  748. rm -rf "$__webroot/.well-known/acme-challenge/$3"
  749. else
  750. _info "Skip for removelevel:$2"
  751. fi
  752. return 0
  753. }
  754. issue() {
  755. if [[ -z "$2" ]] ; then
  756. echo "Usage: le --issue -d a.com -w /path/to/webroot/a.com/ "
  757. return 1
  758. fi
  759. Le_Webroot="$1"
  760. Le_Domain="$2"
  761. Le_Alt="$3"
  762. Le_Keylength="$4"
  763. Le_RealCertPath="$5"
  764. Le_RealKeyPath="$6"
  765. Le_RealCACertPath="$7"
  766. Le_ReloadCmd="$8"
  767. Le_RealFullChainPath="$9"
  768. _initpath $Le_Domain
  769. if [[ -f "$DOMAIN_CONF" ]] ; then
  770. Le_NextRenewTime=$(grep "^Le_NextRenewTime=" "$DOMAIN_CONF" | cut -d '=' -f 2)
  771. if [[ -z "$FORCE" ]] && [[ "$Le_NextRenewTime" ]] && [[ "$(date -u "+%s" )" -lt "$Le_NextRenewTime" ]] ; then
  772. _info "Skip, Next renewal time is: $(grep "^Le_NextRenewTimeStr" "$DOMAIN_CONF" | cut -d '=' -f 2)"
  773. return 2
  774. fi
  775. fi
  776. _setopt "$DOMAIN_CONF" "Le_Domain" "=" "$Le_Domain"
  777. _setopt "$DOMAIN_CONF" "Le_Alt" "=" "$Le_Alt"
  778. _setopt "$DOMAIN_CONF" "Le_Webroot" "=" "$Le_Webroot"
  779. _setopt "$DOMAIN_CONF" "Le_Keylength" "=" "$Le_Keylength"
  780. _setopt "$DOMAIN_CONF" "Le_RealCertPath" "=" "\"$Le_RealCertPath\""
  781. _setopt "$DOMAIN_CONF" "Le_RealCACertPath" "=" "\"$Le_RealCACertPath\""
  782. _setopt "$DOMAIN_CONF" "Le_RealKeyPath" "=" "\"$Le_RealKeyPath\""
  783. _setopt "$DOMAIN_CONF" "Le_ReloadCmd" "=" "\"$Le_ReloadCmd\""
  784. _setopt "$DOMAIN_CONF" "Le_RealFullChainPath" "=" "\"$Le_RealFullChainPath\""
  785. if [[ "$Le_Alt" == "no" ]] ; then
  786. Le_Alt=""
  787. fi
  788. if [[ "$Le_Keylength" == "no" ]] ; then
  789. Le_Keylength=""
  790. fi
  791. if [[ "$Le_RealCertPath" == "no" ]] ; then
  792. Le_RealCertPath=""
  793. fi
  794. if [[ "$Le_RealKeyPath" == "no" ]] ; then
  795. Le_RealKeyPath=""
  796. fi
  797. if [[ "$Le_RealCACertPath" == "no" ]] ; then
  798. Le_RealCACertPath=""
  799. fi
  800. if [[ "$Le_ReloadCmd" == "no" ]] ; then
  801. Le_ReloadCmd=""
  802. fi
  803. if [[ "$Le_RealFullChainPath" == "no" ]] ; then
  804. Le_RealFullChainPath=""
  805. fi
  806. if [[ "$Le_Webroot" == *"no"* ]] ; then
  807. _info "Standalone mode."
  808. if ! command -v "nc" > /dev/null ; then
  809. _err "Please install netcat(nc) tools first."
  810. return 1
  811. fi
  812. if [[ -z "$Le_HTTPPort" ]] ; then
  813. Le_HTTPPort=80
  814. fi
  815. _setopt "$DOMAIN_CONF" "Le_HTTPPort" "=" "$Le_HTTPPort"
  816. netprc="$(_ss "$Le_HTTPPort" | grep "$Le_HTTPPort")"
  817. if [[ "$netprc" ]] ; then
  818. _err "$netprc"
  819. _err "tcp port $Le_HTTPPort is already used by $(echo "$netprc" | cut -d : -f 4)"
  820. _err "Please stop it first"
  821. return 1
  822. fi
  823. fi
  824. if [[ "$Le_Webroot" == *"apache"* ]] ; then
  825. if ! _setApache ; then
  826. _err "set up apache error. Report error to me."
  827. return 1
  828. fi
  829. wellknown_path="$ACME_DIR"
  830. else
  831. usingApache=""
  832. fi
  833. createAccountKey $Le_Domain $Le_Keylength
  834. if ! _calcjwk "$ACCOUNT_KEY_PATH" ; then
  835. return 1
  836. fi
  837. accountkey_json=$(echo -n "$jwk" | tr -d ' ' )
  838. thumbprint=$(echo -n "$accountkey_json" | _digest "sha256" | _urlencode)
  839. accountkeyhash="$(cat "$ACCOUNT_KEY_PATH" | _digest "sha256" )"
  840. accountkeyhash="$(echo $accountkeyhash$API | _digest "sha256" )"
  841. if [[ "$accountkeyhash" != "$ACCOUNT_KEY_HASH" ]] ; then
  842. _info "Registering account"
  843. regjson='{"resource": "new-reg", "agreement": "'$AGREEMENT'"}'
  844. if [[ "$ACCOUNT_EMAIL" ]] ; then
  845. regjson='{"resource": "new-reg", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
  846. fi
  847. _send_signed_request "$API/acme/new-reg" "$regjson"
  848. if [[ "$code" == "" ]] || [[ "$code" == '201' ]] ; then
  849. _info "Registered"
  850. echo $response > $LE_WORKING_DIR/account.json
  851. elif [[ "$code" == '409' ]] ; then
  852. _info "Already registered"
  853. else
  854. _err "Register account Error: $response"
  855. _clearup
  856. return 1
  857. fi
  858. ACCOUNT_KEY_HASH="$accountkeyhash"
  859. _saveaccountconf "ACCOUNT_KEY_HASH" "$ACCOUNT_KEY_HASH"
  860. else
  861. _info "Skip register account key"
  862. fi
  863. if ! createDomainKey $Le_Domain $Le_Keylength ; then
  864. _err "Create domain key error."
  865. return 1
  866. fi
  867. if ! createCSR $Le_Domain $Le_Alt ; then
  868. _err "Create CSR error."
  869. return 1
  870. fi
  871. vlist="$Le_Vlist"
  872. # verify each domain
  873. _info "Verify each domain"
  874. sep='#'
  875. if [[ -z "$vlist" ]] ; then
  876. alldomains=$(echo "$Le_Domain,$Le_Alt" | tr ',' ' ' )
  877. _index=1
  878. _currentRoot=""
  879. for d in $alldomains
  880. do
  881. _info "Getting webroot for domain" $d
  882. _w="$(echo $Le_Webroot | cut -d , -f $_index)"
  883. _debug _w "$_w"
  884. if [[ "$_w" ]] ; then
  885. _currentRoot="$_w"
  886. fi
  887. _debug "_currentRoot" "$_currentRoot"
  888. let "_index+=1"
  889. vtype="$VTYPE_HTTP"
  890. if [[ "$_currentRoot" == "dns"* ]] ; then
  891. vtype="$VTYPE_DNS"
  892. fi
  893. _info "Getting token for domain" $d
  894. _send_signed_request "$API/acme/new-authz" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$d\"}}"
  895. if [[ ! -z "$code" ]] && [[ ! "$code" == '201' ]] ; then
  896. _err "new-authz error: $response"
  897. _clearup
  898. return 1
  899. fi
  900. entry="$(printf $response | egrep -o '\{[^{]*"type":"'$vtype'"[^}]*')"
  901. _debug entry "$entry"
  902. token="$(printf "$entry" | egrep -o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
  903. _debug token $token
  904. uri="$(printf "$entry" | egrep -o '"uri":"[^"]*'| cut -d : -f 2,3 | tr -d '"' )"
  905. _debug uri $uri
  906. keyauthorization="$token.$thumbprint"
  907. _debug keyauthorization "$keyauthorization"
  908. dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
  909. _debug dvlist "$dvlist"
  910. vlist="$vlist$dvlist,"
  911. done
  912. #add entry
  913. dnsadded=""
  914. ventries=$(echo "$vlist" | tr ',' ' ' )
  915. for ventry in $ventries
  916. do
  917. d=$(echo $ventry | cut -d $sep -f 1)
  918. keyauthorization=$(echo $ventry | cut -d $sep -f 2)
  919. vtype=$(echo $ventry | cut -d $sep -f 4)
  920. _currentRoot=$(echo $ventry | cut -d $sep -f 5)
  921. if [[ "$vtype" == "$VTYPE_DNS" ]] ; then
  922. dnsadded='0'
  923. txtdomain="_acme-challenge.$d"
  924. _debug txtdomain "$txtdomain"
  925. txt="$(echo -e -n $keyauthorization | _digest "sha256" | _urlencode)"
  926. _debug txt "$txt"
  927. #dns
  928. #1. check use api
  929. d_api=""
  930. if [[ -f "$LE_WORKING_DIR/$d/$_currentRoot" ]] ; then
  931. d_api="$LE_WORKING_DIR/$d/$_currentRoot"
  932. elif [[ -f "$LE_WORKING_DIR/$d/$_currentRoot.sh" ]] ; then
  933. d_api="$LE_WORKING_DIR/$d/$_currentRoot.sh"
  934. elif [[ -f "$LE_WORKING_DIR/$_currentRoot" ]] ; then
  935. d_api="$LE_WORKING_DIR/$_currentRoot"
  936. elif [[ -f "$LE_WORKING_DIR/$_currentRoot.sh" ]] ; then
  937. d_api="$LE_WORKING_DIR/$_currentRoot.sh"
  938. elif [[ -f "$LE_WORKING_DIR/dnsapi/$_currentRoot" ]] ; then
  939. d_api="$LE_WORKING_DIR/dnsapi/$_currentRoot"
  940. elif [[ -f "$LE_WORKING_DIR/dnsapi/$_currentRoot.sh" ]] ; then
  941. d_api="$LE_WORKING_DIR/dnsapi/$_currentRoot.sh"
  942. fi
  943. _debug d_api "$d_api"
  944. if [[ "$d_api" ]] ; then
  945. _info "Found domain api file: $d_api"
  946. else
  947. _err "Add the following TXT record:"
  948. _err "Domain: $txtdomain"
  949. _err "TXT value: $txt"
  950. _err "Please be aware that you prepend _acme-challenge. before your domain"
  951. _err "so the resulting subdomain will be: $txtdomain"
  952. continue
  953. fi
  954. (
  955. if ! source $d_api ; then
  956. _err "Load file $d_api error. Please check your api file and try again."
  957. return 1
  958. fi
  959. addcommand="$_currentRoot-add"
  960. if ! _exists $addcommand ; then
  961. _err "It seems that your api file is not correct, it must have a function named: $addcommand"
  962. return 1
  963. fi
  964. if ! $addcommand $txtdomain $txt ; then
  965. _err "Error add txt for domain:$txtdomain"
  966. return 1
  967. fi
  968. )
  969. if [[ "$?" != "0" ]] ; then
  970. return 1
  971. fi
  972. dnsadded='1'
  973. fi
  974. done
  975. if [[ "$dnsadded" == '0' ]] ; then
  976. _setopt "$DOMAIN_CONF" "Le_Vlist" "=" "\"$vlist\""
  977. _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
  978. _err "Please add the TXT records to the domains, and retry again."
  979. return 1
  980. fi
  981. fi
  982. if [[ "$dnsadded" == '1' ]] ; then
  983. _info "Sleep 60 seconds for the txt records to take effect"
  984. sleep 60
  985. fi
  986. _debug "ok, let's start to verify"
  987. ventries=$(echo "$vlist" | tr ',' ' ' )
  988. for ventry in $ventries
  989. do
  990. d=$(echo $ventry | cut -d $sep -f 1)
  991. keyauthorization=$(echo $ventry | cut -d $sep -f 2)
  992. uri=$(echo $ventry | cut -d $sep -f 3)
  993. vtype=$(echo $ventry | cut -d $sep -f 4)
  994. _currentRoot=$(echo $ventry | cut -d $sep -f 5)
  995. _info "Verifying:$d"
  996. _debug "d" "$d"
  997. _debug "keyauthorization" "$keyauthorization"
  998. _debug "uri" "$uri"
  999. removelevel=""
  1000. token=""
  1001. _debug "_currentRoot" "$_currentRoot"
  1002. if [[ "$vtype" == "$VTYPE_HTTP" ]] ; then
  1003. if [[ "$_currentRoot" == "no" ]] ; then
  1004. _info "Standalone mode server"
  1005. _startserver "$keyauthorization" &
  1006. if [[ "$?" != "0" ]] ; then
  1007. return 1
  1008. fi
  1009. serverproc="$!"
  1010. sleep 2
  1011. _debug serverproc $serverproc
  1012. else
  1013. if [[ -z "$wellknown_path" ]] ; then
  1014. wellknown_path="$_currentRoot/.well-known/acme-challenge"
  1015. fi
  1016. _debug wellknown_path "$wellknown_path"
  1017. if [[ ! -d "$_currentRoot/.well-known" ]] ; then
  1018. removelevel='1'
  1019. elif [[ ! -d "$_currentRoot/.well-known/acme-challenge" ]] ; then
  1020. removelevel='2'
  1021. else
  1022. removelevel='3'
  1023. fi
  1024. token="$(echo -e -n "$keyauthorization" | cut -d '.' -f 1)"
  1025. _debug "writing token:$token to $wellknown_path/$token"
  1026. mkdir -p "$wellknown_path"
  1027. echo -n "$keyauthorization" > "$wellknown_path/$token"
  1028. if [[ ! "$usingApache" ]] ; then
  1029. webroot_owner=$(_stat $_currentRoot)
  1030. _debug "Changing owner/group of .well-known to $webroot_owner"
  1031. chown -R $webroot_owner "$_currentRoot/.well-known"
  1032. fi
  1033. fi
  1034. fi
  1035. _send_signed_request $uri "{\"resource\": \"challenge\", \"keyAuthorization\": \"$keyauthorization\"}"
  1036. if [[ ! -z "$code" ]] && [[ ! "$code" == '202' ]] ; then
  1037. _err "$d:Challenge error: $response"
  1038. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1039. _clearup
  1040. return 1
  1041. fi
  1042. waittimes=0
  1043. if [[ -z "$MAX_RETRY_TIMES" ]] ; then
  1044. MAX_RETRY_TIMES=30
  1045. fi
  1046. while [[ "1" ]] ; do
  1047. let "waittimes+=1"
  1048. if [[ "$waittimes" -ge "$MAX_RETRY_TIMES" ]] ; then
  1049. _err "$d:Timeout"
  1050. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1051. _clearup
  1052. return 1
  1053. fi
  1054. _debug "sleep 5 secs to verify"
  1055. sleep 5
  1056. _debug "checking"
  1057. response="$(_get $uri)"
  1058. if [[ "$?" != "0" ]] ; then
  1059. _err "$d:Verify error:$response"
  1060. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1061. _clearup
  1062. return 1
  1063. fi
  1064. status=$(echo $response | egrep -o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
  1065. if [[ "$status" == "valid" ]] ; then
  1066. _info "Success"
  1067. _stopserver $serverproc
  1068. serverproc=""
  1069. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1070. break;
  1071. fi
  1072. if [[ "$status" == "invalid" ]] ; then
  1073. error=$(echo $response | egrep -o '"error":{[^}]*}' | grep -o '"detail":"[^"]*"' | cut -d '"' -f 4)
  1074. _err "$d:Verify error:$error"
  1075. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1076. _clearup
  1077. return 1;
  1078. fi
  1079. if [[ "$status" == "pending" ]] ; then
  1080. _info "Pending"
  1081. else
  1082. _err "$d:Verify error:$response"
  1083. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1084. _clearup
  1085. return 1
  1086. fi
  1087. done
  1088. done
  1089. _clearup
  1090. _info "Verify finished, start to sign."
  1091. der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _urlencode)"
  1092. _send_signed_request "$API/acme/new-cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"
  1093. Le_LinkCert="$(grep -i -o '^Location.*$' $HTTP_HEADER | head -1 | tr -d "\r\n" | cut -d " " -f 2)"
  1094. _setopt "$DOMAIN_CONF" "Le_LinkCert" "=" "$Le_LinkCert"
  1095. if [[ "$Le_LinkCert" ]] ; then
  1096. echo "$BEGIN_CERT" > "$CERT_PATH"
  1097. _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH"
  1098. echo "$END_CERT" >> "$CERT_PATH"
  1099. _info "Cert success."
  1100. cat "$CERT_PATH"
  1101. _info "Your cert is in $CERT_PATH"
  1102. cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
  1103. if [[ ! "$USER_PATH" ]] || [[ ! "$IN_CRON" ]] ; then
  1104. USER_PATH="$PATH"
  1105. _saveaccountconf "USER_PATH" "$USER_PATH"
  1106. fi
  1107. fi
  1108. if [[ -z "$Le_LinkCert" ]] ; then
  1109. response="$(echo $response | _dbase64 "multiline" )"
  1110. _err "Sign failed: $(echo "$response" | grep -o '"detail":"[^"]*"')"
  1111. return 1
  1112. fi
  1113. _setopt "$DOMAIN_CONF" 'Le_Vlist' '=' "\"\""
  1114. Le_LinkIssuer=$(grep -i '^Link' $HTTP_HEADER | head -1 | cut -d " " -f 2| cut -d ';' -f 1 | tr -d '<>' )
  1115. _setopt "$DOMAIN_CONF" "Le_LinkIssuer" "=" "$Le_LinkIssuer"
  1116. if [[ "$Le_LinkIssuer" ]] ; then
  1117. echo "$BEGIN_CERT" > "$CA_CERT_PATH"
  1118. _get "$Le_LinkIssuer" | _base64 "multiline" >> "$CA_CERT_PATH"
  1119. echo "$END_CERT" >> "$CA_CERT_PATH"
  1120. _info "The intermediate CA cert is in $CA_CERT_PATH"
  1121. cat "$CA_CERT_PATH" >> "$CERT_FULLCHAIN_PATH"
  1122. _info "And the full chain certs is there: $CERT_FULLCHAIN_PATH"
  1123. fi
  1124. Le_CertCreateTime=$(date -u "+%s")
  1125. _setopt "$DOMAIN_CONF" "Le_CertCreateTime" "=" "$Le_CertCreateTime"
  1126. Le_CertCreateTimeStr=$(date -u )
  1127. _setopt "$DOMAIN_CONF" "Le_CertCreateTimeStr" "=" "\"$Le_CertCreateTimeStr\""
  1128. if [[ ! "$Le_RenewalDays" ]] ; then
  1129. Le_RenewalDays=80
  1130. fi
  1131. _setopt "$DOMAIN_CONF" "Le_RenewalDays" "=" "$Le_RenewalDays"
  1132. let "Le_NextRenewTime=Le_CertCreateTime+Le_RenewalDays*24*60*60"
  1133. _setopt "$DOMAIN_CONF" "Le_NextRenewTime" "=" "$Le_NextRenewTime"
  1134. Le_NextRenewTimeStr=$( _time2str $Le_NextRenewTime )
  1135. _setopt "$DOMAIN_CONF" "Le_NextRenewTimeStr" "=" "\"$Le_NextRenewTimeStr\""
  1136. installcert $Le_Domain "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath"
  1137. }
  1138. renew() {
  1139. Le_Domain="$1"
  1140. if [[ -z "$Le_Domain" ]] ; then
  1141. _err "Usage: le.sh --renew -d domain.com"
  1142. return 1
  1143. fi
  1144. _initpath $Le_Domain
  1145. if [[ ! -f "$DOMAIN_CONF" ]] ; then
  1146. _info "$Le_Domain is not a issued domain, skip."
  1147. return 0;
  1148. fi
  1149. source "$DOMAIN_CONF"
  1150. if [[ -z "$FORCE" ]] && [[ "$Le_NextRenewTime" ]] && [[ "$(date -u "+%s" )" -lt "$Le_NextRenewTime" ]] ; then
  1151. _info "Skip, Next renewal time is: $Le_NextRenewTimeStr"
  1152. return 2
  1153. fi
  1154. IS_RENEW="1"
  1155. issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath"
  1156. local res=$?
  1157. IS_RENEW=""
  1158. return $res
  1159. }
  1160. renewAll() {
  1161. _initpath
  1162. _info "renewAll"
  1163. for d in $(ls -F ${LE_WORKING_DIR}/ | grep [^.].*[.].*/$ ) ; do
  1164. d=$(echo $d | cut -d '/' -f 1)
  1165. _info "renew $d"
  1166. Le_LinkCert=""
  1167. Le_Domain=""
  1168. Le_Alt="no"
  1169. Le_Webroot=""
  1170. Le_Keylength=""
  1171. Le_LinkIssuer=""
  1172. Le_CertCreateTime=""
  1173. Le_CertCreateTimeStr=""
  1174. Le_RenewalDays=""
  1175. Le_NextRenewTime=""
  1176. Le_NextRenewTimeStr=""
  1177. Le_RealCertPath=""
  1178. Le_RealKeyPath=""
  1179. Le_RealCACertPath=""
  1180. Le_ReloadCmd=""
  1181. Le_RealFullChainPath=""
  1182. DOMAIN_PATH=""
  1183. DOMAIN_CONF=""
  1184. DOMAIN_SSL_CONF=""
  1185. CSR_PATH=""
  1186. CERT_KEY_PATH=""
  1187. CERT_PATH=""
  1188. CA_CERT_PATH=""
  1189. CERT_PFX_PATH=""
  1190. CERT_FULLCHAIN_PATH=""
  1191. ACCOUNT_KEY_PATH=""
  1192. wellknown_path=""
  1193. renew "$d"
  1194. done
  1195. }
  1196. installcert() {
  1197. Le_Domain="$1"
  1198. if [[ -z "$Le_Domain" ]] ; then
  1199. echo "Usage: le.sh --installcert -d domain.com [--certpath cert-file-path] [--keypath key-file-path] [--capath ca-cert-file-path] [ --reloadCmd reloadCmd] [--fullchainpath fullchain-path]"
  1200. return 1
  1201. fi
  1202. Le_RealCertPath="$2"
  1203. Le_RealKeyPath="$3"
  1204. Le_RealCACertPath="$4"
  1205. Le_ReloadCmd="$5"
  1206. Le_RealFullChainPath="$6"
  1207. _initpath $Le_Domain
  1208. _setopt "$DOMAIN_CONF" "Le_RealCertPath" "=" "\"$Le_RealCertPath\""
  1209. _setopt "$DOMAIN_CONF" "Le_RealCACertPath" "=" "\"$Le_RealCACertPath\""
  1210. _setopt "$DOMAIN_CONF" "Le_RealKeyPath" "=" "\"$Le_RealKeyPath\""
  1211. _setopt "$DOMAIN_CONF" "Le_ReloadCmd" "=" "\"$Le_ReloadCmd\""
  1212. _setopt "$DOMAIN_CONF" "Le_RealFullChainPath" "=" "\"$Le_RealFullChainPath\""
  1213. if [[ "$Le_RealCertPath" ]] ; then
  1214. if [[ -f "$Le_RealCertPath" ]] ; then
  1215. cp -p "$Le_RealCertPath" "$Le_RealCertPath".bak
  1216. fi
  1217. cat "$CERT_PATH" > "$Le_RealCertPath"
  1218. fi
  1219. if [[ "$Le_RealCACertPath" ]] ; then
  1220. if [[ "$Le_RealCACertPath" == "$Le_RealCertPath" ]] ; then
  1221. echo "" >> "$Le_RealCACertPath"
  1222. cat "$CA_CERT_PATH" >> "$Le_RealCACertPath"
  1223. else
  1224. if [[ -f "$Le_RealCACertPath" ]] ; then
  1225. cp -p "$Le_RealCACertPath" "$Le_RealCACertPath".bak
  1226. fi
  1227. cat "$CA_CERT_PATH" > "$Le_RealCACertPath"
  1228. fi
  1229. fi
  1230. if [[ "$Le_RealKeyPath" ]] ; then
  1231. if [[ -f "$Le_RealKeyPath" ]] ; then
  1232. cp -p "$Le_RealKeyPath" "$Le_RealKeyPath".bak
  1233. fi
  1234. cat "$CERT_KEY_PATH" > "$Le_RealKeyPath"
  1235. fi
  1236. if [[ "$Le_RealFullChainPath" ]] ; then
  1237. if [[ -f "$Le_RealFullChainPath" ]] ; then
  1238. cp -p "$Le_RealFullChainPath" "$Le_RealFullChainPath".bak
  1239. fi
  1240. cat "$CERT_FULLCHAIN_PATH" > "$Le_RealFullChainPath"
  1241. fi
  1242. if [[ "$Le_ReloadCmd" ]] ; then
  1243. _info "Run Le_ReloadCmd: $Le_ReloadCmd"
  1244. (cd "$DOMAIN_PATH" && eval "$Le_ReloadCmd")
  1245. fi
  1246. }
  1247. installcronjob() {
  1248. _initpath
  1249. if ! _exists "crontab" ; then
  1250. _err "crontab doesn't exist, so, we can not install cron jobs."
  1251. _err "All your certs will not be renewed automatically."
  1252. _err "You must add your own cron job to call 'le.sh cron' everyday."
  1253. return 1
  1254. fi
  1255. _info "Installing cron job"
  1256. if ! crontab -l | grep 'le.sh cron' ; then
  1257. if [[ -f "$LE_WORKING_DIR/le.sh" ]] ; then
  1258. lesh="\"$LE_WORKING_DIR\"/le.sh"
  1259. else
  1260. _err "Can not install cronjob, le.sh not found."
  1261. return 1
  1262. fi
  1263. crontab -l | { cat; echo "0 0 * * * LE_WORKING_DIR=\"$LE_WORKING_DIR\" $lesh cron > /dev/null"; } | crontab -
  1264. fi
  1265. if [[ "$?" != "0" ]] ; then
  1266. _err "Install cron job failed. You need to manually renew your certs."
  1267. _err "Or you can add cronjob by yourself:"
  1268. _err "LE_WORKING_DIR=\"$LE_WORKING_DIR\" $lesh cron > /dev/null"
  1269. return 1
  1270. fi
  1271. }
  1272. uninstallcronjob() {
  1273. if ! _exists "crontab" ; then
  1274. return
  1275. fi
  1276. _info "Removing cron job"
  1277. cr="$(crontab -l | grep 'le.sh cron')"
  1278. if [[ "$cr" ]] ; then
  1279. crontab -l | sed "/le.sh cron/d" | crontab -
  1280. LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 6 | cut -d '=' -f 2 | tr -d '"')"
  1281. _info LE_WORKING_DIR "$LE_WORKING_DIR"
  1282. fi
  1283. _initpath
  1284. }
  1285. revoke() {
  1286. Le_Domain="$1"
  1287. if [[ -z "$Le_Domain" ]] ; then
  1288. echo "Usage: le.sh --revoke -d domain.com"
  1289. return 1
  1290. fi
  1291. _initpath $Le_Domain
  1292. if [[ ! -f "$DOMAIN_CONF" ]] ; then
  1293. _err "$Le_Domain is not a issued domain, skip."
  1294. return 1;
  1295. fi
  1296. if [[ ! -f "$CERT_PATH" ]] ; then
  1297. _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
  1298. return 1
  1299. fi
  1300. cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}"| tr -d "\r\n" | _urlencode)"
  1301. if [[ -z "$cert" ]] ; then
  1302. _err "Cert for $Le_Domain is empty found, skip."
  1303. return 1
  1304. fi
  1305. data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
  1306. uri="$API/acme/revoke-cert"
  1307. _info "Try domain key first."
  1308. if _send_signed_request $uri "$data" "" "$CERT_KEY_PATH"; then
  1309. if [[ -z "$response" ]] ; then
  1310. _info "Revoke success."
  1311. rm -f $CERT_PATH
  1312. return 0
  1313. else
  1314. _err "Revoke error by domain key."
  1315. _err "$resource"
  1316. fi
  1317. fi
  1318. _info "Then try account key."
  1319. if _send_signed_request $uri "$data" "" "$ACCOUNT_KEY_PATH" ; then
  1320. if [[ -z "$response" ]] ; then
  1321. _info "Revoke success."
  1322. rm -f $CERT_PATH
  1323. return 0
  1324. else
  1325. _err "Revoke error."
  1326. _debug "$resource"
  1327. fi
  1328. fi
  1329. return 1
  1330. }
  1331. # Detect profile file if not specified as environment variable
  1332. _detect_profile() {
  1333. if [ -n "$PROFILE" -a -f "$PROFILE" ] ; then
  1334. echo "$PROFILE"
  1335. return
  1336. fi
  1337. local DETECTED_PROFILE
  1338. DETECTED_PROFILE=''
  1339. local SHELLTYPE
  1340. SHELLTYPE="$(basename "/$SHELL")"
  1341. if [[ "$SHELLTYPE" = "bash" ]] ; then
  1342. if [[ -f "$HOME/.bashrc" ]] ; then
  1343. DETECTED_PROFILE="$HOME/.bashrc"
  1344. elif [[ -f "$HOME/.bash_profile" ]] ; then
  1345. DETECTED_PROFILE="$HOME/.bash_profile"
  1346. fi
  1347. elif [[ "$SHELLTYPE" = "zsh" ]] ; then
  1348. DETECTED_PROFILE="$HOME/.zshrc"
  1349. fi
  1350. if [[ -z "$DETECTED_PROFILE" ]] ; then
  1351. if [[ -f "$HOME/.profile" ]] ; then
  1352. DETECTED_PROFILE="$HOME/.profile"
  1353. elif [[ -f "$HOME/.bashrc" ]] ; then
  1354. DETECTED_PROFILE="$HOME/.bashrc"
  1355. elif [[ -f "$HOME/.bash_profile" ]] ; then
  1356. DETECTED_PROFILE="$HOME/.bash_profile"
  1357. elif [[ -f "$HOME/.zshrc" ]] ; then
  1358. DETECTED_PROFILE="$HOME/.zshrc"
  1359. fi
  1360. fi
  1361. if [[ ! -z "$DETECTED_PROFILE" ]] ; then
  1362. echo "$DETECTED_PROFILE"
  1363. fi
  1364. }
  1365. _initconf() {
  1366. _initpath
  1367. if [[ ! -f "$ACCOUNT_CONF_PATH" ]] ; then
  1368. echo "#ACCOUNT_CONF_PATH=xxxx
  1369. #Account configurations:
  1370. #Here are the supported macros, uncomment them to make them take effect.
  1371. #ACCOUNT_EMAIL=aaa@aaa.com # the account email used to register account.
  1372. #ACCOUNT_KEY_PATH=\"/path/to/account.key\"
  1373. #STAGE=1 # Use the staging api
  1374. #FORCE=1 # Force to issue cert
  1375. #DEBUG=1 # Debug mode
  1376. #ACCOUNT_KEY_HASH=account key hash
  1377. USER_AGENT=\"le.sh client: $PROJECT\"
  1378. #USER_PATH=""
  1379. #dns api
  1380. #######################
  1381. #Cloudflare:
  1382. #api key
  1383. #CF_Key=\"sdfsdfsdfljlbjkljlkjsdfoiwje\"
  1384. #account email
  1385. #CF_Email=\"xxxx@sss.com\"
  1386. #######################
  1387. #Dnspod.cn:
  1388. #api key id
  1389. #DP_Id=\"1234\"
  1390. #api key
  1391. #DP_Key=\"sADDsdasdgdsf\"
  1392. #######################
  1393. #Cloudxns.com:
  1394. #CX_Key=\"1234\"
  1395. #
  1396. #CX_Secret=\"sADDsdasdgdsf\"
  1397. " > $ACCOUNT_CONF_PATH
  1398. fi
  1399. }
  1400. _precheck() {
  1401. if ! _exists "curl" && ! _exists "wget"; then
  1402. _err "Please install curl or wget first, we need to access http resources."
  1403. return 1
  1404. fi
  1405. if ! _exists "crontab" ; then
  1406. _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
  1407. _err "We need to set cron job to renew the certs automatically."
  1408. _err "Otherwise, your certs will not be able to be renewed automatically."
  1409. if [[ -z "$FORCE" ]] ; then
  1410. _err "Please define 'FORCE=1' and try install again to go without crontab."
  1411. _err "FORCE=1 ./le.sh install"
  1412. return 1
  1413. fi
  1414. fi
  1415. if ! _exists "openssl" ; then
  1416. _err "Please install openssl first."
  1417. _err "We need openssl to generate keys."
  1418. return 1
  1419. fi
  1420. if ! _exists "nc" ; then
  1421. _err "It is recommended to install nc first, try to install 'nc' or 'netcat'."
  1422. _err "We use nc for standalone server if you use standalone mode."
  1423. _err "If you don't use standalone mode, just ignore this warning."
  1424. fi
  1425. return 0
  1426. }
  1427. install() {
  1428. if ! _initpath ; then
  1429. _err "Install failed."
  1430. return 1
  1431. fi
  1432. if ! _precheck ; then
  1433. _err "Pre-check failed, can not install."
  1434. return 1
  1435. fi
  1436. _info "Installing to $LE_WORKING_DIR"
  1437. if ! mkdir -p "$LE_WORKING_DIR" ; then
  1438. _err "Can not craete working dir: $LE_WORKING_DIR"
  1439. return 1
  1440. fi
  1441. cp le.sh "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/le.sh"
  1442. if [[ "$?" != "0" ]] ; then
  1443. _err "Install failed, can not copy le.sh"
  1444. return 1
  1445. fi
  1446. _info "Installed to $LE_WORKING_DIR/le.sh"
  1447. _profile="$(_detect_profile)"
  1448. if [[ "$_profile" ]] ; then
  1449. _debug "Found profile: $_profile"
  1450. echo "LE_WORKING_DIR=$LE_WORKING_DIR
  1451. alias le=\"$LE_WORKING_DIR/le.sh\"
  1452. alias le.sh=\"$LE_WORKING_DIR/le.sh\"
  1453. " > "$LE_WORKING_DIR/le.env"
  1454. echo "" >> "$_profile"
  1455. _setopt "$_profile" "source \"$LE_WORKING_DIR/le.env\""
  1456. _info "OK, Close and reopen your terminal to start using le"
  1457. else
  1458. _info "No profile is found, you will need to go into $LE_WORKING_DIR to use le.sh"
  1459. fi
  1460. mkdir -p $LE_WORKING_DIR/dnsapi
  1461. cp dnsapi/* $LE_WORKING_DIR/dnsapi/
  1462. #to keep compatible mv the .acc file to .key file
  1463. if [[ -f "$LE_WORKING_DIR/account.acc" ]] ; then
  1464. mv "$LE_WORKING_DIR/account.acc" "$LE_WORKING_DIR/account.key"
  1465. fi
  1466. if [[ ! -f "$ACCOUNT_CONF_PATH" ]] ; then
  1467. _initconf
  1468. fi
  1469. _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
  1470. _setopt "$ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
  1471. installcronjob
  1472. _info OK
  1473. }
  1474. uninstall() {
  1475. uninstallcronjob
  1476. _initpath
  1477. _profile="$(_detect_profile)"
  1478. if [[ "$_profile" ]] ; then
  1479. text="$(cat $_profile)"
  1480. echo "$text" | sed "s|^source.*le.env.*$||" > "$_profile"
  1481. fi
  1482. rm -f $LE_WORKING_DIR/le.sh
  1483. _info "The keys and certs are in $LE_WORKING_DIR, you can remove them by yourself."
  1484. }
  1485. cron() {
  1486. IN_CRON=1
  1487. renewAll
  1488. IN_CRON=""
  1489. }
  1490. version() {
  1491. echo "$PROJECT"
  1492. echo "v$VER"
  1493. }
  1494. showhelp() {
  1495. version
  1496. echo "Usage: le.sh command ...[parameters]....
  1497. Commands:
  1498. --help, -h Show this help message.
  1499. --version, -v Show version info.
  1500. --install Install le.sh to your system.
  1501. --uninstall Uninstall le.sh, and uninstall the cron job.
  1502. --issue Issue a cert.
  1503. --installcert Install the issued cert to apache/nginx or any other server.
  1504. --renew, -r Renew a cert.
  1505. --renewAll Renew all the certs
  1506. --revoke Revoke a cert.
  1507. --installcronjob Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
  1508. --uninstallcronjob Uninstall the cron job. The 'uninstall' command can do this automatically.
  1509. --cron Run cron job to renew all the certs.
  1510. --toPkcs Export the certificate and key to a pfx file.
  1511. --createAccountKey, -cak Create an account private key, professional use.
  1512. --createDomainKey, -cdk Create an domain private key, professional use.
  1513. --createCSR, -ccsr Create CSR , professional use.
  1514. Parameters:
  1515. --domain, -d domain.tld Specifies a domain, used to issue, renew or revoke etc.
  1516. --force, -f Used to force to install or force to renew a cert immediately.
  1517. --staging, --test Use staging server, just for test.
  1518. --debug Output debug info.
  1519. --webroot, -w /path/to/webroot Specifies the web root folder for web root mode.
  1520. --standalone Use standalone mode.
  1521. --apache Use apache mode.
  1522. --dns [dns-cf|dns-dp|dns-cx|/path/to/api/file] Use dns mode or dns api.
  1523. --keylength, -k [2048] Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
  1524. --accountkeylength, -ak [2048] Specifies the account key length.
  1525. These parameters are to install the cert to nginx/apache or anyother server after issue/renew a cert:
  1526. --certpath /path/to/real/cert/file After issue/renew, the cert will be copied to this path.
  1527. --keypath /path/to/real/key/file After issue/renew, the key will be copied to this path.
  1528. --capath /path/to/real/ca/file After issue/renew, the intermediate cert will be copied to this path.
  1529. --fullchainpath /path/to/fullchain/file After issue/renew, the fullchain cert will be copied to this path.
  1530. --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
  1531. --accountconf Specifies a customized account config file.
  1532. --leworkingdir Specifies the home dir for le.sh
  1533. "
  1534. }
  1535. _installOnline() {
  1536. _info "Installing from online archive."
  1537. if [[ ! "$BRANCH" ]] ; then
  1538. BRANCH="master"
  1539. fi
  1540. _initpath
  1541. target="$PROJECT/archive/$BRANCH.tar.gz"
  1542. _info "Downloading $target"
  1543. localname="$BRANCH.tar.gz"
  1544. if ! _get "$target" > $localname ; then
  1545. _debug "Download error."
  1546. return 1
  1547. fi
  1548. _info "Extracting $localname"
  1549. tar xzf $localname
  1550. cd "le-$BRANCH"
  1551. chmod +x le.sh
  1552. if ./le.sh install ; then
  1553. _info "Install success!"
  1554. fi
  1555. cd ..
  1556. rm -rf "le-$BRANCH"
  1557. rm -f "$localname"
  1558. }
  1559. _process() {
  1560. _CMD=""
  1561. _domain=""
  1562. _altdomains="no"
  1563. _webroot=""
  1564. _keylength="no"
  1565. _accountkeylength="no"
  1566. _certpath="no"
  1567. _keypath="no"
  1568. _capath="no"
  1569. _fullchainpath="no"
  1570. _reloadcmd="no"
  1571. _password=""
  1572. while (( ${#} )); do
  1573. case "${1}" in
  1574. --help|-h)
  1575. showhelp
  1576. return
  1577. ;;
  1578. --version|-v)
  1579. version
  1580. return
  1581. ;;
  1582. --install)
  1583. _CMD="install"
  1584. ;;
  1585. --uninstall)
  1586. _CMD="uninstall"
  1587. ;;
  1588. --issue)
  1589. _CMD="issue"
  1590. ;;
  1591. --installcert|-i)
  1592. _CMD="installcert"
  1593. ;;
  1594. --renew|-r)
  1595. _CMD="renew"
  1596. ;;
  1597. --renewAll|-renewall)
  1598. _CMD="renewAll"
  1599. ;;
  1600. --revoke)
  1601. _CMD="revoke"
  1602. ;;
  1603. --installcronjob)
  1604. _CMD="installcronjob"
  1605. ;;
  1606. --uninstallcronjob)
  1607. _CMD="uninstallcronjob"
  1608. ;;
  1609. --cron)
  1610. _CMD="cron"
  1611. ;;
  1612. --toPkcs)
  1613. _CMD="toPkcs"
  1614. ;;
  1615. --createAccountKey|--createaccountkey|-cak)
  1616. _CMD="createAccountKey"
  1617. ;;
  1618. --createDomainKey|--createdomainkey|-cdk)
  1619. _CMD="createDomainKey"
  1620. ;;
  1621. --createCSR|--createcsr|-ccr)
  1622. _CMD="createCSR"
  1623. ;;
  1624. --domain|-d)
  1625. _dvalue="$2"
  1626. if [[ -z "$_dvalue" ]] || [[ "$_dvalue" == "-"* ]] ; then
  1627. _err "'$_dvalue' is not a valid domain for parameter '$1'"
  1628. return 1
  1629. fi
  1630. if [[ -z "$_domain" ]] ; then
  1631. _domain="$_dvalue"
  1632. else
  1633. if [[ "$_altdomains" == "no" ]] ; then
  1634. _altdomains="$_dvalue"
  1635. else
  1636. _altdomains="$_altdomains,$_dvalue"
  1637. fi
  1638. fi
  1639. shift
  1640. ;;
  1641. --force|-f)
  1642. FORCE="1"
  1643. ;;
  1644. --staging|--test)
  1645. STAGE="1"
  1646. ;;
  1647. --debug)
  1648. if [[ "$2" == "-"* ]] || [[ -z "$2" ]]; then
  1649. DEBUG="1"
  1650. else
  1651. DEBUG="$2"
  1652. shift
  1653. fi
  1654. ;;
  1655. --webroot|-w)
  1656. wvalue="$2"
  1657. if [[ -z "$_webroot" ]] ; then
  1658. _webroot="$wvalue"
  1659. else
  1660. _webroot="$_webroot,$wvalue"
  1661. fi
  1662. shift
  1663. ;;
  1664. --standalone)
  1665. wvalue="no"
  1666. if [[ -z "$_webroot" ]] ; then
  1667. _webroot="$wvalue"
  1668. else
  1669. _webroot="$_webroot,$wvalue"
  1670. fi
  1671. ;;
  1672. --apache)
  1673. wvalue="apache"
  1674. if [[ -z "$_webroot" ]] ; then
  1675. _webroot="$wvalue"
  1676. else
  1677. _webroot="$_webroot,$wvalue"
  1678. fi
  1679. ;;
  1680. --dns)
  1681. wvalue="dns"
  1682. if [[ "$2" != "-"* ]] ; then
  1683. wvalue="$2"
  1684. shift
  1685. fi
  1686. if [[ -z "$_webroot" ]] ; then
  1687. _webroot="$wvalue"
  1688. else
  1689. _webroot="$_webroot,$wvalue"
  1690. fi
  1691. ;;
  1692. --keylength|-k)
  1693. _keylength="$2"
  1694. accountkeylength="$2"
  1695. shift
  1696. ;;
  1697. --accountkeylength|-ak)
  1698. accountkeylength="$2"
  1699. shift
  1700. ;;
  1701. --certpath)
  1702. _certpath="$2"
  1703. shift
  1704. ;;
  1705. --keypath)
  1706. _keypath="$2"
  1707. shift
  1708. ;;
  1709. --capath)
  1710. _capath="$2"
  1711. shift
  1712. ;;
  1713. --fullchainpath)
  1714. _fullchainpath="$2"
  1715. shift
  1716. ;;
  1717. --reloadcmd)
  1718. _reloadcmd="$2"
  1719. shift
  1720. ;;
  1721. --password)
  1722. _password="$2"
  1723. shift
  1724. ;;
  1725. --accountconf)
  1726. ACCOUNT_CONF_PATH="$2"
  1727. ;;
  1728. --leworkingdir)
  1729. LE_WORKING_DIR="$2"
  1730. ;;
  1731. *)
  1732. _err "Unknown parameter : $1"
  1733. return 1
  1734. ;;
  1735. esac
  1736. shift 1
  1737. done
  1738. case "${_CMD}" in
  1739. install) install ;;
  1740. uninstall) uninstall ;;
  1741. issue)
  1742. issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_certpath" "$_keylength" "$_capath" "$_reloadcmd" "$_fullchainpath"
  1743. ;;
  1744. installcert)
  1745. installcert "$_domain" "$_certpath" "$_keylength" "$_capath" "$_reloadcmd" "$_fullchainpath"
  1746. ;;
  1747. renew)
  1748. renew "$_domain"
  1749. ;;
  1750. renewAll)
  1751. renewAll
  1752. ;;
  1753. revoke)
  1754. revoke "$_domain"
  1755. ;;
  1756. installcronjob) installcronjob ;;
  1757. uninstallcronjob) uninstallcronjob ;;
  1758. cron) cron ;;
  1759. toPkcs)
  1760. toPkcs "$_domain" "$_password"
  1761. ;;
  1762. createAccountKey)
  1763. createAccountKey "$_domain" "$_accountkeylength"
  1764. ;;
  1765. createDomainKey)
  1766. createDomainKey "$_domain" "$_keylength"
  1767. ;;
  1768. createCSR)
  1769. createCSR "$_domain" "$_altdomains"
  1770. ;;
  1771. *)
  1772. _err "Invalid command: $_CMD"
  1773. showhelp;
  1774. return 1
  1775. ;;
  1776. esac
  1777. }
  1778. if [[ "$INSTALLONLINE" ]] ; then
  1779. INSTALLONLINE=""
  1780. _installOnline $BRANCH
  1781. exit
  1782. fi
  1783. if [[ -z "$1" ]] ; then
  1784. showhelp
  1785. else
  1786. if [[ "$1" == "-"* ]] ; then
  1787. _process "$@"
  1788. else
  1789. "$@"
  1790. fi
  1791. fi