You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1701 lines
41 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. #!/usr/bin/env bash
  2. VER=1.2.2
  3. PROJECT="https://github.com/Neilpang/le"
  4. DEFAULT_CA="https://acme-v01.api.letsencrypt.org"
  5. DEFAULT_AGREEMENT="https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf"
  6. DEFAULT_USER_AGENT="le.sh client: $PROJECT"
  7. STAGE_CA="https://acme-staging.api.letsencrypt.org"
  8. VTYPE_HTTP="http-01"
  9. VTYPE_DNS="dns-01"
  10. BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  11. END_CSR="-----END CERTIFICATE REQUEST-----"
  12. BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  13. END_CERT="-----END CERTIFICATE-----"
  14. if [ -z "$AGREEMENT" ] ; then
  15. AGREEMENT="$DEFAULT_AGREEMENT"
  16. fi
  17. _info() {
  18. if [ -z "$2" ] ; then
  19. echo "$1"
  20. else
  21. echo "$1"="$2"
  22. fi
  23. }
  24. _err() {
  25. if [ -z "$2" ] ; then
  26. echo "$1" >&2
  27. else
  28. echo "$1"="'$2'" >&2
  29. fi
  30. return 1
  31. }
  32. _debug() {
  33. if [ -z "$DEBUG" ] ; then
  34. return
  35. fi
  36. _err "$1" "$2"
  37. return 0
  38. }
  39. _exists() {
  40. cmd="$1"
  41. if [ -z "$cmd" ] ; then
  42. _err "Usage: _exists cmd"
  43. return 1
  44. fi
  45. command -v $cmd >/dev/null 2>&1
  46. ret="$?"
  47. _debug "$cmd exists=$ret"
  48. return $ret
  49. }
  50. _h2b() {
  51. hex=$(cat)
  52. i=1
  53. j=2
  54. while [ '1' ] ; do
  55. h=$(printf $hex | cut -c $i-$j)
  56. if [ -z "$h" ] ; then
  57. break;
  58. fi
  59. printf "\x$h"
  60. let "i+=2"
  61. let "j+=2"
  62. done
  63. }
  64. #options file
  65. _sed_i() {
  66. options="$1"
  67. filename="$2"
  68. if [ -z "$filename" ] ; then
  69. _err "Usage:_sed_i options filename"
  70. return 1
  71. fi
  72. if sed -h 2>&1 | grep "\-i[SUFFIX]" ; then
  73. _debug "Using sed -i"
  74. sed -i ""
  75. else
  76. _debug "No -i support in sed"
  77. text="$(cat $filename)"
  78. echo "$text" | sed "$options" > "$filename"
  79. fi
  80. }
  81. #Usage: file startline endline
  82. _getfile() {
  83. filename="$1"
  84. startline="$2"
  85. endline="$3"
  86. if [ -z "$endline" ] ; then
  87. _err "Usage: file startline endline"
  88. return 1
  89. fi
  90. i="$(grep -n -- "$startline" $filename | cut -d : -f 1)"
  91. if [ -z "$i" ] ; then
  92. _err "Can not find start line: $startline"
  93. return 1
  94. fi
  95. let "i+=1"
  96. _debug i $i
  97. j="$(grep -n -- "$endline" $filename | cut -d : -f 1)"
  98. if [ -z "$j" ] ; then
  99. _err "Can not find end line: $endline"
  100. return 1
  101. fi
  102. let "j-=1"
  103. _debug j $j
  104. sed -n $i,${j}p "$filename"
  105. }
  106. #Usage: multiline
  107. _base64() {
  108. if [ "$1" ] ; then
  109. openssl base64 -e
  110. else
  111. openssl base64 -e | tr -d '\r\n'
  112. fi
  113. }
  114. #Usage: multiline
  115. _dbase64() {
  116. if [ "$1" ] ; then
  117. openssl base64 -d -A
  118. else
  119. openssl base64 -d
  120. fi
  121. }
  122. #Usage: hashalg
  123. #Output Base64-encoded digest
  124. _digest() {
  125. alg="$1"
  126. if [ -z "$alg" ] ; then
  127. _err "Usage: _digest hashalg"
  128. return 1
  129. fi
  130. if [ "$alg" == "sha256" ] ; then
  131. openssl dgst -sha256 -binary | _base64
  132. else
  133. _err "$alg is not supported yet"
  134. return 1
  135. fi
  136. }
  137. #Usage: keyfile hashalg
  138. #Output: Base64-encoded signature value
  139. _sign() {
  140. keyfile="$1"
  141. alg="$2"
  142. if [ -z "$alg" ] ; then
  143. _err "Usage: _sign keyfile hashalg"
  144. return 1
  145. fi
  146. if [ "$alg" == "sha256" ] ; then
  147. openssl dgst -sha256 -sign "$keyfile" | _base64
  148. else
  149. _err "$alg is not supported yet"
  150. return 1
  151. fi
  152. }
  153. _ss() {
  154. _port="$1"
  155. if _exists "ss" ; then
  156. _debug "Using: ss"
  157. ss -ntpl | grep :$_port" "
  158. return 0
  159. fi
  160. if _exists "netstat" ; then
  161. _debug "Using: netstat"
  162. if netstat -h 2>&1 | grep "\-p proto" >/dev/null ; then
  163. #for windows version netstat tool
  164. netstat -anb -p tcp | grep "LISTENING" | grep :$_port" "
  165. else
  166. if netstat -help 2>&1 | grep "\-p protocol" >/dev/null ; then
  167. netstat -an -p tcp | grep LISTEN | grep :$_port" "
  168. else
  169. netstat -ntpl | grep :$_port" "
  170. fi
  171. fi
  172. return 0
  173. fi
  174. return 1
  175. }
  176. #domain [2048]
  177. createAccountKey() {
  178. _info "Creating account key"
  179. if [ -z "$1" ] ; then
  180. echo Usage: createAccountKey account-domain [2048]
  181. return
  182. fi
  183. account=$1
  184. length=$2
  185. if [[ "$length" == "ec-"* ]] ; then
  186. length=2048
  187. fi
  188. if [ -z "$2" ] ; then
  189. _info "Use default length 2048"
  190. length=2048
  191. fi
  192. _initpath
  193. if [ -f "$ACCOUNT_KEY_PATH" ] ; then
  194. _info "Account key exists, skip"
  195. return
  196. else
  197. #generate account key
  198. openssl genrsa $length 2>/dev/null > "$ACCOUNT_KEY_PATH"
  199. fi
  200. }
  201. #domain length
  202. createDomainKey() {
  203. _info "Creating domain key"
  204. if [ -z "$1" ] ; then
  205. echo Usage: createDomainKey domain [2048]
  206. return
  207. fi
  208. domain=$1
  209. length=$2
  210. isec=""
  211. if [[ "$length" == "ec-"* ]] ; then
  212. isec="1"
  213. length=$(printf $length | cut -d '-' -f 2-100)
  214. eccname="$length"
  215. fi
  216. if [ -z "$length" ] ; then
  217. if [ "$isec" ] ; then
  218. length=256
  219. else
  220. length=2048
  221. fi
  222. fi
  223. _info "Use length $length"
  224. if [ "$isec" ] ; then
  225. if [ "$length" == "256" ] ; then
  226. eccname="prime256v1"
  227. fi
  228. if [ "$length" == "384" ] ; then
  229. eccname="secp384r1"
  230. fi
  231. if [ "$length" == "521" ] ; then
  232. eccname="secp521r1"
  233. fi
  234. _info "Using ec name: $eccname"
  235. fi
  236. _initpath $domain
  237. if [ ! -f "$CERT_KEY_PATH" ] || ( [ "$FORCE" ] && ! [ "$IS_RENEW" ] ); then
  238. #generate account key
  239. if [ "$isec" ] ; then
  240. openssl ecparam -name $eccname -genkey 2>/dev/null > "$CERT_KEY_PATH"
  241. else
  242. openssl genrsa $length 2>/dev/null > "$CERT_KEY_PATH"
  243. fi
  244. else
  245. if [ "$IS_RENEW" ] ; then
  246. _info "Domain key exists, skip"
  247. return 0
  248. else
  249. _err "Domain key exists, do you want to overwrite the key?"
  250. _err "Set FORCE=1, and try again."
  251. return 1
  252. fi
  253. fi
  254. }
  255. # domain domainlist
  256. createCSR() {
  257. _info "Creating csr"
  258. if [ -z "$1" ] ; then
  259. echo Usage: $0 domain [domainlist]
  260. return
  261. fi
  262. domain=$1
  263. _initpath $domain
  264. domainlist=$2
  265. if [ -f "$CSR_PATH" ] && [ "$IS_RENEW" ] && ! [ "$FORCE" ]; then
  266. _info "CSR exists, skip"
  267. return
  268. fi
  269. if [ -z "$domainlist" ] ; then
  270. #single domain
  271. _info "Single domain" $domain
  272. printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\n" > "$DOMAIN_SSL_CONF"
  273. openssl req -new -sha256 -key "$CERT_KEY_PATH" -subj "/CN=$domain" -config "$DOMAIN_SSL_CONF" -out "$CSR_PATH"
  274. else
  275. alt="DNS:$(echo $domainlist | sed "s/,/,DNS:/g")"
  276. #multi
  277. _info "Multi domain" "$alt"
  278. printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\n[SAN]\nsubjectAltName=$alt" > "$DOMAIN_SSL_CONF"
  279. openssl req -new -sha256 -key "$CERT_KEY_PATH" -subj "/CN=$domain" -reqexts SAN -config "$DOMAIN_SSL_CONF" -out "$CSR_PATH"
  280. fi
  281. }
  282. _urlencode() {
  283. __n=$(cat)
  284. echo $__n | tr '/+' '_-' | tr -d '= '
  285. }
  286. _time2str() {
  287. #BSD
  288. if date -u -d@$1 2>/dev/null ; then
  289. return
  290. fi
  291. #Linux
  292. if date -u -r $1 2>/dev/null ; then
  293. return
  294. fi
  295. }
  296. _stat() {
  297. #Linux
  298. if stat -c '%U:%G' "$1" 2>/dev/null ; then
  299. return
  300. fi
  301. #BSD
  302. if stat -f '%Su:%Sg' "$1" 2>/dev/null ; then
  303. return
  304. fi
  305. }
  306. #keyfile
  307. _calcjwk() {
  308. keyfile="$1"
  309. if [ -z "$keyfile" ] ; then
  310. _err "Usage: _calcjwk keyfile"
  311. return 1
  312. fi
  313. EC_SIGN=""
  314. if grep "BEGIN RSA PRIVATE KEY" "$keyfile" > /dev/null 2>&1 ; then
  315. _debug "RSA key"
  316. pub_exp=$(openssl rsa -in $keyfile -noout -text | grep "^publicExponent:"| cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
  317. if [ "${#pub_exp}" == "5" ] ; then
  318. pub_exp=0$pub_exp
  319. fi
  320. _debug pub_exp "$pub_exp"
  321. e=$(echo $pub_exp | _h2b | _base64)
  322. _debug e "$e"
  323. modulus=$(openssl rsa -in $keyfile -modulus -noout | cut -d '=' -f 2 )
  324. n=$(echo $modulus| _h2b | _base64 | _urlencode )
  325. jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
  326. _debug jwk "$jwk"
  327. HEADER='{"alg": "RS256", "jwk": '$jwk'}'
  328. HEADERPLACE='{"nonce": "NONCE", "alg": "RS256", "jwk": '$jwk'}'
  329. elif grep "BEGIN EC PRIVATE KEY" "$keyfile" > /dev/null 2>&1 ; then
  330. _debug "EC key"
  331. EC_SIGN="1"
  332. crv="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
  333. _debug crv $crv
  334. pubi="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
  335. _debug pubi $pubi
  336. let "pubi=pubi+1"
  337. pubj="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
  338. _debug pubj $pubj
  339. let "pubj=pubj-1"
  340. pubtext="$(openssl ec -in $keyfile -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
  341. _debug pubtext "$pubtext"
  342. xlen="$(printf "$pubtext" | tr -d ':' | wc -c)"
  343. let "xlen=xlen/4"
  344. _debug xlen $xlen
  345. let "xend=xlen+1"
  346. x="$(printf $pubtext | cut -d : -f 2-$xend)"
  347. _debug x $x
  348. x64="$(printf $x | tr -d : | _h2b | _base64 | _urlencode)"
  349. _debug x64 $x64
  350. let "xend+=1"
  351. y="$(printf $pubtext | cut -d : -f $xend-10000)"
  352. _debug y $y
  353. y64="$(printf $y | tr -d : | _h2b | _base64 | _urlencode)"
  354. _debug y64 $y64
  355. jwk='{"kty": "EC", "crv": "'$crv'", "x": "'$x64'", "y": "'$y64'"}'
  356. _debug jwk "$jwk"
  357. HEADER='{"alg": "ES256", "jwk": '$jwk'}'
  358. HEADERPLACE='{"nonce": "NONCE", "alg": "ES256", "jwk": '$jwk'}'
  359. else
  360. _err "Only RSA or EC key is supported."
  361. return 1
  362. fi
  363. _debug HEADER "$HEADER"
  364. }
  365. # body url [needbase64]
  366. _post() {
  367. body="$1"
  368. url="$2"
  369. needbase64="$3"
  370. if _exists "curl" ; then
  371. CURL="$CURL --dump-header $HTTP_HEADER "
  372. if [ "$needbase64" ] ; then
  373. response="$($CURL -A "User-Agent: $USER_AGENT" -X POST --data "$body" $url | _base64)"
  374. else
  375. response="$($CURL -A "User-Agent: $USER_AGENT" -X POST --data "$body" $url)"
  376. fi
  377. else
  378. if [ "$needbase64" ] ; then
  379. response="$($WGET -S -O - --user-agent="$USER_AGENT" --post-data="$body" $url 2>"$HTTP_HEADER" | _base64)"
  380. else
  381. response="$($WGET -S -O - --user-agent="$USER_AGENT" --post-data="$body" $url 2>"$HTTP_HEADER")"
  382. fi
  383. _sed_i "s/^ *//g" "$HTTP_HEADER"
  384. fi
  385. echo -n "$response"
  386. }
  387. # url getheader
  388. _get() {
  389. url="$1"
  390. onlyheader="$2"
  391. _debug url $url
  392. if _exists "curl" ; then
  393. if [ "$onlyheader" ] ; then
  394. $CURL -I -A "User-Agent: $USER_AGENT" $url
  395. else
  396. $CURL -A "User-Agent: $USER_AGENT" $url
  397. fi
  398. else
  399. _debug "WGET" "$WGET"
  400. if [ "$onlyheader" ] ; then
  401. eval $WGET --user-agent=\"$USER_AGENT\" -S -O /dev/null $url 2>&1 | sed 's/^[ ]*//g'
  402. else
  403. eval $WGET --user-agent=\"$USER_AGENT\" -O - $url
  404. fi
  405. fi
  406. ret=$?
  407. return $ret
  408. }
  409. # url payload needbase64 keyfile
  410. _send_signed_request() {
  411. url=$1
  412. payload=$2
  413. needbase64=$3
  414. keyfile=$4
  415. if [ -z "$keyfile" ] ; then
  416. keyfile="$ACCOUNT_KEY_PATH"
  417. fi
  418. _debug url $url
  419. _debug payload "$payload"
  420. if ! _calcjwk "$keyfile" ; then
  421. return 1
  422. fi
  423. payload64=$(echo -n $payload | _base64 | _urlencode)
  424. _debug payload64 $payload64
  425. nonceurl="$API/directory"
  426. nonce="$(_get $nonceurl "onlyheader" | grep -o "Replay-Nonce:.*$" | head -1 | tr -d "\r\n" | cut -d ' ' -f 2)"
  427. _debug nonce "$nonce"
  428. protected="$(printf "$HEADERPLACE" | sed "s/NONCE/$nonce/" )"
  429. _debug protected "$protected"
  430. protected64="$(printf "$protected" | _base64 | _urlencode)"
  431. _debug protected64 "$protected64"
  432. sig=$(echo -n "$protected64.$payload64" | _sign "$keyfile" "sha256" | _urlencode)
  433. _debug sig "$sig"
  434. body="{\"header\": $HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
  435. _debug body "$body"
  436. response="$(_post "$body" $url "$needbase64" )"
  437. responseHeaders="$(cat $HTTP_HEADER)"
  438. _debug responseHeaders "$responseHeaders"
  439. _debug response "$response"
  440. code="$(grep "^HTTP" $HTTP_HEADER | tail -1 | cut -d " " -f 2 | tr -d "\r\n" )"
  441. _debug code $code
  442. }
  443. #setopt "file" "opt" "=" "value" [";"]
  444. _setopt() {
  445. __conf="$1"
  446. __opt="$2"
  447. __sep="$3"
  448. __val="$4"
  449. __end="$5"
  450. if [ -z "$__opt" ] ; then
  451. echo usage: _setopt '"file" "opt" "=" "value" [";"]'
  452. return
  453. fi
  454. if [ ! -f "$__conf" ] ; then
  455. touch "$__conf"
  456. fi
  457. if grep -H -n "^$__opt$__sep" "$__conf" > /dev/null ; then
  458. _debug OK
  459. if [[ "$__val" == *"&"* ]] ; then
  460. __val="$(echo $__val | sed 's/&/\\&/g')"
  461. fi
  462. text="$(cat $__conf)"
  463. echo "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" > "$__conf"
  464. elif grep -H -n "^#$__opt$__sep" "$__conf" > /dev/null ; then
  465. if [[ "$__val" == *"&"* ]] ; then
  466. __val="$(echo $__val | sed 's/&/\\&/g')"
  467. fi
  468. text="$(cat $__conf)"
  469. echo "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" > "$__conf"
  470. else
  471. _debug APP
  472. echo "$__opt$__sep$__val$__end" >> "$__conf"
  473. fi
  474. _debug "$(grep -H -n "^$__opt$__sep" $__conf)"
  475. }
  476. #_savedomainconf key value
  477. #save to domain.conf
  478. _savedomainconf() {
  479. key="$1"
  480. value="$2"
  481. if [ "$DOMAIN_CONF" ] ; then
  482. _setopt $DOMAIN_CONF "$key" "=" "$value"
  483. else
  484. _err "DOMAIN_CONF is empty, can not save $key=$value"
  485. fi
  486. }
  487. #_saveaccountconf key value
  488. _saveaccountconf() {
  489. key="$1"
  490. value="$2"
  491. if [ "$ACCOUNT_CONF_PATH" ] ; then
  492. _setopt $ACCOUNT_CONF_PATH "$key" "=" "\"$value\""
  493. else
  494. _err "ACCOUNT_CONF_PATH is empty, can not save $key=$value"
  495. fi
  496. }
  497. _startserver() {
  498. content="$1"
  499. nchelp="$(nc -h 2>&1)"
  500. if echo "$nchelp" | grep "\-q[ ,]" >/dev/null ; then
  501. _NC="nc -q 1 -l"
  502. else
  503. if echo "$nchelp" | grep "GNU netcat" >/dev/null && echo "$nchelp" | grep "\-c, \-\-close" >/dev/null ; then
  504. _NC="nc -c -l"
  505. elif echo "$nchelp" | grep "\-N" |grep "Shutdown the network socket after EOF on stdin" >/dev/null ; then
  506. _NC="nc -N -l"
  507. else
  508. _NC="nc -l"
  509. fi
  510. fi
  511. _debug "_NC" "$_NC"
  512. # while true ; do
  513. if [ "$DEBUG" ] ; then
  514. if ! echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC -p $Le_HTTPPort -vv ; then
  515. echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC $Le_HTTPPort -vv ;
  516. fi
  517. else
  518. if ! echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC -p $Le_HTTPPort > /dev/null 2>&1; then
  519. echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC $Le_HTTPPort > /dev/null 2>&1
  520. fi
  521. fi
  522. if [ "$?" != "0" ] ; then
  523. _err "nc listen error."
  524. return 1
  525. fi
  526. # done
  527. }
  528. _stopserver() {
  529. pid="$1"
  530. }
  531. _initpath() {
  532. if [ -z "$LE_WORKING_DIR" ]; then
  533. LE_WORKING_DIR=$HOME/.le
  534. fi
  535. if [ -z "$ACCOUNT_CONF_PATH" ] ; then
  536. ACCOUNT_CONF_PATH="$LE_WORKING_DIR/account.conf"
  537. fi
  538. if [ -f "$ACCOUNT_CONF_PATH" ] ; then
  539. source "$ACCOUNT_CONF_PATH"
  540. fi
  541. if [[ "$IN_CRON" ]] ; then
  542. if [[ ! "$_USER_PATH_EXPORTED" ]] ; then
  543. _USER_PATH_EXPORTED=1
  544. export PATH="$USER_PATH:$PATH"
  545. fi
  546. fi
  547. if [ -z "$API" ] ; then
  548. if [ -z "$STAGE" ] ; then
  549. API="$DEFAULT_CA"
  550. else
  551. API="$STAGE_CA"
  552. _info "Using stage api:$API"
  553. fi
  554. fi
  555. if [ -z "$ACME_DIR" ] ; then
  556. ACME_DIR="/home/.acme"
  557. fi
  558. if [ -z "$APACHE_CONF_BACKUP_DIR" ] ; then
  559. APACHE_CONF_BACKUP_DIR="$LE_WORKING_DIR"
  560. fi
  561. if [ -z "$USER_AGENT" ] ; then
  562. USER_AGENT="$DEFAULT_USER_AGENT"
  563. fi
  564. HTTP_HEADER="$LE_WORKING_DIR/http.header"
  565. WGET="wget -q"
  566. if [ "$DEBUG" ] ; then
  567. WGET="$WGET -d "
  568. fi
  569. dp="$LE_WORKING_DIR/curl.dump"
  570. CURL="curl -L --silent"
  571. if [ "$DEBUG" ] ; then
  572. CURL="$CURL -L --trace-ascii $dp "
  573. fi
  574. domain="$1"
  575. if [ -z "$ACCOUNT_KEY_PATH" ] ; then
  576. ACCOUNT_KEY_PATH="$LE_WORKING_DIR/account.key"
  577. fi
  578. if [ -z "$domain" ] ; then
  579. return 0
  580. fi
  581. domainhome="$LE_WORKING_DIR/$domain"
  582. mkdir -p "$domainhome"
  583. if [ -z "$DOMAIN_PATH" ] ; then
  584. DOMAIN_PATH="$domainhome"
  585. fi
  586. if [ -z "$DOMAIN_CONF" ] ; then
  587. DOMAIN_CONF="$domainhome/$domain.conf"
  588. fi
  589. if [ -z "$DOMAIN_SSL_CONF" ] ; then
  590. DOMAIN_SSL_CONF="$domainhome/$domain.ssl.conf"
  591. fi
  592. if [ -z "$CSR_PATH" ] ; then
  593. CSR_PATH="$domainhome/$domain.csr"
  594. fi
  595. if [ -z "$CERT_KEY_PATH" ] ; then
  596. CERT_KEY_PATH="$domainhome/$domain.key"
  597. fi
  598. if [ -z "$CERT_PATH" ] ; then
  599. CERT_PATH="$domainhome/$domain.cer"
  600. fi
  601. if [ -z "$CA_CERT_PATH" ] ; then
  602. CA_CERT_PATH="$domainhome/ca.cer"
  603. fi
  604. if [ -z "$CERT_FULLCHAIN_PATH" ] ; then
  605. CERT_FULLCHAIN_PATH="$domainhome/fullchain.cer"
  606. fi
  607. }
  608. _apachePath() {
  609. httpdconfname="$(apachectl -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"' )"
  610. if [[ "$httpdconfname" == '/'* ]] ; then
  611. httpdconf="$httpdconfname"
  612. httpdconfname="$(basename $httpdconfname)"
  613. else
  614. httpdroot="$(apachectl -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"' )"
  615. httpdconf="$httpdroot/$httpdconfname"
  616. fi
  617. if [ ! -f $httpdconf ] ; then
  618. _err "Apache Config file not found" $httpdconf
  619. return 1
  620. fi
  621. return 0
  622. }
  623. _restoreApache() {
  624. if [ -z "$usingApache" ] ; then
  625. return 0
  626. fi
  627. _initpath
  628. if ! _apachePath ; then
  629. return 1
  630. fi
  631. if [ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ] ; then
  632. _debug "No config file to restore."
  633. return 0
  634. fi
  635. cp -p "$APACHE_CONF_BACKUP_DIR/$httpdconfname" "$httpdconf"
  636. if ! apachectl -t ; then
  637. _err "Sorry, restore apache config error, please contact me."
  638. return 1;
  639. fi
  640. rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
  641. return 0
  642. }
  643. _setApache() {
  644. _initpath
  645. if ! _apachePath ; then
  646. return 1
  647. fi
  648. #backup the conf
  649. _debug "Backup apache config file" $httpdconf
  650. cp -p $httpdconf $APACHE_CONF_BACKUP_DIR/
  651. _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
  652. _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
  653. _info "The backup file will be deleted on sucess, just forget it."
  654. #add alias
  655. echo "
  656. Alias /.well-known/acme-challenge $ACME_DIR
  657. <Directory $ACME_DIR >
  658. Require all granted
  659. </Directory>
  660. " >> $httpdconf
  661. if ! apachectl -t ; then
  662. _err "Sorry, apache config error, please contact me."
  663. _restoreApache
  664. return 1;
  665. fi
  666. if [ ! -d "$ACME_DIR" ] ; then
  667. mkdir -p "$ACME_DIR"
  668. chmod 755 "$ACME_DIR"
  669. fi
  670. if ! apachectl graceful ; then
  671. _err "Sorry, apachectl graceful error, please contact me."
  672. _restoreApache
  673. return 1;
  674. fi
  675. usingApache="1"
  676. return 0
  677. }
  678. _clearup () {
  679. _stopserver $serverproc
  680. serverproc=""
  681. _restoreApache
  682. }
  683. # webroot removelevel tokenfile
  684. _clearupwebbroot() {
  685. __webroot="$1"
  686. if [ -z "$__webroot" ] ; then
  687. _debug "no webroot specified, skip"
  688. return 0
  689. fi
  690. if [ "$2" == '1' ] ; then
  691. _debug "remove $__webroot/.well-known"
  692. rm -rf "$__webroot/.well-known"
  693. elif [ "$2" == '2' ] ; then
  694. _debug "remove $__webroot/.well-known/acme-challenge"
  695. rm -rf "$__webroot/.well-known/acme-challenge"
  696. elif [ "$2" == '3' ] ; then
  697. _debug "remove $__webroot/.well-known/acme-challenge/$3"
  698. rm -rf "$__webroot/.well-known/acme-challenge/$3"
  699. else
  700. _info "Skip for removelevel:$2"
  701. fi
  702. return 0
  703. }
  704. issue() {
  705. if [ -z "$2" ] ; then
  706. _err "Usage: le issue webroot|no|apache|dns a.com [www.a.com,b.com,c.com]|no [key-length]|no"
  707. return 1
  708. fi
  709. Le_Webroot="$1"
  710. Le_Domain="$2"
  711. Le_Alt="$3"
  712. Le_Keylength="$4"
  713. Le_RealCertPath="$5"
  714. Le_RealKeyPath="$6"
  715. Le_RealCACertPath="$7"
  716. Le_ReloadCmd="$8"
  717. _initpath $Le_Domain
  718. if [ -f "$DOMAIN_CONF" ] ; then
  719. Le_NextRenewTime=$(grep "^Le_NextRenewTime=" "$DOMAIN_CONF" | cut -d '=' -f 2)
  720. if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(date -u "+%s" )" -lt "$Le_NextRenewTime" ] ; then
  721. _info "Skip, Next renewal time is: $(grep "^Le_NextRenewTimeStr" "$DOMAIN_CONF" | cut -d '=' -f 2)"
  722. return 2
  723. fi
  724. fi
  725. _setopt "$DOMAIN_CONF" "Le_Domain" "=" "$Le_Domain"
  726. _setopt "$DOMAIN_CONF" "Le_Alt" "=" "$Le_Alt"
  727. _setopt "$DOMAIN_CONF" "Le_Webroot" "=" "$Le_Webroot"
  728. _setopt "$DOMAIN_CONF" "Le_Keylength" "=" "$Le_Keylength"
  729. _setopt "$DOMAIN_CONF" "Le_RealCertPath" "=" "\"$Le_RealCertPath\""
  730. _setopt "$DOMAIN_CONF" "Le_RealCACertPath" "=" "\"$Le_RealCACertPath\""
  731. _setopt "$DOMAIN_CONF" "Le_RealKeyPath" "=" "\"$Le_RealKeyPath\""
  732. _setopt "$DOMAIN_CONF" "Le_ReloadCmd" "=" "\"$Le_ReloadCmd\""
  733. if [ "$Le_Alt" == "no" ] ; then
  734. Le_Alt=""
  735. fi
  736. if [ "$Le_Keylength" == "no" ] ; then
  737. Le_Keylength=""
  738. fi
  739. if [ "$Le_RealCertPath" == "no" ] ; then
  740. Le_RealCertPath=""
  741. fi
  742. if [ "$Le_RealKeyPath" == "no" ] ; then
  743. Le_RealKeyPath=""
  744. fi
  745. if [ "$Le_RealCACertPath" == "no" ] ; then
  746. Le_RealCACertPath=""
  747. fi
  748. if [ "$Le_ReloadCmd" == "no" ] ; then
  749. Le_ReloadCmd=""
  750. fi
  751. if [ "$Le_Webroot" == "no" ] ; then
  752. _info "Standalone mode."
  753. if ! command -v "nc" > /dev/null ; then
  754. _err "Please install netcat(nc) tools first."
  755. return 1
  756. fi
  757. if [ -z "$Le_HTTPPort" ] ; then
  758. Le_HTTPPort=80
  759. fi
  760. _setopt "$DOMAIN_CONF" "Le_HTTPPort" "=" "$Le_HTTPPort"
  761. netprc="$(_ss "$Le_HTTPPort" | grep "$Le_HTTPPort")"
  762. if [ "$netprc" ] ; then
  763. _err "$netprc"
  764. _err "tcp port $Le_HTTPPort is already used by $(echo "$netprc" | cut -d : -f 4)"
  765. _err "Please stop it first"
  766. return 1
  767. fi
  768. fi
  769. if [ "$Le_Webroot" == "apache" ] ; then
  770. if ! _setApache ; then
  771. _err "set up apache error. Report error to me."
  772. return 1
  773. fi
  774. wellknown_path="$ACME_DIR"
  775. else
  776. usingApache=""
  777. fi
  778. createAccountKey $Le_Domain $Le_Keylength
  779. if ! _calcjwk "$ACCOUNT_KEY_PATH" ; then
  780. return 1
  781. fi
  782. accountkey_json=$(echo -n "$jwk" | tr -d ' ' )
  783. thumbprint=$(echo -n "$accountkey_json" | _digest "sha256" | _urlencode)
  784. accountkeyhash="$(cat "$ACCOUNT_KEY_PATH" | _digest "sha256" )"
  785. if [ "$accountkeyhash" != "$ACCOUNT_KEY_HASH" ] ; then
  786. _info "Registering account"
  787. regjson='{"resource": "new-reg", "agreement": "'$AGREEMENT'"}'
  788. if [ "$ACCOUNT_EMAIL" ] ; then
  789. regjson='{"resource": "new-reg", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
  790. fi
  791. _send_signed_request "$API/acme/new-reg" "$regjson"
  792. if [ "$code" == "" ] || [ "$code" == '201' ] ; then
  793. _info "Registered"
  794. echo $response > $LE_WORKING_DIR/account.json
  795. elif [ "$code" == '409' ] ; then
  796. _info "Already registered"
  797. else
  798. _err "Register account Error: $response"
  799. _clearup
  800. return 1
  801. fi
  802. ACCOUNT_KEY_HASH="$accountkeyhash"
  803. _saveaccountconf "ACCOUNT_KEY_HASH" "$ACCOUNT_KEY_HASH"
  804. else
  805. _info "Skip register account key"
  806. fi
  807. if ! createDomainKey $Le_Domain $Le_Keylength ; then
  808. _err "Create domain key error."
  809. return 1
  810. fi
  811. if ! createCSR $Le_Domain $Le_Alt ; then
  812. _err "Create CSR error."
  813. return 1
  814. fi
  815. vtype="$VTYPE_HTTP"
  816. if [[ "$Le_Webroot" == "dns"* ]] ; then
  817. vtype="$VTYPE_DNS"
  818. fi
  819. vlist="$Le_Vlist"
  820. # verify each domain
  821. _info "Verify each domain"
  822. sep='#'
  823. if [ -z "$vlist" ] ; then
  824. alldomains=$(echo "$Le_Domain,$Le_Alt" | tr ',' ' ' )
  825. for d in $alldomains
  826. do
  827. _info "Getting token for domain" $d
  828. _send_signed_request "$API/acme/new-authz" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$d\"}}"
  829. if [ ! -z "$code" ] && [ ! "$code" == '201' ] ; then
  830. _err "new-authz error: $response"
  831. _clearup
  832. return 1
  833. fi
  834. entry="$(printf $response | egrep -o '\{[^{]*"type":"'$vtype'"[^}]*')"
  835. _debug entry "$entry"
  836. token="$(printf "$entry" | egrep -o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
  837. _debug token $token
  838. uri="$(printf "$entry" | egrep -o '"uri":"[^"]*'| cut -d : -f 2,3 | tr -d '"' )"
  839. _debug uri $uri
  840. keyauthorization="$token.$thumbprint"
  841. _debug keyauthorization "$keyauthorization"
  842. dvlist="$d$sep$keyauthorization$sep$uri"
  843. _debug dvlist "$dvlist"
  844. vlist="$vlist$dvlist,"
  845. done
  846. #add entry
  847. dnsadded=""
  848. ventries=$(echo "$vlist" | tr ',' ' ' )
  849. for ventry in $ventries
  850. do
  851. d=$(echo $ventry | cut -d $sep -f 1)
  852. keyauthorization=$(echo $ventry | cut -d $sep -f 2)
  853. if [ "$vtype" == "$VTYPE_DNS" ] ; then
  854. dnsadded='0'
  855. txtdomain="_acme-challenge.$d"
  856. _debug txtdomain "$txtdomain"
  857. txt="$(echo -e -n $keyauthorization | _digest "sha256" | _urlencode)"
  858. _debug txt "$txt"
  859. #dns
  860. #1. check use api
  861. d_api=""
  862. if [ -f "$LE_WORKING_DIR/$d/$Le_Webroot" ] ; then
  863. d_api="$LE_WORKING_DIR/$d/$Le_Webroot"
  864. elif [ -f "$LE_WORKING_DIR/$d/$Le_Webroot.sh" ] ; then
  865. d_api="$LE_WORKING_DIR/$d/$Le_Webroot.sh"
  866. elif [ -f "$LE_WORKING_DIR/$Le_Webroot" ] ; then
  867. d_api="$LE_WORKING_DIR/$Le_Webroot"
  868. elif [ -f "$LE_WORKING_DIR/$Le_Webroot.sh" ] ; then
  869. d_api="$LE_WORKING_DIR/$Le_Webroot.sh"
  870. elif [ -f "$LE_WORKING_DIR/dnsapi/$Le_Webroot" ] ; then
  871. d_api="$LE_WORKING_DIR/dnsapi/$Le_Webroot"
  872. elif [ -f "$LE_WORKING_DIR/dnsapi/$Le_Webroot.sh" ] ; then
  873. d_api="$LE_WORKING_DIR/dnsapi/$Le_Webroot.sh"
  874. fi
  875. _debug d_api "$d_api"
  876. if [ "$d_api" ]; then
  877. _info "Found domain api file: $d_api"
  878. else
  879. _err "Add the following TXT record:"
  880. _err "Domain: $txtdomain"
  881. _err "TXT value: $txt"
  882. _err "Please be aware that you prepend _acme-challenge. before your domain"
  883. _err "so the resulting subdomain will be: $txtdomain"
  884. continue
  885. fi
  886. (
  887. if ! source $d_api ; then
  888. _err "Load file $d_api error. Please check your api file and try again."
  889. return 1
  890. fi
  891. addcommand="$Le_Webroot-add"
  892. if ! command -v $addcommand ; then
  893. _err "It seems that your api file is not correct, it must have a function named: $addcommand"
  894. return 1
  895. fi
  896. if ! $addcommand $txtdomain $txt ; then
  897. _err "Error add txt for domain:$txtdomain"
  898. return 1
  899. fi
  900. )
  901. if [[ "$?" != "0" ]] ; then
  902. return 1
  903. fi
  904. dnsadded='1'
  905. fi
  906. done
  907. if [ "$dnsadded" == '0' ] ; then
  908. _setopt "$DOMAIN_CONF" "Le_Vlist" "=" "\"$vlist\""
  909. _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
  910. _err "Please add the TXT records to the domains, and retry again."
  911. return 1
  912. fi
  913. fi
  914. if [ "$dnsadded" == '1' ] ; then
  915. _info "Sleep 60 seconds for the txt records to take effect"
  916. sleep 60
  917. fi
  918. _debug "ok, let's start to verify"
  919. ventries=$(echo "$vlist" | tr ',' ' ' )
  920. for ventry in $ventries
  921. do
  922. d=$(echo $ventry | cut -d $sep -f 1)
  923. keyauthorization=$(echo $ventry | cut -d $sep -f 2)
  924. uri=$(echo $ventry | cut -d $sep -f 3)
  925. _info "Verifying:$d"
  926. _debug "d" "$d"
  927. _debug "keyauthorization" "$keyauthorization"
  928. _debug "uri" "$uri"
  929. removelevel=""
  930. token=""
  931. if [ "$vtype" == "$VTYPE_HTTP" ] ; then
  932. if [ "$Le_Webroot" == "no" ] ; then
  933. _info "Standalone mode server"
  934. _startserver "$keyauthorization" &
  935. serverproc="$!"
  936. sleep 2
  937. _debug serverproc $serverproc
  938. else
  939. if [ -z "$wellknown_path" ] ; then
  940. wellknown_path="$Le_Webroot/.well-known/acme-challenge"
  941. fi
  942. _debug wellknown_path "$wellknown_path"
  943. if [ ! -d "$Le_Webroot/.well-known" ] ; then
  944. removelevel='1'
  945. elif [ ! -d "$Le_Webroot/.well-known/acme-challenge" ] ; then
  946. removelevel='2'
  947. else
  948. removelevel='3'
  949. fi
  950. token="$(echo -e -n "$keyauthorization" | cut -d '.' -f 1)"
  951. _debug "writing token:$token to $wellknown_path/$token"
  952. mkdir -p "$wellknown_path"
  953. echo -n "$keyauthorization" > "$wellknown_path/$token"
  954. if [[ ! "$usingApache" ]] ; then
  955. webroot_owner=$(_stat $Le_Webroot)
  956. _debug "Changing owner/group of .well-known to $webroot_owner"
  957. chown -R $webroot_owner "$Le_Webroot/.well-known"
  958. fi
  959. fi
  960. fi
  961. _send_signed_request $uri "{\"resource\": \"challenge\", \"keyAuthorization\": \"$keyauthorization\"}"
  962. if [ ! -z "$code" ] && [ ! "$code" == '202' ] ; then
  963. _err "$d:Challenge error: $response"
  964. _clearupwebbroot "$Le_Webroot" "$removelevel" "$token"
  965. _clearup
  966. return 1
  967. fi
  968. while [ "1" ] ; do
  969. _debug "sleep 5 secs to verify"
  970. sleep 5
  971. _debug "checking"
  972. response="$(_get $uri)"
  973. if [ "$?" != "0" ] ; then
  974. _err "$d:Verify error:$response"
  975. _clearupwebbroot "$Le_Webroot" "$removelevel" "$token"
  976. _clearup
  977. return 1
  978. fi
  979. status=$(echo $response | egrep -o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
  980. if [ "$status" == "valid" ] ; then
  981. _info "Success"
  982. _stopserver $serverproc
  983. serverproc=""
  984. _clearupwebbroot "$Le_Webroot" "$removelevel" "$token"
  985. break;
  986. fi
  987. if [ "$status" == "invalid" ] ; then
  988. error=$(echo $response | egrep -o '"error":{[^}]*}' | grep -o '"detail":"[^"]*"' | cut -d '"' -f 4)
  989. _err "$d:Verify error:$error"
  990. _clearupwebbroot "$Le_Webroot" "$removelevel" "$token"
  991. _clearup
  992. return 1;
  993. fi
  994. if [ "$status" == "pending" ] ; then
  995. _info "Pending"
  996. else
  997. _err "$d:Verify error:$response"
  998. _clearupwebbroot "$Le_Webroot" "$removelevel" "$token"
  999. _clearup
  1000. return 1
  1001. fi
  1002. done
  1003. done
  1004. _clearup
  1005. _info "Verify finished, start to sign."
  1006. der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _urlencode)"
  1007. _send_signed_request "$API/acme/new-cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"
  1008. Le_LinkCert="$(grep -i -o '^Location.*$' $HTTP_HEADER | head -1 | tr -d "\r\n" | cut -d " " -f 2)"
  1009. _setopt "$DOMAIN_CONF" "Le_LinkCert" "=" "$Le_LinkCert"
  1010. if [ "$Le_LinkCert" ] ; then
  1011. echo "$BEGIN_CERT" > "$CERT_PATH"
  1012. _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH"
  1013. echo "$END_CERT" >> "$CERT_PATH"
  1014. _info "Cert success."
  1015. cat "$CERT_PATH"
  1016. _info "Your cert is in $CERT_PATH"
  1017. cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
  1018. if [[ ! "$USER_PATH" ]] || [[ ! "$IN_CRON" ]] ; then
  1019. USER_PATH="$PATH"
  1020. _saveaccountconf "USER_PATH" "$USER_PATH"
  1021. fi
  1022. fi
  1023. if [ -z "$Le_LinkCert" ] ; then
  1024. response="$(echo $response | _dbase64 "multiline" )"
  1025. _err "Sign failed: $(echo "$response" | grep -o '"detail":"[^"]*"')"
  1026. return 1
  1027. fi
  1028. _setopt "$DOMAIN_CONF" 'Le_Vlist' '=' "\"\""
  1029. Le_LinkIssuer=$(grep -i '^Link' $HTTP_HEADER | head -1 | cut -d " " -f 2| cut -d ';' -f 1 | tr -d '<>' )
  1030. _setopt "$DOMAIN_CONF" "Le_LinkIssuer" "=" "$Le_LinkIssuer"
  1031. if [ "$Le_LinkIssuer" ] ; then
  1032. echo "$BEGIN_CERT" > "$CA_CERT_PATH"
  1033. _get "$Le_LinkIssuer" | _base64 "multiline" >> "$CA_CERT_PATH"
  1034. echo "$END_CERT" >> "$CA_CERT_PATH"
  1035. _info "The intermediate CA cert is in $CA_CERT_PATH"
  1036. cat "$CA_CERT_PATH" >> "$CERT_FULLCHAIN_PATH"
  1037. _info "And the full chain certs is there: $CERT_FULLCHAIN_PATH"
  1038. fi
  1039. Le_CertCreateTime=$(date -u "+%s")
  1040. _setopt "$DOMAIN_CONF" "Le_CertCreateTime" "=" "$Le_CertCreateTime"
  1041. Le_CertCreateTimeStr=$(date -u )
  1042. _setopt "$DOMAIN_CONF" "Le_CertCreateTimeStr" "=" "\"$Le_CertCreateTimeStr\""
  1043. if [ ! "$Le_RenewalDays" ] ; then
  1044. Le_RenewalDays=80
  1045. fi
  1046. _setopt "$DOMAIN_CONF" "Le_RenewalDays" "=" "$Le_RenewalDays"
  1047. let "Le_NextRenewTime=Le_CertCreateTime+Le_RenewalDays*24*60*60"
  1048. _setopt "$DOMAIN_CONF" "Le_NextRenewTime" "=" "$Le_NextRenewTime"
  1049. Le_NextRenewTimeStr=$( _time2str $Le_NextRenewTime )
  1050. _setopt "$DOMAIN_CONF" "Le_NextRenewTimeStr" "=" "\"$Le_NextRenewTimeStr\""
  1051. installcert $Le_Domain "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd"
  1052. }
  1053. renew() {
  1054. Le_Domain="$1"
  1055. if [ -z "$Le_Domain" ] ; then
  1056. _err "Usage: $0 domain.com"
  1057. return 1
  1058. fi
  1059. _initpath $Le_Domain
  1060. if [ ! -f "$DOMAIN_CONF" ] ; then
  1061. _info "$Le_Domain is not a issued domain, skip."
  1062. return 0;
  1063. fi
  1064. source "$DOMAIN_CONF"
  1065. if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(date -u "+%s" )" -lt "$Le_NextRenewTime" ] ; then
  1066. _info "Skip, Next renewal time is: $Le_NextRenewTimeStr"
  1067. return 2
  1068. fi
  1069. IS_RENEW="1"
  1070. issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd"
  1071. local res=$?
  1072. IS_RENEW=""
  1073. return $res
  1074. }
  1075. renewAll() {
  1076. _initpath
  1077. _info "renewAll"
  1078. for d in $(ls -F ${LE_WORKING_DIR}/ | grep [^.].*[.].*/$ ) ; do
  1079. d=$(echo $d | cut -d '/' -f 1)
  1080. _info "renew $d"
  1081. Le_LinkCert=""
  1082. Le_Domain=""
  1083. Le_Alt="no"
  1084. Le_Webroot=""
  1085. Le_Keylength=""
  1086. Le_LinkIssuer=""
  1087. Le_CertCreateTime=""
  1088. Le_CertCreateTimeStr=""
  1089. Le_RenewalDays=""
  1090. Le_NextRenewTime=""
  1091. Le_NextRenewTimeStr=""
  1092. Le_RealCertPath=""
  1093. Le_RealKeyPath=""
  1094. Le_RealCACertPath=""
  1095. Le_ReloadCmd=""
  1096. DOMAIN_PATH=""
  1097. DOMAIN_CONF=""
  1098. DOMAIN_SSL_CONF=""
  1099. CSR_PATH=""
  1100. CERT_KEY_PATH=""
  1101. CERT_PATH=""
  1102. CA_CERT_PATH=""
  1103. CERT_FULLCHAIN_PATH=""
  1104. ACCOUNT_KEY_PATH=""
  1105. wellknown_path=""
  1106. renew "$d"
  1107. done
  1108. }
  1109. installcert() {
  1110. Le_Domain="$1"
  1111. if [ -z "$Le_Domain" ] ; then
  1112. _err "Usage: $0 domain.com [cert-file-path]|no [key-file-path]|no [ca-cert-file-path]|no [reloadCmd]|no"
  1113. return 1
  1114. fi
  1115. Le_RealCertPath="$2"
  1116. Le_RealKeyPath="$3"
  1117. Le_RealCACertPath="$4"
  1118. Le_ReloadCmd="$5"
  1119. _initpath $Le_Domain
  1120. _setopt "$DOMAIN_CONF" "Le_RealCertPath" "=" "\"$Le_RealCertPath\""
  1121. _setopt "$DOMAIN_CONF" "Le_RealCACertPath" "=" "\"$Le_RealCACertPath\""
  1122. _setopt "$DOMAIN_CONF" "Le_RealKeyPath" "=" "\"$Le_RealKeyPath\""
  1123. _setopt "$DOMAIN_CONF" "Le_ReloadCmd" "=" "\"$Le_ReloadCmd\""
  1124. if [ "$Le_RealCertPath" ] ; then
  1125. if [ -f "$Le_RealCertPath" ] ; then
  1126. cp -p "$Le_RealCertPath" "$Le_RealCertPath".bak
  1127. fi
  1128. cat "$CERT_PATH" > "$Le_RealCertPath"
  1129. fi
  1130. if [ "$Le_RealCACertPath" ] ; then
  1131. if [ -f "$Le_RealCACertPath" ] ; then
  1132. cp -p "$Le_RealCACertPath" "$Le_RealCACertPath".bak
  1133. fi
  1134. if [ "$Le_RealCACertPath" == "$Le_RealCertPath" ] ; then
  1135. echo "" >> "$Le_RealCACertPath"
  1136. cat "$CA_CERT_PATH" >> "$Le_RealCACertPath"
  1137. else
  1138. cat "$CA_CERT_PATH" > "$Le_RealCACertPath"
  1139. fi
  1140. fi
  1141. if [ "$Le_RealKeyPath" ] ; then
  1142. if [ -f "$Le_RealKeyPath" ] ; then
  1143. cp -p "$Le_RealKeyPath" "$Le_RealKeyPath".bak
  1144. fi
  1145. cat "$CERT_KEY_PATH" > "$Le_RealKeyPath"
  1146. fi
  1147. if [ "$Le_ReloadCmd" ] ; then
  1148. _info "Run Le_ReloadCmd: $Le_ReloadCmd"
  1149. (cd "$DOMAIN_PATH" && eval "$Le_ReloadCmd")
  1150. fi
  1151. }
  1152. installcronjob() {
  1153. _initpath
  1154. if ! _exists "crontab" ; then
  1155. _err "crontab doesn't exist, so, we can not install cron jobs."
  1156. _err "All your certs will not be renewed automatically."
  1157. _err "You must add your own cron job to call 'le.sh cron' everyday."
  1158. return 1
  1159. fi
  1160. _info "Installing cron job"
  1161. if ! crontab -l | grep 'le.sh cron' ; then
  1162. if [ -f "$LE_WORKING_DIR/le.sh" ] ; then
  1163. lesh="\"$LE_WORKING_DIR\"/le.sh"
  1164. else
  1165. _err "Can not install cronjob, le.sh not found."
  1166. return 1
  1167. fi
  1168. crontab -l | { cat; echo "0 0 * * * LE_WORKING_DIR=\"$LE_WORKING_DIR\" $lesh cron > /dev/null"; } | crontab -
  1169. fi
  1170. if [ "$?" != "0" ] ; then
  1171. _err "Install cron job failed. You need to manually renew your certs."
  1172. _err "Or you can add cronjob by yourself:"
  1173. _err "LE_WORKING_DIR=\"$LE_WORKING_DIR\" $lesh cron > /dev/null"
  1174. return 1
  1175. fi
  1176. }
  1177. uninstallcronjob() {
  1178. if ! _exists "crontab" ; then
  1179. return
  1180. fi
  1181. _info "Removing cron job"
  1182. cr="$(crontab -l | grep 'le.sh cron')"
  1183. if [ "$cr" ] ; then
  1184. crontab -l | sed "/le.sh cron/d" | crontab -
  1185. LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 6 | cut -d '=' -f 2 | tr -d '"')"
  1186. _info LE_WORKING_DIR "$LE_WORKING_DIR"
  1187. fi
  1188. _initpath
  1189. }
  1190. # Detect profile file if not specified as environment variable
  1191. _detect_profile() {
  1192. if [ -n "$PROFILE" -a -f "$PROFILE" ]; then
  1193. echo "$PROFILE"
  1194. return
  1195. fi
  1196. local DETECTED_PROFILE
  1197. DETECTED_PROFILE=''
  1198. local SHELLTYPE
  1199. SHELLTYPE="$(basename "/$SHELL")"
  1200. if [ "$SHELLTYPE" = "bash" ]; then
  1201. if [ -f "$HOME/.bashrc" ]; then
  1202. DETECTED_PROFILE="$HOME/.bashrc"
  1203. elif [ -f "$HOME/.bash_profile" ]; then
  1204. DETECTED_PROFILE="$HOME/.bash_profile"
  1205. fi
  1206. elif [ "$SHELLTYPE" = "zsh" ]; then
  1207. DETECTED_PROFILE="$HOME/.zshrc"
  1208. fi
  1209. if [ -z "$DETECTED_PROFILE" ]; then
  1210. if [ -f "$HOME/.profile" ]; then
  1211. DETECTED_PROFILE="$HOME/.profile"
  1212. elif [ -f "$HOME/.bashrc" ]; then
  1213. DETECTED_PROFILE="$HOME/.bashrc"
  1214. elif [ -f "$HOME/.bash_profile" ]; then
  1215. DETECTED_PROFILE="$HOME/.bash_profile"
  1216. elif [ -f "$HOME/.zshrc" ]; then
  1217. DETECTED_PROFILE="$HOME/.zshrc"
  1218. fi
  1219. fi
  1220. if [ ! -z "$DETECTED_PROFILE" ]; then
  1221. echo "$DETECTED_PROFILE"
  1222. fi
  1223. }
  1224. _initconf() {
  1225. _initpath
  1226. if [ ! -f "$ACCOUNT_CONF_PATH" ] ; then
  1227. echo "#Account configurations:
  1228. #Here are the supported macros, uncomment them to make them take effect.
  1229. #ACCOUNT_EMAIL=aaa@aaa.com # the account email used to register account.
  1230. #ACCOUNT_KEY_PATH=\"/path/to/account.key\"
  1231. #STAGE=1 # Use the staging api
  1232. #FORCE=1 # Force to issue cert
  1233. #DEBUG=1 # Debug mode
  1234. #ACCOUNT_KEY_HASH=account key hash
  1235. USER_AGENT=\"le.sh client: $PROJECT\"
  1236. #USER_PATH=""
  1237. #dns api
  1238. #######################
  1239. #Cloudflare:
  1240. #api key
  1241. #CF_Key=\"sdfsdfsdfljlbjkljlkjsdfoiwje\"
  1242. #account email
  1243. #CF_Email=\"xxxx@sss.com\"
  1244. #######################
  1245. #Dnspod.cn:
  1246. #api key id
  1247. #DP_Id=\"1234\"
  1248. #api key
  1249. #DP_Key=\"sADDsdasdgdsf\"
  1250. #######################
  1251. #Cloudxns.com:
  1252. #CX_Key=\"1234\"
  1253. #
  1254. #CX_Secret=\"sADDsdasdgdsf\"
  1255. " > $ACCOUNT_CONF_PATH
  1256. fi
  1257. }
  1258. _precheck() {
  1259. if ! _exists "curl" && ! _exists "wget"; then
  1260. _err "Please install curl or wget first, we need to access http resources."
  1261. return 1
  1262. fi
  1263. if ! _exists "crontab" ; then
  1264. _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
  1265. _err "We need to set cron job to renew the certs automatically."
  1266. _err "Otherwise, your certs will not be able to be renewed automatically."
  1267. if [ -z "$FORCE" ] ; then
  1268. _err "Please define 'FORCE=1' and try install again to go without crontab."
  1269. _err "FORCE=1 ./le.sh install"
  1270. return 1
  1271. fi
  1272. fi
  1273. if ! _exists "openssl" ; then
  1274. _err "Please install openssl first."
  1275. _err "We need openssl to generate keys."
  1276. return 1
  1277. fi
  1278. if ! _exists "nc" ; then
  1279. _err "It is recommended to install nc first, try to install 'nc' or 'netcat'."
  1280. _err "We use nc for standalone server if you use standalone mode."
  1281. _err "If you don't use standalone mode, just ignore this warning."
  1282. fi
  1283. return 0
  1284. }
  1285. install() {
  1286. if ! _initpath ; then
  1287. _err "Install failed."
  1288. return 1
  1289. fi
  1290. if ! _precheck ; then
  1291. _err "Pre-check failed, can not install."
  1292. return 1
  1293. fi
  1294. _info "Installing to $LE_WORKING_DIR"
  1295. if ! mkdir -p "$LE_WORKING_DIR" ; then
  1296. _err "Can not craete working dir: $LE_WORKING_DIR"
  1297. return 1
  1298. fi
  1299. cp le.sh "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/le.sh"
  1300. if [ "$?" != "0" ] ; then
  1301. _err "Install failed, can not copy le.sh"
  1302. return 1
  1303. fi
  1304. _info "Installed to $LE_WORKING_DIR/le.sh"
  1305. _profile="$(_detect_profile)"
  1306. if [ "$_profile" ] ; then
  1307. _debug "Found profile: $_profile"
  1308. echo "LE_WORKING_DIR=$LE_WORKING_DIR
  1309. alias le=\"$LE_WORKING_DIR/le.sh\"
  1310. alias le.sh=\"$LE_WORKING_DIR/le.sh\"
  1311. " > "$LE_WORKING_DIR/le.env"
  1312. echo "" >> "$_profile"
  1313. _setopt "$_profile" "source \"$LE_WORKING_DIR/le.env\""
  1314. _info "OK, Close and reopen your terminal to start using le"
  1315. else
  1316. _info "No profile is found, you will need to go into $LE_WORKING_DIR to use le.sh"
  1317. fi
  1318. mkdir -p $LE_WORKING_DIR/dnsapi
  1319. cp dnsapi/* $LE_WORKING_DIR/dnsapi/
  1320. #to keep compatible mv the .acc file to .key file
  1321. if [ -f "$LE_WORKING_DIR/account.acc" ] ; then
  1322. mv "$LE_WORKING_DIR/account.acc" "$LE_WORKING_DIR/account.key"
  1323. fi
  1324. installcronjob
  1325. if [ ! -f "$ACCOUNT_CONF_PATH" ] ; then
  1326. _initconf
  1327. fi
  1328. _info OK
  1329. }
  1330. uninstall() {
  1331. uninstallcronjob
  1332. _initpath
  1333. _profile="$(_detect_profile)"
  1334. if [ "$_profile" ] ; then
  1335. text="$(cat $_profile)"
  1336. echo "$text" | sed "s|^source.*le.env.*$||" > "$_profile"
  1337. fi
  1338. rm -f $LE_WORKING_DIR/le.sh
  1339. _info "The keys and certs are in $LE_WORKING_DIR, you can remove them by yourself."
  1340. }
  1341. cron() {
  1342. IN_CRON=1
  1343. renewAll
  1344. IN_CRON=""
  1345. }
  1346. version() {
  1347. _info "$PROJECT"
  1348. _info "v$VER"
  1349. }
  1350. showhelp() {
  1351. version
  1352. echo "Usage: le.sh [command] ...[args]....
  1353. Avalible commands:
  1354. install:
  1355. Install le.sh to your system.
  1356. issue:
  1357. Issue a cert.
  1358. installcert:
  1359. Install the issued cert to apache/nginx or any other server.
  1360. renew:
  1361. Renew a cert.
  1362. renewAll:
  1363. Renew all the certs.
  1364. uninstall:
  1365. Uninstall le.sh, and uninstall the cron job.
  1366. version:
  1367. Show version info.
  1368. installcronjob:
  1369. Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
  1370. uninstallcronjob:
  1371. Uninstall the cron job. The 'uninstall' command can do this automatically.
  1372. createAccountKey:
  1373. Create an account private key, professional use.
  1374. createDomainKey:
  1375. Create an domain private key, professional use.
  1376. createCSR:
  1377. Create CSR , professional use.
  1378. "
  1379. }
  1380. _installOnline() {
  1381. _info "Installing from online archive."
  1382. if [ ! "$BRANCH" ] ; then
  1383. BRANCH="master"
  1384. fi
  1385. _initpath
  1386. target="$PROJECT/archive/$BRANCH.tar.gz"
  1387. _info "Downloading $target"
  1388. localname="$BRANCH.tar.gz"
  1389. if ! _get "$target" > $localname ; then
  1390. _debug "Download error."
  1391. return 1
  1392. fi
  1393. _info "Extracting $localname"
  1394. tar xzf $localname
  1395. cd "le-$BRANCH"
  1396. chmod +x le.sh
  1397. if ./le.sh install ; then
  1398. _info "Install success!"
  1399. fi
  1400. cd ..
  1401. rm -rf "le-$BRANCH"
  1402. rm -f "$localname"
  1403. }
  1404. if [ "$INSTALLONLINE" ] ; then
  1405. INSTALLONLINE=""
  1406. _installOnline $BRANCH
  1407. exit
  1408. fi
  1409. if [ -z "$1" ] ; then
  1410. showhelp
  1411. else
  1412. "$@"
  1413. fi