You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

2285 lines
57 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
  1. #!/usr/bin/env bash
  2. VER=2.2.1
  3. PROJECT_NAME="acme.sh"
  4. PROJECT_ENTRY="acme.sh"
  5. PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
  6. DEFAULT_CA="https://acme-v01.api.letsencrypt.org"
  7. DEFAULT_AGREEMENT="https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf"
  8. DEFAULT_USER_AGENT="$PROJECT_ENTRY client: $PROJECT"
  9. STAGE_CA="https://acme-staging.api.letsencrypt.org"
  10. VTYPE_HTTP="http-01"
  11. VTYPE_DNS="dns-01"
  12. BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  13. END_CSR="-----END CERTIFICATE REQUEST-----"
  14. BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  15. END_CERT="-----END CERTIFICATE-----"
  16. if [ -z "$AGREEMENT" ] ; then
  17. AGREEMENT="$DEFAULT_AGREEMENT"
  18. fi
  19. _info() {
  20. if [ -z "$2" ] ; then
  21. echo "[$(date)] $1"
  22. else
  23. echo "[$(date)] $1"="'$2'"
  24. fi
  25. }
  26. _err() {
  27. _info "$@" >&2
  28. return 1
  29. }
  30. _debug() {
  31. if [ -z "$DEBUG" ] ; then
  32. return
  33. fi
  34. _err "$@"
  35. return 0
  36. }
  37. _debug2() {
  38. if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ] ; then
  39. _debug "$@"
  40. fi
  41. return
  42. }
  43. _startswith(){
  44. _str="$1"
  45. _sub="$2"
  46. echo $_str | grep ^$_sub >/dev/null 2>&1
  47. }
  48. _contains(){
  49. _str="$1"
  50. _sub="$2"
  51. echo $_str | grep $_sub >/dev/null 2>&1
  52. }
  53. _exists(){
  54. cmd="$1"
  55. if [ -z "$cmd" ] ; then
  56. _err "Usage: _exists cmd"
  57. return 1
  58. fi
  59. if type command >/dev/null 2>&1 ; then
  60. command -v $cmd >/dev/null 2>&1
  61. else
  62. type $cmd >/dev/null 2>&1
  63. fi
  64. ret="$?"
  65. _debug2 "$cmd exists=$ret"
  66. return $ret
  67. }
  68. _h2b() {
  69. hex=$(cat)
  70. i=1
  71. j=2
  72. while [ '1' ] ; do
  73. h=$(printf $hex | cut -c $i-$j)
  74. if [ -z "$h" ] ; then
  75. break;
  76. fi
  77. printf "\x$h"
  78. let "i+=2"
  79. let "j+=2"
  80. done
  81. }
  82. #options file
  83. _sed_i() {
  84. options="$1"
  85. filename="$2"
  86. if [ -z "$filename" ] ; then
  87. _err "Usage:_sed_i options filename"
  88. return 1
  89. fi
  90. if sed -h 2>&1 | grep "\-i[SUFFIX]" ; then
  91. _debug "Using sed -i"
  92. sed -i ""
  93. else
  94. _debug "No -i support in sed"
  95. text="$(cat $filename)"
  96. echo "$text" | sed "$options" > "$filename"
  97. fi
  98. }
  99. #Usage: file startline endline
  100. _getfile() {
  101. filename="$1"
  102. startline="$2"
  103. endline="$3"
  104. if [ -z "$endline" ] ; then
  105. _err "Usage: file startline endline"
  106. return 1
  107. fi
  108. i="$(grep -n -- "$startline" $filename | cut -d : -f 1)"
  109. if [ -z "$i" ] ; then
  110. _err "Can not find start line: $startline"
  111. return 1
  112. fi
  113. let "i+=1"
  114. _debug i $i
  115. j="$(grep -n -- "$endline" $filename | cut -d : -f 1)"
  116. if [ -z "$j" ] ; then
  117. _err "Can not find end line: $endline"
  118. return 1
  119. fi
  120. let "j-=1"
  121. _debug j $j
  122. sed -n $i,${j}p "$filename"
  123. }
  124. #Usage: multiline
  125. _base64() {
  126. if [ "$1" ] ; then
  127. openssl base64 -e
  128. else
  129. openssl base64 -e | tr -d '\r\n'
  130. fi
  131. }
  132. #Usage: multiline
  133. _dbase64() {
  134. if [ "$1" ] ; then
  135. openssl base64 -d -A
  136. else
  137. openssl base64 -d
  138. fi
  139. }
  140. #Usage: hashalg
  141. #Output Base64-encoded digest
  142. _digest() {
  143. alg="$1"
  144. if [ -z "$alg" ] ; then
  145. _err "Usage: _digest hashalg"
  146. return 1
  147. fi
  148. if [ "$alg" = "sha256" ] ; then
  149. openssl dgst -sha256 -binary | _base64
  150. else
  151. _err "$alg is not supported yet"
  152. return 1
  153. fi
  154. }
  155. #Usage: keyfile hashalg
  156. #Output: Base64-encoded signature value
  157. _sign() {
  158. keyfile="$1"
  159. alg="$2"
  160. if [ -z "$alg" ] ; then
  161. _err "Usage: _sign keyfile hashalg"
  162. return 1
  163. fi
  164. if [ "$alg" = "sha256" ] ; then
  165. openssl dgst -sha256 -sign "$keyfile" | _base64
  166. else
  167. _err "$alg is not supported yet"
  168. return 1
  169. fi
  170. }
  171. _ss() {
  172. _port="$1"
  173. if _exists "ss" ; then
  174. _debug "Using: ss"
  175. ss -ntpl | grep :$_port" "
  176. return 0
  177. fi
  178. if _exists "netstat" ; then
  179. _debug "Using: netstat"
  180. if netstat -h 2>&1 | grep "\-p proto" >/dev/null ; then
  181. #for windows version netstat tool
  182. netstat -anb -p tcp | grep "LISTENING" | grep :$_port" "
  183. else
  184. if netstat -help 2>&1 | grep "\-p protocol" >/dev/null ; then
  185. netstat -an -p tcp | grep LISTEN | grep :$_port" "
  186. else
  187. netstat -ntpl | grep :$_port" "
  188. fi
  189. fi
  190. return 0
  191. fi
  192. return 1
  193. }
  194. toPkcs() {
  195. domain="$1"
  196. pfxPassword="$2"
  197. if [ -z "$domain" ] ; then
  198. echo "Usage: $PROJECT_ENTRY --toPkcs -d domain [--password pfx-password]"
  199. return 1
  200. fi
  201. _initpath "$domain"
  202. if [ "$pfxPassword" ] ; then
  203. openssl pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH" -password "pass:$pfxPassword"
  204. else
  205. openssl pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH"
  206. fi
  207. if [ "$?" = "0" ] ; then
  208. _info "Success, Pfx is exported to: $CERT_PFX_PATH"
  209. fi
  210. }
  211. #domain [2048]
  212. createAccountKey() {
  213. _info "Creating account key"
  214. if [ -z "$1" ] ; then
  215. echo Usage: $PROJECT_ENTRY --createAccountKey -d domain.com [--accountkeylength 2048]
  216. return
  217. fi
  218. account=$1
  219. length=$2
  220. _debug account "$account"
  221. _debug length "$length"
  222. if _startswith "$length" "ec-" ; then
  223. length=2048
  224. fi
  225. if [ -z "$2" ] || [ "$2" = "no" ] ; then
  226. _info "Use default length 2048"
  227. length=2048
  228. fi
  229. _initpath
  230. if [ -f "$ACCOUNT_KEY_PATH" ] ; then
  231. _info "Account key exists, skip"
  232. return
  233. else
  234. #generate account key
  235. openssl genrsa $length 2>/dev/null > "$ACCOUNT_KEY_PATH"
  236. fi
  237. }
  238. #domain length
  239. createDomainKey() {
  240. _info "Creating domain key"
  241. if [ -z "$1" ] ; then
  242. echo Usage: $PROJECT_ENTRY --createDomainKey -d domain.com [ --keylength 2048 ]
  243. return
  244. fi
  245. domain=$1
  246. length=$2
  247. isec=""
  248. if _startswith "$length" "ec-" ; then
  249. isec="1"
  250. length=$(printf $length | cut -d '-' -f 2-100)
  251. eccname="$length"
  252. fi
  253. if [ -z "$length" ] ; then
  254. if [ "$isec" ] ; then
  255. length=256
  256. else
  257. length=2048
  258. fi
  259. fi
  260. _info "Use length $length"
  261. if [ "$isec" ] ; then
  262. if [ "$length" = "256" ] ; then
  263. eccname="prime256v1"
  264. fi
  265. if [ "$length" = "384" ] ; then
  266. eccname="secp384r1"
  267. fi
  268. if [ "$length" = "521" ] ; then
  269. eccname="secp521r1"
  270. fi
  271. _info "Using ec name: $eccname"
  272. fi
  273. _initpath $domain
  274. if [ ! -f "$CERT_KEY_PATH" ] || ( [ "$FORCE" ] && ! [ "$IS_RENEW" ] ); then
  275. #generate account key
  276. if [ "$isec" ] ; then
  277. openssl ecparam -name $eccname -genkey 2>/dev/null > "$CERT_KEY_PATH"
  278. else
  279. openssl genrsa $length 2>/dev/null > "$CERT_KEY_PATH"
  280. fi
  281. else
  282. if [ "$IS_RENEW" ] ; then
  283. _info "Domain key exists, skip"
  284. return 0
  285. else
  286. _err "Domain key exists, do you want to overwrite the key?"
  287. _err "Add '--force', and try again."
  288. return 1
  289. fi
  290. fi
  291. }
  292. # domain domainlist
  293. createCSR() {
  294. _info "Creating csr"
  295. if [ -z "$1" ] ; then
  296. echo Usage: $PROJECT_ENTRY --createCSR -d domain1.com [-d domain2.com -d domain3.com ... ]
  297. return
  298. fi
  299. domain=$1
  300. _initpath $domain
  301. domainlist=$2
  302. if [ -f "$CSR_PATH" ] && [ "$IS_RENEW" ] && [ -z "$FORCE" ]; then
  303. _info "CSR exists, skip"
  304. return
  305. fi
  306. if [ -z "$domainlist" ] || [ "$domainlist" = "no" ]; then
  307. #single domain
  308. _info "Single domain" $domain
  309. printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\n" > "$DOMAIN_SSL_CONF"
  310. openssl req -new -sha256 -key "$CERT_KEY_PATH" -subj "/CN=$domain" -config "$DOMAIN_SSL_CONF" -out "$CSR_PATH"
  311. else
  312. alt="DNS:$(echo $domainlist | sed "s/,/,DNS:/g")"
  313. #multi
  314. _info "Multi domain" "$alt"
  315. printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\n[SAN]\nsubjectAltName=$alt" > "$DOMAIN_SSL_CONF"
  316. openssl req -new -sha256 -key "$CERT_KEY_PATH" -subj "/CN=$domain" -reqexts SAN -config "$DOMAIN_SSL_CONF" -out "$CSR_PATH"
  317. fi
  318. }
  319. _urlencode() {
  320. __n=$(cat)
  321. echo $__n | tr '/+' '_-' | tr -d '= '
  322. }
  323. _time2str() {
  324. #BSD
  325. if date -u -d@$1 2>/dev/null ; then
  326. return
  327. fi
  328. #Linux
  329. if date -u -r $1 2>/dev/null ; then
  330. return
  331. fi
  332. }
  333. _stat() {
  334. #Linux
  335. if stat -c '%U:%G' "$1" 2>/dev/null ; then
  336. return
  337. fi
  338. #BSD
  339. if stat -f '%Su:%Sg' "$1" 2>/dev/null ; then
  340. return
  341. fi
  342. }
  343. #keyfile
  344. _calcjwk() {
  345. keyfile="$1"
  346. if [ -z "$keyfile" ] ; then
  347. _err "Usage: _calcjwk keyfile"
  348. return 1
  349. fi
  350. EC_SIGN=""
  351. if grep "BEGIN RSA PRIVATE KEY" "$keyfile" > /dev/null 2>&1 ; then
  352. _debug "RSA key"
  353. pub_exp=$(openssl rsa -in $keyfile -noout -text | grep "^publicExponent:"| cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
  354. if [ "${#pub_exp}" = "5" ] ; then
  355. pub_exp=0$pub_exp
  356. fi
  357. _debug2 pub_exp "$pub_exp"
  358. e=$(echo $pub_exp | _h2b | _base64)
  359. _debug2 e "$e"
  360. modulus=$(openssl rsa -in $keyfile -modulus -noout | cut -d '=' -f 2 )
  361. n=$(echo $modulus| _h2b | _base64 | _urlencode )
  362. jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
  363. _debug2 jwk "$jwk"
  364. HEADER='{"alg": "RS256", "jwk": '$jwk'}'
  365. HEADERPLACE='{"nonce": "NONCE", "alg": "RS256", "jwk": '$jwk'}'
  366. elif grep "BEGIN EC PRIVATE KEY" "$keyfile" > /dev/null 2>&1 ; then
  367. _debug "EC key"
  368. EC_SIGN="1"
  369. crv="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
  370. _debug2 crv $crv
  371. pubi="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
  372. _debug2 pubi $pubi
  373. let "pubi=pubi+1"
  374. pubj="$(openssl ec -in $keyfile -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
  375. _debug2 pubj $pubj
  376. let "pubj=pubj-1"
  377. pubtext="$(openssl ec -in $keyfile -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
  378. _debug2 pubtext "$pubtext"
  379. xlen="$(printf "$pubtext" | tr -d ':' | wc -c)"
  380. let "xlen=xlen/4"
  381. _debug2 xlen $xlen
  382. let "xend=xlen+1"
  383. x="$(printf $pubtext | cut -d : -f 2-$xend)"
  384. _debug2 x $x
  385. x64="$(printf $x | tr -d : | _h2b | _base64 | _urlencode)"
  386. _debug2 x64 $x64
  387. let "xend+=1"
  388. y="$(printf $pubtext | cut -d : -f $xend-10000)"
  389. _debug2 y $y
  390. y64="$(printf $y | tr -d : | _h2b | _base64 | _urlencode)"
  391. _debug2 y64 $y64
  392. jwk='{"kty": "EC", "crv": "'$crv'", "x": "'$x64'", "y": "'$y64'"}'
  393. _debug2 jwk "$jwk"
  394. HEADER='{"alg": "ES256", "jwk": '$jwk'}'
  395. HEADERPLACE='{"nonce": "NONCE", "alg": "ES256", "jwk": '$jwk'}'
  396. else
  397. _err "Only RSA or EC key is supported."
  398. return 1
  399. fi
  400. _debug2 HEADER "$HEADER"
  401. }
  402. # body url [needbase64]
  403. _post() {
  404. body="$1"
  405. url="$2"
  406. needbase64="$3"
  407. if _exists "curl" ; then
  408. CURL="$CURL --dump-header $HTTP_HEADER "
  409. if [ "$needbase64" ] ; then
  410. response="$($CURL -A "User-Agent: $USER_AGENT" -X POST --data "$body" $url | _base64)"
  411. else
  412. response="$($CURL -A "User-Agent: $USER_AGENT" -X POST --data "$body" $url)"
  413. fi
  414. else
  415. if [ "$needbase64" ] ; then
  416. response="$($WGET -S -O - --user-agent="$USER_AGENT" --post-data="$body" $url 2>"$HTTP_HEADER" | _base64)"
  417. else
  418. response="$($WGET -S -O - --user-agent="$USER_AGENT" --post-data="$body" $url 2>"$HTTP_HEADER")"
  419. fi
  420. _sed_i "s/^ *//g" "$HTTP_HEADER"
  421. fi
  422. echo -n "$response"
  423. }
  424. # url getheader
  425. _get() {
  426. url="$1"
  427. onlyheader="$2"
  428. _debug url $url
  429. if _exists "curl" ; then
  430. if [ "$onlyheader" ] ; then
  431. $CURL -I -A "User-Agent: $USER_AGENT" $url
  432. else
  433. $CURL -A "User-Agent: $USER_AGENT" $url
  434. fi
  435. else
  436. _debug "WGET" "$WGET"
  437. if [ "$onlyheader" ] ; then
  438. eval $WGET --user-agent=\"$USER_AGENT\" -S -O /dev/null $url 2>&1 | sed 's/^[ ]*//g'
  439. else
  440. eval $WGET --user-agent=\"$USER_AGENT\" -O - $url
  441. fi
  442. fi
  443. ret=$?
  444. return $ret
  445. }
  446. # url payload needbase64 keyfile
  447. _send_signed_request() {
  448. url=$1
  449. payload=$2
  450. needbase64=$3
  451. keyfile=$4
  452. if [ -z "$keyfile" ] ; then
  453. keyfile="$ACCOUNT_KEY_PATH"
  454. fi
  455. _debug url $url
  456. _debug payload "$payload"
  457. if ! _calcjwk "$keyfile" ; then
  458. return 1
  459. fi
  460. payload64=$(echo -n $payload | _base64 | _urlencode)
  461. _debug2 payload64 $payload64
  462. nonceurl="$API/directory"
  463. nonce="$(_get $nonceurl "onlyheader" | grep -o "Replay-Nonce:.*$" | head -1 | tr -d "\r\n" | cut -d ' ' -f 2)"
  464. _debug nonce "$nonce"
  465. protected="$(printf "$HEADERPLACE" | sed "s/NONCE/$nonce/" )"
  466. _debug2 protected "$protected"
  467. protected64="$(printf "$protected" | _base64 | _urlencode)"
  468. _debug2 protected64 "$protected64"
  469. sig=$(echo -n "$protected64.$payload64" | _sign "$keyfile" "sha256" | _urlencode)
  470. _debug2 sig "$sig"
  471. body="{\"header\": $HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
  472. _debug2 body "$body"
  473. response="$(_post "$body" $url "$needbase64" )"
  474. responseHeaders="$(cat $HTTP_HEADER)"
  475. _debug2 responseHeaders "$responseHeaders"
  476. _debug2 response "$response"
  477. code="$(grep "^HTTP" $HTTP_HEADER | tail -1 | cut -d " " -f 2 | tr -d "\r\n" )"
  478. _debug code $code
  479. }
  480. #setopt "file" "opt" "=" "value" [";"]
  481. _setopt() {
  482. __conf="$1"
  483. __opt="$2"
  484. __sep="$3"
  485. __val="$4"
  486. __end="$5"
  487. if [ -z "$__opt" ] ; then
  488. echo usage: _setopt '"file" "opt" "=" "value" [";"]'
  489. return
  490. fi
  491. if [ ! -f "$__conf" ] ; then
  492. touch "$__conf"
  493. fi
  494. if grep -H -n "^$__opt$__sep" "$__conf" > /dev/null ; then
  495. _debug2 OK
  496. if _contains "$__val" "&" ; then
  497. __val="$(echo $__val | sed 's/&/\\&/g')"
  498. fi
  499. text="$(cat $__conf)"
  500. echo "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" > "$__conf"
  501. elif grep -H -n "^#$__opt$__sep" "$__conf" > /dev/null ; then
  502. if _contains "$__val" "&" ; then
  503. __val="$(echo $__val | sed 's/&/\\&/g')"
  504. fi
  505. text="$(cat $__conf)"
  506. echo "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" > "$__conf"
  507. else
  508. _debug2 APP
  509. echo "$__opt$__sep$__val$__end" >> "$__conf"
  510. fi
  511. _debug "$(grep -H -n "^$__opt$__sep" $__conf)"
  512. }
  513. #_savedomainconf key value
  514. #save to domain.conf
  515. _savedomainconf() {
  516. key="$1"
  517. value="$2"
  518. if [ "$DOMAIN_CONF" ] ; then
  519. _setopt $DOMAIN_CONF "$key" "=" "$value"
  520. else
  521. _err "DOMAIN_CONF is empty, can not save $key=$value"
  522. fi
  523. }
  524. #_saveaccountconf key value
  525. _saveaccountconf() {
  526. key="$1"
  527. value="$2"
  528. if [ "$ACCOUNT_CONF_PATH" ] ; then
  529. _setopt $ACCOUNT_CONF_PATH "$key" "=" "\"$value\""
  530. else
  531. _err "ACCOUNT_CONF_PATH is empty, can not save $key=$value"
  532. fi
  533. }
  534. _startserver() {
  535. content="$1"
  536. _debug "startserver: $$"
  537. nchelp="$(nc -h 2>&1)"
  538. if echo "$nchelp" | grep "\-q[ ,]" >/dev/null ; then
  539. _NC="nc -q 1 -l"
  540. else
  541. if echo "$nchelp" | grep "GNU netcat" >/dev/null && echo "$nchelp" | grep "\-c, \-\-close" >/dev/null ; then
  542. _NC="nc -c -l"
  543. elif echo "$nchelp" | grep "\-N" |grep "Shutdown the network socket after EOF on stdin" >/dev/null ; then
  544. _NC="nc -N -l"
  545. else
  546. _NC="nc -l"
  547. fi
  548. fi
  549. _debug "_NC" "$_NC"
  550. # while true ; do
  551. if [ "$DEBUG" ] ; then
  552. if ! echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC -p $Le_HTTPPort ; then
  553. echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC $Le_HTTPPort ;
  554. fi
  555. else
  556. if ! echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC -p $Le_HTTPPort > /dev/null 2>&1; then
  557. echo -e -n "HTTP/1.1 200 OK\r\n\r\n$content" | $_NC $Le_HTTPPort > /dev/null 2>&1
  558. fi
  559. fi
  560. if [ "$?" != "0" ] ; then
  561. _err "nc listen error."
  562. exit 1
  563. fi
  564. # done
  565. }
  566. _stopserver(){
  567. pid="$1"
  568. _debug "pid" "$pid"
  569. if [ -z "$pid" ] ; then
  570. return
  571. fi
  572. if [ "$(ps | grep "$pid")" ] ; then
  573. _debug "Found proc process, kill it."
  574. kill -s 9 $pid > /dev/null
  575. fi
  576. for ncid in $(echo $(ps | grep nc) | cut -d " " -f 1) ; do
  577. _debug "kill $ncid"
  578. kill -s 9 $ncid > /dev/null
  579. done
  580. _get "http://localhost:$Le_HTTPPort" >/dev/null 2>&1
  581. }
  582. _initpath() {
  583. if [ -z "$LE_WORKING_DIR" ] ; then
  584. LE_WORKING_DIR=$HOME/.$PROJECT_NAME
  585. fi
  586. _DEFAULT_ACCOUNT_CONF_PATH="$LE_WORKING_DIR/account.conf"
  587. if [ -z "$ACCOUNT_CONF_PATH" ] ; then
  588. if [ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ] ; then
  589. . "$_DEFAULT_ACCOUNT_CONF_PATH"
  590. fi
  591. fi
  592. if [ -z "$ACCOUNT_CONF_PATH" ] ; then
  593. ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
  594. fi
  595. if [ -f "$ACCOUNT_CONF_PATH" ] ; then
  596. . "$ACCOUNT_CONF_PATH"
  597. fi
  598. if [ "$IN_CRON" ] ; then
  599. if [ ! "$_USER_PATH_EXPORTED" ] ; then
  600. _USER_PATH_EXPORTED=1
  601. export PATH="$USER_PATH:$PATH"
  602. fi
  603. fi
  604. if [ -z "$API" ] ; then
  605. if [ -z "$STAGE" ] ; then
  606. API="$DEFAULT_CA"
  607. else
  608. API="$STAGE_CA"
  609. _info "Using stage api:$API"
  610. fi
  611. fi
  612. if [ -z "$ACME_DIR" ] ; then
  613. ACME_DIR="/home/.acme"
  614. fi
  615. if [ -z "$APACHE_CONF_BACKUP_DIR" ] ; then
  616. APACHE_CONF_BACKUP_DIR="$LE_WORKING_DIR"
  617. fi
  618. if [ -z "$USER_AGENT" ] ; then
  619. USER_AGENT="$DEFAULT_USER_AGENT"
  620. fi
  621. HTTP_HEADER="$LE_WORKING_DIR/http.header"
  622. WGET="wget -q"
  623. if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ] ; then
  624. WGET="$WGET -d "
  625. fi
  626. dp="$LE_WORKING_DIR/curl.dump"
  627. CURL="curl -L --silent"
  628. if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ] ; then
  629. CURL="$CURL -L --trace-ascii $dp "
  630. fi
  631. _DEFAULT_ACCOUNT_KEY_PATH="$LE_WORKING_DIR/account.key"
  632. if [ -z "$ACCOUNT_KEY_PATH" ] ; then
  633. ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
  634. fi
  635. _DEFAULT_CERT_HOME="$LE_WORKING_DIR"
  636. if [ -z "$CERT_HOME" ] ; then
  637. CERT_HOME="$_DEFAULT_CERT_HOME"
  638. fi
  639. domain="$1"
  640. if [ -z "$domain" ] ; then
  641. return 0
  642. fi
  643. domainhome="$CERT_HOME/$domain"
  644. mkdir -p "$domainhome"
  645. if [ -z "$DOMAIN_PATH" ] ; then
  646. DOMAIN_PATH="$domainhome"
  647. fi
  648. if [ -z "$DOMAIN_CONF" ] ; then
  649. DOMAIN_CONF="$domainhome/$domain.conf"
  650. fi
  651. if [ -z "$DOMAIN_SSL_CONF" ] ; then
  652. DOMAIN_SSL_CONF="$domainhome/$domain.ssl.conf"
  653. fi
  654. if [ -z "$CSR_PATH" ] ; then
  655. CSR_PATH="$domainhome/$domain.csr"
  656. fi
  657. if [ -z "$CERT_KEY_PATH" ] ; then
  658. CERT_KEY_PATH="$domainhome/$domain.key"
  659. fi
  660. if [ -z "$CERT_PATH" ] ; then
  661. CERT_PATH="$domainhome/$domain.cer"
  662. fi
  663. if [ -z "$CA_CERT_PATH" ] ; then
  664. CA_CERT_PATH="$domainhome/ca.cer"
  665. fi
  666. if [ -z "$CERT_FULLCHAIN_PATH" ] ; then
  667. CERT_FULLCHAIN_PATH="$domainhome/fullchain.cer"
  668. fi
  669. if [ -z "$CERT_PFX_PATH" ] ; then
  670. CERT_PFX_PATH="$domainhome/$domain.pfx"
  671. fi
  672. }
  673. _apachePath() {
  674. if ! _exists apachectl ; then
  675. _err "'apachecrl not found. It seems that apache is not installed, or you are not root user.'"
  676. _err "Please use webroot mode to try again."
  677. return 1
  678. fi
  679. httpdconfname="$(apachectl -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"' )"
  680. if _startswith "$httpdconfname" '/' ; then
  681. httpdconf="$httpdconfname"
  682. httpdconfname="$(basename $httpdconfname)"
  683. else
  684. httpdroot="$(apachectl -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"' )"
  685. httpdconf="$httpdroot/$httpdconfname"
  686. fi
  687. if [ ! -f $httpdconf ] ; then
  688. _err "Apache Config file not found" $httpdconf
  689. return 1
  690. fi
  691. return 0
  692. }
  693. _restoreApache() {
  694. if [ -z "$usingApache" ] ; then
  695. return 0
  696. fi
  697. _initpath
  698. if ! _apachePath ; then
  699. return 1
  700. fi
  701. if [ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ] ; then
  702. _debug "No config file to restore."
  703. return 0
  704. fi
  705. cp -p "$APACHE_CONF_BACKUP_DIR/$httpdconfname" "$httpdconf"
  706. _debug "Restored: $httpdconf."
  707. if ! apachectl -t ; then
  708. _err "Sorry, restore apache config error, please contact me."
  709. return 1;
  710. fi
  711. _debug "Restored successfully."
  712. rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
  713. return 0
  714. }
  715. _setApache() {
  716. _initpath
  717. if ! _apachePath ; then
  718. return 1
  719. fi
  720. #backup the conf
  721. _debug "Backup apache config file" $httpdconf
  722. cp -p $httpdconf $APACHE_CONF_BACKUP_DIR/
  723. _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
  724. _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
  725. _info "The backup file will be deleted on sucess, just forget it."
  726. #add alias
  727. apacheVer="$(apachectl -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2 )"
  728. _debug "apacheVer" "$apacheVer"
  729. apacheMajer="$(echo "$apacheVer" | cut -d . -f 1)"
  730. apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
  731. if [ "$apacheVer" ] && [ "$apacheMajer" -ge "2" ] && [ "$apacheMinor" -ge "4" ] ; then
  732. echo "
  733. Alias /.well-known/acme-challenge $ACME_DIR
  734. <Directory $ACME_DIR >
  735. Require all granted
  736. </Directory>
  737. " >> $httpdconf
  738. else
  739. echo "
  740. Alias /.well-known/acme-challenge $ACME_DIR
  741. <Directory $ACME_DIR >
  742. Order allow,deny
  743. Allow from all
  744. </Directory>
  745. " >> $httpdconf
  746. fi
  747. if ! apachectl -t ; then
  748. _err "Sorry, apache config error, please contact me."
  749. _restoreApache
  750. return 1;
  751. fi
  752. if [ ! -d "$ACME_DIR" ] ; then
  753. mkdir -p "$ACME_DIR"
  754. chmod 755 "$ACME_DIR"
  755. fi
  756. if ! apachectl graceful ; then
  757. _err "Sorry, apachectl graceful error, please contact me."
  758. _restoreApache
  759. return 1;
  760. fi
  761. usingApache="1"
  762. return 0
  763. }
  764. _clearup() {
  765. _stopserver $serverproc
  766. serverproc=""
  767. _restoreApache
  768. }
  769. # webroot removelevel tokenfile
  770. _clearupwebbroot() {
  771. __webroot="$1"
  772. if [ -z "$__webroot" ] ; then
  773. _debug "no webroot specified, skip"
  774. return 0
  775. fi
  776. if [ "$2" = '1' ] ; then
  777. _debug "remove $__webroot/.well-known"
  778. rm -rf "$__webroot/.well-known"
  779. elif [ "$2" = '2' ] ; then
  780. _debug "remove $__webroot/.well-known/acme-challenge"
  781. rm -rf "$__webroot/.well-known/acme-challenge"
  782. elif [ "$2" = '3' ] ; then
  783. _debug "remove $__webroot/.well-known/acme-challenge/$3"
  784. rm -rf "$__webroot/.well-known/acme-challenge/$3"
  785. else
  786. _info "Skip for removelevel:$2"
  787. fi
  788. return 0
  789. }
  790. issue() {
  791. if [ -z "$2" ] ; then
  792. echo "Usage: $PROJECT_ENTRY --issue -d a.com -w /path/to/webroot/a.com/ "
  793. return 1
  794. fi
  795. Le_Webroot="$1"
  796. Le_Domain="$2"
  797. Le_Alt="$3"
  798. Le_Keylength="$4"
  799. Le_RealCertPath="$5"
  800. Le_RealKeyPath="$6"
  801. Le_RealCACertPath="$7"
  802. Le_ReloadCmd="$8"
  803. Le_RealFullChainPath="$9"
  804. #remove these later.
  805. if [ "$Le_Webroot" = "dns-cf" ] ; then
  806. Le_Webroot="dns_cf"
  807. fi
  808. if [ "$Le_Webroot" = "dns-dp" ] ; then
  809. Le_Webroot="dns_dp"
  810. fi
  811. if [ "$Le_Webroot" = "dns-cx" ] ; then
  812. Le_Webroot="dns_cx"
  813. fi
  814. _initpath $Le_Domain
  815. if [ -f "$DOMAIN_CONF" ] ; then
  816. Le_NextRenewTime=$(grep "^Le_NextRenewTime=" "$DOMAIN_CONF" | cut -d '=' -f 2)
  817. if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(date -u "+%s" )" -lt "$Le_NextRenewTime" ] ; then
  818. _info "Skip, Next renewal time is: $(grep "^Le_NextRenewTimeStr" "$DOMAIN_CONF" | cut -d '=' -f 2)"
  819. return 2
  820. fi
  821. fi
  822. _setopt "$DOMAIN_CONF" "Le_Domain" "=" "$Le_Domain"
  823. _setopt "$DOMAIN_CONF" "Le_Alt" "=" "$Le_Alt"
  824. _setopt "$DOMAIN_CONF" "Le_Webroot" "=" "$Le_Webroot"
  825. _setopt "$DOMAIN_CONF" "Le_Keylength" "=" "$Le_Keylength"
  826. _setopt "$DOMAIN_CONF" "Le_RealCertPath" "=" "\"$Le_RealCertPath\""
  827. _setopt "$DOMAIN_CONF" "Le_RealCACertPath" "=" "\"$Le_RealCACertPath\""
  828. _setopt "$DOMAIN_CONF" "Le_RealKeyPath" "=" "\"$Le_RealKeyPath\""
  829. _setopt "$DOMAIN_CONF" "Le_ReloadCmd" "=" "\"$Le_ReloadCmd\""
  830. _setopt "$DOMAIN_CONF" "Le_RealFullChainPath" "=" "\"$Le_RealFullChainPath\""
  831. if [ "$Le_Alt" = "no" ] ; then
  832. Le_Alt=""
  833. fi
  834. if [ "$Le_Keylength" = "no" ] ; then
  835. Le_Keylength=""
  836. fi
  837. if [ "$Le_RealCertPath" = "no" ] ; then
  838. Le_RealCertPath=""
  839. fi
  840. if [ "$Le_RealKeyPath" = "no" ] ; then
  841. Le_RealKeyPath=""
  842. fi
  843. if [ "$Le_RealCACertPath" = "no" ] ; then
  844. Le_RealCACertPath=""
  845. fi
  846. if [ "$Le_ReloadCmd" = "no" ] ; then
  847. Le_ReloadCmd=""
  848. fi
  849. if [ "$Le_RealFullChainPath" = "no" ] ; then
  850. Le_RealFullChainPath=""
  851. fi
  852. if _contains "$Le_Webroot" "no" ; then
  853. _info "Standalone mode."
  854. if ! _exists "nc" ; then
  855. _err "Please install netcat(nc) tools first."
  856. return 1
  857. fi
  858. if [ -z "$Le_HTTPPort" ] ; then
  859. Le_HTTPPort=80
  860. fi
  861. _setopt "$DOMAIN_CONF" "Le_HTTPPort" "=" "$Le_HTTPPort"
  862. netprc="$(_ss "$Le_HTTPPort" | grep "$Le_HTTPPort")"
  863. if [ "$netprc" ] ; then
  864. _err "$netprc"
  865. _err "tcp port $Le_HTTPPort is already used by $(echo "$netprc" | cut -d : -f 4)"
  866. _err "Please stop it first"
  867. return 1
  868. fi
  869. fi
  870. if _contains "$Le_Webroot" "apache" ; then
  871. if ! _setApache ; then
  872. _err "set up apache error. Report error to me."
  873. return 1
  874. fi
  875. else
  876. usingApache=""
  877. fi
  878. if [ ! -f "$ACCOUNT_KEY_PATH" ] ; then
  879. if ! createAccountKey $Le_Domain $Le_Keylength ; then
  880. _err "Create account key error."
  881. if [ "$usingApache" ] ; then
  882. _restoreApache
  883. fi
  884. return 1
  885. fi
  886. fi
  887. if ! _calcjwk "$ACCOUNT_KEY_PATH" ; then
  888. if [ "$usingApache" ] ; then
  889. _restoreApache
  890. fi
  891. return 1
  892. fi
  893. accountkey_json=$(echo -n "$jwk" | tr -d ' ' )
  894. thumbprint=$(echo -n "$accountkey_json" | _digest "sha256" | _urlencode)
  895. accountkeyhash="$(cat "$ACCOUNT_KEY_PATH" | _digest "sha256" )"
  896. accountkeyhash="$(echo $accountkeyhash$API | _digest "sha256" )"
  897. if [ "$accountkeyhash" != "$ACCOUNT_KEY_HASH" ] ; then
  898. _info "Registering account"
  899. regjson='{"resource": "new-reg", "agreement": "'$AGREEMENT'"}'
  900. if [ "$ACCOUNT_EMAIL" ] ; then
  901. regjson='{"resource": "new-reg", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
  902. fi
  903. _send_signed_request "$API/acme/new-reg" "$regjson"
  904. if [ "$code" = "" ] || [ "$code" = '201' ] ; then
  905. _info "Registered"
  906. echo $response > $LE_WORKING_DIR/account.json
  907. elif [ "$code" = '409' ] ; then
  908. _info "Already registered"
  909. else
  910. _err "Register account Error: $response"
  911. _clearup
  912. return 1
  913. fi
  914. ACCOUNT_KEY_HASH="$accountkeyhash"
  915. _saveaccountconf "ACCOUNT_KEY_HASH" "$ACCOUNT_KEY_HASH"
  916. else
  917. _info "Skip register account key"
  918. fi
  919. if [ ! -f "$CERT_KEY_PATH" ] ; then
  920. if ! createDomainKey $Le_Domain $Le_Keylength ; then
  921. _err "Create domain key error."
  922. _clearup
  923. return 1
  924. fi
  925. fi
  926. if ! createCSR $Le_Domain $Le_Alt ; then
  927. _err "Create CSR error."
  928. _clearup
  929. return 1
  930. fi
  931. vlist="$Le_Vlist"
  932. # verify each domain
  933. _info "Verify each domain"
  934. sep='#'
  935. if [ -z "$vlist" ] ; then
  936. alldomains=$(echo "$Le_Domain,$Le_Alt" | tr ',' ' ' )
  937. _index=1
  938. _currentRoot=""
  939. for d in $alldomains
  940. do
  941. _info "Getting webroot for domain" $d
  942. _w="$(echo $Le_Webroot | cut -d , -f $_index)"
  943. _debug _w "$_w"
  944. if [ "$_w" ] ; then
  945. _currentRoot="$_w"
  946. fi
  947. _debug "_currentRoot" "$_currentRoot"
  948. let "_index+=1"
  949. vtype="$VTYPE_HTTP"
  950. if _startswith "$_currentRoot" "dns" ; then
  951. vtype="$VTYPE_DNS"
  952. fi
  953. _info "Getting token for domain" $d
  954. _send_signed_request "$API/acme/new-authz" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$d\"}}"
  955. if [ ! -z "$code" ] && [ ! "$code" = '201' ] ; then
  956. _err "new-authz error: $response"
  957. _clearup
  958. return 1
  959. fi
  960. entry="$(printf $response | egrep -o '\{[^{]*"type":"'$vtype'"[^}]*')"
  961. _debug entry "$entry"
  962. token="$(printf "$entry" | egrep -o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
  963. _debug token $token
  964. uri="$(printf "$entry" | egrep -o '"uri":"[^"]*'| cut -d : -f 2,3 | tr -d '"' )"
  965. _debug uri $uri
  966. keyauthorization="$token.$thumbprint"
  967. _debug keyauthorization "$keyauthorization"
  968. dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
  969. _debug dvlist "$dvlist"
  970. vlist="$vlist$dvlist,"
  971. done
  972. #add entry
  973. dnsadded=""
  974. ventries=$(echo "$vlist" | tr ',' ' ' )
  975. for ventry in $ventries
  976. do
  977. d=$(echo $ventry | cut -d $sep -f 1)
  978. keyauthorization=$(echo $ventry | cut -d $sep -f 2)
  979. vtype=$(echo $ventry | cut -d $sep -f 4)
  980. _currentRoot=$(echo $ventry | cut -d $sep -f 5)
  981. if [ "$vtype" = "$VTYPE_DNS" ] ; then
  982. dnsadded='0'
  983. txtdomain="_acme-challenge.$d"
  984. _debug txtdomain "$txtdomain"
  985. txt="$(echo -n $keyauthorization | _digest "sha256" | _urlencode)"
  986. _debug txt "$txt"
  987. #dns
  988. #1. check use api
  989. d_api=""
  990. if [ -f "$LE_WORKING_DIR/$d/$_currentRoot" ] ; then
  991. d_api="$LE_WORKING_DIR/$d/$_currentRoot"
  992. elif [ -f "$LE_WORKING_DIR/$d/$_currentRoot.sh" ] ; then
  993. d_api="$LE_WORKING_DIR/$d/$_currentRoot.sh"
  994. elif [ -f "$LE_WORKING_DIR/$_currentRoot" ] ; then
  995. d_api="$LE_WORKING_DIR/$_currentRoot"
  996. elif [ -f "$LE_WORKING_DIR/$_currentRoot.sh" ] ; then
  997. d_api="$LE_WORKING_DIR/$_currentRoot.sh"
  998. elif [ -f "$LE_WORKING_DIR/dnsapi/$_currentRoot" ] ; then
  999. d_api="$LE_WORKING_DIR/dnsapi/$_currentRoot"
  1000. elif [ -f "$LE_WORKING_DIR/dnsapi/$_currentRoot.sh" ] ; then
  1001. d_api="$LE_WORKING_DIR/dnsapi/$_currentRoot.sh"
  1002. fi
  1003. _debug d_api "$d_api"
  1004. if [ "$d_api" ] ; then
  1005. _info "Found domain api file: $d_api"
  1006. else
  1007. _err "Add the following TXT record:"
  1008. _err "Domain: $txtdomain"
  1009. _err "TXT value: $txt"
  1010. _err "Please be aware that you prepend _acme-challenge. before your domain"
  1011. _err "so the resulting subdomain will be: $txtdomain"
  1012. continue
  1013. fi
  1014. (
  1015. if ! . $d_api ; then
  1016. _err "Load file $d_api error. Please check your api file and try again."
  1017. return 1
  1018. fi
  1019. addcommand="${_currentRoot}_add"
  1020. if ! _exists $addcommand ; then
  1021. _err "It seems that your api file is not correct, it must have a function named: $addcommand"
  1022. return 1
  1023. fi
  1024. if ! $addcommand $txtdomain $txt ; then
  1025. _err "Error add txt for domain:$txtdomain"
  1026. return 1
  1027. fi
  1028. )
  1029. if [ "$?" != "0" ] ; then
  1030. _clearup
  1031. return 1
  1032. fi
  1033. dnsadded='1'
  1034. fi
  1035. done
  1036. if [ "$dnsadded" = '0' ] ; then
  1037. _setopt "$DOMAIN_CONF" "Le_Vlist" "=" "\"$vlist\""
  1038. _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
  1039. _err "Please add the TXT records to the domains, and retry again."
  1040. _clearup
  1041. return 1
  1042. fi
  1043. fi
  1044. if [ "$dnsadded" = '1' ] ; then
  1045. _info "Sleep 60 seconds for the txt records to take effect"
  1046. sleep 60
  1047. fi
  1048. _debug "ok, let's start to verify"
  1049. ventries=$(echo "$vlist" | tr ',' ' ' )
  1050. for ventry in $ventries
  1051. do
  1052. d=$(echo $ventry | cut -d $sep -f 1)
  1053. keyauthorization=$(echo $ventry | cut -d $sep -f 2)
  1054. uri=$(echo $ventry | cut -d $sep -f 3)
  1055. vtype=$(echo $ventry | cut -d $sep -f 4)
  1056. _currentRoot=$(echo $ventry | cut -d $sep -f 5)
  1057. _info "Verifying:$d"
  1058. _debug "d" "$d"
  1059. _debug "keyauthorization" "$keyauthorization"
  1060. _debug "uri" "$uri"
  1061. removelevel=""
  1062. token=""
  1063. _debug "_currentRoot" "$_currentRoot"
  1064. if [ "$vtype" = "$VTYPE_HTTP" ] ; then
  1065. if [ "$_currentRoot" = "no" ] ; then
  1066. _info "Standalone mode server"
  1067. _startserver "$keyauthorization" &
  1068. if [ "$?" != "0" ] ; then
  1069. _clearup
  1070. return 1
  1071. fi
  1072. serverproc="$!"
  1073. sleep 2
  1074. _debug serverproc $serverproc
  1075. else
  1076. if [ "$_currentRoot" = "apache" ] ; then
  1077. wellknown_path="$ACME_DIR"
  1078. else
  1079. wellknown_path="$_currentRoot/.well-known/acme-challenge"
  1080. if [ ! -d "$_currentRoot/.well-known" ] ; then
  1081. removelevel='1'
  1082. elif [ ! -d "$_currentRoot/.well-known/acme-challenge" ] ; then
  1083. removelevel='2'
  1084. else
  1085. removelevel='3'
  1086. fi
  1087. fi
  1088. _debug wellknown_path "$wellknown_path"
  1089. token="$(echo -e -n "$keyauthorization" | cut -d '.' -f 1)"
  1090. _debug "writing token:$token to $wellknown_path/$token"
  1091. mkdir -p "$wellknown_path"
  1092. echo -n "$keyauthorization" > "$wellknown_path/$token"
  1093. if [ ! "$usingApache" ] ; then
  1094. webroot_owner=$(_stat $_currentRoot)
  1095. _debug "Changing owner/group of .well-known to $webroot_owner"
  1096. chown -R $webroot_owner "$_currentRoot/.well-known"
  1097. fi
  1098. fi
  1099. fi
  1100. _send_signed_request $uri "{\"resource\": \"challenge\", \"keyAuthorization\": \"$keyauthorization\"}"
  1101. if [ ! -z "$code" ] && [ ! "$code" = '202' ] ; then
  1102. _err "$d:Challenge error: $response"
  1103. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1104. _clearup
  1105. return 1
  1106. fi
  1107. waittimes=0
  1108. if [ -z "$MAX_RETRY_TIMES" ] ; then
  1109. MAX_RETRY_TIMES=30
  1110. fi
  1111. while [ "1" ] ; do
  1112. let "waittimes+=1"
  1113. if [ "$waittimes" -ge "$MAX_RETRY_TIMES" ] ; then
  1114. _err "$d:Timeout"
  1115. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1116. _clearup
  1117. return 1
  1118. fi
  1119. _debug "sleep 5 secs to verify"
  1120. sleep 5
  1121. _debug "checking"
  1122. response="$(_get $uri)"
  1123. if [ "$?" != "0" ] ; then
  1124. _err "$d:Verify error:$response"
  1125. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1126. _clearup
  1127. return 1
  1128. fi
  1129. status=$(echo $response | egrep -o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
  1130. if [ "$status" = "valid" ] ; then
  1131. _info "Success"
  1132. _stopserver $serverproc
  1133. serverproc=""
  1134. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1135. break;
  1136. fi
  1137. if [ "$status" = "invalid" ] ; then
  1138. error=$(echo $response | egrep -o '"error":{[^}]*}' | grep -o '"detail":"[^"]*"' | cut -d '"' -f 4)
  1139. _err "$d:Verify error:$error"
  1140. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1141. _clearup
  1142. return 1;
  1143. fi
  1144. if [ "$status" = "pending" ] ; then
  1145. _info "Pending"
  1146. else
  1147. _err "$d:Verify error:$response"
  1148. _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
  1149. _clearup
  1150. return 1
  1151. fi
  1152. done
  1153. done
  1154. _clearup
  1155. _info "Verify finished, start to sign."
  1156. der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _urlencode)"
  1157. _send_signed_request "$API/acme/new-cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"
  1158. Le_LinkCert="$(grep -i -o '^Location.*$' $HTTP_HEADER | head -1 | tr -d "\r\n" | cut -d " " -f 2)"
  1159. _setopt "$DOMAIN_CONF" "Le_LinkCert" "=" "$Le_LinkCert"
  1160. if [ "$Le_LinkCert" ] ; then
  1161. echo "$BEGIN_CERT" > "$CERT_PATH"
  1162. _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH"
  1163. echo "$END_CERT" >> "$CERT_PATH"
  1164. _info "Cert success."
  1165. cat "$CERT_PATH"
  1166. _info "Your cert is in $CERT_PATH"
  1167. cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
  1168. if [ ! "$USER_PATH" ] || [ ! "$IN_CRON" ] ; then
  1169. USER_PATH="$PATH"
  1170. _saveaccountconf "USER_PATH" "$USER_PATH"
  1171. fi
  1172. fi
  1173. if [ -z "$Le_LinkCert" ] ; then
  1174. response="$(echo $response | _dbase64 "multiline" )"
  1175. _err "Sign failed: $(echo "$response" | grep -o '"detail":"[^"]*"')"
  1176. return 1
  1177. fi
  1178. _setopt "$DOMAIN_CONF" 'Le_Vlist' '=' "\"\""
  1179. Le_LinkIssuer=$(grep -i '^Link' $HTTP_HEADER | head -1 | cut -d " " -f 2| cut -d ';' -f 1 | tr -d '<>' )
  1180. _setopt "$DOMAIN_CONF" "Le_LinkIssuer" "=" "$Le_LinkIssuer"
  1181. if [ "$Le_LinkIssuer" ] ; then
  1182. echo "$BEGIN_CERT" > "$CA_CERT_PATH"
  1183. _get "$Le_LinkIssuer" | _base64 "multiline" >> "$CA_CERT_PATH"
  1184. echo "$END_CERT" >> "$CA_CERT_PATH"
  1185. _info "The intermediate CA cert is in $CA_CERT_PATH"
  1186. cat "$CA_CERT_PATH" >> "$CERT_FULLCHAIN_PATH"
  1187. _info "And the full chain certs is there: $CERT_FULLCHAIN_PATH"
  1188. fi
  1189. Le_CertCreateTime=$(date -u "+%s")
  1190. _setopt "$DOMAIN_CONF" "Le_CertCreateTime" "=" "$Le_CertCreateTime"
  1191. Le_CertCreateTimeStr=$(date -u )
  1192. _setopt "$DOMAIN_CONF" "Le_CertCreateTimeStr" "=" "\"$Le_CertCreateTimeStr\""
  1193. if [ -z "$Le_RenewalDays" ] || [ "$Le_RenewalDays" -lt "0" ] || [ "$Le_RenewalDays" -gt "80" ] ; then
  1194. Le_RenewalDays=80
  1195. fi
  1196. _setopt "$DOMAIN_CONF" "Le_RenewalDays" "=" "$Le_RenewalDays"
  1197. let "Le_NextRenewTime=Le_CertCreateTime+Le_RenewalDays*24*60*60"
  1198. _setopt "$DOMAIN_CONF" "Le_NextRenewTime" "=" "$Le_NextRenewTime"
  1199. Le_NextRenewTimeStr=$( _time2str $Le_NextRenewTime )
  1200. _setopt "$DOMAIN_CONF" "Le_NextRenewTimeStr" "=" "\"$Le_NextRenewTimeStr\""
  1201. installcert $Le_Domain "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath"
  1202. }
  1203. renew() {
  1204. Le_Domain="$1"
  1205. if [ -z "$Le_Domain" ] ; then
  1206. _err "Usage: $PROJECT_ENTRY --renew -d domain.com"
  1207. return 1
  1208. fi
  1209. _initpath $Le_Domain
  1210. if [ ! -f "$DOMAIN_CONF" ] ; then
  1211. _info "$Le_Domain is not a issued domain, skip."
  1212. return 0;
  1213. fi
  1214. . "$DOMAIN_CONF"
  1215. if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(date -u "+%s" )" -lt "$Le_NextRenewTime" ] ; then
  1216. _info "Skip, Next renewal time is: $Le_NextRenewTimeStr"
  1217. return 2
  1218. fi
  1219. IS_RENEW="1"
  1220. issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath"
  1221. local res=$?
  1222. IS_RENEW=""
  1223. return $res
  1224. }
  1225. renewAll() {
  1226. _initpath
  1227. _info "renewAll"
  1228. for d in $(ls -F ${CERT_HOME}/ | grep [^.].*[.].*/$ ) ; do
  1229. d=$(echo $d | cut -d '/' -f 1)
  1230. _info "renew $d"
  1231. Le_LinkCert=""
  1232. Le_Domain=""
  1233. Le_Alt="no"
  1234. Le_Webroot=""
  1235. Le_Keylength=""
  1236. Le_LinkIssuer=""
  1237. Le_CertCreateTime=""
  1238. Le_CertCreateTimeStr=""
  1239. Le_RenewalDays=""
  1240. Le_NextRenewTime=""
  1241. Le_NextRenewTimeStr=""
  1242. Le_RealCertPath=""
  1243. Le_RealKeyPath=""
  1244. Le_RealCACertPath=""
  1245. Le_ReloadCmd=""
  1246. Le_RealFullChainPath=""
  1247. DOMAIN_PATH=""
  1248. DOMAIN_CONF=""
  1249. DOMAIN_SSL_CONF=""
  1250. CSR_PATH=""
  1251. CERT_KEY_PATH=""
  1252. CERT_PATH=""
  1253. CA_CERT_PATH=""
  1254. CERT_PFX_PATH=""
  1255. CERT_FULLCHAIN_PATH=""
  1256. ACCOUNT_KEY_PATH=""
  1257. wellknown_path=""
  1258. renew "$d"
  1259. done
  1260. }
  1261. installcert() {
  1262. Le_Domain="$1"
  1263. if [ -z "$Le_Domain" ] ; then
  1264. echo "Usage: $PROJECT_ENTRY --installcert -d domain.com [--certpath cert-file-path] [--keypath key-file-path] [--capath ca-cert-file-path] [ --reloadCmd reloadCmd] [--fullchainpath fullchain-path]"
  1265. return 1
  1266. fi
  1267. Le_RealCertPath="$2"
  1268. Le_RealKeyPath="$3"
  1269. Le_RealCACertPath="$4"
  1270. Le_ReloadCmd="$5"
  1271. Le_RealFullChainPath="$6"
  1272. _initpath $Le_Domain
  1273. _setopt "$DOMAIN_CONF" "Le_RealCertPath" "=" "\"$Le_RealCertPath\""
  1274. _setopt "$DOMAIN_CONF" "Le_RealCACertPath" "=" "\"$Le_RealCACertPath\""
  1275. _setopt "$DOMAIN_CONF" "Le_RealKeyPath" "=" "\"$Le_RealKeyPath\""
  1276. _setopt "$DOMAIN_CONF" "Le_ReloadCmd" "=" "\"$Le_ReloadCmd\""
  1277. _setopt "$DOMAIN_CONF" "Le_RealFullChainPath" "=" "\"$Le_RealFullChainPath\""
  1278. if [ "$Le_RealCertPath" ] ; then
  1279. if [ -f "$Le_RealCertPath" ] ; then
  1280. cp -p "$Le_RealCertPath" "$Le_RealCertPath".bak
  1281. fi
  1282. cat "$CERT_PATH" > "$Le_RealCertPath"
  1283. fi
  1284. if [ "$Le_RealCACertPath" ] ; then
  1285. if [ "$Le_RealCACertPath" = "$Le_RealCertPath" ] ; then
  1286. echo "" >> "$Le_RealCACertPath"
  1287. cat "$CA_CERT_PATH" >> "$Le_RealCACertPath"
  1288. else
  1289. if [ -f "$Le_RealCACertPath" ] ; then
  1290. cp -p "$Le_RealCACertPath" "$Le_RealCACertPath".bak
  1291. fi
  1292. cat "$CA_CERT_PATH" > "$Le_RealCACertPath"
  1293. fi
  1294. fi
  1295. if [ "$Le_RealKeyPath" ] ; then
  1296. if [ -f "$Le_RealKeyPath" ] ; then
  1297. cp -p "$Le_RealKeyPath" "$Le_RealKeyPath".bak
  1298. fi
  1299. cat "$CERT_KEY_PATH" > "$Le_RealKeyPath"
  1300. fi
  1301. if [ "$Le_RealFullChainPath" ] ; then
  1302. if [ -f "$Le_RealFullChainPath" ] ; then
  1303. cp -p "$Le_RealFullChainPath" "$Le_RealFullChainPath".bak
  1304. fi
  1305. cat "$CERT_FULLCHAIN_PATH" > "$Le_RealFullChainPath"
  1306. fi
  1307. if [ "$Le_ReloadCmd" ] ; then
  1308. _info "Run Le_ReloadCmd: $Le_ReloadCmd"
  1309. (cd "$DOMAIN_PATH" && eval "$Le_ReloadCmd")
  1310. fi
  1311. }
  1312. installcronjob() {
  1313. _initpath
  1314. if ! _exists "crontab" ; then
  1315. _err "crontab doesn't exist, so, we can not install cron jobs."
  1316. _err "All your certs will not be renewed automatically."
  1317. _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
  1318. return 1
  1319. fi
  1320. _info "Installing cron job"
  1321. if ! crontab -l | grep "$PROJECT_ENTRY --cron" ; then
  1322. if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ] ; then
  1323. lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
  1324. else
  1325. _err "Can not install cronjob, $PROJECT_ENTRY not found."
  1326. return 1
  1327. fi
  1328. crontab -l | { cat; echo "0 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"; } | crontab -
  1329. fi
  1330. if [ "$?" != "0" ] ; then
  1331. _err "Install cron job failed. You need to manually renew your certs."
  1332. _err "Or you can add cronjob by yourself:"
  1333. _err "$lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"
  1334. return 1
  1335. fi
  1336. }
  1337. uninstallcronjob() {
  1338. if ! _exists "crontab" ; then
  1339. return
  1340. fi
  1341. _info "Removing cron job"
  1342. cr="$(crontab -l | grep "$PROJECT_ENTRY --cron")"
  1343. if [ "$cr" ] ; then
  1344. crontab -l | sed "/$PROJECT_ENTRY --cron/d" | crontab -
  1345. LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 9 | tr -d '"')"
  1346. _info LE_WORKING_DIR "$LE_WORKING_DIR"
  1347. fi
  1348. _initpath
  1349. }
  1350. revoke() {
  1351. Le_Domain="$1"
  1352. if [ -z "$Le_Domain" ] ; then
  1353. echo "Usage: $PROJECT_ENTRY --revoke -d domain.com"
  1354. return 1
  1355. fi
  1356. _initpath $Le_Domain
  1357. if [ ! -f "$DOMAIN_CONF" ] ; then
  1358. _err "$Le_Domain is not a issued domain, skip."
  1359. return 1;
  1360. fi
  1361. if [ ! -f "$CERT_PATH" ] ; then
  1362. _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
  1363. return 1
  1364. fi
  1365. cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}"| tr -d "\r\n" | _urlencode)"
  1366. if [ -z "$cert" ] ; then
  1367. _err "Cert for $Le_Domain is empty found, skip."
  1368. return 1
  1369. fi
  1370. data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
  1371. uri="$API/acme/revoke-cert"
  1372. _info "Try domain key first."
  1373. if _send_signed_request $uri "$data" "" "$CERT_KEY_PATH"; then
  1374. if [ -z "$response" ] ; then
  1375. _info "Revoke success."
  1376. rm -f $CERT_PATH
  1377. return 0
  1378. else
  1379. _err "Revoke error by domain key."
  1380. _err "$resource"
  1381. fi
  1382. fi
  1383. _info "Then try account key."
  1384. if _send_signed_request $uri "$data" "" "$ACCOUNT_KEY_PATH" ; then
  1385. if [ -z "$response" ] ; then
  1386. _info "Revoke success."
  1387. rm -f $CERT_PATH
  1388. return 0
  1389. else
  1390. _err "Revoke error."
  1391. _debug "$resource"
  1392. fi
  1393. fi
  1394. return 1
  1395. }
  1396. # Detect profile file if not specified as environment variable
  1397. _detect_profile() {
  1398. if [ -n "$PROFILE" -a -f "$PROFILE" ] ; then
  1399. echo "$PROFILE"
  1400. return
  1401. fi
  1402. local DETECTED_PROFILE
  1403. DETECTED_PROFILE=''
  1404. local SHELLTYPE
  1405. SHELLTYPE="$(basename "/$SHELL")"
  1406. if [ "$SHELLTYPE" = "bash" ] ; then
  1407. if [ -f "$HOME/.bashrc" ] ; then
  1408. DETECTED_PROFILE="$HOME/.bashrc"
  1409. elif [ -f "$HOME/.bash_profile" ] ; then
  1410. DETECTED_PROFILE="$HOME/.bash_profile"
  1411. fi
  1412. elif [ "$SHELLTYPE" = "zsh" ] ; then
  1413. DETECTED_PROFILE="$HOME/.zshrc"
  1414. fi
  1415. if [ -z "$DETECTED_PROFILE" ] ; then
  1416. if [ -f "$HOME/.profile" ] ; then
  1417. DETECTED_PROFILE="$HOME/.profile"
  1418. elif [ -f "$HOME/.bashrc" ] ; then
  1419. DETECTED_PROFILE="$HOME/.bashrc"
  1420. elif [ -f "$HOME/.bash_profile" ] ; then
  1421. DETECTED_PROFILE="$HOME/.bash_profile"
  1422. elif [ -f "$HOME/.zshrc" ] ; then
  1423. DETECTED_PROFILE="$HOME/.zshrc"
  1424. fi
  1425. fi
  1426. if [ ! -z "$DETECTED_PROFILE" ] ; then
  1427. echo "$DETECTED_PROFILE"
  1428. fi
  1429. }
  1430. _initconf() {
  1431. _initpath
  1432. if [ ! -f "$ACCOUNT_CONF_PATH" ] ; then
  1433. echo "#ACCOUNT_CONF_PATH=xxxx
  1434. #Account configurations:
  1435. #Here are the supported macros, uncomment them to make them take effect.
  1436. #ACCOUNT_EMAIL=aaa@aaa.com # the account email used to register account.
  1437. #ACCOUNT_KEY_PATH=\"/path/to/account.key\"
  1438. #CERT_HOME=\"/path/to/cert/home\"
  1439. #STAGE=1 # Use the staging api
  1440. #FORCE=1 # Force to issue cert
  1441. #DEBUG=1 # Debug mode
  1442. #ACCOUNT_KEY_HASH=account key hash
  1443. USER_AGENT=\"$USER_AGENT\"
  1444. #USER_PATH=""
  1445. #dns api
  1446. #######################
  1447. #Cloudflare:
  1448. #api key
  1449. #CF_Key=\"sdfsdfsdfljlbjkljlkjsdfoiwje\"
  1450. #account email
  1451. #CF_Email=\"xxxx@sss.com\"
  1452. #######################
  1453. #Dnspod.cn:
  1454. #api key id
  1455. #DP_Id=\"1234\"
  1456. #api key
  1457. #DP_Key=\"sADDsdasdgdsf\"
  1458. #######################
  1459. #Cloudxns.com:
  1460. #CX_Key=\"1234\"
  1461. #
  1462. #CX_Secret=\"sADDsdasdgdsf\"
  1463. " > $ACCOUNT_CONF_PATH
  1464. fi
  1465. }
  1466. _precheck() {
  1467. if ! _exists "curl" && ! _exists "wget"; then
  1468. _err "Please install curl or wget first, we need to access http resources."
  1469. return 1
  1470. fi
  1471. if ! _exists "crontab" ; then
  1472. _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
  1473. _err "We need to set cron job to renew the certs automatically."
  1474. _err "Otherwise, your certs will not be able to be renewed automatically."
  1475. if [ -z "$FORCE" ] ; then
  1476. _err "Please add '--force' and try install again to go without crontab."
  1477. _err "./$PROJECT_ENTRY --install --force"
  1478. return 1
  1479. fi
  1480. fi
  1481. if ! _exists "openssl" ; then
  1482. _err "Please install openssl first."
  1483. _err "We need openssl to generate keys."
  1484. return 1
  1485. fi
  1486. if ! _exists "nc" ; then
  1487. _err "It is recommended to install nc first, try to install 'nc' or 'netcat'."
  1488. _err "We use nc for standalone server if you use standalone mode."
  1489. _err "If you don't use standalone mode, just ignore this warning."
  1490. fi
  1491. return 0
  1492. }
  1493. install() {
  1494. if ! _initpath ; then
  1495. _err "Install failed."
  1496. return 1
  1497. fi
  1498. if ! _precheck ; then
  1499. _err "Pre-check failed, can not install."
  1500. return 1
  1501. fi
  1502. #convert from le
  1503. if [ -d "$HOME/.le" ] ; then
  1504. for envfile in "le.env" "le.sh.env"
  1505. do
  1506. if [ -f "$HOME/.le/$envfile" ] ; then
  1507. if grep "le.sh" "$HOME/.le/$envfile" >/dev/null ; then
  1508. _upgrading="1"
  1509. _info "You are upgrading from le.sh"
  1510. _info "Renaming \"$HOME/.le\" to $LE_WORKING_DIR"
  1511. mv "$HOME/.le" "$LE_WORKING_DIR"
  1512. mv "$LE_WORKING_DIR/$envfile" "$LE_WORKING_DIR/$PROJECT_ENTRY.env"
  1513. break;
  1514. fi
  1515. fi
  1516. done
  1517. fi
  1518. _info "Installing to $LE_WORKING_DIR"
  1519. if ! mkdir -p "$LE_WORKING_DIR" ; then
  1520. _err "Can not craete working dir: $LE_WORKING_DIR"
  1521. return 1
  1522. fi
  1523. cp $PROJECT_ENTRY "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
  1524. if [ "$?" != "0" ] ; then
  1525. _err "Install failed, can not copy $PROJECT_ENTRY"
  1526. return 1
  1527. fi
  1528. _info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
  1529. _profile="$(_detect_profile)"
  1530. if [ "$_profile" ] ; then
  1531. _debug "Found profile: $_profile"
  1532. _envfile="$LE_WORKING_DIR/$PROJECT_ENTRY.env"
  1533. if [ "$_upgrading" ] && [ "$_upgrading" = "1" ] ; then
  1534. echo "$(cat $_envfile)" | sed "s|^LE_WORKING_DIR.*$||" > "$_envfile"
  1535. echo "$(cat $_envfile)" | sed "s|^alias le.*$||" > "$_envfile"
  1536. echo "$(cat $_envfile)" | sed "s|^alias le.sh.*$||" > "$_envfile"
  1537. fi
  1538. _setopt "$_envfile" "LE_WORKING_DIR" "=" "\"$LE_WORKING_DIR\""
  1539. _setopt "$_envfile" "alias $PROJECT_ENTRY" "=" "\"$LE_WORKING_DIR/$PROJECT_ENTRY\""
  1540. echo "" >> "$_profile"
  1541. _setopt "$_profile" ". \"$LE_WORKING_DIR/$PROJECT_NAME.env\""
  1542. _info "OK, Close and reopen your terminal to start using $PROJECT_NAME"
  1543. else
  1544. _info "No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME"
  1545. fi
  1546. if [ -d "dnsapi" ] ; then
  1547. mkdir -p $LE_WORKING_DIR/dnsapi
  1548. cp dnsapi/* $LE_WORKING_DIR/dnsapi/
  1549. fi
  1550. #to keep compatible mv the .acc file to .key file
  1551. if [ -f "$LE_WORKING_DIR/account.acc" ] ; then
  1552. mv "$LE_WORKING_DIR/account.acc" "$LE_WORKING_DIR/account.key"
  1553. fi
  1554. if [ ! -f "$ACCOUNT_CONF_PATH" ] ; then
  1555. _initconf
  1556. fi
  1557. if [ "$_DEFAULT_ACCOUNT_CONF_PATH" != "$ACCOUNT_CONF_PATH" ] ; then
  1558. _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
  1559. fi
  1560. if [ "$_DEFAULT_CERT_HOME" != "$CERT_HOME" ] ; then
  1561. _saveaccountconf "CERT_HOME" "$CERT_HOME"
  1562. fi
  1563. if [ "$_DEFAULT_ACCOUNT_KEY_PATH" != "$ACCOUNT_KEY_PATH" ] ; then
  1564. _saveaccountconf "ACCOUNT_KEY_PATH" "$ACCOUNT_KEY_PATH"
  1565. fi
  1566. installcronjob
  1567. _info OK
  1568. }
  1569. uninstall() {
  1570. uninstallcronjob
  1571. _initpath
  1572. _profile="$(_detect_profile)"
  1573. if [ "$_profile" ] ; then
  1574. text="$(cat $_profile)"
  1575. echo "$text" | sed "s|^[.] \"$LE_WORKING_DIR/$PROJECT_NAME.env\"$||" > "$_profile"
  1576. fi
  1577. rm -f $LE_WORKING_DIR/$PROJECT_ENTRY
  1578. _info "The keys and certs are in $LE_WORKING_DIR, you can remove them by yourself."
  1579. }
  1580. cron() {
  1581. IN_CRON=1
  1582. renewAll
  1583. IN_CRON=""
  1584. }
  1585. version() {
  1586. echo "$PROJECT"
  1587. echo "v$VER"
  1588. }
  1589. showhelp() {
  1590. version
  1591. echo "Usage: $PROJECT_ENTRY command ...[parameters]....
  1592. Commands:
  1593. --help, -h Show this help message.
  1594. --version, -v Show version info.
  1595. --install Install $PROJECT_NAME to your system.
  1596. --uninstall Uninstall $PROJECT_NAME, and uninstall the cron job.
  1597. --issue Issue a cert.
  1598. --installcert Install the issued cert to apache/nginx or any other server.
  1599. --renew, -r Renew a cert.
  1600. --renewAll Renew all the certs
  1601. --revoke Revoke a cert.
  1602. --installcronjob Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
  1603. --uninstallcronjob Uninstall the cron job. The 'uninstall' command can do this automatically.
  1604. --cron Run cron job to renew all the certs.
  1605. --toPkcs Export the certificate and key to a pfx file.
  1606. --createAccountKey, -cak Create an account private key, professional use.
  1607. --createDomainKey, -cdk Create an domain private key, professional use.
  1608. --createCSR, -ccsr Create CSR , professional use.
  1609. Parameters:
  1610. --domain, -d domain.tld Specifies a domain, used to issue, renew or revoke etc.
  1611. --force, -f Used to force to install or force to renew a cert immediately.
  1612. --staging, --test Use staging server, just for test.
  1613. --debug Output debug info.
  1614. --webroot, -w /path/to/webroot Specifies the web root folder for web root mode.
  1615. --standalone Use standalone mode.
  1616. --apache Use apache mode.
  1617. --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file] Use dns mode or dns api.
  1618. --keylength, -k [2048] Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
  1619. --accountkeylength, -ak [2048] Specifies the account key length.
  1620. These parameters are to install the cert to nginx/apache or anyother server after issue/renew a cert:
  1621. --certpath /path/to/real/cert/file After issue/renew, the cert will be copied to this path.
  1622. --keypath /path/to/real/key/file After issue/renew, the key will be copied to this path.
  1623. --capath /path/to/real/ca/file After issue/renew, the intermediate cert will be copied to this path.
  1624. --fullchainpath /path/to/fullchain/file After issue/renew, the fullchain cert will be copied to this path.
  1625. --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
  1626. --accountconf Specifies a customized account config file.
  1627. --home Specifies the home dir for $PROJECT_NAME .
  1628. --certhome Specifies the home dir to save all the certs.
  1629. --useragent Specifies the user agent string. it will be saved for future use too.
  1630. --accountemail Specifies the account email for registering, Only valid for the '--install' command.
  1631. --accountkey Specifies the account key path, Only valid for the '--install' command.
  1632. --days Specifies the days to renew the cert when using '--issue' command. The max value is 80 days.
  1633. "
  1634. }
  1635. _installOnline() {
  1636. _info "Installing from online archive."
  1637. if [ ! "$BRANCH" ] ; then
  1638. BRANCH="master"
  1639. fi
  1640. _initpath
  1641. target="$PROJECT/archive/$BRANCH.tar.gz"
  1642. _info "Downloading $target"
  1643. localname="$BRANCH.tar.gz"
  1644. if ! _get "$target" > $localname ; then
  1645. _debug "Download error."
  1646. return 1
  1647. fi
  1648. _info "Extracting $localname"
  1649. tar xzf $localname
  1650. cd "$PROJECT_NAME-$BRANCH"
  1651. chmod +x $PROJECT_ENTRY
  1652. if ./$PROJECT_ENTRY install ; then
  1653. _info "Install success!"
  1654. fi
  1655. cd ..
  1656. rm -rf "$PROJECT_NAME-$BRANCH"
  1657. rm -f "$localname"
  1658. }
  1659. _process() {
  1660. _CMD=""
  1661. _domain=""
  1662. _altdomains="no"
  1663. _webroot=""
  1664. _keylength="no"
  1665. _accountkeylength="no"
  1666. _certpath="no"
  1667. _keypath="no"
  1668. _capath="no"
  1669. _fullchainpath="no"
  1670. _reloadcmd="no"
  1671. _password=""
  1672. _accountconf=""
  1673. _useragent=""
  1674. _accountemail=""
  1675. _accountkey=""
  1676. _certhome=""
  1677. while [ ${#} -gt 0 ] ; do
  1678. case "${1}" in
  1679. --help|-h)
  1680. showhelp
  1681. return
  1682. ;;
  1683. --version|-v)
  1684. version
  1685. return
  1686. ;;
  1687. --install)
  1688. _CMD="install"
  1689. ;;
  1690. --uninstall)
  1691. _CMD="uninstall"
  1692. ;;
  1693. --issue)
  1694. _CMD="issue"
  1695. ;;
  1696. --installcert|-i)
  1697. _CMD="installcert"
  1698. ;;
  1699. --renew|-r)
  1700. _CMD="renew"
  1701. ;;
  1702. --renewAll|-renewall)
  1703. _CMD="renewAll"
  1704. ;;
  1705. --revoke)
  1706. _CMD="revoke"
  1707. ;;
  1708. --installcronjob)
  1709. _CMD="installcronjob"
  1710. ;;
  1711. --uninstallcronjob)
  1712. _CMD="uninstallcronjob"
  1713. ;;
  1714. --cron)
  1715. _CMD="cron"
  1716. ;;
  1717. --toPkcs)
  1718. _CMD="toPkcs"
  1719. ;;
  1720. --createAccountKey|--createaccountkey|-cak)
  1721. _CMD="createAccountKey"
  1722. ;;
  1723. --createDomainKey|--createdomainkey|-cdk)
  1724. _CMD="createDomainKey"
  1725. ;;
  1726. --createCSR|--createcsr|-ccr)
  1727. _CMD="createCSR"
  1728. ;;
  1729. --domain|-d)
  1730. _dvalue="$2"
  1731. if [ -z "$_dvalue" ] || _startswith "$_dvalue" "-" ; then
  1732. _err "'$_dvalue' is not a valid domain for parameter '$1'"
  1733. return 1
  1734. fi
  1735. if [ -z "$_domain" ] ; then
  1736. _domain="$_dvalue"
  1737. else
  1738. if [ "$_altdomains" = "no" ] ; then
  1739. _altdomains="$_dvalue"
  1740. else
  1741. _altdomains="$_altdomains,$_dvalue"
  1742. fi
  1743. fi
  1744. shift
  1745. ;;
  1746. --force|-f)
  1747. FORCE="1"
  1748. ;;
  1749. --staging|--test)
  1750. STAGE="1"
  1751. ;;
  1752. --debug)
  1753. if [ -z "$2" ] || _startswith "$2" "-" ; then
  1754. DEBUG="1"
  1755. else
  1756. DEBUG="$2"
  1757. shift
  1758. fi
  1759. ;;
  1760. --webroot|-w)
  1761. wvalue="$2"
  1762. if [ -z "$_webroot" ] ; then
  1763. _webroot="$wvalue"
  1764. else
  1765. _webroot="$_webroot,$wvalue"
  1766. fi
  1767. shift
  1768. ;;
  1769. --standalone)
  1770. wvalue="no"
  1771. if [ -z "$_webroot" ] ; then
  1772. _webroot="$wvalue"
  1773. else
  1774. _webroot="$_webroot,$wvalue"
  1775. fi
  1776. ;;
  1777. --apache)
  1778. wvalue="apache"
  1779. if [ -z "$_webroot" ] ; then
  1780. _webroot="$wvalue"
  1781. else
  1782. _webroot="$_webroot,$wvalue"
  1783. fi
  1784. ;;
  1785. --dns)
  1786. wvalue="dns"
  1787. if ! _startswith "$2" "-" ; then
  1788. wvalue="$2"
  1789. shift
  1790. fi
  1791. if [ -z "$_webroot" ] ; then
  1792. _webroot="$wvalue"
  1793. else
  1794. _webroot="$_webroot,$wvalue"
  1795. fi
  1796. ;;
  1797. --keylength|-k)
  1798. _keylength="$2"
  1799. accountkeylength="$2"
  1800. shift
  1801. ;;
  1802. --accountkeylength|-ak)
  1803. accountkeylength="$2"
  1804. shift
  1805. ;;
  1806. --certpath)
  1807. _certpath="$2"
  1808. shift
  1809. ;;
  1810. --keypath)
  1811. _keypath="$2"
  1812. shift
  1813. ;;
  1814. --capath)
  1815. _capath="$2"
  1816. shift
  1817. ;;
  1818. --fullchainpath)
  1819. _fullchainpath="$2"
  1820. shift
  1821. ;;
  1822. --reloadcmd|--reloadCmd)
  1823. _reloadcmd="$2"
  1824. shift
  1825. ;;
  1826. --password)
  1827. _password="$2"
  1828. shift
  1829. ;;
  1830. --accountconf)
  1831. _accountconf="$2"
  1832. ACCOUNT_CONF_PATH="$_accountconf"
  1833. shift
  1834. ;;
  1835. --home)
  1836. LE_WORKING_DIR="$2"
  1837. shift
  1838. ;;
  1839. --certhome)
  1840. _certhome="$2"
  1841. CERT_HOME="$_certhome"
  1842. shift
  1843. ;;
  1844. --useragent)
  1845. _useragent="$2"
  1846. USER_AGENT="$_useragent"
  1847. shift
  1848. ;;
  1849. --accountemail )
  1850. _accountemail="$2"
  1851. ACCOUNT_EMAIL="$_accountemail"
  1852. shift
  1853. ;;
  1854. --accountkey )
  1855. _accountkey="$2"
  1856. ACCOUNT_KEY_PATH="$_accountkey"
  1857. shift
  1858. ;;
  1859. --days )
  1860. _days="$2"
  1861. Le_RenewalDays="$_days"
  1862. shift
  1863. ;;
  1864. *)
  1865. _err "Unknown parameter : $1"
  1866. return 1
  1867. ;;
  1868. esac
  1869. shift 1
  1870. done
  1871. case "${_CMD}" in
  1872. install) install ;;
  1873. uninstall) uninstall ;;
  1874. issue)
  1875. issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_certpath" "$_keypath" "$_capath" "$_reloadcmd" "$_fullchainpath"
  1876. ;;
  1877. installcert)
  1878. installcert "$_domain" "$_certpath" "$_keypath" "$_capath" "$_reloadcmd" "$_fullchainpath"
  1879. ;;
  1880. renew)
  1881. renew "$_domain"
  1882. ;;
  1883. renewAll)
  1884. renewAll
  1885. ;;
  1886. revoke)
  1887. revoke "$_domain"
  1888. ;;
  1889. installcronjob) installcronjob ;;
  1890. uninstallcronjob) uninstallcronjob ;;
  1891. cron) cron ;;
  1892. toPkcs)
  1893. toPkcs "$_domain" "$_password"
  1894. ;;
  1895. createAccountKey)
  1896. createAccountKey "$_domain" "$_accountkeylength"
  1897. ;;
  1898. createDomainKey)
  1899. createDomainKey "$_domain" "$_keylength"
  1900. ;;
  1901. createCSR)
  1902. createCSR "$_domain" "$_altdomains"
  1903. ;;
  1904. *)
  1905. _err "Invalid command: $_CMD"
  1906. showhelp;
  1907. return 1
  1908. ;;
  1909. esac
  1910. if [ "$_useragent" ] ; then
  1911. _saveaccountconf "USER_AGENT" "$_useragent"
  1912. fi
  1913. if [ "$_accountemail" ] ; then
  1914. _saveaccountconf "ACCOUNT_EMAIL" "$_accountemail"
  1915. fi
  1916. }
  1917. if [ "$INSTALLONLINE" ] ; then
  1918. INSTALLONLINE=""
  1919. _installOnline $BRANCH
  1920. exit
  1921. fi
  1922. if [ -z "$1" ] ; then
  1923. showhelp
  1924. else
  1925. if echo "$1" | grep "^-" >/dev/null 2>&1 ; then
  1926. _process "$@"
  1927. else
  1928. "$@"
  1929. fi
  1930. fi