[](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
- An ACME protocol client written purely in Shell (Unix shell) language.
- Full ACME protocol implementation.
- Support ACME v1 and ACME v2
@@ -451,6 +451,36 @@ TODO:
2. ACME protocol: https://github.com/ietf-wg-acme/acme
+## Contributors
+
+### Code Contributors
+
+This project exists thanks to all the people who contribute. [[Contribute](CONTRIBUTING.md)].
+
+
+### Financial Contributors
+
+Become a financial contributor and help us sustain our community. [[Contribute](https://opencollective.com/acmesh/contribute)]
+
+#### Individuals
+
+
+
+#### Organizations
+
+Support this project with your organization. Your logo will show up here with a link to your website. [[Contribute](https://opencollective.com/acmesh/contribute)]
+
+
+
+
+
+
+
+
+
+
+
+
# 19. License & Others
License is GPLv3
diff --git a/acme.sh b/acme.sh
index 60580f8..4d4957f 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1,6 +1,6 @@
#!/usr/bin/env sh
-VER=2.8.2
+VER=2.8.4
PROJECT_NAME="acme.sh"
@@ -90,6 +90,9 @@ DEBUG_LEVEL_3=3
DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
DEBUG_LEVEL_NONE=0
+DOH_CLOUDFLARE=1
+DOH_GOOGLE=2
+
HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
SYSLOG_ERROR="user.error"
@@ -135,6 +138,8 @@ _DNS_MANUAL_WIKI="https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode"
_NOTIFY_WIKI="https://github.com/Neilpang/acme.sh/wiki/notify"
+_SUDO_WIKI="https://github.com/Neilpang/acme.sh/wiki/sudo"
+
_DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
_DNS_MANUAL_WARN="It seems that you are using dns manual mode. please take care: $_DNS_MANUAL_ERR"
@@ -148,7 +153,7 @@ fi
__green() {
if [ "${__INTERACTIVE}${ACME_NO_COLOR:-0}" = "10" -o "${ACME_FORCE_COLOR}" = "1" ]; then
- printf '\033[1;31;32m%b\033[0m' "$1"
+ printf '\33[1;32m%b\33[0m' "$1"
return
fi
printf -- "%b" "$1"
@@ -156,7 +161,7 @@ __green() {
__red() {
if [ "${__INTERACTIVE}${ACME_NO_COLOR:-0}" = "10" -o "${ACME_FORCE_COLOR}" = "1" ]; then
- printf '\033[1;31;40m%b\033[0m' "$1"
+ printf '\33[1;31m%b\33[0m' "$1"
return
fi
printf -- "%b" "$1"
@@ -173,7 +178,7 @@ _printargs() {
printf -- "%s" "$1='$2'"
fi
printf "\n"
- # return the saved exit status
+ # return the saved exit status
return "$_exitstatus"
}
@@ -260,6 +265,37 @@ _usage() {
printf "\n" >&2
}
+__debug_bash_helper() {
+ # At this point only do for --debug 3
+ if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -lt "$DEBUG_LEVEL_3" ]; then
+ return
+ fi
+ # Return extra debug info when running with bash, otherwise return empty
+ # string.
+ if [ -z "${BASH_VERSION}" ]; then
+ return
+ fi
+ # We are a bash shell at this point, return the filename, function name, and
+ # line number as a string
+ _dbh_saveIFS=$IFS
+ IFS=" "
+ # Must use eval or syntax error happens under dash. The eval should use
+ # single quotes as older versions of busybox had a bug with double quotes and
+ # eval.
+ # Use 'caller 1' as we want one level up the stack as we should be called
+ # by one of the _debug* functions
+ eval '_dbh_called=($(caller 1))'
+ IFS=$_dbh_saveIFS
+ eval '_dbh_file=${_dbh_called[2]}'
+ if [ -n "${_script_home}" ]; then
+ # Trim off the _script_home directory name
+ eval '_dbh_file=${_dbh_file#$_script_home/}'
+ fi
+ eval '_dbh_function=${_dbh_called[1]}'
+ eval '_dbh_lineno=${_dbh_called[0]}'
+ printf "%-40s " "$_dbh_file:${_dbh_function}:${_dbh_lineno}"
+}
+
_debug() {
if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
_log "$@"
@@ -268,7 +304,8 @@ _debug() {
_syslog "$SYSLOG_DEBUG" "$@"
fi
if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
- _printargs "$@" >&2
+ _bash_debug=$(__debug_bash_helper)
+ _printargs "${_bash_debug}$@" >&2
fi
}
@@ -301,7 +338,8 @@ _debug2() {
_syslog "$SYSLOG_DEBUG" "$@"
fi
if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
- _printargs "$@" >&2
+ _bash_debug=$(__debug_bash_helper)
+ _printargs "${_bash_debug}$@" >&2
fi
}
@@ -333,7 +371,8 @@ _debug3() {
_syslog "$SYSLOG_DEBUG" "$@"
fi
if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
- _printargs "$@" >&2
+ _bash_debug=$(__debug_bash_helper)
+ _printargs "${_bash_debug}$@" >&2
fi
}
@@ -1695,18 +1734,37 @@ _post() {
if [ "$HTTPS_INSECURE" ]; then
_CURL="$_CURL --insecure "
fi
+ if [ "$httpmethod" = "HEAD" ]; then
+ _CURL="$_CURL -I "
+ fi
_debug "_CURL" "$_CURL"
if [ "$needbase64" ]; then
- if [ "$_postContentType" ]; then
- response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+ if [ "$body" ]; then
+ if [ "$_postContentType" ]; then
+ response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+ else
+ response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+ fi
else
- response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+ if [ "$_postContentType" ]; then
+ response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url" | _base64)"
+ else
+ response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url" | _base64)"
+ fi
fi
else
- if [ "$_postContentType" ]; then
- response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+ if [ "$body" ]; then
+ if [ "$_postContentType" ]; then
+ response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+ else
+ response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+ fi
else
- response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+ if [ "$_postContentType" ]; then
+ response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url")"
+ else
+ response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url")"
+ fi
fi
fi
_ret="$?"
@@ -1722,6 +1780,9 @@ _post() {
if [ "$HTTPS_INSECURE" ]; then
_WGET="$_WGET --no-check-certificate "
fi
+ if [ "$httpmethod" = "HEAD" ]; then
+ _WGET="$_WGET --read-timeout=3.0 --tries=2 "
+ fi
_debug "_WGET" "$_WGET"
if [ "$needbase64" ]; then
if [ "$httpmethod" = "POST" ]; then
@@ -1744,6 +1805,12 @@ _post() {
else
response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
fi
+ elif [ "$httpmethod" = "HEAD" ]; then
+ if [ "$_postContentType" ]; then
+ response="$($_WGET --spider -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
+ else
+ response="$($_WGET --spider -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
+ fi
else
if [ "$_postContentType" ]; then
response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
@@ -1876,7 +1943,7 @@ _send_signed_request() {
if [ "$ACME_NEW_NONCE" ]; then
_debug2 "Get nonce with HEAD. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
nonceurl="$ACME_NEW_NONCE"
- if _post "" "$nonceurl" "" "HEAD" "$__request_conent_type"; then
+ if _post "" "$nonceurl" "" "HEAD" "$__request_conent_type" >/dev/null; then
_headers="$(cat "$HTTP_HEADER")"
_debug2 _headers "$_headers"
_CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
@@ -2078,6 +2145,28 @@ _readdomainconf() {
_read_conf "$DOMAIN_CONF" "$1"
}
+#key value base64encode
+_savedeployconf() {
+ _savedomainconf "SAVED_$1" "$2" "$3"
+ #remove later
+ _cleardomainconf "$1"
+}
+
+#key
+_getdeployconf() {
+ _rac_key="$1"
+ _rac_value="$(eval echo \$"$_rac_key")"
+ if [ "$_rac_value" ]; then
+ if _startswith "$_rac_value" '"' && _endswith "$_rac_value" '"'; then
+ _debug2 "trim quotation marks"
+ eval "export $_rac_key=$_rac_value"
+ fi
+ return 0 # do nothing
+ fi
+ _saved=$(_readdomainconf "SAVED_$_rac_key")
+ eval "export $_rac_key=$_saved"
+}
+
#_saveaccountconf key value base64encode
_saveaccountconf() {
_save_conf "$ACCOUNT_CONF_PATH" "$@"
@@ -2428,7 +2517,7 @@ _initpath() {
. "$ACCOUNT_CONF_PATH"
fi
- if [ "$IN_CRON" ]; then
+ if [ "$ACME_IN_CRON" ]; then
if [ ! "$_USER_PATH_EXPORTED" ]; then
_USER_PATH_EXPORTED=1
export PATH="$USER_PATH:$PATH"
@@ -2775,6 +2864,11 @@ _setNginx() {
_debug NGINX_CONF "$NGINX_CONF"
NGINX_CONF="$(echo "$NGINX_CONF" | cut -d = -f 2)"
_debug NGINX_CONF "$NGINX_CONF"
+ if [ -z "$NGINX_CONF" ]; then
+ _err "Can not find nginx conf."
+ NGINX_CONF=""
+ return 1
+ fi
if [ ! -f "$NGINX_CONF" ]; then
_err "'$NGINX_CONF' doesn't exist."
NGINX_CONF=""
@@ -3013,11 +3107,13 @@ _clearupdns() {
d=$(_getfield "$entry" 1)
txtdomain=$(_getfield "$entry" 2)
aliasDomain=$(_getfield "$entry" 3)
+ _currentRoot=$(_getfield "$entry" 4)
txt=$(_getfield "$entry" 5)
d_api=$(_getfield "$entry" 6)
_debug "d" "$d"
_debug "txtdomain" "$txtdomain"
_debug "aliasDomain" "$aliasDomain"
+ _debug "_currentRoot" "$_currentRoot"
_debug "txt" "$txt"
_debug "d_api" "$d_api"
if [ "$d_api" = "$txt" ]; then
@@ -3194,14 +3290,6 @@ _on_issue_err() {
_err "See: $_DEBUG_WIKI"
fi
- if [ "$IN_CRON" ]; then
- if [ "$NOTIFY_LEVEL" ] && [ $NOTIFY_LEVEL -ge $NOTIFY_LEVEL_ERROR ]; then
- if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
- _send_notify "Renew $_main_domain error" "There is an error." "$NOTIFY_HOOK" 1
- fi
- fi
- fi
-
#run the post hook
if [ "$_chk_post_hook" ]; then
_info "Run post hook:'$_chk_post_hook'"
@@ -3244,17 +3332,16 @@ _on_issue_success() {
_chk_post_hook="$1"
_chk_renew_hook="$2"
_debug _on_issue_success
- if [ "$IN_CRON" ]; then
- if [ "$NOTIFY_LEVEL" ] && [ $NOTIFY_LEVEL -ge $NOTIFY_LEVEL_RENEW ]; then
- if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
- _send_notify "Renew $_main_domain success" "Good, the cert is renewed." "$NOTIFY_HOOK" 0
- fi
- fi
- fi
+
#run the post hook
if [ "$_chk_post_hook" ]; then
_info "Run post hook:'$_chk_post_hook'"
if ! (
+ export CERT_PATH
+ export CERT_KEY_PATH
+ export CA_CERT_PATH
+ export CERT_FULLCHAIN_PATH
+ export Le_Domain="$_main_domain"
cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
); then
_err "Error when run post hook."
@@ -3266,6 +3353,11 @@ _on_issue_success() {
if [ "$IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
_info "Run renew hook:'$_chk_renew_hook'"
if ! (
+ export CERT_PATH
+ export CERT_KEY_PATH
+ export CA_CERT_PATH
+ export CERT_FULLCHAIN_PATH
+ export Le_Domain="$_main_domain"
cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
); then
_err "Error when run renew hook."
@@ -3273,7 +3365,7 @@ _on_issue_success() {
fi
fi
- if _hasfield "$Le_Webroot" "$W_DNS"; then
+ if _hasfield "$Le_Webroot" "$W_DNS" && [ -z "$FORCE_DNS_MANUAL" ]; then
_err "$_DNS_MANUAL_WARN"
fi
@@ -3581,7 +3673,7 @@ __trigger_validation() {
}
#endpoint domain type
-_ns_lookup() {
+_ns_lookup_impl() {
_ns_ep="$1"
_ns_domain="$2"
_ns_type="$3"
@@ -3605,7 +3697,7 @@ _ns_lookup_cf() {
_cf_ld="$1"
_cf_ld_type="$2"
_cf_ep="https://cloudflare-dns.com/dns-query"
- _ns_lookup "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
+ _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
}
#domain, type
@@ -3613,11 +3705,49 @@ _ns_purge_cf() {
_cf_d="$1"
_cf_d_type="$2"
_debug "Cloudflare purge $_cf_d_type record for domain $_cf_d"
- _cf_purl="https://1.1.1.1/api/v1/purge?domain=$_cf_d&type=$_cf_d_type"
+ _cf_purl="https://cloudflare-dns.com/api/v1/purge?domain=$_cf_d&type=$_cf_d_type"
response="$(_post "" "$_cf_purl")"
_debug2 response "$response"
}
+#checks if cf server is available
+_ns_is_available_cf() {
+ if _get "https://cloudflare-dns.com" >/dev/null 2>&1; then
+ return 0
+ else
+ return 1
+ fi
+}
+
+#domain, type
+_ns_lookup_google() {
+ _cf_ld="$1"
+ _cf_ld_type="$2"
+ _cf_ep="https://dns.google/resolve"
+ _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
+}
+
+#domain, type
+_ns_lookup() {
+ if [ -z "$DOH_USE" ]; then
+ _debug "Detect dns server first."
+ if _ns_is_available_cf; then
+ _debug "Use cloudflare doh server"
+ export DOH_USE=$DOH_CLOUDFLARE
+ else
+ _debug "Use google doh server"
+ export DOH_USE=$DOH_GOOGLE
+ fi
+ fi
+
+ if [ "$DOH_USE" = "$DOH_CLOUDFLARE" ] || [ -z "$DOH_USE" ]; then
+ _ns_lookup_cf "$@"
+ else
+ _ns_lookup_google "$@"
+ fi
+
+}
+
#txtdomain, alias, txt
__check_txt() {
_c_txtdomain="$1"
@@ -3626,7 +3756,7 @@ __check_txt() {
_debug "_c_txtdomain" "$_c_txtdomain"
_debug "_c_aliasdomain" "$_c_aliasdomain"
_debug "_c_txt" "$_c_txt"
- _answers="$(_ns_lookup_cf "$_c_aliasdomain" TXT)"
+ _answers="$(_ns_lookup "$_c_aliasdomain" TXT)"
_contains "$_answers" "$_c_txt"
}
@@ -3635,7 +3765,13 @@ __check_txt() {
__purge_txt() {
_p_txtdomain="$1"
_debug _p_txtdomain "$_p_txtdomain"
- _ns_purge_cf "$_p_txtdomain" "TXT"
+ if [ "$DOH_USE" = "$DOH_CLOUDFLARE" ] || [ -z "$DOH_USE" ]; then
+ _ns_purge_cf "$_p_txtdomain" "TXT"
+ else
+ _debug "no purge api for google dns api, just sleep 5 secs"
+ _sleep 5
+ fi
+
}
#wait and check each dns entries
@@ -3672,11 +3808,11 @@ _check_dns_entries() {
fi
_left=1
_info "Not valid yet, let's wait 10 seconds and check next one."
- _sleep 10
__purge_txt "$txtdomain"
if [ "$txtdomain" != "$aliasDomain" ]; then
__purge_txt "$aliasDomain"
fi
+ _sleep 10
done
if [ "$_left" ]; then
_info "Let's wait 10 seconds and check again".
@@ -3841,7 +3977,7 @@ issue() {
_savedomainconf "Le_Keylength" "$_key_length"
vlist="$Le_Vlist"
-
+ _cleardomainconf "Le_Vlist"
_info "Getting domain auth token for each domain"
sep='#'
dvsep=','
@@ -3945,7 +4081,18 @@ $_authorizations_map"
fi
if [ "$ACME_VERSION" = "2" ]; then
- response="$(echo "$_authorizations_map" | grep "^$(_idn "$d")," | sed "s/$d,//")"
+ _idn_d="$(_idn "$d")"
+ _candindates="$(echo "$_authorizations_map" | grep "^$_idn_d,")"
+ _debug2 _candindates "$_candindates"
+ if [ "$(echo "$_candindates" | wc -l)" -gt 1 ]; then
+ for _can in $_candindates; do
+ if _startswith "$(echo "$_can" | tr '.' '|')" "$(echo "$_idn_d" | tr '.' '|'),"; then
+ _candindates="$_can"
+ break
+ fi
+ done
+ fi
+ response="$(echo "$_candindates" | sed "s/$_idn_d,//")"
_debug2 "response" "$response"
if [ -z "$response" ]; then
_err "get to authz error."
@@ -4338,6 +4485,8 @@ $_authorizations_map"
if [ "$status" = "pending" ]; then
_info "Pending"
+ elif [ "$status" = "processing" ]; then
+ _info "Processing"
else
_err "$d:Verify error:$response"
_clearupwebbroot "$_currentRoot" "$removelevel" "$token"
@@ -4482,14 +4631,12 @@ $_authorizations_map"
_info "Your cert key is in $(__green " $CERT_KEY_PATH ")"
fi
- if [ ! "$USER_PATH" ] || [ ! "$IN_CRON" ]; then
+ if [ ! "$USER_PATH" ] || [ ! "$ACME_IN_CRON" ]; then
USER_PATH="$PATH"
_saveaccountconf "USER_PATH" "$USER_PATH"
fi
fi
- _cleardomainconf "Le_Vlist"
-
if [ "$ACME_VERSION" = "2" ]; then
_debug "v2 chain."
else
@@ -4664,19 +4811,10 @@ renew() {
if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
_info "Skip, Next renewal time is: $(__green "$Le_NextRenewTimeStr")"
_info "Add '$(__red '--force')' to force to renew."
-
- if [ "$IN_CRON" = "1" ]; then
- if [ "$NOTIFY_LEVEL" ] && [ $NOTIFY_LEVEL -ge $NOTIFY_LEVEL_SKIP ]; then
- if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
- _send_notify "Renew $Le_Domain skipped" "Good, the cert next renewal time is $Le_NextRenewTimeStr." "$NOTIFY_HOOK" "$RENEW_SKIP"
- fi
- fi
- fi
-
return "$RENEW_SKIP"
fi
- if [ "$IN_CRON" = "1" ] && [ -z "$Le_CertCreateTime" ]; then
+ if [ "$ACME_IN_CRON" = "1" ] && [ -z "$Le_CertCreateTime" ]; then
_info "Skip invalid cert for: $Le_Domain"
return $RENEW_SKIP
fi
@@ -4711,6 +4849,10 @@ renewAll() {
_success_msg=""
_error_msg=""
_skipped_msg=""
+ _error_level=$NOTIFY_LEVEL_SKIP
+ _notify_code=$RENEW_SKIP
+ _set_level=${NOTIFY_LEVEL:-$NOTIFY_LEVEL_DEFAULT}
+ _debug "_set_level" "$_set_level"
for di in "${CERT_HOME}"/*.*/; do
_debug di "$di"
if ! [ -d "$di" ]; then
@@ -4728,49 +4870,84 @@ renewAll() {
)
rc="$?"
_debug "Return code: $rc"
- if [ "$rc" != "0" ]; then
- if [ "$rc" = "$RENEW_SKIP" ]; then
- _info "Skipped $d"
- _skipped_msg="${_skipped_msg} $d
-"
- else
- _error_msg="${_error_msg} $d
+ if [ "$rc" = "0" ]; then
+ if [ $_error_level -gt $NOTIFY_LEVEL_RENEW ]; then
+ _error_level="$NOTIFY_LEVEL_RENEW"
+ _notify_code=0
+ fi
+ if [ "$ACME_IN_CRON" ]; then
+ if [ $_set_level -ge $NOTIFY_LEVEL_RENEW ]; then
+ if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
+ _send_notify "Renew $d success" "Good, the cert is renewed." "$NOTIFY_HOOK" 0
+ fi
+ fi
+ fi
+ _success_msg="${_success_msg} $d
"
- if [ "$_stopRenewOnError" ]; then
- _err "Error renew $d, stop now."
- _ret="$rc"
- break
- else
- _ret="$rc"
- _err "Error renew $d."
+ elif [ "$rc" = "$RENEW_SKIP" ]; then
+ if [ $_error_level -gt $NOTIFY_LEVEL_SKIP ]; then
+ _error_level="$NOTIFY_LEVEL_SKIP"
+ _notify_code=$RENEW_SKIP
+ fi
+ if [ "$ACME_IN_CRON" ]; then
+ if [ $_set_level -ge $NOTIFY_LEVEL_SKIP ]; then
+ if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
+ _send_notify "Renew $d skipped" "Good, the cert is skipped." "$NOTIFY_HOOK" "$RENEW_SKIP"
+ fi
fi
fi
+ _info "Skipped $d"
+ _skipped_msg="${_skipped_msg} $d
+"
else
- _success_msg="${_success_msg} $d
+ if [ $_error_level -gt $NOTIFY_LEVEL_ERROR ]; then
+ _error_level="$NOTIFY_LEVEL_ERROR"
+ _notify_code=1
+ fi
+ if [ "$ACME_IN_CRON" ]; then
+ if [ $_set_level -ge $NOTIFY_LEVEL_ERROR ]; then
+ if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
+ _send_notify "Renew $d error" "There is an error." "$NOTIFY_HOOK" 1
+ fi
+ fi
+ fi
+ _error_msg="${_error_msg} $d
"
+ if [ "$_stopRenewOnError" ]; then
+ _err "Error renew $d, stop now."
+ _ret="$rc"
+ break
+ else
+ _ret="$rc"
+ _err "Error renew $d."
+ fi
fi
done
-
- if [ "$IN_CRON" = "1" ]; then
+ _debug _error_level "$_error_level"
+ _debug _set_level "$_set_level"
+ if [ "$ACME_IN_CRON" ] && [ $_error_level -le $_set_level ]; then
if [ -z "$NOTIFY_MODE" ] || [ "$NOTIFY_MODE" = "$NOTIFY_MODE_BULK" ]; then
_msg_subject="Renew"
if [ "$_error_msg" ]; then
_msg_subject="${_msg_subject} Error"
+ _msg_data="Error certs:
+${_error_msg}
+"
fi
if [ "$_success_msg" ]; then
_msg_subject="${_msg_subject} Success"
+ _msg_data="${_msg_data}Success certs:
+${_success_msg}
+"
fi
if [ "$_skipped_msg" ]; then
_msg_subject="${_msg_subject} Skipped"
- fi
- _msg_data="Error certs:
-${_error_msg}
-Success certs:
-${_success_msg}
-Skipped certs:
-$_skipped_msg
+ _msg_data="${_msg_data}Skipped certs:
+${_skipped_msg}
"
- _send_notify "$_msg_subject" "$_msg_data" "$NOTIFY_HOOK" 0
+ fi
+
+ _send_notify "$_msg_subject" "$_msg_data" "$NOTIFY_HOOK" "$_notify_code"
fi
fi
@@ -4889,18 +5066,14 @@ list() {
if [ "$_raw" ]; then
printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Created${_sep}Renew"
for di in "${CERT_HOME}"/*.*/; do
- if ! [ -d "$di" ]; then
- _debug "Not directory, skip: $di"
- continue
- fi
d=$(basename "$di")
_debug d "$d"
(
if _endswith "$d" "$ECC_SUFFIX"; then
- _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
+ _isEcc="ecc"
d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
fi
- _initpath "$d" "$_isEcc"
+ DOMAIN_CONF="$di/$d.conf"
if [ -f "$DOMAIN_CONF" ]; then
. "$DOMAIN_CONF"
printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr"
@@ -5686,7 +5859,7 @@ install() {
_debug "Skip install cron job"
fi
- if [ "$IN_CRON" != "1" ]; then
+ if [ "$ACME_IN_CRON" != "1" ]; then
if ! _precheck "$_nocron"; then
_err "Pre-check failed, can not install."
return 1
@@ -5743,7 +5916,7 @@ install() {
_info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
- if [ "$IN_CRON" != "1" ] && [ -z "$_noprofile" ]; then
+ if [ "$ACME_IN_CRON" != "1" ] && [ -z "$_noprofile" ]; then
_installalias "$_c_home"
fi
@@ -5841,7 +6014,7 @@ _uninstallalias() {
}
cron() {
- export IN_CRON=1
+ export ACME_IN_CRON=1
_initpath
_info "$(__green "===Starting cron===")"
if [ "$AUTO_UPGRADE" = "1" ]; then
@@ -5862,7 +6035,7 @@ cron() {
fi
renewAll
_ret="$?"
- IN_CRON=""
+ ACME_IN_CRON=""
_info "$(__green "===End cron===")"
exit $_ret
}
@@ -5892,8 +6065,12 @@ _send_notify() {
_send_err=0
for _n_hook in $(echo "$_nhooks" | tr ',' " "); do
_n_hook_file="$(_findHook "" $_SUB_FOLDER_NOTIFY "$_n_hook")"
- _info "Found $_n_hook_file"
-
+ _info "Sending via: $_n_hook"
+ _debug "Found $_n_hook_file for $_n_hook"
+ if [ -z "$_n_hook_file" ]; then
+ _err "Can not find the hook file for $_n_hook"
+ continue
+ fi
if ! (
if ! . "$_n_hook_file"; then
_err "Load file $_n_hook_file error. Please check your api file and try again."
@@ -5927,8 +6104,8 @@ _send_notify() {
_set_notify_hook() {
_nhooks="$1"
- _test_subject="Hello, this is notification from $PROJECT_NAME"
- _test_content="If you receive this email, your notification works."
+ _test_subject="Hello, this is a notification from $PROJECT_NAME"
+ _test_content="If you receive this message, your notification works."
_send_notify "$_test_subject" "$_test_content" "$_nhooks" 0
@@ -6083,12 +6260,12 @@ Parameters:
--branch, -b Only valid for '--upgrade' command, specifies the branch name to upgrade to.
--notify-level 0|1|2|3 Set the notification level: Default value is $NOTIFY_LEVEL_DEFAULT.
- 0: disabled, no notification will be sent.
- 1: send notification only when there is an error. No news is good news.
- 2: send notification when a cert is successfully renewed, or there is an error
- 3: send notification when a cert is skipped, renewdd, or error
+ 0: disabled, no notification will be sent.
+ 1: send notifications only when there is an error.
+ 2: send notifications when a cert is successfully renewed, or there is an error.
+ 3: send notifications when a cert is skipped, renewed, or error.
--notify-mode 0|1 Set notification mode. Default value is $NOTIFY_MODE_DEFAULT.
- 0: Bulk mode. Send all the domain's notifications in one message(mail)
+ 0: Bulk mode. Send all the domain's notifications in one message(mail).
1: Cert mode. Send a message for every single cert.
--notify-hook [hookname] Set the notify hook
@@ -6179,6 +6356,23 @@ _processAccountConf() {
}
+_checkSudo() {
+ if [ "$SUDO_GID" ] && [ "$SUDO_COMMAND" ] && [ "$SUDO_USER" ] && [ "$SUDO_UID" ]; then
+ if [ "$SUDO_USER" = "root" ] && [ "$SUDO_UID" = "0" ]; then
+ #it's root using sudo, no matter it's using sudo or not, just fine
+ return 0
+ fi
+ if [ "$SUDO_COMMAND" = "/bin/su" ] || [ "$SUDO_COMMAND" = "/bin/bash" ]; then
+ #it's a normal user doing "sudo su", or `sudo -i` or `sudo -s`
+ #fine
+ return 0
+ fi
+ #otherwise
+ return 1
+ fi
+ return 0
+}
+
_process() {
_CMD=""
_domain=""
@@ -6430,6 +6624,10 @@ _process() {
;;
--nginx)
wvalue="$NGINX"
+ if [ "$2" ] && ! _startswith "$2" "-"; then
+ wvalue="$NGINX$2"
+ shift
+ fi
if [ -z "$_webroot" ]; then
_webroot="$wvalue"
else
@@ -6707,6 +6905,14 @@ _process() {
done
if [ "${_CMD}" != "install" ]; then
+ if [ "$__INTERACTIVE" ] && ! _checkSudo; then
+ if [ -z "$FORCE" ]; then
+ #Use "echo" here, instead of _info. it's too early
+ echo "It seems that you are using sudo, please read this link first:"
+ echo "$_SUDO_WIKI"
+ return 1
+ fi
+ fi
__initHome
if [ "$_log" ]; then
if [ -z "$_logfile" ]; then
@@ -6749,7 +6955,7 @@ _process() {
_debug "Using server: $_server"
fi
fi
-
+ _debug "Running cmd: ${_CMD}"
case "${_CMD}" in
install) install "$_nocron" "$_confighome" "$_noprofile" ;;
uninstall) uninstall "$_nocron" ;;
diff --git a/deploy/docker.sh b/deploy/docker.sh
new file mode 100755
index 0000000..05333b3
--- /dev/null
+++ b/deploy/docker.sh
@@ -0,0 +1,287 @@
+#!/usr/bin/env sh
+
+#DEPLOY_DOCKER_CONTAINER_LABEL="xxxxxxx"
+
+#DEPLOY_DOCKER_CONTAINER_KEY_FILE="/path/to/key.pem"
+#DEPLOY_DOCKER_CONTAINER_CERT_FILE="/path/to/cert.pem"
+#DEPLOY_DOCKER_CONTAINER_CA_FILE="/path/to/ca.pem"
+#DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE="/path/to/fullchain.pem"
+#DEPLOY_DOCKER_CONTAINER_RELOAD_CMD="service nginx force-reload"
+
+_DEPLOY_DOCKER_WIKI="https://github.com/Neilpang/acme.sh/wiki/deploy-to-docker-containers"
+
+_DOCKER_HOST_DEFAULT="/var/run/docker.sock"
+
+docker_deploy() {
+ _cdomain="$1"
+ _ckey="$2"
+ _ccert="$3"
+ _cca="$4"
+ _cfullchain="$5"
+ _debug _cdomain "$_cdomain"
+ _getdeployconf DEPLOY_DOCKER_CONTAINER_LABEL
+ _debug2 DEPLOY_DOCKER_CONTAINER_LABEL "$DEPLOY_DOCKER_CONTAINER_LABEL"
+ if [ -z "$DEPLOY_DOCKER_CONTAINER_LABEL" ]; then
+ _err "The DEPLOY_DOCKER_CONTAINER_LABEL variable is not defined, we use this label to find the container."
+ _err "See: $_DEPLOY_DOCKER_WIKI"
+ fi
+
+ _savedeployconf DEPLOY_DOCKER_CONTAINER_LABEL "$DEPLOY_DOCKER_CONTAINER_LABEL"
+
+ if [ "$DOCKER_HOST" ]; then
+ _saveaccountconf DOCKER_HOST "$DOCKER_HOST"
+ fi
+
+ if _exists docker && docker version | grep -i docker >/dev/null; then
+ _info "Using docker command"
+ export _USE_DOCKER_COMMAND=1
+ else
+ export _USE_DOCKER_COMMAND=
+ fi
+
+ export _USE_UNIX_SOCKET=
+ if [ -z "$_USE_DOCKER_COMMAND" ]; then
+ export _USE_REST=
+ if [ "$DOCKER_HOST" ]; then
+ _debug "Try use docker host: $DOCKER_HOST"
+ export _USE_REST=1
+ else
+ export _DOCKER_SOCK="$_DOCKER_HOST_DEFAULT"
+ _debug "Try use $_DOCKER_SOCK"
+ if [ ! -e "$_DOCKER_SOCK" ] || [ ! -w "$_DOCKER_SOCK" ]; then
+ _err "$_DOCKER_SOCK is not available"
+ return 1
+ fi
+ export _USE_UNIX_SOCKET=1
+ if ! _exists "curl"; then
+ _err "Please install curl first."
+ _err "We need curl to work."
+ return 1
+ fi
+ if ! _check_curl_version; then
+ return 1
+ fi
+ fi
+ fi
+
+ _getdeployconf DEPLOY_DOCKER_CONTAINER_KEY_FILE
+ _debug2 DEPLOY_DOCKER_CONTAINER_KEY_FILE "$DEPLOY_DOCKER_CONTAINER_KEY_FILE"
+ if [ "$DEPLOY_DOCKER_CONTAINER_KEY_FILE" ]; then
+ _savedeployconf DEPLOY_DOCKER_CONTAINER_KEY_FILE "$DEPLOY_DOCKER_CONTAINER_KEY_FILE"
+ fi
+
+ _getdeployconf DEPLOY_DOCKER_CONTAINER_CERT_FILE
+ _debug2 DEPLOY_DOCKER_CONTAINER_CERT_FILE "$DEPLOY_DOCKER_CONTAINER_CERT_FILE"
+ if [ "$DEPLOY_DOCKER_CONTAINER_CERT_FILE" ]; then
+ _savedeployconf DEPLOY_DOCKER_CONTAINER_CERT_FILE "$DEPLOY_DOCKER_CONTAINER_CERT_FILE"
+ fi
+
+ _getdeployconf DEPLOY_DOCKER_CONTAINER_CA_FILE
+ _debug2 DEPLOY_DOCKER_CONTAINER_CA_FILE "$DEPLOY_DOCKER_CONTAINER_CA_FILE"
+ if [ "$DEPLOY_DOCKER_CONTAINER_CA_FILE" ]; then
+ _savedeployconf DEPLOY_DOCKER_CONTAINER_CA_FILE "$DEPLOY_DOCKER_CONTAINER_CA_FILE"
+ fi
+
+ _getdeployconf DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE
+ _debug2 DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE "$DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE"
+ if [ "$DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE" ]; then
+ _savedeployconf DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE "$DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE"
+ fi
+
+ _getdeployconf DEPLOY_DOCKER_CONTAINER_RELOAD_CMD
+ _debug2 DEPLOY_DOCKER_CONTAINER_RELOAD_CMD "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD"
+ if [ "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD" ]; then
+ _savedeployconf DEPLOY_DOCKER_CONTAINER_RELOAD_CMD "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD"
+ fi
+
+ _cid="$(_get_id "$DEPLOY_DOCKER_CONTAINER_LABEL")"
+ _info "Container id: $_cid"
+ if [ -z "$_cid" ]; then
+ _err "can not find container id"
+ return 1
+ fi
+
+ if [ "$DEPLOY_DOCKER_CONTAINER_KEY_FILE" ]; then
+ if ! _docker_cp "$_cid" "$_ckey" "$DEPLOY_DOCKER_CONTAINER_KEY_FILE"; then
+ return 1
+ fi
+ fi
+
+ if [ "$DEPLOY_DOCKER_CONTAINER_CERT_FILE" ]; then
+ if ! _docker_cp "$_cid" "$_ccert" "$DEPLOY_DOCKER_CONTAINER_CERT_FILE"; then
+ return 1
+ fi
+ fi
+
+ if [ "$DEPLOY_DOCKER_CONTAINER_CA_FILE" ]; then
+ if ! _docker_cp "$_cid" "$_cca" "$DEPLOY_DOCKER_CONTAINER_CA_FILE"; then
+ return 1
+ fi
+ fi
+
+ if [ "$DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE" ]; then
+ if ! _docker_cp "$_cid" "$_cfullchain" "$DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE"; then
+ return 1
+ fi
+ fi
+
+ if [ "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD" ]; then
+ _info "Reloading: $DEPLOY_DOCKER_CONTAINER_RELOAD_CMD"
+ if ! _docker_exec "$_cid" "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD"; then
+ return 1
+ fi
+ fi
+ return 0
+}
+
+#label
+_get_id() {
+ _label="$1"
+ if [ "$_USE_DOCKER_COMMAND" ]; then
+ docker ps -f label="$_label" --format "{{.ID}}"
+ elif [ "$_USE_REST" ]; then
+ _err "Not implemented yet."
+ return 1
+ elif [ "$_USE_UNIX_SOCKET" ]; then
+ _req="{\"label\":[\"$_label\"]}"
+ _debug2 _req "$_req"
+ _req="$(printf "%s" "$_req" | _url_encode)"
+ _debug2 _req "$_req"
+ listjson="$(_curl_unix_sock "${_DOCKER_SOCK:-$_DOCKER_HOST_DEFAULT}" GET "/containers/json?filters=$_req")"
+ _debug2 "listjson" "$listjson"
+ echo "$listjson" | tr '{,' '\n' | grep -i '"id":' | _head_n 1 | cut -d '"' -f 4
+ else
+ _err "Not implemented yet."
+ return 1
+ fi
+}
+
+#id cmd
+_docker_exec() {
+ _eargs="$*"
+ _debug2 "_docker_exec $_eargs"
+ _dcid="$1"
+ shift
+ if [ "$_USE_DOCKER_COMMAND" ]; then
+ docker exec -i "$_dcid" sh -c "$*"
+ elif [ "$_USE_REST" ]; then
+ _err "Not implemented yet."
+ return 1
+ elif [ "$_USE_UNIX_SOCKET" ]; then
+ _cmd="$*"
+ #_cmd="$(printf "%s" "$_cmd" | sed 's/ /","/g')"
+ _debug2 _cmd "$_cmd"
+ #create exec instance:
+ cjson="$(_curl_unix_sock "$_DOCKER_SOCK" POST "/containers/$_dcid/exec" "{\"Cmd\": [\"sh\", \"-c\", \"$_cmd\"]}")"
+ _debug2 cjson "$cjson"
+ execid="$(echo "$cjson" | cut -d '"' -f 4)"
+ _debug execid "$execid"
+ ejson="$(_curl_unix_sock "$_DOCKER_SOCK" POST "/exec/$execid/start" "{\"Detach\": false,\"Tty\": false}")"
+ _debug2 ejson "$ejson"
+ if [ "$ejson" ]; then
+ _err "$ejson"
+ return 1
+ fi
+ else
+ _err "Not implemented yet."
+ return 1
+ fi
+}
+
+#id from to
+_docker_cp() {
+ _dcid="$1"
+ _from="$2"
+ _to="$3"
+ _info "Copying file from $_from to $_to"
+ _dir="$(dirname "$_to")"
+ _debug2 _dir "$_dir"
+ if ! _docker_exec "$_dcid" mkdir -p "$_dir"; then
+ _err "Can not create dir: $_dir"
+ return 1
+ fi
+ if [ "$_USE_DOCKER_COMMAND" ]; then
+ if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
+ _docker_exec "$_dcid" tee "$_to" <"$_from"
+ else
+ _docker_exec "$_dcid" tee "$_to" <"$_from" >/dev/null
+ fi
+ if [ "$?" = "0" ]; then
+ _info "Success"
+ return 0
+ else
+ _info "Error"
+ return 1
+ fi
+ elif [ "$_USE_REST" ]; then
+ _err "Not implemented yet."
+ return 1
+ elif [ "$_USE_UNIX_SOCKET" ]; then
+ _frompath="$_from"
+ if _startswith "$_frompath" '/'; then
+ _frompath="$(echo "$_from" | cut -b 2-)" #remove the first '/' char
+ fi
+ _debug2 "_frompath" "$_frompath"
+ _toname="$(basename "$_to")"
+ _debug2 "_toname" "$_toname"
+ _debug2 "_from" "$_from"
+ if ! tar --transform="s,$(printf "%s" "$_frompath" | tr '*' .),$_toname," -cz "$_from" 2>/dev/null | _curl_unix_sock "$_DOCKER_SOCK" PUT "/containers/$_dcid/archive?noOverwriteDirNonDir=1&path=$(printf "%s" "$_dir" | _url_encode)" '@-' "Content-Type: application/octet-stream"; then
+ _err "copy error"
+ return 1
+ fi
+ return 0
+ else
+ _err "Not implemented yet."
+ return 1
+ fi
+
+}
+
+#sock method endpoint data content-type
+_curl_unix_sock() {
+ _socket="$1"
+ _method="$2"
+ _endpoint="$3"
+ _data="$4"
+ _ctype="$5"
+ if [ -z "$_ctype" ]; then
+ _ctype="Content-Type: application/json"
+ fi
+ _debug _data "$_data"
+ _debug2 "url" "http://localhost$_endpoint"
+ if [ "$_CURL_NO_HOST" ]; then
+ _cux_url="http:$_endpoint"
+ else
+ _cux_url="http://localhost$_endpoint"
+ fi
+
+ if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
+ curl -vvv --silent --unix-socket "$_socket" -X "$_method" --data-binary "$_data" --header "$_ctype" "$_cux_url"
+ else
+ curl --silent --unix-socket "$_socket" -X "$_method" --data-binary "$_data" --header "$_ctype" "$_cux_url"
+ fi
+
+}
+
+_check_curl_version() {
+ _cversion="$(curl -V | grep '^curl ' | cut -d ' ' -f 2)"
+ _debug2 "_cversion" "$_cversion"
+
+ _major="$(_getfield "$_cversion" 1 '.')"
+ _debug2 "_major" "$_major"
+
+ _minor="$(_getfield "$_cversion" 2 '.')"
+ _debug2 "_minor" "$_minor"
+
+ if [ "$_major$_minor" -lt "740" ]; then
+ _err "curl v$_cversion doesn't support unit socket"
+ return 1
+ fi
+ if [ "$_major$_minor" -lt "750" ]; then
+ _debug "Use short host name"
+ export _CURL_NO_HOST=1
+ else
+ export _CURL_NO_HOST=
+ fi
+ return 0
+}
diff --git a/deploy/gcore_cdn.sh b/deploy/gcore_cdn.sh
index e0921bc..a2a35f7 100644
--- a/deploy/gcore_cdn.sh
+++ b/deploy/gcore_cdn.sh
@@ -1,7 +1,6 @@
#!/usr/bin/env sh
# Here is the script to deploy the cert to G-Core CDN service (https://gcorelabs.com/ru/) using the G-Core Labs API (https://docs.gcorelabs.com/cdn/).
-# Uses command line curl for send requests and jq for parse responses.
# Returns 0 when success.
#
# Written by temoffey