mirror of https://github.com/plantroon/acme.sh.git
neil
GitHub
commit
130e8dbd40
|
|
@ -15,30 +15,9 @@ on:
|
|||
|
||||
|
||||
jobs:
|
||||
CheckToken:
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
hasToken: ${{ steps.step_one.outputs.hasToken }}
|
||||
env:
|
||||
NGROK_TOKEN : ${{ secrets.NGROK_TOKEN }}
|
||||
steps:
|
||||
- name: Set the value
|
||||
id: step_one
|
||||
run: |
|
||||
if [ "$NGROK_TOKEN" ] ; then
|
||||
echo "::set-output name=hasToken::true"
|
||||
else
|
||||
echo "::set-output name=hasToken::false"
|
||||
fi
|
||||
- name: Check the value
|
||||
run: echo ${{ steps.step_one.outputs.hasToken }}
|
||||
|
||||
Ubuntu:
|
||||
runs-on: ubuntu-latest
|
||||
needs: CheckToken
|
||||
if: "contains(needs.CheckToken.outputs.hasToken, 'true')"
|
||||
env:
|
||||
NGROK_TOKEN : ${{ secrets.NGROK_TOKEN }}
|
||||
TEST_LOCAL: 1
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
|
|
@ -51,9 +30,7 @@ jobs:
|
|||
|
||||
MacOS:
|
||||
runs-on: macos-latest
|
||||
needs: Ubuntu
|
||||
env:
|
||||
NGROK_TOKEN : ${{ secrets.NGROK_TOKEN }}
|
||||
TEST_LOCAL: 1
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
|
|
@ -66,11 +43,9 @@ jobs:
|
|||
|
||||
Windows:
|
||||
runs-on: windows-latest
|
||||
needs: MacOS
|
||||
env:
|
||||
NGROK_TOKEN : ${{ secrets.NGROK_TOKEN }}
|
||||
TEST_LOCAL: 1
|
||||
#The 80 port is used by Windows server, we have to use a custom port, ngrok will also use this port.
|
||||
#The 80 port is used by Windows server, we have to use a custom port, tunnel will also use this port.
|
||||
Le_HTTPPort: 8888
|
||||
steps:
|
||||
- name: Set git to use LF
|
||||
|
|
@ -103,17 +78,24 @@ jobs:
|
|||
|
||||
FreeBSD:
|
||||
runs-on: macos-latest
|
||||
needs: Windows
|
||||
env:
|
||||
NGROK_TOKEN : ${{ secrets.NGROK_TOKEN }}
|
||||
TEST_LOCAL: 1
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: vmactions/cf-tunnel@v0.0.1
|
||||
id: tunnel
|
||||
with:
|
||||
protocol: http
|
||||
port: 8080
|
||||
- name: Set envs
|
||||
run: echo "TestingDomain=${{steps.tunnel.outputs.server}}" >> $GITHUB_ENV
|
||||
- name: Clone acmetest
|
||||
run: cd .. && git clone https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/
|
||||
- uses: vmactions/freebsd-vm@v0.1.4
|
||||
with:
|
||||
envs: 'NGROK_TOKEN TEST_LOCAL'
|
||||
envs: 'TEST_LOCAL TestingDomain'
|
||||
nat: |
|
||||
"8080": "80"
|
||||
prepare: pkg install -y socat curl
|
||||
usesh: true
|
||||
run: |
|
||||
|
|
@ -121,19 +103,17 @@ jobs:
|
|||
|
||||
Solaris:
|
||||
runs-on: macos-latest
|
||||
needs: FreeBSD
|
||||
env:
|
||||
NGROK_TOKEN : ${{ secrets.NGROK_TOKEN }}
|
||||
TEST_LOCAL: 1
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: vmactions/ngrok-tunnel@v0.0.1
|
||||
id: ngrok
|
||||
- uses: vmactions/cf-tunnel@v0.0.1
|
||||
id: tunnel
|
||||
with:
|
||||
protocol: http
|
||||
port: 8080
|
||||
- name: Set envs
|
||||
run: echo "TestingDomain=${{steps.ngrok.outputs.server}}" >> $GITHUB_ENV
|
||||
run: echo "TestingDomain=${{steps.tunnel.outputs.server}}" >> $GITHUB_ENV
|
||||
- name: Clone acmetest
|
||||
run: cd .. && git clone https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/
|
||||
- uses: vmactions/solaris-vm@v0.0.3
|
||||
|
|
|
|||
207
acme.sh
207
acme.sh
|
|
@ -20,9 +20,6 @@ _SUB_FOLDER_DEPLOY="deploy"
|
|||
|
||||
_SUB_FOLDERS="$_SUB_FOLDER_DNSAPI $_SUB_FOLDER_DEPLOY $_SUB_FOLDER_NOTIFY"
|
||||
|
||||
LETSENCRYPT_CA_V1="https://acme-v01.api.letsencrypt.org/directory"
|
||||
LETSENCRYPT_STAGING_CA_V1="https://acme-staging.api.letsencrypt.org/directory"
|
||||
|
||||
CA_LETSENCRYPT_V2="https://acme-v02.api.letsencrypt.org/directory"
|
||||
CA_LETSENCRYPT_V2_TEST="https://acme-staging-v02.api.letsencrypt.org/directory"
|
||||
|
||||
|
|
@ -2072,7 +2069,7 @@ _send_signed_request() {
|
|||
_sleep 2
|
||||
continue
|
||||
fi
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
|
||||
if [ "$url" = "$ACME_NEW_ACCOUNT" ]; then
|
||||
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
|
||||
elif [ "$url" = "$ACME_REVOKE_CERT" ] && [ "$keyfile" != "$ACCOUNT_KEY_PATH" ]; then
|
||||
|
|
@ -2080,9 +2077,7 @@ _send_signed_request() {
|
|||
else
|
||||
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"${ACCOUNT_URL}\""'}'
|
||||
fi
|
||||
else
|
||||
protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
|
||||
fi
|
||||
|
||||
_debug3 protected "$protected"
|
||||
|
||||
protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
|
||||
|
|
@ -2549,61 +2544,25 @@ _initAPI() {
|
|||
response=$(echo "$response" | _json_decode)
|
||||
_debug2 "response" "$response"
|
||||
|
||||
ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'key-change" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
if [ -z "$ACME_KEY_CHANGE" ]; then
|
||||
ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
fi
|
||||
export ACME_KEY_CHANGE
|
||||
|
||||
ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'new-authz" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
if [ -z "$ACME_NEW_AUTHZ" ]; then
|
||||
ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
fi
|
||||
export ACME_NEW_AUTHZ
|
||||
|
||||
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-cert" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
ACME_NEW_ORDER_RES="new-cert"
|
||||
if [ -z "$ACME_NEW_ORDER" ]; then
|
||||
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-order" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
ACME_NEW_ORDER_RES="new-order"
|
||||
if [ -z "$ACME_NEW_ORDER" ]; then
|
||||
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
fi
|
||||
fi
|
||||
export ACME_NEW_ORDER
|
||||
export ACME_NEW_ORDER_RES
|
||||
|
||||
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-reg" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
ACME_NEW_ACCOUNT_RES="new-reg"
|
||||
if [ -z "$ACME_NEW_ACCOUNT" ]; then
|
||||
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-account" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
ACME_NEW_ACCOUNT_RES="new-account"
|
||||
if [ -z "$ACME_NEW_ACCOUNT" ]; then
|
||||
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
if [ "$ACME_NEW_ACCOUNT" ]; then
|
||||
export ACME_VERSION=2
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
export ACME_NEW_ACCOUNT
|
||||
export ACME_NEW_ACCOUNT_RES
|
||||
|
||||
ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revoke-cert" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
if [ -z "$ACME_REVOKE_CERT" ]; then
|
||||
ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
fi
|
||||
export ACME_REVOKE_CERT
|
||||
|
||||
ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'new-nonce" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
if [ -z "$ACME_NEW_NONCE" ]; then
|
||||
ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
fi
|
||||
export ACME_NEW_NONCE
|
||||
|
||||
ACME_AGREEMENT=$(echo "$response" | _egrep_o 'terms-of-service" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
if [ -z "$ACME_AGREEMENT" ]; then
|
||||
ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
|
||||
fi
|
||||
export ACME_AGREEMENT
|
||||
|
||||
_debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
|
||||
|
|
@ -2613,7 +2572,6 @@ _initAPI() {
|
|||
_debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
|
||||
_debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
|
||||
_debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
|
||||
_debug "ACME_VERSION" "$ACME_VERSION"
|
||||
|
||||
fi
|
||||
}
|
||||
|
|
@ -3563,7 +3521,7 @@ _regAccount() {
|
|||
if [ "$_email" ]; then
|
||||
_savecaconf "CA_EMAIL" "$_email"
|
||||
fi
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
|
||||
if [ "$ACME_DIRECTORY" = "$CA_ZEROSSL" ]; then
|
||||
if [ -z "$_eab_id" ] || [ -z "$_eab_hmac_key" ]; then
|
||||
_info "No EAB credentials found for ZeroSSL, let's get one"
|
||||
|
|
@ -3619,13 +3577,6 @@ _regAccount() {
|
|||
email_sg="\"contact\": [\"mailto:$_email\"], "
|
||||
fi
|
||||
regjson="{$email_sg\"termsOfServiceAgreed\": true$externalBinding}"
|
||||
else
|
||||
_reg_res="$ACME_NEW_ACCOUNT_RES"
|
||||
regjson='{"resource": "'$_reg_res'", "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
|
||||
if [ "$_email" ]; then
|
||||
regjson='{"resource": "'$_reg_res'", "contact": ["mailto:'$_email'"], "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
|
||||
fi
|
||||
fi
|
||||
|
||||
_info "Registering account: $ACME_DIRECTORY"
|
||||
|
||||
|
|
@ -3710,20 +3661,13 @@ updateaccount() {
|
|||
_initAPI
|
||||
|
||||
_email="$(_getAccountEmail)"
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
|
||||
if [ "$ACCOUNT_EMAIL" ]; then
|
||||
updjson='{"contact": ["mailto:'$_email'"]}'
|
||||
else
|
||||
updjson='{"contact": []}'
|
||||
fi
|
||||
else
|
||||
# ACMEv1: Updates happen the same way a registration is done.
|
||||
# https://tools.ietf.org/html/draft-ietf-acme-acme-01#section-6.3
|
||||
_regAccount
|
||||
return
|
||||
fi
|
||||
|
||||
# this part handles ACMEv2 account updates.
|
||||
_send_signed_request "$_accUri" "$updjson"
|
||||
|
||||
if [ "$code" = '200' ]; then
|
||||
|
|
@ -3768,11 +3712,8 @@ deactivateaccount() {
|
|||
fi
|
||||
_initAPI
|
||||
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
_djson="{\"status\":\"deactivated\"}"
|
||||
else
|
||||
_djson="{\"resource\": \"reg\", \"status\":\"deactivated\"}"
|
||||
fi
|
||||
|
||||
if _send_signed_request "$_accUri" "$_djson" && _contains "$response" '"deactivated"'; then
|
||||
_info "Deactivate account success for $_accUri."
|
||||
_accid=$(echo "$response" | _egrep_o "\"id\" *: *[^,]*," | cut -d : -f 2 | tr -d ' ,')
|
||||
|
|
@ -3877,11 +3818,9 @@ __trigger_validation() {
|
|||
_debug2 _t_key_authz "$_t_key_authz"
|
||||
_t_vtype="$3"
|
||||
_debug2 _t_vtype "$_t_vtype"
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
|
||||
_send_signed_request "$_t_url" "{}"
|
||||
else
|
||||
_send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"type\": \"$_t_vtype\", \"keyAuthorization\": \"$_t_key_authz\"}"
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
#endpoint domain type
|
||||
|
|
@ -4297,7 +4236,6 @@ issue() {
|
|||
sep='#'
|
||||
dvsep=','
|
||||
if [ -z "$vlist" ]; then
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
#make new order request
|
||||
_identifiers="{\"type\":\"dns\",\"value\":\"$(_idn "$_main_domain")\"}"
|
||||
_w_index=1
|
||||
|
|
@ -4364,7 +4302,6 @@ issue() {
|
|||
$_authorizations_map"
|
||||
done
|
||||
_debug2 _authorizations_map "$_authorizations_map"
|
||||
fi
|
||||
|
||||
_index=0
|
||||
_currentRoot=""
|
||||
|
|
@ -4395,7 +4332,6 @@ $_authorizations_map"
|
|||
vtype="$VTYPE_ALPN"
|
||||
fi
|
||||
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
_idn_d="$(_idn "$d")"
|
||||
_candidates="$(echo "$_authorizations_map" | grep -i "^$_idn_d,")"
|
||||
_debug2 _candidates "$_candidates"
|
||||
|
|
@ -4416,13 +4352,6 @@ $_authorizations_map"
|
|||
_on_issue_err "$_post_hook"
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
if ! __get_domain_new_authz "$d"; then
|
||||
_clearup
|
||||
_on_issue_err "$_post_hook"
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$thumbprint" ]; then
|
||||
thumbprint="$(__calc_account_thumbprint)"
|
||||
|
|
@ -4462,11 +4391,9 @@ $_authorizations_map"
|
|||
_on_issue_err "$_post_hook"
|
||||
return 1
|
||||
fi
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
|
||||
uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
|
||||
else
|
||||
uri="$(echo "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
|
||||
fi
|
||||
|
||||
_debug uri "$uri"
|
||||
|
||||
if [ -z "$uri" ]; then
|
||||
|
|
@ -4764,11 +4691,9 @@ $_authorizations_map"
|
|||
_debug "sleep 2 secs to verify"
|
||||
sleep 2
|
||||
_debug "checking"
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
|
||||
_send_signed_request "$uri"
|
||||
else
|
||||
response="$(_get "$uri")"
|
||||
fi
|
||||
|
||||
if [ "$?" != "0" ]; then
|
||||
_err "$d:Verify error:$response"
|
||||
_clearupwebbroot "$_currentRoot" "$removelevel" "$token"
|
||||
|
|
@ -4833,7 +4758,6 @@ $_authorizations_map"
|
|||
_info "Verify finished, start to sign."
|
||||
der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
|
||||
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
_info "Lets finalize the order."
|
||||
_info "Le_OrderFinalize" "$Le_OrderFinalize"
|
||||
if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
|
||||
|
|
@ -4956,28 +4880,6 @@ $_authorizations_map"
|
|||
done
|
||||
fi
|
||||
fi
|
||||
else
|
||||
if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
|
||||
_err "Sign failed. $response"
|
||||
_on_issue_err "$_post_hook"
|
||||
return 1
|
||||
fi
|
||||
_rcert="$response"
|
||||
Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
|
||||
echo "$BEGIN_CERT" >"$CERT_PATH"
|
||||
|
||||
#if ! _get "$Le_LinkCert" | _base64 "multiline" >> "$CERT_PATH" ; then
|
||||
# _debug "Get cert failed. Let's try last response."
|
||||
# printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >> "$CERT_PATH"
|
||||
#fi
|
||||
|
||||
if ! printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >>"$CERT_PATH"; then
|
||||
_debug "Try cert link."
|
||||
_get "$Le_LinkCert" | _base64 "multiline" >>"$CERT_PATH"
|
||||
fi
|
||||
|
||||
echo "$END_CERT" >>"$CERT_PATH"
|
||||
fi
|
||||
|
||||
_debug "Le_LinkCert" "$Le_LinkCert"
|
||||
_savedomainconf "Le_LinkCert" "$Le_LinkCert"
|
||||
|
|
@ -5005,53 +4907,6 @@ $_authorizations_map"
|
|||
fi
|
||||
fi
|
||||
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
_debug "v2 chain."
|
||||
else
|
||||
cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
|
||||
Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
|
||||
|
||||
if [ "$Le_LinkIssuer" ]; then
|
||||
if ! _contains "$Le_LinkIssuer" ":"; then
|
||||
_info "$(__red "Relative issuer link found.")"
|
||||
Le_LinkIssuer="$_ACME_SERVER_HOST$Le_LinkIssuer"
|
||||
fi
|
||||
_debug Le_LinkIssuer "$Le_LinkIssuer"
|
||||
_savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
|
||||
|
||||
_link_issuer_retry=0
|
||||
_MAX_ISSUER_RETRY=5
|
||||
while [ "$_link_issuer_retry" -lt "$_MAX_ISSUER_RETRY" ]; do
|
||||
_debug _link_issuer_retry "$_link_issuer_retry"
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
if _send_signed_request "$Le_LinkIssuer"; then
|
||||
echo "$response" >"$CA_CERT_PATH"
|
||||
break
|
||||
fi
|
||||
else
|
||||
if _get "$Le_LinkIssuer" >"$CA_CERT_PATH.der"; then
|
||||
echo "$BEGIN_CERT" >"$CA_CERT_PATH"
|
||||
_base64 "multiline" <"$CA_CERT_PATH.der" >>"$CA_CERT_PATH"
|
||||
echo "$END_CERT" >>"$CA_CERT_PATH"
|
||||
if ! _checkcert "$CA_CERT_PATH"; then
|
||||
_err "Can not get the ca cert."
|
||||
break
|
||||
fi
|
||||
cat "$CA_CERT_PATH" >>"$CERT_FULLCHAIN_PATH"
|
||||
rm -f "$CA_CERT_PATH.der"
|
||||
break
|
||||
fi
|
||||
fi
|
||||
_link_issuer_retry=$(_math $_link_issuer_retry + 1)
|
||||
_sleep "$_link_issuer_retry"
|
||||
done
|
||||
if [ "$_link_issuer_retry" = "$_MAX_ISSUER_RETRY" ]; then
|
||||
_err "Max retry for issuer ca cert is reached."
|
||||
fi
|
||||
else
|
||||
_debug "No Le_LinkIssuer header found."
|
||||
fi
|
||||
fi
|
||||
[ -f "$CA_CERT_PATH" ] && _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
|
||||
[ -f "$CERT_FULLCHAIN_PATH" ] && _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
|
||||
|
||||
|
|
@ -5165,15 +5020,6 @@ renew() {
|
|||
. "$DOMAIN_CONF"
|
||||
_debug Le_API "$Le_API"
|
||||
|
||||
if [ "$Le_API" = "$LETSENCRYPT_CA_V1" ]; then
|
||||
_cleardomainconf Le_API
|
||||
Le_API="$DEFAULT_CA"
|
||||
fi
|
||||
if [ "$Le_API" = "$LETSENCRYPT_STAGING_CA_V1" ]; then
|
||||
_cleardomainconf Le_API
|
||||
Le_API="$DEFAULT_STAGING_CA"
|
||||
fi
|
||||
|
||||
if [ "$Le_API" ]; then
|
||||
export ACME_DIRECTORY="$Le_API"
|
||||
#reload ca configs
|
||||
|
|
@ -5388,9 +5234,6 @@ signcsr() {
|
|||
return 1
|
||||
fi
|
||||
|
||||
if [ -z "$ACME_VERSION" ] && _contains "$_csrsubj,$_csrdomainlist" "*."; then
|
||||
export ACME_VERSION=2
|
||||
fi
|
||||
_initpath "$_csrsubj" "$_csrkeylength"
|
||||
mkdir -p "$DOMAIN_PATH"
|
||||
|
||||
|
|
@ -5851,11 +5694,8 @@ revoke() {
|
|||
|
||||
_initAPI
|
||||
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
data="{\"certificate\": \"$cert\",\"reason\":$_reason}"
|
||||
else
|
||||
data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
|
||||
fi
|
||||
|
||||
uri="${ACME_REVOKE_CERT}"
|
||||
|
||||
if [ -f "$CERT_KEY_PATH" ]; then
|
||||
|
|
@ -5926,7 +5766,6 @@ _deactivate() {
|
|||
_d_type="$2"
|
||||
_initpath
|
||||
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
_identifiers="{\"type\":\"dns\",\"value\":\"$_d_domain\"}"
|
||||
if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
|
||||
_err "Can not get domain new order."
|
||||
|
|
@ -5955,20 +5794,6 @@ _deactivate() {
|
|||
response="$(echo "$response" | _normalizeJson)"
|
||||
_debug2 response "$response"
|
||||
_URL_NAME="url"
|
||||
else
|
||||
if ! __get_domain_new_authz "$_d_domain"; then
|
||||
_err "Can not get domain new authz token."
|
||||
return 1
|
||||
fi
|
||||
|
||||
authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ':' -f 2- | tr -d "\r\n")"
|
||||
_debug "authzUri" "$authzUri"
|
||||
if [ "$code" ] && [ ! "$code" = '201' ]; then
|
||||
_err "new-authz error: $response"
|
||||
return 1
|
||||
fi
|
||||
_URL_NAME="uri"
|
||||
fi
|
||||
|
||||
entries="$(echo "$response" | tr '][' '==' | _egrep_o "challenges\": *=[^=]*=" | tr '}{' '\n' | grep "\"status\": *\"valid\"")"
|
||||
if [ -z "$entries" ]; then
|
||||
|
|
@ -6023,11 +5848,7 @@ _deactivate() {
|
|||
|
||||
_info "Deactivate: $_vtype"
|
||||
|
||||
if [ "$ACME_VERSION" = "2" ]; then
|
||||
_djson="{\"status\":\"deactivated\"}"
|
||||
else
|
||||
_djson="{\"resource\": \"authz\", \"status\":\"deactivated\"}"
|
||||
fi
|
||||
|
||||
if _send_signed_request "$authzUri" "$_djson" && _contains "$response" '"deactivated"'; then
|
||||
_info "Deactivate: $_vtype success."
|
||||
|
|
@ -7033,10 +6854,6 @@ _process() {
|
|||
return 1
|
||||
fi
|
||||
|
||||
if _startswith "$_dvalue" "*."; then
|
||||
_debug "Wildcard domain"
|
||||
export ACME_VERSION=2
|
||||
fi
|
||||
if [ -z "$_domain" ]; then
|
||||
_domain="$_dvalue"
|
||||
else
|
||||
|
|
|
|||
|
|
@ -121,12 +121,6 @@ synology_dsm_deploy() {
|
|||
# we've verified this certificate description is a thing, so save it
|
||||
_savedeployconf SYNO_Certificate "$SYNO_Certificate"
|
||||
|
||||
default=""
|
||||
if echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -- 'is_default":true' >/dev/null; then
|
||||
default=true
|
||||
fi
|
||||
_debug2 default "$default"
|
||||
|
||||
_info "Generate form POST request"
|
||||
nl="\0015\0012"
|
||||
delim="--------------------------$(_utc_date | tr -d -- '-: ')"
|
||||
|
|
@ -135,7 +129,12 @@ synology_dsm_deploy() {
|
|||
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"inter_cert\"; filename=\"$(basename "$_cca")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cca")\0012"
|
||||
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"id\"${nl}${nl}$id"
|
||||
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"desc\"${nl}${nl}${SYNO_Certificate}"
|
||||
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"as_default\"${nl}${nl}${default}"
|
||||
if echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -- 'is_default":true' >/dev/null; then
|
||||
_debug2 default "this is the default certificate"
|
||||
content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"as_default\"${nl}${nl}true"
|
||||
else
|
||||
_debug2 default "this is NOT the default certificate"
|
||||
fi
|
||||
content="$content${nl}--$delim--${nl}"
|
||||
content="$(printf "%b_" "$content")"
|
||||
content="${content%_}" # protect trailing \n
|
||||
|
|
|
|||
|
|
@ -20,21 +20,17 @@ dns_desec_add() {
|
|||
_debug txtvalue "$txtvalue"
|
||||
|
||||
DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
|
||||
DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
|
||||
|
||||
if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
|
||||
if [ -z "$DEDYN_TOKEN" ]; then
|
||||
DEDYN_TOKEN=""
|
||||
DEDYN_NAME=""
|
||||
_err "You did not specify DEDYN_TOKEN and DEDYN_NAME yet."
|
||||
_err "You did not specify DEDYN_TOKEN yet."
|
||||
_err "Please create your key and try again."
|
||||
_err "e.g."
|
||||
_err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
|
||||
_err "export DEDYN_NAME=foobar.dedyn.io"
|
||||
return 1
|
||||
fi
|
||||
#save the api token and name to the account conf file.
|
||||
#save the api token to the account conf file.
|
||||
_saveaccountconf_mutable DEDYN_TOKEN "$DEDYN_TOKEN"
|
||||
_saveaccountconf_mutable DEDYN_NAME "$DEDYN_NAME"
|
||||
|
||||
_debug "First detect the root zone"
|
||||
if ! _get_root "$fulldomain" "$REST_API/"; then
|
||||
|
|
@ -47,7 +43,7 @@ dns_desec_add() {
|
|||
# Get existing TXT record
|
||||
_debug "Getting txt records"
|
||||
txtvalues="\"\\\"$txtvalue\\\"\""
|
||||
_desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
|
||||
_desec_rest GET "$REST_API/$_domain/rrsets/$_sub_domain/TXT/"
|
||||
|
||||
if [ "$_code" = "200" ]; then
|
||||
oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
|
||||
|
|
@ -63,7 +59,7 @@ dns_desec_add() {
|
|||
_info "Adding record"
|
||||
body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":3600}]"
|
||||
|
||||
if _desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"; then
|
||||
if _desec_rest PUT "$REST_API/$_domain/rrsets/" "$body"; then
|
||||
if _contains "$response" "$txtvalue"; then
|
||||
_info "Added, OK"
|
||||
return 0
|
||||
|
|
@ -87,16 +83,13 @@ dns_desec_rm() {
|
|||
_debug txtvalue "$txtvalue"
|
||||
|
||||
DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
|
||||
DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
|
||||
|
||||
if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
|
||||
if [ -z "$DEDYN_TOKEN" ]; then
|
||||
DEDYN_TOKEN=""
|
||||
DEDYN_NAME=""
|
||||
_err "You did not specify DEDYN_TOKEN and DEDYN_NAME yet."
|
||||
_err "You did not specify DEDYN_TOKEN yet."
|
||||
_err "Please create your key and try again."
|
||||
_err "e.g."
|
||||
_err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
|
||||
_err "export DEDYN_NAME=foobar.dedyn.io"
|
||||
return 1
|
||||
fi
|
||||
|
||||
|
|
@ -112,7 +105,7 @@ dns_desec_rm() {
|
|||
# Get existing TXT record
|
||||
_debug "Getting txt records"
|
||||
txtvalues=""
|
||||
_desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
|
||||
_desec_rest GET "$REST_API/$_domain/rrsets/$_sub_domain/TXT/"
|
||||
|
||||
if [ "$_code" = "200" ]; then
|
||||
oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
|
||||
|
|
@ -131,7 +124,7 @@ dns_desec_rm() {
|
|||
|
||||
_info "Deleting record"
|
||||
body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":3600}]"
|
||||
_desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"
|
||||
_desec_rest PUT "$REST_API/$_domain/rrsets/" "$body"
|
||||
if [ "$_code" = "200" ]; then
|
||||
_info "Deleted, OK"
|
||||
return 0
|
||||
|
|
|
|||
|
|
@ -78,7 +78,7 @@ dns_porkbun_rm() {
|
|||
if [ "$count" = "0" ]; then
|
||||
_info "Don't need to remove."
|
||||
else
|
||||
record_id=$(echo "$response" | tr '{' '\n' | grep "$txtvalue" | cut -d, -f1 | cut -d: -f2 | tr -d \")
|
||||
record_id=$(echo "$response" | tr '{' '\n' | grep -- "$txtvalue" | cut -d, -f1 | cut -d: -f2 | tr -d \")
|
||||
_debug "record_id" "$record_id"
|
||||
if [ -z "$record_id" ]; then
|
||||
_err "Can not get record id to remove."
|
||||
|
|
|
|||
Loading…
Reference in New Issue