mirror of https://github.com/plantroon/acme.sh.git
Merge branch 'dev'
This commit is contained in:
neilpang
commit
4c32bc8e22
4
acme.sh
4
acme.sh
|
|
@ -1053,9 +1053,9 @@ _sign() {
|
|||
|
||||
_sign_openssl="${ACME_OPENSSL_BIN:-openssl} dgst -sign $keyfile "
|
||||
|
||||
if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1 || grep "BEGIN PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
|
||||
if _isRSA "$keyfile" >/dev/null 2>&1; then
|
||||
$_sign_openssl -$alg | _base64
|
||||
elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
|
||||
elif _isEcc "$keyfile" >/dev/null 2>&1; then
|
||||
if ! _signedECText="$($_sign_openssl -sha$__ECC_KEY_LEN | ${ACME_OPENSSL_BIN:-openssl} asn1parse -inform DER)"; then
|
||||
_err "Sign failed: $_sign_openssl"
|
||||
_err "Key file: $keyfile"
|
||||
|
|
|
|||
|
|
@ -66,21 +66,31 @@ routeros_deploy() {
|
|||
_debug _cca "$_cca"
|
||||
_debug _cfullchain "$_cfullchain"
|
||||
|
||||
_getdeployconf ROUTER_OS_HOST
|
||||
|
||||
if [ -z "$ROUTER_OS_HOST" ]; then
|
||||
_debug "Using _cdomain as ROUTER_OS_HOST, please set if not correct."
|
||||
ROUTER_OS_HOST="$_cdomain"
|
||||
fi
|
||||
|
||||
_getdeployconf ROUTER_OS_USERNAME
|
||||
|
||||
if [ -z "$ROUTER_OS_USERNAME" ]; then
|
||||
_err "Need to set the env variable ROUTER_OS_USERNAME"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_getdeployconf ROUTER_OS_ADDITIONAL_SERVICES
|
||||
|
||||
if [ -z "$ROUTER_OS_ADDITIONAL_SERVICES" ]; then
|
||||
_debug "Not enabling additional services"
|
||||
ROUTER_OS_ADDITIONAL_SERVICES=""
|
||||
fi
|
||||
|
||||
_savedeployconf ROUTER_OS_HOST "$ROUTER_OS_HOST"
|
||||
_savedeployconf ROUTER_OS_USERNAME "$ROUTER_OS_USERNAME"
|
||||
_savedeployconf ROUTER_OS_ADDITIONAL_SERVICES "$ROUTER_OS_ADDITIONAL_SERVICES"
|
||||
|
||||
_info "Trying to push key '$_ckey' to router"
|
||||
scp "$_ckey" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.key"
|
||||
_info "Trying to push cert '$_cfullchain' to router"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,180 @@
|
|||
#!/usr/bin/env sh
|
||||
|
||||
# Here is a scipt to deploy the cert to your TrueNAS using the REST API.
|
||||
# https://www.truenas.com/docs/hub/additional-topics/api/rest_api.html
|
||||
#
|
||||
# Written by Frank Plass github@f-plass.de
|
||||
# https://github.com/danb35/deploy-freenas/blob/master/deploy_freenas.py
|
||||
# Thanks to danb35 for your template!
|
||||
#
|
||||
# Following environment variables must be set:
|
||||
#
|
||||
# export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI"
|
||||
#
|
||||
# The following environmental variables may be set if you don't like their
|
||||
# default values:
|
||||
#
|
||||
# DEPLOY_TRUENAS_HOSTNAME - defaults to localhost
|
||||
# DEPLOY_TRUENAS_SCHEME - defaults to http, set alternatively to https
|
||||
#
|
||||
#returns 0 means success, otherwise error.
|
||||
|
||||
######## Public functions #####################
|
||||
|
||||
#domain keyfile certfile cafile fullchain
|
||||
truenas_deploy() {
|
||||
_cdomain="$1"
|
||||
_ckey="$2"
|
||||
_ccert="$3"
|
||||
_cca="$4"
|
||||
_cfullchain="$5"
|
||||
|
||||
_debug _cdomain "$_cdomain"
|
||||
_debug _ckey "$_ckey"
|
||||
_debug _ccert "$_ccert"
|
||||
_debug _cca "$_cca"
|
||||
_debug _cfullchain "$_cfullchain"
|
||||
|
||||
_getdeployconf DEPLOY_TRUENAS_APIKEY
|
||||
|
||||
if [ -z "$DEPLOY_TRUENAS_APIKEY" ]; then
|
||||
_err "TrueNAS Api Key is not found, please define DEPLOY_TRUENAS_APIKEY."
|
||||
return 1
|
||||
fi
|
||||
_secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
|
||||
|
||||
# Optional hostname, scheme for TrueNAS
|
||||
_getdeployconf DEPLOY_TRUENAS_HOSTNAME
|
||||
_getdeployconf DEPLOY_TRUENAS_SCHEME
|
||||
|
||||
# default values for hostname and scheme
|
||||
[ -n "${DEPLOY_TRUENAS_HOSTNAME}" ] || DEPLOY_TRUENAS_HOSTNAME="localhost"
|
||||
[ -n "${DEPLOY_TRUENAS_SCHEME}" ] || DEPLOY_TRUENAS_SCHEME="http"
|
||||
|
||||
_debug2 DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
|
||||
_debug2 DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
|
||||
|
||||
_api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0"
|
||||
_debug _api_url "$_api_url"
|
||||
|
||||
_H1="Authorization: Bearer $DEPLOY_TRUENAS_APIKEY"
|
||||
_secure_debug3 _H1 "$_H1"
|
||||
|
||||
_info "Testing Connection TrueNAS"
|
||||
_response=$(_get "$_api_url/system/state")
|
||||
_info "TrueNAS System State: $_response."
|
||||
|
||||
if [ -z "$_response" ]; then
|
||||
_err "Unable to authenticate to $_api_url."
|
||||
_err 'Check your Connection and set DEPLOY_TRUENAS_HOSTNAME="192.168.178.x".'
|
||||
_err 'or'
|
||||
_err 'set DEPLOY_TRUENAS_HOSTNAME="<truenas_dnsname>".'
|
||||
_err 'Check your Connection and set DEPLOY_TRUENAS_SCHEME="https".'
|
||||
_err "Check your Api Key."
|
||||
return 1
|
||||
fi
|
||||
|
||||
_savedeployconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
|
||||
_savedeployconf DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
|
||||
_savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
|
||||
|
||||
_info "Getting active certificate from TrueNAS"
|
||||
_response=$(_get "$_api_url/system/general")
|
||||
_active_cert_id=$(echo "$_response" | grep -B2 '"name":' | grep 'id' | tr -d -- '"id: ,')
|
||||
_active_cert_name=$(echo "$_response" | grep '"name":' | sed -n 's/.*: "\(.\{1,\}\)",$/\1/p')
|
||||
_param_httpsredirect=$(echo "$_response" | grep '"ui_httpsredirect":' | sed -n 's/.*": \(.\{1,\}\),$/\1/p')
|
||||
_debug Active_UI_Certificate_ID "$_active_cert_id"
|
||||
_debug Active_UI_Certificate_Name "$_active_cert_name"
|
||||
_debug Active_UI_http_redirect "$_param_httpsredirect"
|
||||
|
||||
if [ "$DEPLOY_TRUENAS_SCHEME" = "http" ] && [ "$_param_httpsredirect" = "true" ]; then
|
||||
_info "http Redirect active"
|
||||
_info "Setting DEPLOY_TRUENAS_SCHEME to 'https'"
|
||||
DEPLOY_TRUENAS_SCHEME="https"
|
||||
_api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0"
|
||||
_savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
|
||||
fi
|
||||
|
||||
_info "Upload new certifikate to TrueNAS"
|
||||
_certname="Letsencrypt_$(_utc_date | tr ' ' '_' | tr -d -- ':')"
|
||||
_debug3 _certname "$_certname"
|
||||
|
||||
_certData="{\"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"name\": \"${_certname}\", \"certificate\": \"$(_json_encode <"$_cfullchain")\", \"privatekey\": \"$(_json_encode <"$_ckey")\"}"
|
||||
_add_cert_result="$(_post "$_certData" "$_api_url/certificate" "" "POST" "application/json")"
|
||||
|
||||
_debug3 _add_cert_result "$_add_cert_result"
|
||||
|
||||
_info "Getting Certificate list to get new Cert ID"
|
||||
_cert_list=$(_get "$_api_url/system/general/ui_certificate_choices")
|
||||
_cert_id=$(echo "$_cert_list" | grep "$_certname" | sed -n 's/.*"\([0-9]\{1,\}\)".*$/\1/p')
|
||||
|
||||
_debug3 _cert_id "$_cert_id"
|
||||
|
||||
_info "Activate Certificate ID: $_cert_id"
|
||||
_activateData="{\"ui_certificate\": \"${_cert_id}\"}"
|
||||
_activate_result="$(_post "$_activateData" "$_api_url/system/general" "" "PUT" "application/json")"
|
||||
|
||||
_debug3 _activate_result "$_activate_result"
|
||||
|
||||
_info "Check if WebDAV certificate is the same as the WEB UI"
|
||||
_webdav_list=$(_get "$_api_url/webdav")
|
||||
_webdav_cert_id=$(echo "$_webdav_list" | grep '"certssl":' | tr -d -- '"certsl: ,')
|
||||
|
||||
if [ "$_webdav_cert_id" = "$_active_cert_id" ]; then
|
||||
_info "Update the WebDAV Certificate"
|
||||
_debug _webdav_cert_id "$_webdav_cert_id"
|
||||
_webdav_data="{\"certssl\": \"${_cert_id}\"}"
|
||||
_activate_webdav_cert="$(_post "$_webdav_data" "$_api_url/webdav" "" "PUT" "application/json")"
|
||||
_webdav_new_cert_id=$(echo "$_activate_webdav_cert" | _json_decode | sed -n 's/.*: \([0-9]\{1,\}\) }$/\1/p')
|
||||
if [ "$_webdav_new_cert_id" -eq "$_cert_id" ]; then
|
||||
_info "WebDAV Certificate update successfully"
|
||||
else
|
||||
_err "Unable to set WebDAV certificate"
|
||||
_debug3 _activate_webdav_cert "$_activate_webdav_cert"
|
||||
_debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
|
||||
return 1
|
||||
fi
|
||||
_debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
|
||||
else
|
||||
_info "WebDAV certificate not set or not the same as Web UI"
|
||||
fi
|
||||
|
||||
_info "Check if FTP certificate is the same as the WEB UI"
|
||||
_ftp_list=$(_get "$_api_url/ftp")
|
||||
_ftp_cert_id=$(echo "$_ftp_list" | grep '"ssltls_certificate":' | tr -d -- '"certislfa:_ ,')
|
||||
|
||||
if [ "$_ftp_cert_id" = "$_active_cert_id" ]; then
|
||||
_info "Update the FTP Certificate"
|
||||
_debug _ftp_cert_id "$_ftp_cert_id"
|
||||
_ftp_data="{\"ssltls_certificate\": \"${_cert_id}\"}"
|
||||
_activate_ftp_cert="$(_post "$_ftp_data" "$_api_url/ftp" "" "PUT" "application/json")"
|
||||
_ftp_new_cert_id=$(echo "$_activate_ftp_cert" | _json_decode | sed -n 's/.*: \([0-9]\{1,\}\) }$/\1/p')
|
||||
if [ "$_ftp_new_cert_id" -eq "$_cert_id" ]; then
|
||||
_info "FTP Certificate update successfully"
|
||||
else
|
||||
_err "Unable to set FTP certificate"
|
||||
_debug3 _activate_ftp_cert "$_activate_ftp_cert"
|
||||
_debug3 _ftp_new_cert_id "$_ftp_new_cert_id"
|
||||
return 1
|
||||
fi
|
||||
_debug3 _activate_ftp_cert "$_activate_ftp_cert"
|
||||
else
|
||||
_info "FTP certificate not set or not the same as Web UI"
|
||||
fi
|
||||
|
||||
_info "Delete old Certificate"
|
||||
_delete_result="$(_post "" "$_api_url/certificate/id/$_active_cert_id" "" "DELETE" "application/json")"
|
||||
|
||||
_debug3 _delete_result "$_delete_result"
|
||||
|
||||
_info "Reload WebUI from TrueNAS"
|
||||
_restart_UI=$(_get "$_api_url/system/general/ui_restart")
|
||||
_debug2 _restart_UI "$_restart_UI"
|
||||
|
||||
if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ]; then
|
||||
return 0
|
||||
else
|
||||
_err "Certupdate was not succesfull, please use --debug"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
|
@ -35,7 +35,7 @@ dns_huaweicloud_add() {
|
|||
_err "dns_api(dns_huaweicloud): Error getting token."
|
||||
return 1
|
||||
fi
|
||||
_debug "Access token is: ${token}"
|
||||
_secure_debug "Access token is:" "${token}"
|
||||
|
||||
unset zoneid
|
||||
zoneid="$(_get_zoneid "${token}" "${fulldomain}")"
|
||||
|
|
@ -43,7 +43,7 @@ dns_huaweicloud_add() {
|
|||
_err "dns_api(dns_huaweicloud): Error getting zone id."
|
||||
return 1
|
||||
fi
|
||||
_debug "Zone ID is: ${zoneid}"
|
||||
_debug "Zone ID is:" "${zoneid}"
|
||||
|
||||
_debug "Adding Record"
|
||||
_add_record "${token}" "${fulldomain}" "${txtvalue}"
|
||||
|
|
@ -86,7 +86,7 @@ dns_huaweicloud_rm() {
|
|||
_err "dns_api(dns_huaweicloud): Error getting token."
|
||||
return 1
|
||||
fi
|
||||
_debug "Access token is: ${token}"
|
||||
_secure_debug "Access token is:" "${token}"
|
||||
|
||||
unset zoneid
|
||||
zoneid="$(_get_zoneid "${token}" "${fulldomain}")"
|
||||
|
|
@ -94,7 +94,7 @@ dns_huaweicloud_rm() {
|
|||
_err "dns_api(dns_huaweicloud): Error getting zone id."
|
||||
return 1
|
||||
fi
|
||||
_debug "Zone ID is: ${zoneid}"
|
||||
_debug "Zone ID is:" "${zoneid}"
|
||||
|
||||
# Remove all records
|
||||
# Therotically HuaweiCloud does not allow more than one record set
|
||||
|
|
@ -129,14 +129,25 @@ _get_zoneid() {
|
|||
fi
|
||||
_debug "$h"
|
||||
response=$(_get "${dns_api}/v2/zones?name=${h}")
|
||||
|
||||
if _contains "${response}" "id"; then
|
||||
_debug "Get Zone ID Success."
|
||||
_zoneid=$(echo "${response}" | _egrep_o "\"id\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")
|
||||
printf "%s" "${_zoneid}"
|
||||
return 0
|
||||
_debug2 "$response"
|
||||
if _contains "${response}" '"id"'; then
|
||||
zoneidlist=$(echo "${response}" | _egrep_o "\"id\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")
|
||||
zonenamelist=$(echo "${response}" | _egrep_o "\"name\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")
|
||||
_debug2 "Return Zone ID(s):" "${zoneidlist}"
|
||||
_debug2 "Return Zone Name(s):" "${zonenamelist}"
|
||||
zoneidnum=0
|
||||
echo "${zonenamelist}" | while read -r zonename; do
|
||||
zoneidnum=$(_math "$zoneidnum" + 1)
|
||||
_debug "Check Zone Name" "${zonename}"
|
||||
if [ "${zonename}" = "${h}." ]; then
|
||||
_debug "Get Zone ID Success."
|
||||
_zoneid=$(echo "${zoneidlist}" | sed -n "${zoneidnum}p")
|
||||
_debug2 "ZoneID:" "${_zoneid}"
|
||||
printf "%s" "${_zoneid}"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
i=$(_math "$i" + 1)
|
||||
done
|
||||
return 1
|
||||
|
|
@ -149,7 +160,7 @@ _get_recordset_id() {
|
|||
export _H1="X-Auth-Token: ${_token}"
|
||||
|
||||
response=$(_get "${dns_api}/v2/zones/${_zoneid}/recordsets?name=${_domain}")
|
||||
if _contains "${response}" "id"; then
|
||||
if _contains "${response}" '"id"'; then
|
||||
_id="$(echo "${response}" | _egrep_o "\"id\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")"
|
||||
printf "%s" "${_id}"
|
||||
return 0
|
||||
|
|
@ -197,7 +208,7 @@ _add_record() {
|
|||
fi
|
||||
|
||||
_record_id="$(_get_recordset_id "${_token}" "${_domain}" "${zoneid}")"
|
||||
_debug "Record Set ID is: ${_record_id}"
|
||||
_debug "Record Set ID is:" "${_record_id}"
|
||||
|
||||
# Remove all records
|
||||
while [ "${_record_id}" != "0" ]; do
|
||||
|
|
@ -269,7 +280,7 @@ _get_token() {
|
|||
_post "${body}" "${iam_api}/v3/auth/tokens" >/dev/null
|
||||
_code=$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")
|
||||
_token=$(grep "^X-Subject-Token" "$HTTP_HEADER" | cut -d " " -f 2-)
|
||||
_debug2 "${_code}"
|
||||
_secure_debug "${_code}"
|
||||
printf "%s" "${_token}"
|
||||
return 0
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue