@ -1250,7 +1250,7 @@ _idn() {
fi
}
#_createcsr cn san_list keyfile csrfile conf acmeValidationv1
#_createcsr cn san_list keyfile csrfile conf acmeValidationv1 extendedUsage
_createcsr( ) {
_debug _createcsr
domain = " $1 "
@ -1259,6 +1259,7 @@ _createcsr() {
csr = " $4 "
csrconf = " $5 "
acmeValidationv1 = " $6 "
extusage = " $7 "
_debug2 domain " $domain "
_debug2 domainlist " $domainlist "
_debug2 csrkey " $csrkey "
@ -1267,11 +1268,10 @@ _createcsr() {
printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]" >" $csrconf "
if [ " $Le_ExtKeyUse " ] ; then
_savedomainconf Le_ExtKeyUse " $Le_ExtKeyUse "
printf " \nextendedKeyUsage= $Le_ExtKeyUse \n " >>" $csrconf "
if [ " $extusage " ] ; then
printf " \nextendedKeyUsage= $extusage \n " >>" $csrconf "
else
printf "\nextendedKeyUsage=serverAuth\n" >>" $csrconf "
printf "\nextendedKeyUsage=serverAuth,clientAuth \n" >>" $csrconf "
fi
if [ " $acmeValidationv1 " ] ; then
@ -4445,6 +4445,7 @@ issue() {
_valid_from = " ${ 16 } "
_valid_to = " ${ 17 } "
_certificate_profile = " ${ 18 } "
_extended_key_usage = " ${ 19 } "
if [ -z " $_ACME_IS_RENEW " ] ; then
_initpath " $_main_domain " " $_key_length "
@ -4589,12 +4590,25 @@ issue() {
return 1
fi
fi
if ! _createcsr " $_main_domain " " $_alt_domains " " $CERT_KEY_PATH " " $CSR_PATH " " $DOMAIN_SSL_CONF " ; then
_keyusage = " $_extended_key_usage "
if [ " $Le_API " = " $CA_GOOGLE " ] || [ " $Le_API " = " $CA_GOOGLE_TEST " ] ; then
if [ -z " $_keyusage " ] ; then
#https://github.com/acmesh-official/acme.sh/issues/6610
#google accepts serverauth only
_keyusage = "serverAuth"
fi
fi
if ! _createcsr " $_main_domain " " $_alt_domains " " $CERT_KEY_PATH " " $CSR_PATH " " $DOMAIN_SSL_CONF " "" " $_keyusage " ; then
_err "Error creating CSR."
_clearup
_on_issue_err " $_post_hook "
return 1
fi
if [ " $_extended_key_usage " ] ; then
_savedomainconf "Le_ExtKeyUse" " $_extended_key_usage "
else
_cleardomainconf "Le_ExtKeyUse"
fi
fi
_savedomainconf "Le_Keylength" " $_key_length "
@ -5228,6 +5242,16 @@ $_authorizations_map"
return 1
fi
break
elif _contains " $response " "\"ready\"" ; then
_info "Order status is 'ready', let's sleep and retry."
_retryafter = $( echo " $responseHeaders " | grep -i "^Retry-After *:" | cut -d : -f 2 | tr -d ' ' | tr -d '\r' )
_debug "_retryafter" " $_retryafter "
if [ " $_retryafter " ] ; then
_info " Sleeping for $_retryafter seconds then retrying "
_sleep $_retryafter
else
_sleep 2
fi
elif _contains " $response " "\"processing\"" ; then
_info "Order status is 'processing', let's sleep and retry."
_retryafter = $( echo " $responseHeaders " | grep -i "^Retry-After *:" | cut -d : -f 2 | tr -d ' ' | tr -d '\r' )
@ -5553,7 +5577,7 @@ renew() {
_cleardomainconf Le_OCSP_Staple
fi
fi
issue " $Le_Webroot " " $Le_Domain " " $Le_Alt " " $Le_Keylength " " $Le_RealCertPath " " $Le_RealKeyPath " " $Le_RealCACertPath " " $Le_ReloadCmd " " $Le_RealFullChainPath " " $Le_PreHook " " $Le_PostHook " " $Le_RenewHook " " $Le_LocalAddress " " $Le_ChallengeAlias " " $Le_Preferred_Chain " " $Le_Valid_From " " $Le_Valid_To " " $Le_Certificate_Profile "
issue " $Le_Webroot " " $Le_Domain " " $Le_Alt " " $Le_Keylength " " $Le_RealCertPath " " $Le_RealKeyPath " " $Le_RealCACertPath " " $Le_ReloadCmd " " $Le_RealFullChainPath " " $Le_PreHook " " $Le_PostHook " " $Le_RenewHook " " $Le_LocalAddress " " $Le_ChallengeAlias " " $Le_Preferred_Chain " " $Le_Valid_From " " $Le_Valid_To " " $Le_Certificate_Profile " " $Le_ExtKeyUse "
res = " $? "
if [ " $res " != "0" ] ; then
return " $res "
@ -7469,6 +7493,7 @@ _process() {
_valid_from = ""
_valid_to = ""
_certificate_profile = ""
_extended_key_usage = ""
while [ ${# } -gt 0 ] ; do
case " ${ 1 } " in
@ -7864,7 +7889,7 @@ _process() {
shift
; ;
--extended-key-usage)
Le_ExtKeyUs e= " $2 "
_extended_key_usag e= " $2 "
shift
; ;
--ocsp-must-staple | --ocsp)
@ -8081,7 +8106,7 @@ _process() {
uninstall) uninstall " $_nocron " ; ;
upgrade) upgrade ; ;
issue)
issue " $_webroot " " $_domain " " $_altdomains " " $_keylength " " $_cert_file " " $_key_file " " $_ca_file " " $_reloadcmd " " $_fullchain_file " " $_pre_hook " " $_post_hook " " $_renew_hook " " $_local_address " " $_challenge_alias " " $_preferred_chain " " $_valid_from " " $_valid_to " " $_certificate_profile "
issue " $_webroot " " $_domain " " $_altdomains " " $_keylength " " $_cert_file " " $_key_file " " $_ca_file " " $_reloadcmd " " $_fullchain_file " " $_pre_hook " " $_post_hook " " $_renew_hook " " $_local_address " " $_challenge_alias " " $_preferred_chain " " $_valid_from " " $_valid_to " " $_certificate_profile " " $_extended_key_usage "
; ;
deploy)
deploy " $_domain " " $_deploy_hook " " $_ecc "
Tobias Göbel
2 weeks ago
GitHub