|
|
|
@ -23,9 +23,6 @@ _SUB_FOLDERS="$_SUB_FOLDER_DNSAPI $_SUB_FOLDER_DEPLOY $_SUB_FOLDER_NOTIFY" |
|
|
|
CA_LETSENCRYPT_V2="https://acme-v02.api.letsencrypt.org/directory" |
|
|
|
CA_LETSENCRYPT_V2_TEST="https://acme-staging-v02.api.letsencrypt.org/directory" |
|
|
|
|
|
|
|
CA_BUYPASS="https://api.buypass.com/acme/directory" |
|
|
|
CA_BUYPASS_TEST="https://api.test4.buypass.no/acme/directory" |
|
|
|
|
|
|
|
CA_ZEROSSL="https://acme.zerossl.com/v2/DV90" |
|
|
|
_ZERO_EAB_ENDPOINT="https://api.zerossl.com/acme/eab-credentials-email" |
|
|
|
|
|
|
|
@ -35,6 +32,8 @@ CA_SSLCOM_ECC="https://acme.ssl.com/sslcom-dv-ecc" |
|
|
|
CA_GOOGLE="https://dv.acme-v02.api.pki.goog/directory" |
|
|
|
CA_GOOGLE_TEST="https://dv.acme-v02.test-api.pki.goog/directory" |
|
|
|
|
|
|
|
CA_ACTALIS="https://acme-api.actalis.com/acme/directory" |
|
|
|
|
|
|
|
DEFAULT_CA=$CA_ZEROSSL |
|
|
|
DEFAULT_STAGING_CA=$CA_LETSENCRYPT_V2_TEST |
|
|
|
|
|
|
|
@ -42,14 +41,13 @@ CA_NAMES=" |
|
|
|
ZeroSSL.com,zerossl |
|
|
|
LetsEncrypt.org,letsencrypt |
|
|
|
LetsEncrypt.org_test,letsencrypt_test,letsencrypttest |
|
|
|
BuyPass.com,buypass |
|
|
|
BuyPass.com_test,buypass_test,buypasstest |
|
|
|
SSL.com,sslcom |
|
|
|
Google.com,google |
|
|
|
Google.com_test,googletest,google_test |
|
|
|
Actalis.com,actalis.com,actalis |
|
|
|
" |
|
|
|
|
|
|
|
CA_SERVERS="$CA_ZEROSSL,$CA_LETSENCRYPT_V2,$CA_LETSENCRYPT_V2_TEST,$CA_BUYPASS,$CA_BUYPASS_TEST,$CA_SSLCOM_RSA,$CA_GOOGLE,$CA_GOOGLE_TEST" |
|
|
|
CA_SERVERS="$CA_ZEROSSL,$CA_LETSENCRYPT_V2,$CA_LETSENCRYPT_V2_TEST,$CA_SSLCOM_RSA,$CA_GOOGLE,$CA_GOOGLE_TEST,$CA_ACTALIS" |
|
|
|
|
|
|
|
DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)" |
|
|
|
|
|
|
|
@ -180,6 +178,8 @@ _VALIDITY_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Validity" |
|
|
|
|
|
|
|
_DNSCHECK_WIKI="https://github.com/acmesh-official/acme.sh/wiki/dnscheck" |
|
|
|
|
|
|
|
_PROFILESELECTION_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Profile-selection" |
|
|
|
|
|
|
|
_DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead." |
|
|
|
|
|
|
|
_DNS_MANUAL_WARN="It seems that you are using dns manual mode. please take care: $_DNS_MANUAL_ERR" |
|
|
|
@ -4434,6 +4434,7 @@ issue() { |
|
|
|
_preferred_chain="${15}" |
|
|
|
_valid_from="${16}" |
|
|
|
_valid_to="${17}" |
|
|
|
_certificate_profile="${18}" |
|
|
|
|
|
|
|
if [ -z "$_ACME_IS_RENEW" ]; then |
|
|
|
_initpath "$_main_domain" "$_key_length" |
|
|
|
@ -4509,6 +4510,11 @@ issue() { |
|
|
|
else |
|
|
|
_cleardomainconf "Le_Preferred_Chain" |
|
|
|
fi |
|
|
|
if [ "$_certificate_profile" ]; then |
|
|
|
_savedomainconf "Le_Certificate_Profile" "$_certificate_profile" |
|
|
|
else |
|
|
|
_cleardomainconf "Le_Certificate_Profile" |
|
|
|
fi |
|
|
|
|
|
|
|
Le_API="$ACME_DIRECTORY" |
|
|
|
_savedomainconf "Le_API" "$Le_API" |
|
|
|
@ -4641,6 +4647,9 @@ issue() { |
|
|
|
if [ "$_notAfter" ]; then |
|
|
|
_newOrderObj="$_newOrderObj,\"notAfter\": \"$_notAfter\"" |
|
|
|
fi |
|
|
|
if [ "$_certificate_profile" ]; then |
|
|
|
_newOrderObj="$_newOrderObj,\"profile\": \"$_certificate_profile\"" |
|
|
|
fi |
|
|
|
_debug "STEP 1, Ordering a Certificate" |
|
|
|
if ! _send_signed_request "$ACME_NEW_ORDER" "$_newOrderObj}"; then |
|
|
|
_err "Error creating new order." |
|
|
|
@ -5478,10 +5487,6 @@ renew() { |
|
|
|
_info "Switching back to $CA_LETSENCRYPT_V2" |
|
|
|
Le_API="$CA_LETSENCRYPT_V2" |
|
|
|
;; |
|
|
|
"$CA_BUYPASS_TEST") |
|
|
|
_info "Switching back to $CA_BUYPASS" |
|
|
|
Le_API="$CA_BUYPASS" |
|
|
|
;; |
|
|
|
"$CA_GOOGLE_TEST") |
|
|
|
_info "Switching back to $CA_GOOGLE" |
|
|
|
Le_API="$CA_GOOGLE" |
|
|
|
@ -5523,6 +5528,7 @@ renew() { |
|
|
|
Le_PostHook="$(_readdomainconf Le_PostHook)" |
|
|
|
Le_RenewHook="$(_readdomainconf Le_RenewHook)" |
|
|
|
Le_Preferred_Chain="$(_readdomainconf Le_Preferred_Chain)" |
|
|
|
Le_Certificate_Profile="$(_readdomainconf Le_Certificate_Profile)" |
|
|
|
# When renewing from an old version, the empty Le_Keylength means 2048. |
|
|
|
# Note, do not use DEFAULT_DOMAIN_KEY_LENGTH as that value may change over |
|
|
|
# time but an empty value implies 2048 specifically. |
|
|
|
@ -5537,7 +5543,7 @@ renew() { |
|
|
|
_cleardomainconf Le_OCSP_Staple |
|
|
|
fi |
|
|
|
fi |
|
|
|
issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress" "$Le_ChallengeAlias" "$Le_Preferred_Chain" "$Le_Valid_From" "$Le_Valid_To" |
|
|
|
issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress" "$Le_ChallengeAlias" "$Le_Preferred_Chain" "$Le_Valid_From" "$Le_Valid_To" "$Le_Certificate_Profile" |
|
|
|
res="$?" |
|
|
|
if [ "$res" != "0" ]; then |
|
|
|
return "$res" |
|
|
|
@ -5798,7 +5804,7 @@ list() { |
|
|
|
_sep="|" |
|
|
|
if [ "$_raw" ]; then |
|
|
|
if [ -z "$_domain" ]; then |
|
|
|
printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}CA${_sep}Created${_sep}Renew" |
|
|
|
printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Profile${_sep}CA${_sep}Created${_sep}Renew" |
|
|
|
fi |
|
|
|
for di in "${CERT_HOME}"/*.*/; do |
|
|
|
d=$(basename "$di") |
|
|
|
@ -5813,7 +5819,7 @@ list() { |
|
|
|
. "$DOMAIN_CONF" |
|
|
|
_ca="$(_getCAShortName "$Le_API")" |
|
|
|
if [ -z "$_domain" ]; then |
|
|
|
printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$_ca${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr" |
|
|
|
printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$Le_Certificate_Profile${_sep}$_ca${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr" |
|
|
|
else |
|
|
|
if [ "$_domain" = "$d" ]; then |
|
|
|
cat "$DOMAIN_CONF" |
|
|
|
@ -5832,6 +5838,48 @@ list() { |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
list_profiles() { |
|
|
|
_initpath |
|
|
|
_initAPI |
|
|
|
|
|
|
|
_l_server_url="$ACME_DIRECTORY" |
|
|
|
_l_server_name="$(_getCAShortName "$_l_server_url")" |
|
|
|
_info "Fetching profiles from $_l_server_name ($_l_server_url)..." |
|
|
|
|
|
|
|
response=$(_get "$_l_server_url" "" 10) |
|
|
|
if [ "$?" != "0" ]; then |
|
|
|
_err "Failed to connect to CA directory: $_l_server_url" |
|
|
|
return 1 |
|
|
|
fi |
|
|
|
|
|
|
|
normalized_response=$(echo "$response" | _normalizeJson) |
|
|
|
profiles_json=$(echo "$normalized_response" | _egrep_o '"profiles" *: *\{[^\}]*\}') |
|
|
|
|
|
|
|
if [ -z "$profiles_json" ]; then |
|
|
|
_info "The CA '$_l_server_name' does not publish certificate profiles via its directory endpoint." |
|
|
|
return 0 |
|
|
|
fi |
|
|
|
|
|
|
|
# Strip the outer layer to get the key-value pairs |
|
|
|
profiles_kv=$(echo "$profiles_json" | sed 's/"profiles" *: *{//' | sed 's/}$//' | tr ',' '\n') |
|
|
|
|
|
|
|
printf "\n%-15s %s\n" "name" "info" |
|
|
|
printf -- "--------------------------------------------------------------------\n" |
|
|
|
|
|
|
|
_old_IFS="$IFS" |
|
|
|
IFS=' |
|
|
|
' |
|
|
|
for pair in $profiles_kv; do |
|
|
|
# Trim quotes and whitespace |
|
|
|
_name=$(echo "$pair" | cut -d: -f1 | tr -d '" \t') |
|
|
|
_info_url=$(echo "$pair" | cut -d: -f2- | sed 's/^ *//' | tr -d '"') |
|
|
|
printf "%-15s %s\n" "$_name" "$_info_url" |
|
|
|
done |
|
|
|
IFS="$_old_IFS" |
|
|
|
|
|
|
|
return 0 |
|
|
|
} |
|
|
|
|
|
|
|
_deploy() { |
|
|
|
_d="$1" |
|
|
|
_hooks="$2" |
|
|
|
@ -7010,6 +7058,9 @@ Parameters: |
|
|
|
If no match, the default offered chain will be used. (default: empty) |
|
|
|
See: $_PREFERRED_CHAIN_WIKI |
|
|
|
|
|
|
|
--cert-profile, --certificate-profile <profile> If the CA offers profiles, select the desired profile |
|
|
|
See: $_PROFILESELECTION_WIKI |
|
|
|
|
|
|
|
--valid-to <date-time> Request the NotAfter field of the cert. |
|
|
|
See: $_VALIDITY_WIKI |
|
|
|
--valid-from <date-time> Request the NotBefore field of the cert. |
|
|
|
@ -7385,6 +7436,7 @@ _process() { |
|
|
|
_preferred_chain="" |
|
|
|
_valid_from="" |
|
|
|
_valid_to="" |
|
|
|
_certificate_profile="" |
|
|
|
while [ ${#} -gt 0 ]; do |
|
|
|
case "${1}" in |
|
|
|
|
|
|
|
@ -7488,6 +7540,9 @@ _process() { |
|
|
|
--set-default-chain) |
|
|
|
_CMD="setdefaultchain" |
|
|
|
;; |
|
|
|
--list-profiles) |
|
|
|
_CMD="list_profiles" |
|
|
|
;; |
|
|
|
-d | --domain) |
|
|
|
_dvalue="$2" |
|
|
|
|
|
|
|
@ -7703,6 +7758,10 @@ _process() { |
|
|
|
_valid_to="$2" |
|
|
|
shift |
|
|
|
;; |
|
|
|
--certificate-profile | --cert-profile) |
|
|
|
_certificate_profile="$2" |
|
|
|
shift |
|
|
|
;; |
|
|
|
--httpport) |
|
|
|
_httpport="$2" |
|
|
|
Le_HTTPPort="$_httpport" |
|
|
|
@ -7978,7 +8037,7 @@ _process() { |
|
|
|
uninstall) uninstall "$_nocron" ;; |
|
|
|
upgrade) upgrade ;; |
|
|
|
issue) |
|
|
|
issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias" "$_preferred_chain" "$_valid_from" "$_valid_to" |
|
|
|
issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias" "$_preferred_chain" "$_valid_from" "$_valid_to" "$_certificate_profile" |
|
|
|
;; |
|
|
|
deploy) |
|
|
|
deploy "$_domain" "$_deploy_hook" "$_ecc" |
|
|
|
@ -8049,6 +8108,9 @@ _process() { |
|
|
|
setdefaultchain) |
|
|
|
setdefaultchain "$_preferred_chain" |
|
|
|
;; |
|
|
|
list_profiles) |
|
|
|
list_profiles |
|
|
|
;; |
|
|
|
*) |
|
|
|
if [ "$_CMD" ]; then |
|
|
|
_err "Invalid command: $_CMD" |
|
|
|
|
Alexis Savin
2 days ago
GitHub