techknowlogick
6 days ago
committed by
GitHub
GitHub
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 509 additions and 12 deletions
-
46README.md
-
105acme.sh
-
116httpapi/README.md
-
119httpapi/http_local.sh
-
135httpapi/http_scp.sh
@ -0,0 +1,116 @@ |
|||
# HTTP API Validation Plugin |
|||
|
|||
This directory contains plugins for acme.sh's HTTP API validation system. These plugins allow you to deploy ACME HTTP-01 challenge files to remote servers using various methods without requiring direct filesystem access. |
|||
|
|||
## Usage |
|||
|
|||
To use an HTTP API validation plugin, there are two ways to specify it: |
|||
|
|||
### Method 1: Using the `--webroot` parameter with the plugin name prefix: |
|||
|
|||
```bash |
|||
acme.sh --issue -d example.com --webroot http_scp |
|||
``` |
|||
|
|||
### Method 2: Using the dedicated `--http-api` parameter: |
|||
|
|||
```bash |
|||
acme.sh --issue -d example.com --http-api http_scp |
|||
``` |
|||
|
|||
The second method is preferred as it's more explicit about the validation method being used. |
|||
|
|||
## Available Plugins |
|||
|
|||
- `http_scp`: Deploy challenge files via SCP to a remote web server |
|||
- `http_local`: Deploy challenge files to a local directory (for testing) |
|||
|
|||
## Using HTTP API Plugins |
|||
|
|||
Before using an HTTP API plugin, you need to set the required environment variables: |
|||
|
|||
```bash |
|||
# For SCP plugin |
|||
export HTTP_SCP_USER="username" |
|||
export HTTP_SCP_HOST="example.com" |
|||
export HTTP_SCP_PATH="/var/www/html" |
|||
# Optional |
|||
export HTTP_SCP_PORT="22" |
|||
export HTTP_SCP_KEY="/path/to/ssh/key" |
|||
|
|||
# For Local plugin |
|||
export HTTP_LOCAL_DIR="/var/www/html" |
|||
export HTTP_LOCAL_MKDIR="true" # Create directory if it doesn't exist |
|||
export HTTP_LOCAL_VERIFY="true" # Simple curl verification |
|||
|
|||
# Then issue your certificate |
|||
acme.sh --issue -d example.com --http-api http_scp |
|||
``` |
|||
|
|||
These environment variables will be saved to your account configuration for future use. |
|||
|
|||
## Creating Your Own Plugin |
|||
|
|||
Plugins are shell scripts with at least two functions: |
|||
|
|||
1. `<plugin-name>_deploy`: Deploy the challenge file |
|||
2. `<plugin-name>_rm`: Remove the challenge file |
|||
|
|||
Here's a minimal example: |
|||
|
|||
```bash |
|||
#!/usr/bin/env sh |
|||
|
|||
# Deploy the challenge file |
|||
http_myplugin_deploy() { |
|||
local domain="$1" |
|||
local token="$2" |
|||
local keyauthorization="$3" |
|||
|
|||
# Deploy the challenge file to your web server |
|||
# ... |
|||
|
|||
return 0 # Return 0 for success, non-zero for failure |
|||
} |
|||
|
|||
# Remove the challenge file |
|||
http_myplugin_rm() { |
|||
local domain="$1" |
|||
local token="$2" |
|||
|
|||
# Remove the challenge file |
|||
# ... |
|||
|
|||
return 0 # Return 0 for success, non-zero for failure |
|||
} |
|||
``` |
|||
|
|||
## Plugin Configuration |
|||
|
|||
Typically, plugins will need configuration settings like server addresses, credentials, etc. These should be provided as environment variables: |
|||
|
|||
```bash |
|||
export HTTP_MYPLUGIN_HOST="example.com" |
|||
export HTTP_MYPLUGIN_USER="username" |
|||
export HTTP_MYPLUGIN_PASSWORD="password" |
|||
# etc... |
|||
|
|||
acme.sh --issue -d example.com --http-api http_myplugin |
|||
``` |
|||
|
|||
Alternatively, you can save these values in your acme.sh account configuration file for future use. |
|||
|
|||
## Example: Using the SCP Plugin |
|||
|
|||
```bash |
|||
# Set required environment variables |
|||
export HTTP_SCP_USER="username" |
|||
export HTTP_SCP_HOST="remote.server.com" |
|||
export HTTP_SCP_PATH="/var/www/html" |
|||
# Optional: |
|||
export HTTP_SCP_PORT="22" |
|||
export HTTP_SCP_KEY="/path/to/ssh/key" |
|||
|
|||
# Issue certificate using SCP validation |
|||
acme.sh --issue -d example.com --http-api http_scp |
|||
``` |
|||
@ -0,0 +1,119 @@ |
|||
#!/usr/bin/env sh |
|||
|
|||
http_local_info='Local filesystem HTTP-01 validation plugin |
|||
Site: Local filesystem |
|||
Docs: github.com/acmesh-official/acme.sh/wiki/HTTP-API |
|||
Options: |
|||
HTTP_LOCAL_DIR Directory to copy challenge to |
|||
HTTP_LOCAL_MKDIR Create directory if it doesnt exist (true/false) |
|||
HTTP_LOCAL_VERIFY Verify challenge file is accessible via HTTPS (true/false, default: false) |
|||
' |
|||
|
|||
#Here we implement local filesystem-based http validation |
|||
|
|||
#Returns 0 means success, otherwise error. |
|||
|
|||
######## Public functions ##################### |
|||
|
|||
#Usage: http_local_deploy domain token keyauthorization |
|||
http_local_deploy() { |
|||
_cdomain="$1" |
|||
_ctoken="$2" |
|||
_ckey="$3" |
|||
|
|||
_debug _cdomain "$_cdomain" |
|||
_debug _ctoken "$_ctoken" |
|||
|
|||
_getconfig |
|||
if [ "$?" != "0" ]; then |
|||
return 1 |
|||
fi |
|||
|
|||
_info "Deploying challenge file to local directory" |
|||
_wellknown_path="$HTTP_LOCAL_DIR/.well-known/acme-challenge" |
|||
|
|||
# Create directory if needed |
|||
if [ "$HTTP_LOCAL_MKDIR" = "true" ]; then |
|||
_debug "Creating directory $_wellknown_path" |
|||
mkdir -p "$_wellknown_path" |
|||
fi |
|||
|
|||
# Create temporary file with token content |
|||
_tempcontent="$(_mktemp)" |
|||
if [ "$?" != "0" ]; then |
|||
_err "Failed to create temporary file" |
|||
return 1 |
|||
fi |
|||
|
|||
echo "$_ckey" > "$_tempcontent" |
|||
|
|||
# Copy challenge file |
|||
_info "Copying challenge file" |
|||
if ! cp "$_tempcontent" "$_wellknown_path/$_ctoken"; then |
|||
_err "Failed to copy challenge file" |
|||
rm -f "$_tempcontent" |
|||
return 1 |
|||
fi |
|||
|
|||
rm -f "$_tempcontent" |
|||
|
|||
# Verify the file is accessible via HTTPS if enabled |
|||
if [ "$HTTP_LOCAL_VERIFY" != "false" ]; then |
|||
_info "Verifying challenge file is accessible via HTTPS" |
|||
_verify_url="https://$_cdomain/.well-known/acme-challenge/$_ctoken" |
|||
_debug "Verifying URL: $_verify_url" |
|||
|
|||
# Try to access the file with curl, ignoring SSL certificate verification |
|||
if ! curl -k -s -o /dev/null -w "%{http_code}" "$_verify_url" | grep -q "200"; then |
|||
_err "Challenge file is not accessible via HTTPS at $_verify_url" |
|||
return 1 |
|||
fi |
|||
else |
|||
_debug "Skipping HTTPS verification as HTTP_LOCAL_VERIFY is set to false" |
|||
fi |
|||
|
|||
return 0 |
|||
} |
|||
|
|||
#Usage: http_local_rm domain token |
|||
http_local_rm() { |
|||
_cdomain="$1" |
|||
_ctoken="$2" |
|||
|
|||
_debug _cdomain "$_cdomain" |
|||
_debug _ctoken "$_ctoken" |
|||
|
|||
_getconfig |
|||
if [ "$?" != "0" ]; then |
|||
return 1 |
|||
fi |
|||
|
|||
_info "Removing challenge file from local directory" |
|||
_wellknown_path="$HTTP_LOCAL_DIR/.well-known/acme-challenge" |
|||
|
|||
# Remove challenge file |
|||
_info "Removing challenge file" |
|||
if ! rm -f "$_wellknown_path/$_ctoken"; then |
|||
_err "Failed to remove challenge file" |
|||
return 1 |
|||
fi |
|||
|
|||
return 0 |
|||
} |
|||
|
|||
_getconfig() { |
|||
if [ -z "$HTTP_LOCAL_DIR" ]; then |
|||
_err "HTTP_LOCAL_DIR is not defined" |
|||
return 1 |
|||
fi |
|||
|
|||
if [ -z "$HTTP_LOCAL_MKDIR" ]; then |
|||
HTTP_LOCAL_MKDIR="false" |
|||
fi |
|||
|
|||
if [ -z "$HTTP_LOCAL_VERIFY" ]; then |
|||
HTTP_LOCAL_VERIFY="false" |
|||
fi |
|||
|
|||
return 0 |
|||
} |
|||
@ -0,0 +1,135 @@ |
|||
#!/usr/bin/env sh |
|||
|
|||
http_scp_info='SCP HTTP-01 validation plugin |
|||
Site: github.com/acmesh-official/acme.sh/wiki/HTTP-API |
|||
Docs: github.com/acmesh-official/acme.sh/wiki/HTTP-API#http_scp |
|||
Options: |
|||
HTTP_SCP_USER Username for SSH/SCP |
|||
HTTP_SCP_HOST Remote host |
|||
HTTP_SCP_PATH Remote webroot path |
|||
HTTP_SCP_PORT SSH port (optional) |
|||
HTTP_SCP_KEY SSH private key path (optional) |
|||
' |
|||
|
|||
#Here we implement scp-based http validation |
|||
|
|||
#Returns 0 means success, otherwise error. |
|||
|
|||
######## Public functions ##################### |
|||
|
|||
#Usage: http_scp_deploy domain token keyauthorization |
|||
http_scp_deploy() { |
|||
_cdomain="$1" |
|||
_ctoken="$2" |
|||
_ckey="$3" |
|||
|
|||
_debug _cdomain "$_cdomain" |
|||
_debug _ctoken "$_ctoken" |
|||
|
|||
_getconfig |
|||
if [ "$?" != "0" ]; then |
|||
return 1 |
|||
fi |
|||
|
|||
_info "Deploying challenge file to remote server using SCP" |
|||
_wellknown_path="$HTTP_SCP_PATH/.well-known/acme-challenge" |
|||
|
|||
# Create temporary file with token content |
|||
_tempcontent="$(_mktemp)" |
|||
if [ "$?" != "0" ]; then |
|||
_err "Failed to create temporary file" |
|||
return 1 |
|||
fi |
|||
|
|||
echo "$_ckey" > "$_tempcontent" |
|||
|
|||
# Prepare SSH options |
|||
_scp_options="" |
|||
if [ -n "$HTTP_SCP_KEY" ]; then |
|||
_scp_options="$_scp_options -i $HTTP_SCP_KEY" |
|||
fi |
|||
|
|||
if [ -n "$HTTP_SCP_PORT" ]; then |
|||
_scp_options="$_scp_options -P $HTTP_SCP_PORT" |
|||
fi |
|||
_scp_options="$_scp_options -o StrictHostKeyChecking=no" |
|||
|
|||
# Create challenge directory if it doesn't exist |
|||
_info "Creating challenge directory on remote server" |
|||
# shellcheck disable=SC2029 # We intentionally want client-side expansion of _wellknown_path |
|||
if ! ssh $HTTP_SCP_USER@$HTTP_SCP_HOST $_scp_options "mkdir -p ${_wellknown_path}"; then |
|||
_err "Failed to create challenge directory on remote server" |
|||
rm -f "$_tempcontent" |
|||
return 1 |
|||
fi |
|||
|
|||
# Upload challenge file |
|||
_info "Uploading challenge file" |
|||
if ! scp $_scp_options "$_tempcontent" $HTTP_SCP_USER@$HTTP_SCP_HOST:"${_wellknown_path}/${_ctoken}"; then |
|||
_err "Failed to upload challenge file" |
|||
rm -f "$_tempcontent" |
|||
return 1 |
|||
fi |
|||
|
|||
rm -f "$_tempcontent" |
|||
return 0 |
|||
} |
|||
|
|||
#Usage: http_scp_rm domain token |
|||
http_scp_rm() { |
|||
_cdomain="$1" |
|||
_ctoken="$2" |
|||
|
|||
_debug _cdomain "$_cdomain" |
|||
_debug _ctoken "$_ctoken" |
|||
|
|||
_getconfig |
|||
if [ "$?" != "0" ]; then |
|||
return 1 |
|||
fi |
|||
|
|||
_info "Removing challenge file from remote server" |
|||
_wellknown_path="$HTTP_SCP_PATH/.well-known/acme-challenge" |
|||
|
|||
# Prepare SSH options |
|||
_scp_options="" |
|||
if [ -n "$HTTP_SCP_KEY" ]; then |
|||
_scp_options="$_scp_options -i $HTTP_SCP_KEY" |
|||
fi |
|||
|
|||
if [ -n "$HTTP_SCP_PORT" ]; then |
|||
_scp_options="$_scp_options -p $HTTP_SCP_PORT" |
|||
else |
|||
_scp_options="$_scp_options -p 22" |
|||
fi |
|||
_scp_options="$_scp_options -o StrictHostKeyChecking=no" |
|||
|
|||
# Remove challenge file |
|||
_info "Removing challenge file from remote server" |
|||
# shellcheck disable=SC2029 # We intentionally want client-side expansion of _wellknown_path and _ctoken |
|||
if ! ssh $HTTP_SCP_USER@$HTTP_SCP_HOST $_scp_options "rm -f ${_wellknown_path}/${_ctoken}"; then |
|||
_err "Failed to remove challenge file from remote server" |
|||
return 1 |
|||
fi |
|||
|
|||
return 0 |
|||
} |
|||
|
|||
_getconfig() { |
|||
if [ -z "$HTTP_SCP_USER" ]; then |
|||
_err "HTTP_SCP_USER is not defined" |
|||
return 1 |
|||
fi |
|||
|
|||
if [ -z "$HTTP_SCP_HOST" ]; then |
|||
_err "HTTP_SCP_HOST is not defined" |
|||
return 1 |
|||
fi |
|||
|
|||
if [ -z "$HTTP_SCP_PATH" ]; then |
|||
_err "HTTP_SCP_PATH is not defined" |
|||
return 1 |
|||
fi |
|||
|
|||
return 0 |
|||
} |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue