diff --git a/.gitattributesdb b/.gitattributesdb index 7363e2b..766c79b 100644 --- a/.gitattributesdb +++ b/.gitattributesdb @@ -533,9 +533,6 @@ c2Jpbg== 1767688090.000000000 1767688090.000000000 root:root 0777 - - b3B0L3NiaW4vY3JvbmpvYi13YXJuLWdpdC1zdGF0dXM= 1758221607.000000000 1757591137.000000000 root:root 0755 - - b3B0 1771515169.961748163 1771501851.000000000 root:root 0755 - - c2Jpbg== 1767688090.000000000 1767688090.000000000 root:root 0777 - - -b3B0L3NiaW4vZGVoeWRyYXRlZA== - - -b3B0 1771515169.961748163 1771501851.000000000 root:root 0755 - - -c2Jpbg== 1767688090.000000000 1767688090.000000000 root:root 0777 - - b3B0L3NiaW4vcHVzaG92ZXItY2xpZW50 1758224526.000000000 1758224526.000000000 root:root 0755 - - b3B0 1771515169.961748163 1771501851.000000000 root:root 0755 - - c2Jpbg== 1767688090.000000000 1767688090.000000000 root:root 0777 - - diff --git a/opt/sbin/dehydrated b/opt/sbin/dehydrated deleted file mode 100755 index 28c4711..0000000 --- a/opt/sbin/dehydrated +++ /dev/null @@ -1,2539 +0,0 @@ -#!/usr/bin/env bash - -# dehydrated by lukas2511 -# Source: https://dehydrated.io -# -# This script is licensed under The MIT License (see LICENSE for more information). - -set -e -set -u -set -o pipefail -[[ -n "${ZSH_VERSION:-}" ]] && set -o SH_WORD_SPLIT && set +o FUNCTION_ARGZERO && set -o NULL_GLOB && set -o noglob -[[ -z "${ZSH_VERSION:-}" ]] && shopt -s nullglob && set -f - -umask 077 # paranoid umask, we're creating private keys - -# Close weird external file descriptors -exec 3>&- -exec 4>&- - -VERSION="0.7.3" - -# Find directory in which this script is stored by traversing all symbolic links -SOURCE="${0}" -while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symlink - DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )" - SOURCE="$(readlink "$SOURCE")" - [[ $SOURCE != /* ]] && SOURCE="$DIR/$SOURCE" # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located -done -SCRIPTDIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )" - -BASEDIR="${SCRIPTDIR}" -ORIGARGS=("${@}") - -noglob_set() { - if [[ -n "${ZSH_VERSION:-}" ]]; then - set +o noglob - else - set +f - fi -} - -noglob_clear() { - if [[ -n "${ZSH_VERSION:-}" ]]; then - set -o noglob - else - set -f - fi -} - -# Generate json.sh path matching string -json_path() { - if [ ! "${1}" = "-p" ]; then - printf '"%s"' "${1}" - else - printf '%s' "${2}" - fi -} - -# Get string value from json dictionary -get_json_string_value() { - local filter - filter="$(printf 's/.*\[%s\][[:space:]]*"\([^"]*\)"/\\1/p' "$(json_path "${1:-}" "${2:-}")")" - sed -n "${filter}" -} - -# Get array values from json dictionary -get_json_array_values() { - grep -E '^\['"$(json_path "${1:-}" "${2:-}")"',[0-9]*\]' | sed -e 's/\[[^\]*\][[:space:]]*//g' -e 's/^"//' -e 's/"$//' -} - -# Get sub-dictionary from json -get_json_dict_value() { - local filter - filter="$(printf 's/.*\[%s\][[:space:]]*\(.*\)/\\1/p' "$(json_path "${1:-}" "${2:-}")")" - sed -n "${filter}" | jsonsh -} - -# Get integer value from json -get_json_int_value() { - local filter - filter="$(printf 's/.*\[%s\][[:space:]]*\([^"]*\)/\\1/p' "$(json_path "${1:-}" "${2:-}")")" - sed -n "${filter}" -} - -# Get boolean value from json -get_json_bool_value() { - local filter - filter="$(printf 's/.*\[%s\][[:space:]]*\([^"]*\)/\\1/p' "$(json_path "${1:-}" "${2:-}")")" - sed -n "${filter}" -} - -# JSON.sh JSON-parser -# Modified from https://github.com/dominictarr/JSON.sh -# Original Copyright (c) 2011 Dominic Tarr -# Licensed under The MIT License -jsonsh() { - - throw() { - echo "$*" >&2 - exit 1 - } - - awk_egrep () { - local pattern_string=$1 - - awk '{ - while ($0) { - start=match($0, pattern); - token=substr($0, start, RLENGTH); - print token; - $0=substr($0, start+RLENGTH); - } - }' pattern="$pattern_string" - } - - tokenize () { - local GREP - local ESCAPE - local CHAR - - if echo "test string" | grep -Eao --color=never "test" >/dev/null 2>&1 - then - GREP='grep -Eao --color=never' - else - GREP='grep -Eao' - fi - - # shellcheck disable=SC2196 - if echo "test string" | grep -Eao "test" >/dev/null 2>&1 - then - ESCAPE='(\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})' - CHAR='[^[:cntrl:]"\\]' - else - GREP=awk_egrep - ESCAPE='(\\\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})' - CHAR='[^[:cntrl:]"\\\\]' - fi - - local STRING="\"$CHAR*($ESCAPE$CHAR*)*\"" - local NUMBER='-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?' - local KEYWORD='null|false|true' - local SPACE='[[:space:]]+' - - # Force zsh to expand $A into multiple words - local is_wordsplit_disabled - is_wordsplit_disabled="$(unsetopt 2>/dev/null | grep -c '^shwordsplit$' || true)" - if [ "${is_wordsplit_disabled}" != "0" ]; then setopt shwordsplit; fi - $GREP "$STRING|$NUMBER|$KEYWORD|$SPACE|." | grep -Ev "^$SPACE$" - if [ "${is_wordsplit_disabled}" != "0" ]; then unsetopt shwordsplit; fi - } - - parse_array () { - local index=0 - local ary='' - read -r token - case "$token" in - ']') ;; - *) - while : - do - parse_value "$1" "$index" - index=$((index+1)) - ary="$ary""$value" - read -r token - case "$token" in - ']') break ;; - ',') ary="$ary," ;; - *) throw "EXPECTED , or ] GOT ${token:-EOF}" ;; - esac - read -r token - done - ;; - esac - value=$(printf '[%s]' "$ary") || value= - : - } - - parse_object () { - local key - local obj='' - read -r token - case "$token" in - '}') ;; - *) - while : - do - case "$token" in - '"'*'"') key=$token ;; - *) throw "EXPECTED string GOT ${token:-EOF}" ;; - esac - read -r token - case "$token" in - ':') ;; - *) throw "EXPECTED : GOT ${token:-EOF}" ;; - esac - read -r token - parse_value "$1" "$key" - obj="$obj$key:$value" - read -r token - case "$token" in - '}') break ;; - ',') obj="$obj," ;; - *) throw "EXPECTED , or } GOT ${token:-EOF}" ;; - esac - read -r token - done - ;; - esac - value=$(printf '{%s}' "$obj") || value= - : - } - - parse_value () { - local jpath="${1:+$1,}${2:-}" - case "$token" in - '{') parse_object "$jpath" ;; - '[') parse_array "$jpath" ;; - # At this point, the only valid single-character tokens are digits. - ''|[!0-9]) throw "EXPECTED value GOT ${token:-EOF}" ;; - *) value="${token//\\\///}" - # replace solidus ("\/") in json strings with normalized value: "/" - ;; - esac - [ "$value" = '' ] && return - [ -z "$jpath" ] && return # do not print head - - printf "[%s]\t%s\n" "$jpath" "$value" - : - } - - parse () { - read -r token - parse_value - read -r token || true - case "$token" in - '') ;; - *) throw "EXPECTED EOF GOT $token" ;; - esac - } - - tokenize | parse -} - -# Convert IP addresses to their reverse dns variants. -# Used for ALPN certs as validation for IPs uses this in SNI since IPs aren't allowed there. -ip_to_ptr() { - ip="$(cat)" - if [[ "${ip}" =~ : ]]; then - printf "%sip6.arpa" "$(printf "%s" "${ip}" | awk -F: 'BEGIN {OFS=""; }{addCount = 9 - NF; for(i=1; i<=NF;i++){if(length($i) == 0){ for(j=1;j<=addCount;j++){$i = ($i "0000");} } else { $i = substr(("0000" $i), length($i)+5-4);}}; print}' | rev | sed -e "s/./&./g")" - else - printf "%s.in-addr.arpa" "$(printf "%s" "${ip}" | awk -F. '{print $4"."$3"." $2"."$1}')" - fi -} - -# Create (identifiable) temporary files -_mktemp() { - mktemp "${TMPDIR:-/tmp}/dehydrated-XXXXXX" -} - -# Check for script dependencies -check_dependencies() { - # look for required binaries - for binary in grep mktemp diff sed awk curl cut head tail hexdump; do - bin_path="$(command -v "${binary}" 2>/dev/null)" || _exiterr "This script requires ${binary}." - [[ -x "${bin_path}" ]] || _exiterr "${binary} found in PATH but it's not executable" - done - - # just execute some dummy and/or version commands to see if required tools are actually usable - "${OPENSSL}" version > /dev/null 2>&1 || _exiterr "This script requires an openssl binary." - _sed "" < /dev/null > /dev/null 2>&1 || _exiterr "This script requires sed with support for extended (modern) regular expressions." - - # curl returns with an error code in some ancient versions so we have to catch that - set +e - CURL_VERSION="$(curl -V 2>&1 | head -n1 | awk '{print $2}')" - set -e -} - -store_configvars() { - __KEY_ALGO="${KEY_ALGO}" - __OCSP_MUST_STAPLE="${OCSP_MUST_STAPLE}" - __OCSP_FETCH="${OCSP_FETCH}" - __OCSP_DAYS="${OCSP_DAYS}" - __PRIVATE_KEY_RENEW="${PRIVATE_KEY_RENEW}" - __PRIVATE_KEY_ROLLOVER="${PRIVATE_KEY_ROLLOVER}" - __KEYSIZE="${KEYSIZE}" - __CHALLENGETYPE="${CHALLENGETYPE}" - __HOOK="${HOOK}" - __PREFERRED_CHAIN="${PREFERRED_CHAIN}" - __WELLKNOWN="${WELLKNOWN}" - __HOOK_CHAIN="${HOOK_CHAIN}" - __OPENSSL_CNF="${OPENSSL_CNF}" - __RENEW_DAYS="${RENEW_DAYS}" - __IP_VERSION="${IP_VERSION}" - __ACME_PROFILE="${ACME_PROFILE}" - __ORDER_TIMEOUT=${ORDER_TIMEOUT} - __VALIDATION_TIMEOUT=${VALIDATION_TIMEOUT} - __KEEP_GOING=${KEEP_GOING} -} - -reset_configvars() { - KEY_ALGO="${__KEY_ALGO}" - OCSP_MUST_STAPLE="${__OCSP_MUST_STAPLE}" - OCSP_FETCH="${__OCSP_FETCH}" - OCSP_DAYS="${__OCSP_DAYS}" - PRIVATE_KEY_RENEW="${__PRIVATE_KEY_RENEW}" - PRIVATE_KEY_ROLLOVER="${__PRIVATE_KEY_ROLLOVER}" - KEYSIZE="${__KEYSIZE}" - CHALLENGETYPE="${__CHALLENGETYPE}" - HOOK="${__HOOK}" - PREFERRED_CHAIN="${__PREFERRED_CHAIN}" - WELLKNOWN="${__WELLKNOWN}" - HOOK_CHAIN="${__HOOK_CHAIN}" - OPENSSL_CNF="${__OPENSSL_CNF}" - RENEW_DAYS="${__RENEW_DAYS}" - IP_VERSION="${__IP_VERSION}" - ACME_PROFILE="${__ACME_PROFILE}" - ORDER_TIMEOUT=${__ORDER_TIMEOUT} - VALIDATION_TIMEOUT=${__VALIDATION_TIMEOUT} - KEEP_GOING="${__KEEP_GOING}" -} - -hookscript_bricker_hook() { - # Hook scripts should ignore any hooks they don't know. - # Calling a random hook to make this clear to the hook script authors... - if [[ -n "${HOOK}" ]]; then - "${HOOK}" "this_hookscript_is_broken__dehydrated_is_working_fine__please_ignore_unknown_hooks_in_your_script" || _exiterr "Please check your hook script, it should exit cleanly without doing anything on unknown/new hooks." - fi -} - -# verify configuration values -verify_config() { - [[ "${CHALLENGETYPE}" == "http-01" || "${CHALLENGETYPE}" == "dns-01" || "${CHALLENGETYPE}" == "tls-alpn-01" ]] || _exiterr "Unknown challenge type ${CHALLENGETYPE}... cannot continue." - if [[ "${COMMAND:-}" =~ sign_domains|sign_csr ]]; then - if [[ "${CHALLENGETYPE}" = "dns-01" ]] && [[ -z "${HOOK}" ]]; then - _exiterr "Challenge type dns-01 needs a hook script for deployment... cannot continue." - fi - if [[ "${CHALLENGETYPE}" = "http-01" ]] && [[ ! -d "${WELLKNOWN}" ]]; then - _exiterr "WELLKNOWN directory doesn't exist, please create ${WELLKNOWN} and set appropriate permissions." - fi - fi - [[ "${KEY_ALGO}" == "rsa" || "${KEY_ALGO}" == "prime256v1" || "${KEY_ALGO}" == "secp384r1" || "${KEY_ALGO}" == "secp521r1" ]] || _exiterr "Unknown public key algorithm ${KEY_ALGO}... cannot continue." - if [[ -n "${IP_VERSION}" ]]; then - [[ "${IP_VERSION}" = "4" || "${IP_VERSION}" = "6" ]] || _exiterr "Unknown IP version ${IP_VERSION}... cannot continue." - fi - [[ "${API}" == "auto" || "${API}" == "1" || "${API}" == "2" ]] || _exiterr "Unsupported API version defined in config: ${API}" - [[ "${OCSP_DAYS}" =~ ^[0-9]+$ ]] || _exiterr "OCSP_DAYS must be a number" - [[ "${ORDER_TIMEOUT}" =~ ^[0-9]+$ ]] || _exiterr "ORDER_TIMEOUT must be a number" - [[ "${VALIDATION_TIMEOUT}" =~ ^[0-9]+$ ]] || _exiterr "VALIDATION_TIMEOUT must be a number" -} - -# Setup default config values, search for and load configuration files -load_config() { - # Check for config in various locations - if [[ -z "${CONFIG:-}" ]]; then - for check_config in "/etc/dehydrated" "/usr/local/etc/dehydrated" "${PWD}" "${SCRIPTDIR}"; do - if [[ -f "${check_config}/config" ]]; then - BASEDIR="${check_config}" - CONFIG="${check_config}/config" - break - fi - done - fi - - # Preset - CA_ZEROSSL="https://acme.zerossl.com/v2/DV90" - CA_LETSENCRYPT="https://acme-v02.api.letsencrypt.org/directory" - CA_LETSENCRYPT_TEST="https://acme-staging-v02.api.letsencrypt.org/directory" - CA_BUYPASS="https://api.buypass.com/acme/directory" - CA_BUYPASS_TEST="https://api.test4.buypass.no/acme/directory" - CA_GOOGLE="https://dv.acme-v02.api.pki.goog/directory" - CA_GOOGLE_TEST="https://dv.acme-v02.test-api.pki.goog/directory" - - # Default values - CA="letsencrypt" - OLDCA= - CERTDIR= - ALPNCERTDIR= - ACCOUNTDIR= - ACCOUNT_KEYSIZE="4096" - ACCOUNT_KEY_ALGO=rsa - CHALLENGETYPE="http-01" - CONFIG_D= - CURL_OPTS= - DOMAINS_D= - DOMAINS_TXT= - HOOK= - PREFERRED_CHAIN= - HOOK_CHAIN="no" - RENEW_DAYS="32" - KEYSIZE="4096" - WELLKNOWN= - PRIVATE_KEY_RENEW="yes" - PRIVATE_KEY_ROLLOVER="no" - KEY_ALGO=secp384r1 - OPENSSL=openssl - OPENSSL_CNF= - CONTACT_EMAIL= - LOCKFILE= - OCSP_MUST_STAPLE="no" - OCSP_FETCH="no" - OCSP_DAYS=5 - IP_VERSION= - CHAINCACHE= - AUTO_CLEANUP="no" - AUTO_CLEANUP_DELETE="no" - DEHYDRATED_USER= - DEHYDRATED_GROUP= - API="auto" - ACME_PROFILE="" - ORDER_TIMEOUT=0 - VALIDATION_TIMEOUT=0 - KEEP_GOING="no" - - if [[ -z "${CONFIG:-}" ]]; then - echo "#" >&2 - echo "# !! WARNING !! No main config file found, using default config!" >&2 - echo "#" >&2 - elif [[ -f "${CONFIG}" ]]; then - echo "# INFO: Using main config file ${CONFIG}" - BASEDIR="$(dirname "${CONFIG}")" - # shellcheck disable=SC1090 - . "${CONFIG}" - else - _exiterr "Specified config file doesn't exist." - fi - - if [[ -n "${CONFIG_D}" ]]; then - if [[ ! -d "${CONFIG_D}" ]]; then - _exiterr "The path ${CONFIG_D} specified for CONFIG_D does not point to a directory." - fi - - # Allow globbing - noglob_set - - for check_config_d in "${CONFIG_D}"/*.sh; do - if [[ -f "${check_config_d}" ]] && [[ -r "${check_config_d}" ]]; then - echo "# INFO: Using additional config file ${check_config_d}" - # shellcheck disable=SC1090 - . "${check_config_d}" - else - _exiterr "Specified additional config ${check_config_d} is not readable or not a file at all." - fi - done - - # Disable globbing - noglob_clear - fi - - # Check for missing dependencies - check_dependencies - - has_sudo() { - command -v sudo > /dev/null 2>&1 || _exiterr "DEHYDRATED_USER set but sudo not available. Please install sudo." - } - - # Check if we are running & are allowed to run as root - if [[ -n "$DEHYDRATED_USER" ]]; then - command -v getent > /dev/null 2>&1 || _exiterr "DEHYDRATED_USER set but getent not available. Please install getent." - - TARGET_UID="$(getent passwd "${DEHYDRATED_USER}" | cut -d':' -f3)" || _exiterr "DEHYDRATED_USER ${DEHYDRATED_USER} is invalid" - if [[ -z "${DEHYDRATED_GROUP}" ]]; then - if [[ "${EUID}" != "${TARGET_UID}" ]]; then - echo "# INFO: Running $0 as ${DEHYDRATED_USER}" - has_sudo && exec sudo -u "${DEHYDRATED_USER}" "${0}" "${ORIGARGS[@]}" - fi - else - TARGET_GID="$(getent group "${DEHYDRATED_GROUP}" | cut -d':' -f3)" || _exiterr "DEHYDRATED_GROUP ${DEHYDRATED_GROUP} is invalid" - if [[ -z "${EGID:-}" ]]; then - command -v id > /dev/null 2>&1 || _exiterr "DEHYDRATED_GROUP set, don't know current gid and 'id' not available... Please provide 'id' binary." - EGID="$(id -g)" - fi - if [[ "${EUID}" != "${TARGET_UID}" ]] || [[ "${EGID}" != "${TARGET_GID}" ]]; then - echo "# INFO: Running $0 as ${DEHYDRATED_USER}/${DEHYDRATED_GROUP}" - has_sudo && exec sudo -u "${DEHYDRATED_USER}" -g "${DEHYDRATED_GROUP}" "${0}" "${ORIGARGS[@]}" - fi - fi - elif [[ -n "${DEHYDRATED_GROUP}" ]]; then - _exiterr "DEHYDRATED_GROUP can only be used in combination with DEHYDRATED_USER." - fi - - # Remove slash from end of BASEDIR. Mostly for cleaner outputs, doesn't change functionality. - [[ "$BASEDIR" != "/" ]] && BASEDIR="${BASEDIR%%/}" - - # Check BASEDIR and set default variables - [[ -d "${BASEDIR}" ]] || _exiterr "BASEDIR does not exist: ${BASEDIR}" - - # Check for ca cli parameter - if [ -n "${PARAM_CA:-}" ]; then - CA="${PARAM_CA}" - fi - - # Preset CAs - if [ "${CA}" = "letsencrypt" ]; then - CA="${CA_LETSENCRYPT}" - elif [ "${CA}" = "letsencrypt-test" ]; then - CA="${CA_LETSENCRYPT_TEST}" - elif [ "${CA}" = "zerossl" ]; then - CA="${CA_ZEROSSL}" - elif [ "${CA}" = "buypass" ]; then - CA="${CA_BUYPASS}" - elif [ "${CA}" = "buypass-test" ]; then - CA="${CA_BUYPASS_TEST}" - elif [ "${CA}" = "google" ]; then - CA="${CA_GOOGLE}" - elif [ "${CA}" = "google-test" ]; then - CA="${CA_GOOGLE_TEST}" - fi - - if [[ -z "${OLDCA}" ]] && [[ "${CA}" = "https://acme-v02.api.letsencrypt.org/directory" ]]; then - OLDCA="https://acme-v01.api.letsencrypt.org/directory" - fi - - # Create new account directory or symlink to account directory from old CA - # dev note: keep in mind that because of the use of 'echo' instead of 'printf' or - # similar there is a newline encoded in the directory name. not going to fix this - # since it's a non-issue and trying to fix existing installations would be too much - # trouble - CAHASH="$(echo "${CA}" | urlbase64)" - [[ -z "${ACCOUNTDIR}" ]] && ACCOUNTDIR="${BASEDIR}/accounts" - if [[ ! -e "${ACCOUNTDIR}/${CAHASH}" ]]; then - OLDCAHASH="$(echo "${OLDCA}" | urlbase64)" - mkdir -p "${ACCOUNTDIR}" - if [[ -n "${OLDCA}" ]] && [[ -e "${ACCOUNTDIR}/${OLDCAHASH}" ]]; then - echo "! Reusing account from ${OLDCA}" - ln -s "${OLDCAHASH}" "${ACCOUNTDIR}/${CAHASH}" - else - mkdir "${ACCOUNTDIR}/${CAHASH}" - fi - fi - - # shellcheck disable=SC1090 - [[ -f "${ACCOUNTDIR}/${CAHASH}/config" ]] && . "${ACCOUNTDIR}/${CAHASH}/config" - ACCOUNT_KEY="${ACCOUNTDIR}/${CAHASH}/account_key.pem" - ACCOUNT_KEY_JSON="${ACCOUNTDIR}/${CAHASH}/registration_info.json" - ACCOUNT_ID_JSON="${ACCOUNTDIR}/${CAHASH}/account_id.json" - ACCOUNT_DEACTIVATED="${ACCOUNTDIR}/${CAHASH}/deactivated" - - if [[ -f "${ACCOUNT_DEACTIVATED}" ]]; then - _exiterr "Account has been deactivated. Remove account and create a new one using --register." - fi - - if [[ -f "${BASEDIR}/private_key.pem" ]] && [[ ! -f "${ACCOUNT_KEY}" ]]; then - echo "! Moving private_key.pem to ${ACCOUNT_KEY}" - mv "${BASEDIR}/private_key.pem" "${ACCOUNT_KEY}" - fi - if [[ -f "${BASEDIR}/private_key.json" ]] && [[ ! -f "${ACCOUNT_KEY_JSON}" ]]; then - echo "! Moving private_key.json to ${ACCOUNT_KEY_JSON}" - mv "${BASEDIR}/private_key.json" "${ACCOUNT_KEY_JSON}" - fi - - [[ -z "${CERTDIR}" ]] && CERTDIR="${BASEDIR}/certs" - [[ -z "${ALPNCERTDIR}" ]] && ALPNCERTDIR="${BASEDIR}/alpn-certs" - [[ -z "${CHAINCACHE}" ]] && CHAINCACHE="${BASEDIR}/chains" - [[ -z "${DOMAINS_TXT}" ]] && DOMAINS_TXT="${BASEDIR}/domains.txt" - [[ -z "${WELLKNOWN}" ]] && WELLKNOWN="/var/www/dehydrated" - [[ -z "${LOCKFILE}" ]] && LOCKFILE="${BASEDIR}/lock" - [[ -z "${OPENSSL_CNF}" ]] && OPENSSL_CNF="$("${OPENSSL}" version -d | cut -d\" -f2)/openssl.cnf" - [[ -n "${PARAM_LOCKFILE_SUFFIX:-}" ]] && LOCKFILE="${LOCKFILE}-${PARAM_LOCKFILE_SUFFIX}" - [[ -n "${PARAM_NO_LOCK:-}" ]] && LOCKFILE="" - - [[ -n "${PARAM_HOOK:-}" ]] && HOOK="${PARAM_HOOK}" - [[ -n "${PARAM_DOMAINS_TXT:-}" ]] && DOMAINS_TXT="${PARAM_DOMAINS_TXT}" - [[ -n "${PARAM_PREFERRED_CHAIN:-}" ]] && PREFERRED_CHAIN="${PARAM_PREFERRED_CHAIN}" - [[ -n "${PARAM_CERTDIR:-}" ]] && CERTDIR="${PARAM_CERTDIR}" - [[ -n "${PARAM_ALPNCERTDIR:-}" ]] && ALPNCERTDIR="${PARAM_ALPNCERTDIR}" - [[ -n "${PARAM_CHALLENGETYPE:-}" ]] && CHALLENGETYPE="${PARAM_CHALLENGETYPE}" - [[ -n "${PARAM_KEY_ALGO:-}" ]] && KEY_ALGO="${PARAM_KEY_ALGO}" - [[ -n "${PARAM_OCSP_MUST_STAPLE:-}" ]] && OCSP_MUST_STAPLE="${PARAM_OCSP_MUST_STAPLE}" - [[ -n "${PARAM_IP_VERSION:-}" ]] && IP_VERSION="${PARAM_IP_VERSION}" - [[ -n "${PARAM_ACME_PROFILE:-}" ]] && ACME_PROFILE="${PARAM_ACME_PROFILE}" - [[ -n "${PARAM_ORDER_TIMEOUT:-}" ]] && ORDER_TIMEOUT="${PARAM_ORDER_TIMEOUT}" - [[ -n "${PARAM_VALIDATION_TIMEOUT:-}" ]] && VALIDATION_TIMEOUT="${PARAM_VALIDATION_TIMEOUT}" - [[ -n "${PARAM_KEEP_GOING:-}" ]] && KEEP_GOING="${PARAM_KEEP_GOING}" - - if [ "${PARAM_FORCE_VALIDATION:-no}" = "yes" ] && [ "${PARAM_FORCE:-no}" = "no" ]; then - _exiterr "Argument --force-validation can only be used in combination with --force (-x)" - fi - - if [ ! "${1:-}" = "noverify" ]; then - verify_config - fi - store_configvars -} - -# Initialize system -init_system() { - load_config - - # Lockfile handling (prevents concurrent access) - if [[ -n "${LOCKFILE}" ]]; then - LOCKDIR="$(dirname "${LOCKFILE}")" - [[ -w "${LOCKDIR}" ]] || _exiterr "Directory ${LOCKDIR} for LOCKFILE ${LOCKFILE} is not writable, aborting." - ( set -C; date > "${LOCKFILE}" ) 2>/dev/null || _exiterr "Lock file '${LOCKFILE}' present, aborting." - remove_lock() { rm -f "${LOCKFILE}"; } - trap 'remove_lock' EXIT - fi - - # Get CA URLs - CA_DIRECTORY="$(http_request get "${CA}" | jsonsh)" - - # Automatic discovery of API version - if [[ "${API}" = "auto" ]]; then - grep -q newOrder <<< "${CA_DIRECTORY}" && API=2 || API=1 - fi - - # shellcheck disable=SC2015 - if [[ "${API}" = "1" ]]; then - CA_NEW_CERT="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value new-cert)" && - CA_NEW_AUTHZ="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value new-authz)" && - CA_NEW_REG="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value new-reg)" && - CA_TERMS="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value terms-of-service)" && - CA_REQUIRES_EAB="false" && - CA_REVOKE_CERT="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value revoke-cert)" || - _exiterr "Problem retrieving ACME/CA-URLs, check if your configured CA points to the directory entrypoint." - # Since reg URI is missing from directory we will assume it is the same as CA_NEW_REG without the new part - CA_REG=${CA_NEW_REG/new-reg/reg} - - if [[ -n "${ACME_PROFILE}" ]]; then - _exiterr "ACME profiles are not supported in ACME v1." - fi - else - CA_NEW_ORDER="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value newOrder)" && - CA_NEW_NONCE="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value newNonce)" && - CA_NEW_ACCOUNT="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value newAccount)" && - CA_TERMS="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value -p '"meta","termsOfService"')" && - CA_REQUIRES_EAB="$(printf "%s" "${CA_DIRECTORY}" | get_json_bool_value -p '"meta","externalAccountRequired"' || echo false)" && - CA_REVOKE_CERT="$(printf "%s" "${CA_DIRECTORY}" | get_json_string_value revokeCert)" || - _exiterr "Problem retrieving ACME/CA-URLs, check if your configured CA points to the directory entrypoint." - - # Checking ACME profile - if [[ -n "${ACME_PROFILE}" ]]; then - # Extract available profiles from CA directory - declare -A available_profiles=() - while IFS=$'\t' read -r path value; do - if [[ "${value}" =~ ^\"([^\"]+)\"$ ]]; then - value=${BASH_REMATCH[1]} - fi - if [[ "${path}" =~ ^\[\"([^\"]+)\"\]$ ]]; then - available_profiles[${BASH_REMATCH[1]}]=$value - fi - done <<< "$(printf "%s" "${CA_DIRECTORY}" | get_json_dict_value -p '"meta","profiles"' 2>/dev/null)" - if [[ ${#available_profiles[@]} -eq 0 ]]; then - _exiterr "ACME profile not supported by this CA" - fi - - # Check if the requested profile is available - found_profile="no" - for profile in "${!available_profiles[@]}"; do - if [[ "${profile}" == "${ACME_PROFILE}" ]]; then - found_profile="yes" - break - fi - done - if [[ "${found_profile}" == "no" ]]; then - _exiterr "ACME profile '${ACME_PROFILE}' not found, available profiles:$(for key in "${!available_profiles[@]}"; do printf "\n %s: %s" "${key}" "${available_profiles[$key]}"; done)" - fi - fi - fi - - # Export some environment variables to be used in hook script - export WELLKNOWN BASEDIR CERTDIR ALPNCERTDIR CONFIG COMMAND - - # Checking for private key ... - register_new_key="no" - generated="false" - if [[ -n "${PARAM_ACCOUNT_KEY:-}" ]]; then - # a private key was specified from the command line so use it for this run - echo "Using private key ${PARAM_ACCOUNT_KEY} instead of account key" - ACCOUNT_KEY="${PARAM_ACCOUNT_KEY}" - ACCOUNT_KEY_JSON="${PARAM_ACCOUNT_KEY}.json" - ACCOUNT_ID_JSON="${PARAM_ACCOUNT_KEY}_id.json" - [ "${COMMAND:-}" = "register" ] && register_new_key="yes" - else - # Check if private account key exists, if it doesn't exist yet generate a new one (rsa key) - if [[ ! -e "${ACCOUNT_KEY}" ]]; then - if [[ ! "${PARAM_ACCEPT_TERMS:-}" = "yes" ]]; then - printf '\n' >&2 - printf 'To use dehydrated with this certificate authority you have to agree to their terms of service which you can find here: %s\n\n' "${CA_TERMS}" >&2 - printf 'To accept these terms of service run "%s --register --accept-terms".\n' "${0}" >&2 - exit 1 - fi - - echo "+ Generating account key..." - generated="true" - local tmp_account_key - tmp_account_key="$(_mktemp)" - if [[ ${API} -eq 1 && ! "${ACCOUNT_KEY_ALGO}" = "rsa" ]]; then - _exiterr "ACME API version 1 does not support EC account keys" - fi - case "${ACCOUNT_KEY_ALGO}" in - rsa) _openssl genrsa -out "${tmp_account_key}" "${ACCOUNT_KEYSIZE}";; - prime256v1|secp384r1|secp521r1) _openssl ecparam -genkey -name "${ACCOUNT_KEY_ALGO}" -out "${tmp_account_key}" -noout;; - esac - cat "${tmp_account_key}" > "${ACCOUNT_KEY}" - rm "${tmp_account_key}" - register_new_key="yes" - fi - fi - - if ("${OPENSSL}" rsa -in "${ACCOUNT_KEY}" -check 2>/dev/null > /dev/null); then - # Get public components from private key and calculate thumbprint - pubExponent64="$(printf '%x' "$("${OPENSSL}" rsa -in "${ACCOUNT_KEY}" -noout -text | awk '/publicExponent/ {print $2}')" | hex2bin | urlbase64)" - pubMod64="$("${OPENSSL}" rsa -in "${ACCOUNT_KEY}" -noout -modulus | cut -d'=' -f2 | hex2bin | urlbase64)" - - account_key_info="$(printf '{"e":"%s","kty":"RSA","n":"%s"}' "${pubExponent64}" "${pubMod64}")" - account_key_sigalgo=RS256 - elif ("${OPENSSL}" ec -in "${ACCOUNT_KEY}" -check 2>/dev/null > /dev/null); then - curve="$("${OPENSSL}" ec -in "${ACCOUNT_KEY}" -noout -text 2>/dev/null | grep 'NIST CURVE' | cut -d':' -f2 | tr -d ' ')" - pubkey="$("${OPENSSL}" ec -in "${ACCOUNT_KEY}" -noout -text 2>/dev/null | tr -d '\n ' | grep -Eo 'pub:.*ASN1' | _sed -e 's/^pub://' -e 's/ASN1$//' | tr -d ':')" - - if [ "${curve}" = "P-256" ]; then - account_key_sigalgo="ES256" - elif [ "${curve}" = "P-384" ]; then - account_key_sigalgo="ES384" - elif [ "${curve}" = "P-521" ]; then - account_key_sigalgo="ES512" - else - _exiterr "Unknown account key curve: ${curve}" - fi - - ec_x_offset=2 - ec_x_len=$((${#pubkey}/2 - 1)) - ec_x="${pubkey:$ec_x_offset:$ec_x_len}" - ec_x64="$(printf "%s" "${ec_x}" | hex2bin | urlbase64)" - - ec_y_offset=$((ec_x_offset+ec_x_len)) - ec_y_len=$((${#pubkey}-ec_y_offset)) - ec_y="${pubkey:$ec_y_offset:$ec_y_len}" - ec_y64="$(printf "%s" "${ec_y}" | hex2bin | urlbase64)" - - account_key_info="$(printf '{"crv":"%s","kty":"EC","x":"%s","y":"%s"}' "${curve}" "${ec_x64}" "${ec_y64}")" - else - _exiterr "Account key is not valid, cannot continue." - fi - thumbprint="$(printf '%s' "${account_key_info}" | "${OPENSSL}" dgst -sha256 -binary | urlbase64)" - - # If we generated a new private key in the step above we have to register it with the acme-server - if [[ "${register_new_key}" = "yes" ]]; then - echo "+ Registering account key with ACME server..." - FAILED=false - - if [[ ${API} -eq 1 && -z "${CA_NEW_REG}" ]] || [[ ${API} -eq 2 && -z "${CA_NEW_ACCOUNT}" ]]; then - echo "Certificate authority doesn't allow registrations." - FAILED=true - fi - - # ZeroSSL special sauce - if [[ "${CA}" = "${CA_ZEROSSL}" ]]; then - if [[ -z "${EAB_KID:-}" ]] || [[ -z "${EAB_HMAC_KEY:-}" ]]; then - if [[ -z "${CONTACT_EMAIL}" ]]; then - echo "ZeroSSL requires contact email to be set or EAB_KID/EAB_HMAC_KEY to be manually configured" - FAILED=true - else - zeroapi="$(curl -s "https://api.zerossl.com/acme/eab-credentials-email" -d "email=${CONTACT_EMAIL}" | jsonsh)" - EAB_KID="$(printf "%s" "${zeroapi}" | get_json_string_value eab_kid)" - EAB_HMAC_KEY="$(printf "%s" "${zeroapi}" | get_json_string_value eab_hmac_key)" - if [[ -z "${EAB_KID:-}" ]] || [[ -z "${EAB_HMAC_KEY:-}" ]]; then - echo "Unknown error retrieving ZeroSSL API credentials" - echo "${zeroapi}" - FAILED=true - fi - fi - fi - fi - - # Google special sauce - if [[ "${CA}" = "${CA_GOOGLE}" ]]; then - if [[ -z "${CONTACT_EMAIL}" ]] || [[ -z "${EAB_KID:-}" ]] || [[ -z "${EAB_HMAC_KEY:-}" ]]; then - echo "Google requires contact email, EAB_KID and EAB_HMAC_KEY to be manually configured (see https://cloud.google.com/certificate-manager/docs/public-ca-tutorial)" - FAILED=true - fi - fi - - # Check if external account is required - if [[ "${FAILED}" = "false" ]]; then - if [[ "${CA_REQUIRES_EAB}" = "true" ]]; then - if [[ -z "${EAB_KID:-}" ]] || [[ -z "${EAB_HMAC_KEY:-}" ]]; then - FAILED=true - echo "This CA requires an external account but no EAB_KID/EAB_HMAC_KEY has been configured" - fi - fi - fi - - # If an email for the contact has been provided then adding it to the registration request - if [[ "${FAILED}" = "false" ]]; then - if [[ ${API} -eq 1 ]]; then - if [[ -n "${CONTACT_EMAIL}" ]]; then - (signed_request "${CA_NEW_REG}" '{"resource": "new-reg", "contact":["mailto:'"${CONTACT_EMAIL}"'"], "agreement": "'"${CA_TERMS}"'"}' > "${ACCOUNT_KEY_JSON}") || FAILED=true - else - (signed_request "${CA_NEW_REG}" '{"resource": "new-reg", "agreement": "'"${CA_TERMS}"'"}' > "${ACCOUNT_KEY_JSON}") || FAILED=true - fi - else - if [[ -n "${EAB_KID:-}" ]] && [[ -n "${EAB_HMAC_KEY:-}" ]]; then - eab_url="${CA_NEW_ACCOUNT}" - eab_protected64="$(printf '{"alg":"HS256","kid":"%s","url":"%s"}' "${EAB_KID}" "${eab_url}" | urlbase64)" - eab_payload64="$(printf "%s" "${account_key_info}" | urlbase64)" - eab_key="$(printf "%s" "${EAB_HMAC_KEY}" | deurlbase64 | bin2hex)" - eab_signed64="$(printf '%s' "${eab_protected64}.${eab_payload64}" | "${OPENSSL}" dgst -binary -sha256 -mac HMAC -macopt "hexkey:${eab_key}" | urlbase64)" - - if [[ -n "${CONTACT_EMAIL}" ]]; then - regjson='{"contact":["mailto:'"${CONTACT_EMAIL}"'"], "termsOfServiceAgreed": true, "externalAccountBinding": {"protected": "'"${eab_protected64}"'", "payload": "'"${eab_payload64}"'", "signature": "'"${eab_signed64}"'"}}' - else - regjson='{"termsOfServiceAgreed": true, "externalAccountBinding": {"protected": "'"${eab_protected64}"'", "payload": "'"${eab_payload64}"'", "signature": "'"${eab_signed64}"'"}}' - fi - else - if [[ -n "${CONTACT_EMAIL}" ]]; then - regjson='{"contact":["mailto:'"${CONTACT_EMAIL}"'"], "termsOfServiceAgreed": true}' - else - regjson='{"termsOfServiceAgreed": true}' - fi - fi - (signed_request "${CA_NEW_ACCOUNT}" "${regjson}" > "${ACCOUNT_KEY_JSON}") || FAILED=true - fi - fi - - if [[ "${FAILED}" = "true" ]]; then - echo >&2 - echo >&2 - echo "Error registering account key. See message above for more information." >&2 - if [[ "${generated}" = "true" ]]; then - rm "${ACCOUNT_KEY}" - fi - rm -f "${ACCOUNT_KEY_JSON}" - exit 1 - fi - elif [[ "${COMMAND:-}" = "register" ]]; then - echo "+ Account already registered!" - exit 0 - fi - - # Read account information or request from CA if missing - if [[ -e "${ACCOUNT_KEY_JSON}" ]]; then - if [[ ${API} -eq 1 ]]; then - ACCOUNT_ID="$(jsonsh < "${ACCOUNT_KEY_JSON}" | get_json_int_value id)" - ACCOUNT_URL="${CA_REG}/${ACCOUNT_ID}" - else - if [[ -e "${ACCOUNT_ID_JSON}" ]]; then - ACCOUNT_URL="$(jsonsh < "${ACCOUNT_ID_JSON}" | get_json_string_value url)" - fi - # if account URL is not storred, fetch it from the CA - if [[ -z "${ACCOUNT_URL:-}" ]]; then - echo "+ Fetching account URL..." - ACCOUNT_URL="$(signed_request "${CA_NEW_ACCOUNT}" '{"onlyReturnExisting": true}' 4>&1 | grep -i ^Location: | cut -d':' -f2- | tr -d ' \t\r\n')" - if [[ -z "${ACCOUNT_URL}" ]]; then - _exiterr "Unknown error on fetching account information" - fi - echo '{"url":"'"${ACCOUNT_URL}"'"}' > "${ACCOUNT_ID_JSON}" # store the URL for next time - fi - fi - else - echo "Fetching missing account information from CA..." - if [[ ${API} -eq 1 ]]; then - _exiterr "This is not implemented for ACMEv1! Consider switching to ACMEv2 :)" - else - ACCOUNT_URL="$(signed_request "${CA_NEW_ACCOUNT}" '{"onlyReturnExisting": true}' 4>&1 | grep -i ^Location: | cut -d':' -f2- | tr -d ' \t\r\n')" - ACCOUNT_INFO="$(signed_request "${ACCOUNT_URL}" '{}')" - fi - echo "${ACCOUNT_INFO}" > "${ACCOUNT_KEY_JSON}" - fi -} - -# Different sed version for different os types... -_sed() { - if [[ "${OSTYPE}" = "Linux" || "${OSTYPE:0:5}" = "MINGW" ]]; then - sed -r "${@}" - else - sed -E "${@}" - fi -} - -# Print error message and exit with error -_exiterr() { - if [ -n "${1:-}" ]; then - echo "ERROR: ${1}" >&2 - fi - [[ "${skip_exit_hook:-no}" = "no" ]] && [[ -n "${HOOK:-}" ]] && ("${HOOK}" "exit_hook" "${1:-}" || echo 'exit_hook returned with non-zero exit code!' >&2) - exit 1 -} - -# Remove newlines and whitespace from json -clean_json() { - tr -d '\r\n' | _sed -e 's/ +/ /g' -e 's/\{ /{/g' -e 's/ \}/}/g' -e 's/\[ /[/g' -e 's/ \]/]/g' -} - -# Encode data as url-safe formatted base64 -urlbase64() { - # urlbase64: base64 encoded string with '+' replaced with '-' and '/' replaced with '_' - "${OPENSSL}" base64 -e | tr -d '\n\r' | _sed -e 's:=*$::g' -e 'y:+/:-_:' -} - -# Decode data from url-safe formatted base64 -deurlbase64() { - data="$(cat | tr -d ' \n\r')" - modlen=$((${#data} % 4)) - padding="" - if [[ "${modlen}" = "2" ]]; then padding="=="; - elif [[ "${modlen}" = "3" ]]; then padding="="; fi - printf "%s%s" "${data}" "${padding}" | tr -d '\n\r' | _sed -e 'y:-_:+/:' | "${OPENSSL}" base64 -d -A -} - -# Convert hex string to binary data -hex2bin() { - # Remove spaces, add leading zero, escape as hex string and parse with printf - # shellcheck disable=SC2059 - printf "%b" "$(cat | _sed -e 's/[[:space:]]//g' -e 's/^(.(.{2})*)$/0\1/' -e 's/(.{2})/\\x\1/g')" -} - -# Convert binary data to hex string -bin2hex() { - hexdump -v -e '/1 "%02x"' -} - -# OpenSSL writes to stderr/stdout even when there are no errors. So just -# display the output if the exit code was != 0 to simplify debugging. -_openssl() { - set +e - out="$("${OPENSSL}" "${@}" 2>&1)" - res=$? - set -e - if [[ ${res} -ne 0 ]]; then - echo " + ERROR: failed to run $* (Exitcode: ${res})" >&2 - echo >&2 - echo "Details:" >&2 - echo "${out}" >&2 - echo >&2 - exit "${res}" - fi -} - -# Send http(s) request with specified method -http_request() { - tempcont="$(_mktemp)" - tempheaders="$(_mktemp)" - - if [[ -n "${IP_VERSION:-}" ]]; then - ip_version="-${IP_VERSION}" - fi - - set +e - # shellcheck disable=SC2086 - if [[ "${1}" = "head" ]]; then - statuscode="$(curl ${ip_version:-} ${CURL_OPTS} -A "dehydrated/${VERSION} curl/${CURL_VERSION}" -s -w "%{http_code}" -o "${tempcont}" -H 'Cache-Control: no-cache' "${2}" -I)" - curlret="${?}" - touch "${tempheaders}" - elif [[ "${1}" = "get" ]]; then - statuscode="$(curl ${ip_version:-} ${CURL_OPTS} -A "dehydrated/${VERSION} curl/${CURL_VERSION}" -L -s -w "%{http_code}" -o "${tempcont}" -D "${tempheaders}" -H 'Cache-Control: no-cache' "${2}")" - curlret="${?}" - elif [[ "${1}" = "post" ]]; then - statuscode="$(curl ${ip_version:-} ${CURL_OPTS} -A "dehydrated/${VERSION} curl/${CURL_VERSION}" -s -w "%{http_code}" -o "${tempcont}" "${2}" -D "${tempheaders}" -H 'Cache-Control: no-cache' -H 'Content-Type: application/jose+json' -d "${3}")" - curlret="${?}" - else - set -e - _exiterr "Unknown request method: ${1}" - fi - set -e - - if [[ ! "${curlret}" = "0" ]]; then - _exiterr "Problem connecting to server (${1} for ${2}; curl returned with ${curlret})" - fi - - if [[ ! "${statuscode:0:1}" = "2" ]]; then - # check for existing registration warning - if [[ "${API}" = "1" ]] && [[ -n "${CA_NEW_REG:-}" ]] && [[ "${2}" = "${CA_NEW_REG:-}" ]] && [[ "${statuscode}" = "409" ]] && grep -q "Registration key is already in use" "${tempcont}"; then - # do nothing - : - # check for already-revoked warning - elif [[ -n "${CA_REVOKE_CERT:-}" ]] && [[ "${2}" = "${CA_REVOKE_CERT:-}" ]] && [[ "${statuscode}" = "409" ]]; then - grep -q "Certificate already revoked" "${tempcont}" && return - else - if grep -q "urn:ietf:params:acme:error:badNonce" "${tempcont}"; then - printf "badnonce %s" "$(grep -Eoi "^replay-nonce:.*$" "${tempheaders}" | sed 's/ //' | cut -d: -f2)" - return 0 - fi - echo " + ERROR: An error occurred while sending ${1}-request to ${2} (Status ${statuscode})" >&2 - echo >&2 - echo "Details:" >&2 - cat "${tempheaders}" >&2 - cat "${tempcont}" >&2 - echo >&2 - echo >&2 - - # An exclusive hook for the {1}-request error might be useful (e.g., for sending an e-mail to admins) - if [[ -n "${HOOK}" ]]; then - errtxt="$(cat "${tempcont}")" - errheaders="$(cat "${tempheaders}")" - "${HOOK}" "request_failure" "${statuscode}" "${errtxt}" "${1}" "${errheaders}" || _exiterr 'request_failure hook returned with non-zero exit code' - fi - - rm -f "${tempcont}" - rm -f "${tempheaders}" - - # remove temporary domains.txt file if used - [[ "${COMMAND:-}" = "sign_domains" && -n "${PARAM_DOMAIN:-}" && -n "${DOMAINS_TXT:-}" ]] && rm "${DOMAINS_TXT}" - _exiterr - fi - fi - - if { true >&4; } 2>/dev/null; then - cat "${tempheaders}" >&4 - fi - cat "${tempcont}" - rm -f "${tempcont}" - rm -f "${tempheaders}" -} - -# Send signed request -signed_request() { - # Encode payload as urlbase64 - payload64="$(printf '%s' "${2}" | urlbase64)" - - if [ -n "${3:-}" ]; then - nonce="$(printf "%s" "${3}" | tr -d ' \t\n\r')" - else - # Retrieve nonce from acme-server - if [[ ${API} -eq 1 ]]; then - nonce="$(http_request head "${CA}" | grep -i ^Replay-Nonce: | cut -d':' -f2- | tr -d ' \t\n\r')" - else - nonce="$(http_request head "${CA_NEW_NONCE}" | grep -i ^Replay-Nonce: | cut -d':' -f2- | tr -d ' \t\n\r')" - fi - fi - - if [[ ${API} -eq 1 ]]; then - # Build another header which also contains the previously received nonce and encode it as urlbase64 - protected='{"alg": "RS256", "jwk": {"e": "'"${pubExponent64}"'", "kty": "RSA", "n": "'"${pubMod64}"'"}, "nonce": "'"${nonce}"'"}' - protected64="$(printf '%s' "${protected}" | urlbase64)" - else - # Build another header which also contains the previously received nonce and url and encode it as urlbase64 - if [[ -n "${ACCOUNT_URL:-}" ]]; then - protected='{"alg": "'"${account_key_sigalgo}"'", "kid": "'"${ACCOUNT_URL}"'", "url": "'"${1}"'", "nonce": "'"${nonce}"'"}' - else - protected='{"alg": "'"${account_key_sigalgo}"'", "jwk": '"${account_key_info}"', "url": "'"${1}"'", "nonce": "'"${nonce}"'"}' - fi - protected64="$(printf '%s' "${protected}" | urlbase64)" - fi - - # Sign header with nonce and our payload with our private key and encode signature as urlbase64 - if [[ "${account_key_sigalgo}" = "RS256" ]]; then - signed64="$(printf '%s' "${protected64}.${payload64}" | "${OPENSSL}" dgst -sha256 -sign "${ACCOUNT_KEY}" | urlbase64)" - else - dgstparams="$(printf '%s' "${protected64}.${payload64}" | "${OPENSSL}" dgst -sha${account_key_sigalgo:2} -sign "${ACCOUNT_KEY}" | "${OPENSSL}" asn1parse -inform DER)" - dgst_parm_1="$(echo "$dgstparams" | head -n 2 | tail -n 1 | cut -d':' -f4)" - dgst_parm_2="$(echo "$dgstparams" | head -n 3 | tail -n 1 | cut -d':' -f4)" - - # zero-padding (doesn't seem to be necessary, but other clients are doing this as well... - case "${account_key_sigalgo}" in - "ES256") siglen=64;; - "ES384") siglen=96;; - "ES512") siglen=132;; - esac - while [[ ${#dgst_parm_1} -lt $siglen ]]; do dgst_parm_1="0${dgst_parm_1}"; done - while [[ ${#dgst_parm_2} -lt $siglen ]]; do dgst_parm_2="0${dgst_parm_2}"; done - - signed64="$(printf "%s%s" "${dgst_parm_1}" "${dgst_parm_2}" | hex2bin | urlbase64)" - fi - - if [[ ${API} -eq 1 ]]; then - # Build header with just our public key and algorithm information - header='{"alg": "RS256", "jwk": {"e": "'"${pubExponent64}"'", "kty": "RSA", "n": "'"${pubMod64}"'"}}' - - # Send header + extended header + payload + signature to the acme-server - data='{"header": '"${header}"', "protected": "'"${protected64}"'", "payload": "'"${payload64}"'", "signature": "'"${signed64}"'"}' - else - # Send extended header + payload + signature to the acme-server - data='{"protected": "'"${protected64}"'", "payload": "'"${payload64}"'", "signature": "'"${signed64}"'"}' - fi - - output="$(http_request post "${1}" "${data}")" - - if grep -qE "^badnonce " <<< "${output}"; then - echo " ! Request failed (badNonce), retrying request..." >&2 - signed_request "${1:-}" "${2:-}" "$(printf "%s" "${output}" | cut -d' ' -f2)" - else - printf "%s" "${output}" - fi -} - -# Extracts all subject names from a CSR -# Outputs either the CN, or the SANs, one per line -extract_altnames() { - csrfile="${1}" # path to CSR file - - if ! "${OPENSSL}" req -in "${csrfile}" -verify -noout >/dev/null; then - _exiterr "Certificate signing request isn't valid" - fi - - reqtext="$("${OPENSSL}" req -in "${csrfile}" -noout -text)" - if <<<"${reqtext}" grep -q '^[[:space:]]*X509v3 Subject Alternative Name:[[:space:]]*$'; then - # SANs used, extract these - altnames="$( <<<"${reqtext}" awk '/X509v3 Subject Alternative Name:/{print;getline;print;}' | tail -n1 )" - # split to one per line: - # shellcheck disable=SC1003 - altnames="$( <<<"${altnames}" _sed -e 's/^[[:space:]]*//; s/, /\'$'\n''/g' )" - # we can only get DNS/IP: ones signed - if grep -qEv '^(DNS|IP( Address)*|othername):' <<<"${altnames}"; then - _exiterr "Certificate signing request contains non-DNS/IP Subject Alternative Names" - fi - # strip away the DNS/IP: prefix - altnames="$( <<<"${altnames}" _sed -e 's/^(DNS:|IP( Address)*:|othername:)//' )" - printf "%s" "${altnames}" | tr '\n' ' ' - else - # No SANs, extract CN - altnames="$( <<<"${reqtext}" grep '^[[:space:]]*Subject:' | _sed -e 's/.*[ /]CN ?= ?([^ /,]*).*/\1/' )" - printf "%s" "${altnames}" - fi -} - -# Get last issuer CN in certificate chain -get_last_cn() { - <<<"${1}" _sed 'H;/-----BEGIN CERTIFICATE-----/h;$!d;x' | "${OPENSSL}" x509 -noout -issuer | head -n1 | _sed -e 's/.*[ /]CN ?= ?([^/,]*).*/\1/' -} - -# Create certificate for domain(s) and outputs it FD 3 -sign_csr() { - csrfile="${1}" # path to CSR file - - if { true >&3; } 2>/dev/null; then - : # fd 3 looks OK - else - _exiterr "sign_csr: FD 3 not open" - fi - - shift 1 || true - export altnames="${*}" - - if [[ ${API} -eq 1 ]]; then - if [[ -z "${CA_NEW_AUTHZ}" ]] || [[ -z "${CA_NEW_CERT}" ]]; then - _exiterr "Certificate authority doesn't allow certificate signing" - fi - elif [[ ${API} -eq 2 ]] && [[ -z "${CA_NEW_ORDER}" ]]; then - _exiterr "Certificate authority doesn't allow certificate signing" - fi - - if [[ -n "${ZSH_VERSION:-}" ]]; then - local -A challenge_names challenge_uris challenge_tokens authorizations keyauths deploy_args - else - local -a challenge_names challenge_uris challenge_tokens authorizations keyauths deploy_args - fi - - # Initial step: Find which authorizations we're dealing with - if [[ ${API} -eq 2 ]]; then - # Request new order and store authorization URIs - local challenge_identifiers="" - for altname in ${altnames}; do - if [[ "${altname}" =~ ^ip: ]]; then - challenge_identifiers+="$(printf '{"type": "ip", "value": "%s"}, ' "${altname:3}")" - else - challenge_identifiers+="$(printf '{"type": "dns", "value": "%s"}, ' "${altname}")" - fi - done - challenge_identifiers="[${challenge_identifiers%, }]" - - echo " + Requesting new certificate order from CA..." - local order_payload='{"identifiers": '"${challenge_identifiers}" - if [[ -n "${ACME_PROFILE}" ]]; then - order_payload="${order_payload}"',"profile":"'"${ACME_PROFILE}"'"' - fi - order_payload="${order_payload}"'}' - order_location="$(signed_request "${CA_NEW_ORDER}" "${order_payload}" 4>&1 | grep -i ^Location: | cut -d':' -f2- | tr -d ' \t\r\n')" - result="$(signed_request "${order_location}" "" | jsonsh)" - - order_authorizations="$(echo "${result}" | get_json_array_values authorizations)" - finalize="$(echo "${result}" | get_json_string_value finalize)" - - local idx=0 - for uri in ${order_authorizations}; do - authorizations[${idx}]="${uri}" - idx=$((idx+1)) - done - echo " + Received ${idx} authorizations URLs from the CA" - else - # Copy $altnames to $authorizations (just doing this to reduce duplicate code later on) - local idx=0 - for altname in ${altnames}; do - authorizations[${idx}]="${altname}" - idx=$((idx+1)) - done - fi - - # Check if authorizations are valid and gather challenge information for pending authorizations - local idx=0 - for authorization in ${authorizations[*]}; do - if [[ "${API}" -eq 2 ]]; then - # Receive authorization ($authorization is authz uri) - response="$(signed_request "$(echo "${authorization}" | _sed -e 's/\"(.*)".*/\1/')" "" | jsonsh)" - identifier="$(echo "${response}" | get_json_string_value -p '"identifier","value"')" - identifier_type="$(echo "${response}" | get_json_string_value -p '"identifier","type"')" - echo " + Handling authorization for ${identifier}" - else - # Request new authorization ($authorization is altname) - identifier="${authorization}" - echo " + Requesting authorization for ${identifier}..." - response="$(signed_request "${CA_NEW_AUTHZ}" '{"resource": "new-authz", "identifier": {"type": "dns", "value": "'"${identifier}"'"}}' | jsonsh)" - fi - - # Check if authorization has already been validated - if [ "$(echo "${response}" | get_json_string_value status)" = "valid" ]; then - if [ "${PARAM_FORCE_VALIDATION:-no}" = "yes" ]; then - echo " + A valid authorization has been found but will be ignored" - else - echo " + Found valid authorization for ${identifier}" - continue - fi - fi - - # Find challenge in authorization - challengeindex="$(echo "${response}" | grep -E '^\["challenges",[0-9]+,"type"\][[:space:]]+"'"${CHALLENGETYPE}"'"' | cut -d',' -f2 || true)" - - if [ -z "${challengeindex}" ]; then - allowed_validations="$(echo "${response}" | grep -E '^\["challenges",[0-9]+,"type"\]' | sed -e 's/\[[^\]*\][[:space:]]*//g' -e 's/^"//' -e 's/"$//' | tr '\n' ' ')" - _exiterr "Validating this certificate is not possible using ${CHALLENGETYPE}. Possible validation methods are: ${allowed_validations}" - fi - challenge="$(echo "${response}" | get_json_dict_value -p '"challenges",'"${challengeindex}")" - - # Gather challenge information - if [ "${identifier_type:-}" = "ip" ] && [ "${CHALLENGETYPE}" = "tls-alpn-01" ] ; then - challenge_names[${idx}]="$(echo "${identifier}" | ip_to_ptr)" - else - challenge_names[${idx}]="${identifier}" - fi - challenge_tokens[${idx}]="$(echo "${challenge}" | get_json_string_value token)" - - if [[ ${API} -eq 2 ]]; then - challenge_uris[${idx}]="$(echo "${challenge}" | get_json_string_value url)" - else - if [[ "$(echo "${challenge}" | get_json_string_value type)" = "urn:acme:error:unauthorized" ]]; then - _exiterr "Challenge unauthorized: $(echo "${challenge}" | get_json_string_value detail)" - fi - challenge_uris[${idx}]="$(echo "${challenge}" | get_json_dict_value validationRecord | get_json_string_value uri)" - fi - - # Prepare challenge tokens and deployment parameters - keyauth="${challenge_tokens[${idx}]}.${thumbprint}" - - case "${CHALLENGETYPE}" in - "http-01") - # Store challenge response in well-known location and make world-readable (so that a webserver can access it) - printf '%s' "${keyauth}" > "${WELLKNOWN}/${challenge_tokens[${idx}]}" - chmod a+r "${WELLKNOWN}/${challenge_tokens[${idx}]}" - keyauth_hook="${keyauth}" - ;; - "dns-01") - # Generate DNS entry content for dns-01 validation - keyauth_hook="$(printf '%s' "${keyauth}" | "${OPENSSL}" dgst -sha256 -binary | urlbase64)" - ;; - "tls-alpn-01") - keyauth_hook="$(printf '%s' "${keyauth}" | "${OPENSSL}" dgst -sha256 -c -hex | awk '{print $NF}')" - generate_alpn_certificate "${identifier}" "${identifier_type}" "${keyauth_hook}" - ;; - esac - - keyauths[${idx}]="${keyauth}" - if [ "${identifier_type:-}" = "ip" ] && [ "${CHALLENGETYPE}" = "tls-alpn-01" ]; then - deploy_args[${idx}]="$(echo "${identifier}" | ip_to_ptr) ${challenge_tokens[${idx}]} ${keyauth_hook}" - else - deploy_args[${idx}]="${identifier} ${challenge_tokens[${idx}]} ${keyauth_hook}" - fi - - idx=$((idx+1)) - done - local num_pending_challenges=${idx} - echo " + ${num_pending_challenges} pending challenge(s)" - - # Deploy challenge tokens - if [[ ${num_pending_challenges} -ne 0 ]]; then - echo " + Deploying challenge tokens..." - if [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" = "yes" ]]; then - # shellcheck disable=SC2068 - "${HOOK}" "deploy_challenge" ${deploy_args[@]} || _exiterr 'deploy_challenge hook returned with non-zero exit code' - elif [[ -n "${HOOK}" ]]; then - # Run hook script to deploy the challenge token - local idx=0 - while [ ${idx} -lt ${num_pending_challenges} ]; do - # shellcheck disable=SC2086 - "${HOOK}" "deploy_challenge" ${deploy_args[${idx}]} || _exiterr 'deploy_challenge hook returned with non-zero exit code' - idx=$((idx+1)) - done - fi - fi - - # Validate pending challenges - local idx=0 - while [ ${idx} -lt ${num_pending_challenges} ]; do - echo " + Responding to challenge for ${challenge_names[${idx}]} authorization..." - - # Ask the acme-server to verify our challenge and wait until it is no longer pending - if [[ ${API} -eq 1 ]]; then - result="$(signed_request "${challenge_uris[${idx}]}" '{"resource": "challenge", "keyAuthorization": "'"${keyauths[${idx}]}"'"}' | jsonsh)" - else - result="$(signed_request "${challenge_uris[${idx}]}" '{}' | jsonsh)" - fi - - reqstatus="$(echo "${result}" | get_json_string_value status)" - - local waited=0 - while [[ "${reqstatus}" = "pending" ]] || [[ "${reqstatus}" = "processing" ]]; do - if [ ${VALIDATION_TIMEOUT} -gt 0 ] && [ ${waited} -gt ${VALIDATION_TIMEOUT} ]; then - _exiterr "Timed out waiting for processing of domain validation (still ${reqstatus})" - fi - echo " + Validation is ${reqstatus}..." - sleep 1 - waited=$((waited+1)) - if [[ "${API}" -eq 2 ]]; then - result="$(signed_request "${challenge_uris[${idx}]}" "" | jsonsh)" - else - result="$(http_request get "${challenge_uris[${idx}]}" | jsonsh)" - fi - reqstatus="$(echo "${result}" | get_json_string_value status)" - done - - [[ "${CHALLENGETYPE}" = "http-01" ]] && rm -f "${WELLKNOWN}/${challenge_tokens[${idx}]}" - [[ "${CHALLENGETYPE}" = "tls-alpn-01" ]] && rm -f "${ALPNCERTDIR}/${challenge_names[${idx}]}.crt.pem" "${ALPNCERTDIR}/${challenge_names[${idx}]}.key.pem" - - if [[ "${reqstatus}" = "valid" ]]; then - echo " + Challenge is valid!" - else - [[ -n "${HOOK}" ]] && ("${HOOK}" "invalid_challenge" "${altname}" "${result}" || _exiterr 'invalid_challenge hook returned with non-zero exit code') - break - fi - idx=$((idx+1)) - done - - if [[ ${num_pending_challenges} -ne 0 ]]; then - echo " + Cleaning challenge tokens..." - - # Clean challenge tokens using chained hook - # shellcheck disable=SC2068 - [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" = "yes" ]] && ("${HOOK}" "clean_challenge" ${deploy_args[@]} || _exiterr 'clean_challenge hook returned with non-zero exit code') - - # Clean remaining challenge tokens if validation has failed - local idx=0 - while [ ${idx} -lt ${num_pending_challenges} ]; do - # Delete challenge file - [[ "${CHALLENGETYPE}" = "http-01" ]] && rm -f "${WELLKNOWN}/${challenge_tokens[${idx}]}" - # Delete alpn verification certificates - [[ "${CHALLENGETYPE}" = "tls-alpn-01" ]] && rm -f "${ALPNCERTDIR}/${challenge_names[${idx}]}.crt.pem" "${ALPNCERTDIR}/${challenge_names[${idx}]}.key.pem" - # Clean challenge token using non-chained hook - # shellcheck disable=SC2086 - [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" != "yes" ]] && ("${HOOK}" "clean_challenge" ${deploy_args[${idx}]} || _exiterr 'clean_challenge hook returned with non-zero exit code') - idx=$((idx+1)) - done - - if [[ "${reqstatus}" != "valid" ]]; then - echo " + Challenge validation has failed :(" - _exiterr "Challenge is invalid! (returned: ${reqstatus}) (result: ${result})" - fi - fi - - # Finally request certificate from the acme-server and store it in cert-${timestamp}.pem and link from cert.pem - echo " + Requesting certificate..." - csr64="$("${OPENSSL}" req -in "${csrfile}" -config "${OPENSSL_CNF}" -outform DER | urlbase64)" - if [[ ${API} -eq 1 ]]; then - crt64="$(signed_request "${CA_NEW_CERT}" '{"resource": "new-cert", "csr": "'"${csr64}"'"}' | "${OPENSSL}" base64 -e)" - crt="$( printf -- '-----BEGIN CERTIFICATE-----\n%s\n-----END CERTIFICATE-----\n' "${crt64}" )" - else - result="$(signed_request "${finalize}" '{"csr": "'"${csr64}"'"}' | jsonsh)" - waited=0 - while :; do - orderstatus="$(echo "${result}" | get_json_string_value status)" - case "${orderstatus}" - in - "processing" | "pending") - if [ ${ORDER_TIMEOUT} -gt 0 ] && [ ${waited} -gt ${ORDER_TIMEOUT} ]; then - _exiterr "Timed out waiting for processing of order (still ${orderstatus})" - fi - echo " + Order is ${orderstatus}..." - sleep 2; - waited=$((waited+2)) - ;; - "valid") - break; - ;; - *) - _exiterr "Order has invalid/unknown status: ${orderstatus}" - ;; - esac - result="$(signed_request "${order_location}" "" | jsonsh)" - done - - resheaders="$(_mktemp)" - certificate="$(echo "${result}" | get_json_string_value certificate)" - crt="$(signed_request "${certificate}" "" 4>"${resheaders}")" - - if [ -n "${PREFERRED_CHAIN:-}" ]; then - foundaltchain=0 - altcn="$(get_last_cn "${crt}")" - altoptions="${altcn}" - if [ "${altcn}" = "${PREFERRED_CHAIN}" ]; then - foundaltchain=1 - fi - if [ "${foundaltchain}" = "0" ] && (grep -Ei '^link:' "${resheaders}" | grep -q -Ei 'rel="alternate"'); then - while read -r altcrturl; do - if [ "${foundaltchain}" = "0" ]; then - altcrt="$(signed_request "${altcrturl}" "")" - altcn="$(get_last_cn "${altcrt}")" - altoptions="${altoptions}, ${altcn}" - if [ "${altcn}" = "${PREFERRED_CHAIN}" ]; then - foundaltchain=1 - crt="${altcrt}" - fi - fi - done <<< "$(grep -Ei '^link:' "${resheaders}" | grep -Ei 'rel="alternate"' | cut -d'<' -f2 | cut -d'>' -f1)" - fi - if [ "${foundaltchain}" = "0" ]; then - _exiterr "Alternative chain with CN = ${PREFERRED_CHAIN} not found, available options: ${altoptions}" - fi - echo " + Using preferred chain with CN = ${altcn}" - fi - rm -f "${resheaders}" - fi - - # Try to load the certificate to detect corruption - echo " + Checking certificate..." - _openssl x509 -text <<<"${crt}" - - echo "${crt}" >&3 - - unset challenge_token - echo " + Done!" -} - -# grep issuer cert uri from certificate -get_issuer_cert_uri() { - certificate="${1}" - "${OPENSSL}" x509 -in "${certificate}" -noout -text | (grep 'CA Issuers - URI:' | cut -d':' -f2-) || true -} - -get_issuer_hash() { - certificate="${1}" - "${OPENSSL}" x509 -in "${certificate}" -noout -issuer_hash -} - -get_ocsp_url() { - certificate="${1}" - "${OPENSSL}" x509 -in "${certificate}" -noout -ocsp_uri -} - -# walk certificate chain, retrieving all intermediate certificates -walk_chain() { - local certificate - certificate="${1}" - - local issuer_cert_uri - issuer_cert_uri="${2:-}" - if [[ -z "${issuer_cert_uri}" ]]; then issuer_cert_uri="$(get_issuer_cert_uri "${certificate}")"; fi - if [[ -n "${issuer_cert_uri}" ]]; then - # create temporary files - local tmpcert - local tmpcert_raw - tmpcert_raw="$(_mktemp)" - tmpcert="$(_mktemp)" - - # download certificate - http_request get "${issuer_cert_uri}" > "${tmpcert_raw}" - - # PEM - if grep -q "BEGIN CERTIFICATE" "${tmpcert_raw}"; then mv "${tmpcert_raw}" "${tmpcert}" - # DER - elif "${OPENSSL}" x509 -in "${tmpcert_raw}" -inform DER -out "${tmpcert}" -outform PEM 2> /dev/null > /dev/null; then : - # PKCS7 - elif "${OPENSSL}" pkcs7 -in "${tmpcert_raw}" -inform DER -out "${tmpcert}" -outform PEM -print_certs 2> /dev/null > /dev/null; then : - # Unknown certificate type - else _exiterr "Unknown certificate type in chain" - fi - - local next_issuer_cert_uri - next_issuer_cert_uri="$(get_issuer_cert_uri "${tmpcert}")" - if [[ -n "${next_issuer_cert_uri}" ]]; then - printf "\n%s\n" "${issuer_cert_uri}" - cat "${tmpcert}" - walk_chain "${tmpcert}" "${next_issuer_cert_uri}" - fi - rm -f "${tmpcert}" "${tmpcert_raw}" - fi -} - -# Generate ALPN verification certificate -generate_alpn_certificate() { - local altname="${1}" - local identifier_type="${2}" - local acmevalidation="${3}" - - local alpncertdir="${ALPNCERTDIR}" - if [[ ! -e "${alpncertdir}" ]]; then - echo " + Creating new directory ${alpncertdir} ..." - mkdir -p "${alpncertdir}" || _exiterr "Unable to create directory ${alpncertdir}" - fi - - echo " + Generating ALPN certificate and key for ${1}..." - tmp_openssl_cnf="$(_mktemp)" - cat "${OPENSSL_CNF}" > "${tmp_openssl_cnf}" - if [[ "${identifier_type}" = "ip" ]]; then - printf "\n[SAN]\nsubjectAltName=IP:%s\n" "${altname}" >> "${tmp_openssl_cnf}" - else - printf "\n[SAN]\nsubjectAltName=DNS:%s\n" "${altname}" >> "${tmp_openssl_cnf}" - fi - printf "1.3.6.1.5.5.7.1.31=critical,DER:04:20:%s\n" "${acmevalidation}" >> "${tmp_openssl_cnf}" - SUBJ="/CN=${altname}/" - [[ "${OSTYPE:0:5}" = "MINGW" ]] && SUBJ="/${SUBJ}" - if [[ "${identifier_type}" = "ip" ]]; then - altname="$(echo "${altname}" | ip_to_ptr)" - fi - _openssl req -x509 -new -sha256 -nodes -newkey rsa:2048 -keyout "${alpncertdir}/${altname}.key.pem" -out "${alpncertdir}/${altname}.crt.pem" -subj "${SUBJ}" -extensions SAN -config "${tmp_openssl_cnf}" - chmod g+r "${alpncertdir}/${altname}.key.pem" "${alpncertdir}/${altname}.crt.pem" - rm -f "${tmp_openssl_cnf}" -} - -# Create certificate for domain(s) -sign_domain() { - local certdir="${1}" - shift - timestamp="${1}" - shift - domain="${1}" - altnames="${*}" - - export altnames - - echo " + Signing domains..." - if [[ ${API} -eq 1 ]]; then - if [[ -z "${CA_NEW_AUTHZ}" ]] || [[ -z "${CA_NEW_CERT}" ]]; then - _exiterr "Certificate authority doesn't allow certificate signing" - fi - elif [[ ${API} -eq 2 ]] && [[ -z "${CA_NEW_ORDER}" ]]; then - _exiterr "Certificate authority doesn't allow certificate signing" - fi - - local privkey="privkey.pem" - if [[ ! -e "${certdir}/cert-${timestamp}.csr" ]]; then - # generate a new private key if we need or want one - if [[ ! -r "${certdir}/privkey.pem" ]] || [[ "${PRIVATE_KEY_RENEW}" = "yes" ]]; then - echo " + Generating private key..." - privkey="privkey-${timestamp}.pem" - local tmp_privkey - tmp_privkey="$(_mktemp)" - case "${KEY_ALGO}" in - rsa) _openssl genrsa -out "${tmp_privkey}" "${KEYSIZE}";; - prime256v1|secp384r1) _openssl ecparam -genkey -name "${KEY_ALGO}" -out "${tmp_privkey}" -noout;; - esac - cat "${tmp_privkey}" > "${certdir}/privkey-${timestamp}.pem" - rm "${tmp_privkey}" - fi - # move rolloverkey into position (if any) - if [[ -r "${certdir}/privkey.pem" && -r "${certdir}/privkey.roll.pem" && "${PRIVATE_KEY_RENEW}" = "yes" && "${PRIVATE_KEY_ROLLOVER}" = "yes" ]]; then - echo " + Moving Rolloverkey into position.... " - mv "${certdir}/privkey.roll.pem" "${certdir}/privkey-tmp.pem" - mv "${certdir}/privkey-${timestamp}.pem" "${certdir}/privkey.roll.pem" - mv "${certdir}/privkey-tmp.pem" "${certdir}/privkey-${timestamp}.pem" - fi - # generate a new private rollover key if we need or want one - if [[ ! -r "${certdir}/privkey.roll.pem" && "${PRIVATE_KEY_ROLLOVER}" = "yes" && "${PRIVATE_KEY_RENEW}" = "yes" ]]; then - echo " + Generating private rollover key..." - case "${KEY_ALGO}" in - rsa) _openssl genrsa -out "${certdir}/privkey.roll.pem" "${KEYSIZE}";; - prime256v1|secp384r1) _openssl ecparam -genkey -name "${KEY_ALGO}" -out "${certdir}/privkey.roll.pem" -noout;; - esac - fi - # delete rolloverkeys if disabled - if [[ -r "${certdir}/privkey.roll.pem" && ! "${PRIVATE_KEY_ROLLOVER}" = "yes" ]]; then - echo " + Removing Rolloverkey (feature disabled)..." - rm -f "${certdir}/privkey.roll.pem" - fi - - # Generate signing request config and the actual signing request - echo " + Generating signing request..." - SAN="" - for altname in ${altnames}; do - if [[ "${altname}" =~ ^ip: ]]; then - SAN="${SAN}IP:${altname:3}, " - else - SAN="${SAN}DNS:${altname}, " - fi - done - if [[ "${domain}" =~ ^ip: ]]; then - SUBJ="/" - else - SUBJ="/CN=${domain}/" - fi - SAN="${SAN%%, }" - local tmp_openssl_cnf - tmp_openssl_cnf="$(_mktemp)" - cat "${OPENSSL_CNF}" > "${tmp_openssl_cnf}" - printf "\n[SAN]\nsubjectAltName=%s" "${SAN}" >> "${tmp_openssl_cnf}" - if [ "${OCSP_MUST_STAPLE}" = "yes" ]; then - printf "\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >> "${tmp_openssl_cnf}" - fi - if [[ "${OSTYPE:0:5}" = "MINGW" ]]; then - # The subject starts with a /, so MSYS will assume it's a path and convert - # it unless we escape it with another one: - SUBJ="/${SUBJ}" - fi - "${OPENSSL}" req -new -sha256 -key "${certdir}/${privkey}" -out "${certdir}/cert-${timestamp}.csr" -subj "${SUBJ}" -reqexts SAN -config "${tmp_openssl_cnf}" - rm -f "${tmp_openssl_cnf}" - fi - - crt_path="${certdir}/cert-${timestamp}.pem" - # shellcheck disable=SC2086 - sign_csr "${certdir}/cert-${timestamp}.csr" ${altnames} 3>"${crt_path}" - - # Create fullchain.pem - echo " + Creating fullchain.pem..." - if [[ ${API} -eq 1 ]]; then - cat "${crt_path}" > "${certdir}/fullchain-${timestamp}.pem" - local issuer_hash - issuer_hash="$(get_issuer_hash "${crt_path}")" - if [ -e "${CHAINCACHE}/${issuer_hash}.chain" ]; then - echo " + Using cached chain!" - cat "${CHAINCACHE}/${issuer_hash}.chain" > "${certdir}/chain-${timestamp}.pem" - else - echo " + Walking chain..." - local issuer_cert_uri - issuer_cert_uri="$(get_issuer_cert_uri "${crt_path}" || echo "unknown")" - (walk_chain "${crt_path}" > "${certdir}/chain-${timestamp}.pem") || _exiterr "Walking chain has failed, your certificate has been created and can be found at ${crt_path}, the corresponding private key at ${privkey}. If you want you can manually continue on creating and linking all necessary files. If this error occurs again you should manually generate the certificate chain and place it under ${CHAINCACHE}/${issuer_hash}.chain (see ${issuer_cert_uri})" - cat "${certdir}/chain-${timestamp}.pem" > "${CHAINCACHE}/${issuer_hash}.chain" - fi - cat "${certdir}/chain-${timestamp}.pem" >> "${certdir}/fullchain-${timestamp}.pem" - else - tmpcert="$(_mktemp)" - tmpchain="$(_mktemp)" - awk '{print >out}; /----END CERTIFICATE-----/{out=tmpchain}' out="${tmpcert}" tmpchain="${tmpchain}" "${certdir}/cert-${timestamp}.pem" - mv "${certdir}/cert-${timestamp}.pem" "${certdir}/fullchain-${timestamp}.pem" - cat "${tmpcert}" > "${certdir}/cert-${timestamp}.pem" - cat "${tmpchain}" > "${certdir}/chain-${timestamp}.pem" - rm "${tmpcert}" "${tmpchain}" - fi - - # Wait for hook script to sync the files before creating the symlinks - [[ -n "${HOOK}" ]] && ("${HOOK}" "sync_cert" "${certdir}/privkey-${timestamp}.pem" "${certdir}/cert-${timestamp}.pem" "${certdir}/fullchain-${timestamp}.pem" "${certdir}/chain-${timestamp}.pem" "${certdir}/cert-${timestamp}.csr" || _exiterr 'sync_cert hook returned with non-zero exit code') - - # Update symlinks - [[ "${privkey}" = "privkey.pem" ]] || ln -sf "privkey-${timestamp}.pem" "${certdir}/privkey.pem" - - ln -sf "chain-${timestamp}.pem" "${certdir}/chain.pem" - ln -sf "fullchain-${timestamp}.pem" "${certdir}/fullchain.pem" - ln -sf "cert-${timestamp}.csr" "${certdir}/cert.csr" - ln -sf "cert-${timestamp}.pem" "${certdir}/cert.pem" - - # Wait for hook script to clean the challenge and to deploy cert if used - [[ -n "${HOOK}" ]] && ("${HOOK}" "deploy_cert" "${domain}" "${certdir}/privkey.pem" "${certdir}/cert.pem" "${certdir}/fullchain.pem" "${certdir}/chain.pem" "${timestamp}" || _exiterr 'deploy_cert hook returned with non-zero exit code') - - unset challenge_token - echo " + Done!" -} - -# Update OCSP stapling file -update_ocsp_stapling() { - local certdir="${1}" - local update_ocsp="${2}" - local cert="${3}" - local chain="${4}" - - local ocsp_url="$(get_ocsp_url "${cert}")" - - if [[ -z "${ocsp_url}" ]]; then - echo " ! ERROR: OCSP stapling requested but no OCSP url found in certificate." >&2 - echo " ! Keep in mind that some CAs ended support for OCSP: https://letsencrypt.org/2024/12/05/ending-ocsp/" >&2 - return 1 - fi - - if [[ ! -e "${certdir}/ocsp.der" ]]; then - update_ocsp="yes" - elif ! ("${OPENSSL}" ocsp -no_nonce -issuer "${chain}" -verify_other "${chain}" -cert "${cert}" -respin "${certdir}/ocsp.der" -status_age $((OCSP_DAYS*24*3600)) 2>&1 | grep -q "${cert}: good"); then - update_ocsp="yes" - fi - - if [[ "${update_ocsp}" = "yes" ]]; then - echo " + Updating OCSP stapling file" - ocsp_timestamp="$(date +%s)" - if grep -qE "^(openssl (0|(1\.0))\.)|(libressl (1|2|3)\.)" <<< "$(${OPENSSL} version | awk '{print tolower($0)}')"; then - ocsp_log="$("${OPENSSL}" ocsp -no_nonce -issuer "${chain}" -verify_other "${chain}" -cert "${cert}" -respout "${certdir}/ocsp-${ocsp_timestamp}.der" -url "${ocsp_url}" -header "HOST" "$(echo "${ocsp_url}" | _sed -e 's/^http(s?):\/\///' -e 's/\/.*$//g')" 2>&1)" || _exiterr "Fetching of OCSP information failed. Please note that some CAs (e.g. LetsEncrypt) do no longer support OCSP. Error message: ${ocsp_log}" - else - ocsp_log="$("${OPENSSL}" ocsp -no_nonce -issuer "${chain}" -verify_other "${chain}" -cert "${cert}" -respout "${certdir}/ocsp-${ocsp_timestamp}.der" -url "${ocsp_url}" 2>&1)" || _exiterr "Fetching of OCSP information failed. Please note that some CAs (e.g. LetsEncrypt) do no longer support OCSP. Error message: ${ocsp_log}" - fi - ln -sf "ocsp-${ocsp_timestamp}.der" "${certdir}/ocsp.der" - [[ -n "${HOOK}" ]] && (altnames="${domain} ${morenames}" "${HOOK}" "deploy_ocsp" "${domain}" "${certdir}/ocsp.der" "${ocsp_timestamp}" || _exiterr 'deploy_ocsp hook returned with non-zero exit code') - else - echo " + OCSP stapling file is still valid (skipping update)" - fi -} - -# Usage: --version (-v) -# Description: Print version information -command_version() { - load_config noverify - - echo "Dehydrated by Lukas Schauer" - echo "https://dehydrated.io" - echo "" - echo "Dehydrated version: ${VERSION}" - revision="$(cd "${SCRIPTDIR}"; git rev-parse HEAD 2>/dev/null || echo "unknown")" - echo "GIT-Revision: ${revision}" - echo "" - # shellcheck disable=SC1091 - if [[ "${OSTYPE}" =~ (BSD|Darwin) ]]; then - echo "OS: $(uname -sr)" - elif [[ -e /etc/os-release ]]; then - ( . /etc/os-release && echo "OS: $PRETTY_NAME" ) - elif [[ -e /usr/lib/os-release ]]; then - ( . /usr/lib/os-release && echo "OS: $PRETTY_NAME" ) - else - echo "OS: $(grep -v '^$' /etc/issue | head -n1 | _sed 's/\\(r|n|l) .*//g')" - fi - echo "Used software:" - [[ -n "${BASH_VERSION:-}" ]] && echo " bash: ${BASH_VERSION}" - [[ -n "${ZSH_VERSION:-}" ]] && echo " zsh: ${ZSH_VERSION}" - echo " curl: ${CURL_VERSION}" - if [[ "${OSTYPE}" =~ (BSD|Darwin) ]]; then - echo " awk, sed, mktemp, grep, diff: BSD base system versions" - else - echo " awk: $(awk -W version 2>&1 | head -n1)" - echo " sed: $(sed --version 2>&1 | head -n1)" - echo " mktemp: $(mktemp --version 2>&1 | head -n1)" - echo " grep: $(grep --version 2>&1 | head -n1)" - echo " diff: $(diff --version 2>&1 | head -n1)" - fi - echo " openssl: $("${OPENSSL}" version 2>&1)" - - exit 0 -} - -# Usage: --display-terms -# Description: Display current terms of service -command_terms() { - init_system - echo "The current terms of service: $CA_TERMS" - echo "+ Done!" - exit 0 -} - -# Usage: --register -# Description: Register account key -command_register() { - init_system - echo "+ Done!" - exit 0 -} - -# Usage: --account -# Description: Update account contact information -command_account() { - init_system - FAILED=false - - NEW_ACCOUNT_KEY_JSON="$(_mktemp)" - - # Check if we have the registration url - if [[ -z "${ACCOUNT_URL}" ]]; then - _exiterr "Error retrieving registration url." - fi - - echo "+ Updating registration url: ${ACCOUNT_URL} contact information..." - if [[ ${API} -eq 1 ]]; then - # If an email for the contact has been provided then adding it to the registered account - if [[ -n "${CONTACT_EMAIL}" ]]; then - (signed_request "${ACCOUNT_URL}" '{"resource": "reg", "contact":["mailto:'"${CONTACT_EMAIL}"'"]}' > "${NEW_ACCOUNT_KEY_JSON}") || FAILED=true - else - (signed_request "${ACCOUNT_URL}" '{"resource": "reg", "contact":[]}' > "${NEW_ACCOUNT_KEY_JSON}") || FAILED=true - fi - else - # If an email for the contact has been provided then adding it to the registered account - if [[ -n "${CONTACT_EMAIL}" ]]; then - (signed_request "${ACCOUNT_URL}" '{"contact":["mailto:'"${CONTACT_EMAIL}"'"]}' > "${NEW_ACCOUNT_KEY_JSON}") || FAILED=true - else - (signed_request "${ACCOUNT_URL}" '{"contact":[]}' > "${NEW_ACCOUNT_KEY_JSON}") || FAILED=true - fi - fi - - if [[ "${FAILED}" = "true" ]]; then - rm "${NEW_ACCOUNT_KEY_JSON}" - _exiterr "Error updating account information. See message above for more information." - fi - if diff -q "${NEW_ACCOUNT_KEY_JSON}" "${ACCOUNT_KEY_JSON}" > /dev/null; then - echo "+ Account information was the same after the update" - rm "${NEW_ACCOUNT_KEY_JSON}" - else - ACCOUNT_KEY_JSON_BACKUP="${ACCOUNT_KEY_JSON%.*}-$(date +%s).json" - echo "+ Backup ${ACCOUNT_KEY_JSON} as ${ACCOUNT_KEY_JSON_BACKUP}" - cp -p "${ACCOUNT_KEY_JSON}" "${ACCOUNT_KEY_JSON_BACKUP}" - echo "+ Populate ${ACCOUNT_KEY_JSON}" - mv "${NEW_ACCOUNT_KEY_JSON}" "${ACCOUNT_KEY_JSON}" - fi - echo "+ Done!" - exit 0 -} - -# Parse contents of domains.txt and domains.txt.d -parse_domains_txt() { - # Allow globbing temporarily - noglob_set - local inputs=("${DOMAINS_TXT}" "${DOMAINS_TXT}.d"/*.txt) - noglob_clear - - cat "${inputs[@]}" | - tr -d '\r' | - awk '{print tolower($0)}' | - _sed -e 's/^[[:space:]]*//g' -e 's/[[:space:]]*$//g' -e 's/[[:space:]]+/ /g' -e 's/([^ ])>/\1 >/g' -e 's/> />/g' | - (grep -vE '^(#|$)' || true) -} - -# Usage: --cron (-c) -# Description: Sign/renew non-existent/changed/expiring certificates. -command_sign_domains() { - init_system - hookscript_bricker_hook - - # Call startup hook - [[ -n "${HOOK}" ]] && ("${HOOK}" "startup_hook" || _exiterr 'startup_hook hook returned with non-zero exit code') - - if [ ! -d "${CHAINCACHE}" ]; then - echo " + Creating chain cache directory ${CHAINCACHE}" - mkdir "${CHAINCACHE}" - fi - - if [[ -n "${PARAM_DOMAIN:-}" ]]; then - DOMAINS_TXT="$(_mktemp)" - if [[ -n "${PARAM_ALIAS:-}" ]]; then - printf "%s > %s" "${PARAM_DOMAIN}" "${PARAM_ALIAS}" > "${DOMAINS_TXT}" - else - printf "%s" "${PARAM_DOMAIN}" > "${DOMAINS_TXT}" - fi - elif [[ -e "${DOMAINS_TXT}" ]]; then - if [[ ! -r "${DOMAINS_TXT}" ]]; then - _exiterr "domains.txt found but not readable" - fi - else - _exiterr "domains.txt not found and --domain not given" - fi - - # Generate certificates for all domains found in domains.txt. Check if existing certificate are about to expire - ORIGIFS="${IFS}" - IFS=$'\n' - for line in $(parse_domains_txt); do - reset_configvars - IFS="${ORIGIFS}" - alias="$(grep -Eo '>[^ ]+' <<< "${line}" || true)" - line="$(_sed -e 's/>[^ ]+[ ]*//g' <<< "${line}")" - aliascount="$(grep -Eo '>' <<< "${alias}" | awk 'END {print NR}' || true )" - [ "${aliascount}" -gt 1 ] && _exiterr "Only one alias per line is allowed in domains.txt!" - - domain="$(printf '%s\n' "${line}" | cut -d' ' -f1)" - morenames="$(printf '%s\n' "${line}" | cut -s -d' ' -f2-)" - [ "${aliascount}" -lt 1 ] && alias="${domain}" || alias="${alias#>}" - export alias - - if [[ -z "${morenames}" ]];then - echo "Processing ${domain}" - else - echo "Processing ${domain} with alternative names: ${morenames}" - fi - - if [ "${alias:0:2}" = "*." ]; then - _exiterr "Please define a valid alias for your ${domain} wildcard-certificate. See domains.txt-documentation for more details." - fi - - local certdir="${CERTDIR}/${alias}" - cert="${certdir}/cert.pem" - chain="${certdir}/chain.pem" - - force_renew="${PARAM_FORCE:-no}" - - timestamp="$(date +%s)" - - # If there is no existing certificate directory => make it - if [[ ! -e "${certdir}" ]]; then - echo " + Creating new directory ${certdir} ..." - mkdir -p "${certdir}" || _exiterr "Unable to create directory ${certdir}" - fi - - # read cert config - # for now this loads the certificate specific config in a subshell and parses a diff of set variables. - # we could just source the config file but i decided to go this way to protect people from accidentally overriding - # variables used internally by this script itself. - if [[ -n "${DOMAINS_D}" ]]; then - certconfig="${DOMAINS_D}/${alias}" - else - certconfig="${certdir}/config" - fi - - if [ -f "${certconfig}" ]; then - echo " + Using certificate specific config file!" - ORIGIFS="${IFS}" - IFS=$'\n' - for cfgline in $( - beforevars="$(_mktemp)" - aftervars="$(_mktemp)" - set > "${beforevars}" - # shellcheck disable=SC1090 - . "${certconfig}" - set > "${aftervars}" - diff -u "${beforevars}" "${aftervars}" | grep -E '^\+[^+]' - rm "${beforevars}" - rm "${aftervars}" - ); do - config_var="$(echo "${cfgline:1}" | cut -d'=' -f1)" - config_value="$(echo "${cfgline:1}" | cut -d'=' -f2- | tr -d "'")" - # All settings that are allowed here should also be stored and - # restored in store_configvars() and reset_configvars() - case "${config_var}" in - KEY_ALGO|OCSP_MUST_STAPLE|OCSP_FETCH|OCSP_DAYS|PRIVATE_KEY_RENEW|PRIVATE_KEY_ROLLOVER|KEYSIZE|CHALLENGETYPE|HOOK|PREFERRED_CHAIN|WELLKNOWN|HOOK_CHAIN|OPENSSL_CNF|RENEW_DAYS|ACME_PROFILE|ORDER_TIMEOUT|VALIDATION_TIMEOUT|KEEP_GOING) - echo " + ${config_var} = ${config_value}" - declare -- "${config_var}=${config_value}" - ;; - _) ;; - *) echo " ! Setting ${config_var} on a per-certificate base is not (yet) supported" >&2 - esac - done - IFS="${ORIGIFS}" - fi - verify_config - hookscript_bricker_hook - export WELLKNOWN CHALLENGETYPE KEY_ALGO PRIVATE_KEY_ROLLOVER - - skip="no" - - # Allow for external CSR generation - local csrfile="" - if [[ -n "${HOOK}" ]]; then - csr="$("${HOOK}" "generate_csr" "${domain}" "${certdir}" "${domain} ${morenames}")" || _exiterr 'generate_csr hook returned with non-zero exit code' - if grep -qE "\-----BEGIN (NEW )?CERTIFICATE REQUEST-----" <<< "${csr}"; then - csrfile="$(_mktemp)" - cat > "${csrfile}" <<< "${csr}" - altnames="$(extract_altnames "${csrfile}")" - domain="$(cut -d' ' -f1 <<< "${altnames}")" - morenames="$(cut -s -d' ' -f2- <<< "${altnames}")" - echo " + Using CSR from hook script (real names: ${altnames})" - else - csrfile="" - fi - fi - - # Check domain names of existing certificate - if [[ -e "${cert}" && "${force_renew}" = "no" ]]; then - printf " + Checking domain name(s) of existing cert..." - - certnames="$("${OPENSSL}" x509 -in "${cert}" -text -noout | grep -E '(DNS|IP( Address*)):' | _sed 's/(DNS|IP( Address)*)://g' | tr -d ' ' | tr ',' '\n' | sort -u | tr '\n' ' ' | _sed 's/ $//')" - givennames="$(echo "${domain}" "${morenames}"| tr ' ' '\n' | sort -u | tr '\n' ' ' | _sed 's/ip://g' | _sed 's/ $//' | _sed 's/^ //')" - - if [[ "${certnames}" = "${givennames}" ]]; then - echo " unchanged." - else - echo " changed!" - echo " + Domain name(s) are not matching!" - echo " + Names in old certificate: ${certnames}" - echo " + Configured names: ${givennames}" - echo " + Forcing renew." - force_renew="yes" - fi - fi - - # Check expire date of existing certificate - if [[ -e "${cert}" ]]; then - echo " + Checking expire date of existing cert..." - valid="$("${OPENSSL}" x509 -enddate -noout -in "${cert}" | cut -d= -f2- )" - - printf " + Valid till %s " "${valid}" - if ("${OPENSSL}" x509 -checkend $((RENEW_DAYS * 86400)) -noout -in "${cert}" > /dev/null 2>&1); then - printf "(Longer than %d days). " "${RENEW_DAYS}" - if [[ "${force_renew}" = "yes" ]]; then - echo "Ignoring because renew was forced!" - else - # Certificate-Names unchanged and cert is still valid - echo "Skipping renew!" - [[ -n "${HOOK}" ]] && ("${HOOK}" "unchanged_cert" "${domain}" "${certdir}/privkey.pem" "${certdir}/cert.pem" "${certdir}/fullchain.pem" "${certdir}/chain.pem" || _exiterr 'unchanged_cert hook returned with non-zero exit code') - skip="yes" - fi - else - echo "(Less than ${RENEW_DAYS} days). Renewing!" - fi - fi - - local update_ocsp - update_ocsp="no" - - # Sign certificate for this domain - if [[ ! "${skip}" = "yes" ]]; then - update_ocsp="yes" - if [[ -n "${csrfile}" ]]; then - cat "${csrfile}" > "${certdir}/cert-${timestamp}.csr" - rm "${csrfile}" - fi - # shellcheck disable=SC2086 - if [[ "${KEEP_GOING:-}" = "yes" ]]; then - skip_exit_hook=yes - sign_domain "${certdir}" "${timestamp}" "${domain}" ${morenames} & - wait $! || exit_with_errorcode=1 - skip_exit_hook=no - else - sign_domain "${certdir}" "${timestamp}" "${domain}" ${morenames} - fi - fi - - if [[ "${OCSP_FETCH}" = "yes" ]]; then - if [[ "${KEEP_GOING:-}" = "yes" ]]; then - skip_exit_hook=yes - update_ocsp_stapling "${certdir}" "${update_ocsp}" "${cert}" "${chain}" & - wait $! || exit_with_errorcode=1 - skip_exit_hook=no - else - update_ocsp_stapling "${certdir}" "${update_ocsp}" "${cert}" "${chain}" - fi - fi - done - reset_configvars - - # remove temporary domains.txt file if used - [[ -n "${PARAM_DOMAIN:-}" ]] && rm -f "${DOMAINS_TXT}" - - [[ -n "${HOOK}" ]] && ("${HOOK}" "exit_hook" || echo 'exit_hook returned with non-zero exit code!' >&2) - if [[ "${AUTO_CLEANUP}" == "yes" ]]; then - echo " + Running automatic cleanup" - PARAM_CLEANUPDELETE="${AUTO_CLEANUP_DELETE:-no}" command_cleanup noinit | _sed 's/^/ + /g' - fi - - exit "${exit_with_errorcode}" -} - -# Usage: --signcsr (-s) path/to/csr.pem -# Description: Sign a given CSR, output CRT on stdout (advanced usage) -command_sign_csr() { - init_system - - # redirect stdout to stderr - # leave stdout over at fd 3 to output the cert - exec 3>&1 1>&2 - - # load csr - local csrfile="${1}" - if [ ! -r "${csrfile}" ]; then - _exiterr "Could not read certificate signing request ${csrfile}" - fi - - # extract names - altnames="$(extract_altnames "${csrfile}")" - - # gen cert - certfile="$(_mktemp)" - # shellcheck disable=SC2086 - sign_csr "${csrfile}" ${altnames} 3> "${certfile}" - - # print cert - echo "# CERT #" >&3 - cat "${certfile}" >&3 - echo >&3 - - # print chain - if [ -n "${PARAM_FULL_CHAIN:-}" ]; then - # get and convert ca cert - chainfile="$(_mktemp)" - tmpchain="$(_mktemp)" - http_request get "$("${OPENSSL}" x509 -in "${certfile}" -noout -text | grep 'CA Issuers - URI:' | cut -d':' -f2-)" > "${tmpchain}" - if grep -q "BEGIN CERTIFICATE" "${tmpchain}"; then - mv "${tmpchain}" "${chainfile}" - else - "${OPENSSL}" x509 -in "${tmpchain}" -inform DER -out "${chainfile}" -outform PEM - rm "${tmpchain}" - fi - - echo "# CHAIN #" >&3 - cat "${chainfile}" >&3 - - rm "${chainfile}" - fi - - # cleanup - rm "${certfile}" - - exit 0 -} - -# Usage: --revoke (-r) path/to/cert.pem -# Description: Revoke specified certificate -command_revoke() { - init_system - - [[ -n "${CA_REVOKE_CERT}" ]] || _exiterr "Certificate authority doesn't allow certificate revocation." - - cert="${1}" - if [[ -L "${cert}" ]]; then - # follow symlink and use real certificate name (so we move the real file and not the symlink at the end) - local link_target - link_target="$(readlink -n "${cert}")" - if [[ "${link_target}" =~ ^/ ]]; then - cert="${link_target}" - else - cert="$(dirname "${cert}")/${link_target}" - fi - fi - [[ -f "${cert}" ]] || _exiterr "Could not find certificate ${cert}" - - echo "Revoking ${cert}" - - cert64="$("${OPENSSL}" x509 -in "${cert}" -inform PEM -outform DER | urlbase64)" - if [[ ${API} -eq 1 ]]; then - response="$(signed_request "${CA_REVOKE_CERT}" '{"resource": "revoke-cert", "certificate": "'"${cert64}"'"}' | clean_json)" - else - response="$(signed_request "${CA_REVOKE_CERT}" '{"certificate": "'"${cert64}"'"}' | clean_json)" - fi - # if there is a problem with our revoke request _request (via signed_request) will report this and "exit 1" out - # so if we are here, it is safe to assume the request was successful - echo " + Done." - echo " + Renaming certificate to ${cert}-revoked" - mv -f "${cert}" "${cert}-revoked" -} - -# Usage: --deactivate -# Description: Deactivate account -command_deactivate() { - init_system - - echo "Deactivating account ${ACCOUNT_URL}" - - if [[ ${API} -eq 1 ]]; then - echo "Deactivation for ACMEv1 is not implemented" - else - response="$(signed_request "${ACCOUNT_URL}" '{"status": "deactivated"}' | clean_json)" - deactstatus=$(echo "$response" | jsonsh | get_json_string_value "status") - if [[ "${deactstatus}" = "deactivated" ]]; then - touch "${ACCOUNT_DEACTIVATED}" - else - _exiterr "Account deactivation failed!" - fi - fi - - echo " + Done." -} - -# Usage: --cleanup (-gc) -# Description: Move unused certificate files to archive directory -command_cleanup() { - if [ ! "${1:-}" = "noinit" ]; then - load_config - fi - - if [[ ! "${PARAM_CLEANUPDELETE:-}" = "yes" ]]; then - # Create global archive directory if not existent - if [[ ! -e "${BASEDIR}/archive" ]]; then - mkdir "${BASEDIR}/archive" - fi - fi - - # Allow globbing - noglob_set - - # Loop over all certificate directories - for certdir in "${CERTDIR}/"*; do - # Skip if entry is not a folder - [[ -d "${certdir}" ]] || continue - - # Get certificate name - certname="$(basename "${certdir}")" - - # Create certificates archive directory if not existent - if [[ ! "${PARAM_CLEANUPDELETE:-}" = "yes" ]]; then - archivedir="${BASEDIR}/archive/${certname}" - if [[ ! -e "${archivedir}" ]]; then - mkdir "${archivedir}" - fi - fi - - # Loop over file-types (certificates, keys, signing-requests, ...) - for filetype in cert.csr cert.pem chain.pem fullchain.pem privkey.pem ocsp.der; do - # Delete all if symlink is broken - if [[ -r "${certdir}/${filetype}" ]]; then - # Look up current file in use - current="$(basename "$(readlink "${certdir}/${filetype}")")" - else - if [[ -h "${certdir}/${filetype}" ]]; then - echo "Removing broken symlink: ${certdir}/${filetype}" - rm -f "${certdir}/${filetype}" - fi - current="" - fi - - # Split filetype into name and extension - filebase="$(echo "${filetype}" | cut -d. -f1)" - fileext="$(echo "${filetype}" | cut -d. -f2)" - - # Loop over all files of this type - for file in "${certdir}/${filebase}-"*".${fileext}" "${certdir}/${filebase}-"*".${fileext}-revoked"; do - # Check if current file is in use, if unused move to archive directory - filename="$(basename "${file}")" - if [[ ! "${filename}" = "${current}" ]] && [[ -f "${certdir}/${filename}" ]]; then - if [[ "${PARAM_CLEANUPDELETE:-}" = "yes" ]]; then - echo "Deleting unused file: ${certname}/${filename}" - rm "${certdir}/${filename}" - else - echo "Moving unused file to archive directory: ${certname}/${filename}" - mv "${certdir}/${filename}" "${archivedir}/${filename}" - fi - fi - done - done - done - - exit "${exit_with_errorcode}" -} - -# Usage: --cleanup-delete (-gcd) -# Description: Deletes (!) unused certificate files -command_cleanupdelete() { - command_cleanup -} - - -# Usage: --help (-h) -# Description: Show help text -command_help() { - printf "Usage: %s [-h] [command [argument]] [parameter [argument]] [parameter [argument]] ...\n\n" "${0}" - printf "Default command: help\n\n" - echo "Commands:" - grep -e '^[[:space:]]*# Usage:' -e '^[[:space:]]*# Description:' -e '^command_.*()[[:space:]]*{' "${0}" | while read -r usage; read -r description; read -r command; do - if [[ ! "${usage}" =~ Usage ]] || [[ ! "${description}" =~ Description ]] || [[ ! "${command}" =~ ^command_ ]]; then - _exiterr "Error generating help text." - fi - printf " %-32s %s\n" "${usage##"# Usage: "}" "${description##"# Description: "}" - done - printf -- "\nParameters:\n" - grep -E -e '^[[:space:]]*# PARAM_Usage:' -e '^[[:space:]]*# PARAM_Description:' "${0}" | while read -r usage; read -r description; do - if [[ ! "${usage}" =~ Usage ]] || [[ ! "${description}" =~ Description ]]; then - _exiterr "Error generating help text." - fi - printf " %-32s %s\n" "${usage##"# PARAM_Usage: "}" "${description##"# PARAM_Description: "}" - done -} - -# Usage: --env (-e) -# Description: Output configuration variables for use in other scripts -command_env() { - echo "# dehydrated configuration" - load_config - typeset -p CA CERTDIR ALPNCERTDIR CHALLENGETYPE DOMAINS_D DOMAINS_TXT HOOK HOOK_CHAIN RENEW_DAYS ACCOUNT_KEY ACCOUNT_KEY_JSON ACCOUNT_ID_JSON KEYSIZE WELLKNOWN PRIVATE_KEY_RENEW OPENSSL_CNF CONTACT_EMAIL LOCKFILE -} - -# Main method (parses script arguments and calls command_* methods) -main() { - exit_with_errorcode=0 - skip_exit_hook=no - COMMAND="" - set_command() { - [[ -z "${COMMAND}" ]] || _exiterr "Only one command can be executed at a time. See help (-h) for more information." - COMMAND="${1}" - } - - check_parameters() { - if [[ -z "${1:-}" ]]; then - echo "The specified command requires additional parameters. See help:" >&2 - echo >&2 - command_help >&2 - exit 1 - elif [[ "${1:0:1}" = "-" ]]; then - _exiterr "Invalid argument: ${1}" - fi - } - - [[ -z "${*}" ]] && eval set -- "--help" - - while (( ${#} )); do - case "${1}" in - --help|-h) - command_help - exit 0 - ;; - - --env|-e) - set_command env - ;; - - --cron|-c) - set_command sign_domains - ;; - - --register) - set_command register - ;; - - --account) - set_command account - ;; - - # PARAM_Usage: --accept-terms - # PARAM_Description: Accept CAs terms of service - --accept-terms) - PARAM_ACCEPT_TERMS="yes" - ;; - - --display-terms) - set_command terms - ;; - - --signcsr|-s) - shift 1 - set_command sign_csr - check_parameters "${1:-}" - PARAM_CSR="${1}" - ;; - - --revoke|-r) - shift 1 - set_command revoke - check_parameters "${1:-}" - PARAM_REVOKECERT="${1}" - ;; - - --deactivate) - set_command deactivate - ;; - - --version|-v) - set_command version - ;; - - --cleanup|-gc) - set_command cleanup - ;; - - --cleanup-delete|-gcd) - set_command cleanupdelete - PARAM_CLEANUPDELETE="yes" - ;; - - # PARAM_Usage: --full-chain (-fc) - # PARAM_Description: Print full chain when using --signcsr - --full-chain|-fc) - PARAM_FULL_CHAIN="1" - ;; - - # PARAM_Usage: --ipv4 (-4) - # PARAM_Description: Resolve names to IPv4 addresses only - --ipv4|-4) - PARAM_IP_VERSION="4" - ;; - - # PARAM_Usage: --ipv6 (-6) - # PARAM_Description: Resolve names to IPv6 addresses only - --ipv6|-6) - PARAM_IP_VERSION="6" - ;; - - # PARAM_Usage: --domain (-d) domain.tld - # PARAM_Description: Use specified domain name(s) instead of domains.txt entry (one certificate!) - --domain|-d) - shift 1 - check_parameters "${1:-}" - if [[ -z "${PARAM_DOMAIN:-}" ]]; then - PARAM_DOMAIN="${1}" - else - PARAM_DOMAIN="${PARAM_DOMAIN} ${1}" - fi - ;; - - # PARAM_Usage: --ca url/preset - # PARAM_Description: Use specified CA URL or preset - --ca) - shift 1 - check_parameters "${1:-}" - [[ -n "${PARAM_CA:-}" ]] && _exiterr "CA can only be specified once!" - PARAM_CA="${1}" - ;; - - # PARAM_Usage: --alias certalias - # PARAM_Description: Use specified name for certificate directory (and per-certificate config) instead of the primary domain (only used if --domain is specified) - --alias) - shift 1 - check_parameters "${1:-}" - [[ -n "${PARAM_ALIAS:-}" ]] && _exiterr "Alias can only be specified once!" - PARAM_ALIAS="${1}" - ;; - - # PARAM_Usage: --keep-going (-g) - # PARAM_Description: Keep going after encountering an error while creating/renewing multiple certificates in cron mode - --keep-going|-g) - PARAM_KEEP_GOING="yes" - ;; - - # PARAM_Usage: --force (-x) - # PARAM_Description: Force certificate renewal even if it is not due to expire within RENEW_DAYS - --force|-x) - PARAM_FORCE="yes" - ;; - - # PARAM_Usage: --force-validation - # PARAM_Description: Force revalidation of domain names (used in combination with --force) - --force-validation) - PARAM_FORCE_VALIDATION="yes" - ;; - - # PARAM_Usage: --no-lock (-n) - # PARAM_Description: Don't use lockfile (potentially dangerous!) - --no-lock|-n) - PARAM_NO_LOCK="yes" - ;; - - # PARAM_Usage: --lock-suffix example.com - # PARAM_Description: Suffix lockfile name with a string (useful for with -d) - --lock-suffix) - shift 1 - check_parameters "${1:-}" - PARAM_LOCKFILE_SUFFIX="${1}" - ;; - - # PARAM_Usage: --ocsp - # PARAM_Description: Sets option in CSR indicating OCSP stapling to be mandatory - --ocsp) - PARAM_OCSP_MUST_STAPLE="yes" - ;; - - # PARAM_Usage: --privkey (-p) path/to/key.pem - # PARAM_Description: Use specified private key instead of account key (useful for revocation) - --privkey|-p) - shift 1 - check_parameters "${1:-}" - PARAM_ACCOUNT_KEY="${1}" - ;; - - # PARAM_Usage: --domains-txt path/to/domains.txt - # PARAM_Description: Use specified domains.txt instead of default/configured one - --domains-txt) - shift 1 - check_parameters "${1:-}" - PARAM_DOMAINS_TXT="${1}" - ;; - - # PARAM_Usage: --config (-f) path/to/config - # PARAM_Description: Use specified config file - --config|-f) - shift 1 - check_parameters "${1:-}" - CONFIG="${1}" - ;; - - # PARAM_Usage: --hook (-k) path/to/hook.sh - # PARAM_Description: Use specified script for hooks - --hook|-k) - shift 1 - check_parameters "${1:-}" - PARAM_HOOK="${1}" - ;; - - # PARAM_Usage: --preferred-chain issuer-cn - # PARAM_Description: Use alternative certificate chain identified by issuer CN - --preferred-chain) - shift 1 - check_parameters "${1:-}" - PARAM_PREFERRED_CHAIN="${1}" - ;; - - # PARAM_Usage: --out (-o) certs/directory - # PARAM_Description: Output certificates into the specified directory - --out|-o) - shift 1 - check_parameters "${1:-}" - PARAM_CERTDIR="${1}" - ;; - - # PARAM_Usage: --alpn alpn-certs/directory - # PARAM_Description: Output alpn verification certificates into the specified directory - --alpn) - shift 1 - check_parameters "${1:-}" - PARAM_ALPNCERTDIR="${1}" - ;; - - # PARAM_Usage: --challenge (-t) http-01|dns-01|tls-alpn-01 - # PARAM_Description: Which challenge should be used? Currently http-01, dns-01, and tls-alpn-01 are supported - --challenge|-t) - shift 1 - check_parameters "${1:-}" - PARAM_CHALLENGETYPE="${1}" - ;; - - # PARAM_Usage: --algo (-a) rsa|prime256v1|secp384r1 - # PARAM_Description: Which public key algorithm should be used? Supported: rsa, prime256v1 and secp384r1 - --algo|-a) - shift 1 - check_parameters "${1:-}" - PARAM_KEY_ALGO="${1}" - ;; - - # PARAM_Usage: --acme-profile profile_name - # PARAM_Description: Use specified ACME profile - --acme-profile) - shift 1 - check_parameters "${1:-}" - PARAM_ACME_PROFILE="${1}" - ;; - - # PARAM_Usage: --order-timeout seconds - # PARAM_Description: Amount of seconds to wait for processing of order until erroring out - --order-timeout) - shift 1 - check_parameters "${1:-}" - PARAM_ORDER_TIMEOUT=${1} - ;; - - # PARAM_Usage: --validation-timeout seconds - # PARAM_Description: Amount of seconds to wait for processing of domain validations until erroring out - --validation-timeout) - shift 1 - check_parameters "${1:-}" - PARAM_VALIDATION_TIMEOUT=${1} - ;; - - *) - echo "Unknown parameter detected: ${1}" >&2 - echo >&2 - command_help >&2 - exit 1 - ;; - esac - - shift 1 - done - - case "${COMMAND}" in - env) command_env;; - sign_domains) command_sign_domains;; - register) command_register;; - account) command_account;; - sign_csr) command_sign_csr "${PARAM_CSR}";; - revoke) command_revoke "${PARAM_REVOKECERT}";; - deactivate) command_deactivate;; - cleanup) command_cleanup;; - terms) command_terms;; - cleanupdelete) command_cleanupdelete;; - version) command_version;; - *) command_help; exit 1;; - esac - - exit "${exit_with_errorcode}" -} - -# Determine OS type -OSTYPE="$(uname)" - -if [[ ! "${DEHYDRATED_NOOP:-}" = "NOOP" ]]; then - # Run script - main "${@:-}" -fi - -# vi: expandtab sw=2 ts=2