|
@@ -117,7 +117,7 @@ haproxy_deploy() {
|
|
# Create a temporary PEM file
|
|
# Create a temporary PEM file
|
|
_temppem="$(_mktemp)"
|
|
_temppem="$(_mktemp)"
|
|
_debug _temppem "${_temppem}"
|
|
_debug _temppem "${_temppem}"
|
|
- cat "${_ckey}" "${_ccert}" "${_cca}" > "${_temppem}"
|
|
|
|
|
|
+ cat "${_ckey}" "${_ccert}" "${_cca}" >"${_temppem}"
|
|
_ret="$?"
|
|
_ret="$?"
|
|
|
|
|
|
# Check that we could create the temporary file
|
|
# Check that we could create the temporary file
|
|
@@ -130,7 +130,7 @@ haproxy_deploy() {
|
|
# Move PEM file into place
|
|
# Move PEM file into place
|
|
_info "Moving new certificate into place"
|
|
_info "Moving new certificate into place"
|
|
_debug _pem "${_pem}"
|
|
_debug _pem "${_pem}"
|
|
- cat "${_temppem}" > "${_pem}"
|
|
|
|
|
|
+ cat "${_temppem}" >"${_pem}"
|
|
_ret=$?
|
|
_ret=$?
|
|
|
|
|
|
# Clean up temp file
|
|
# Clean up temp file
|
|
@@ -146,7 +146,7 @@ haproxy_deploy() {
|
|
if [ "${Le_Deploy_haproxy_issuer}" = "yes" ]; then
|
|
if [ "${Le_Deploy_haproxy_issuer}" = "yes" ]; then
|
|
_info "Updating .issuer file"
|
|
_info "Updating .issuer file"
|
|
_debug _issuer "${_issuer}"
|
|
_debug _issuer "${_issuer}"
|
|
- cat "${_cca}" > "${_issuer}"
|
|
|
|
|
|
+ cat "${_cca}" >"${_issuer}"
|
|
_ret="$?"
|
|
_ret="$?"
|
|
|
|
|
|
if [ "${_ret}" != "0" ]; then
|
|
if [ "${_ret}" != "0" ]; then
|
|
@@ -187,25 +187,25 @@ haproxy_deploy() {
|
|
if [ "${_subjectdn}" = "${_issuerdn}" ]; then
|
|
if [ "${_subjectdn}" = "${_issuerdn}" ]; then
|
|
# If the issuer is a CA cert then our command line has "-CAfile" added
|
|
# If the issuer is a CA cert then our command line has "-CAfile" added
|
|
openssl ocsp \
|
|
openssl ocsp \
|
|
- -issuer "${_issuer}" \
|
|
|
|
- -cert "${_pem}" \
|
|
|
|
- -url "${_ocsp_url}" \
|
|
|
|
- -header Host "${_ocsp_host}" \
|
|
|
|
- -respout "${_ocsp}" \
|
|
|
|
- -verify_other "${_issuer}" \
|
|
|
|
- -no_nonce \
|
|
|
|
- -CAfile "${_issuer}"
|
|
|
|
|
|
+ -issuer "${_issuer}" \
|
|
|
|
+ -cert "${_pem}" \
|
|
|
|
+ -url "${_ocsp_url}" \
|
|
|
|
+ -header Host "${_ocsp_host}" \
|
|
|
|
+ -respout "${_ocsp}" \
|
|
|
|
+ -verify_other "${_issuer}" \
|
|
|
|
+ -no_nonce \
|
|
|
|
+ -CAfile "${_issuer}"
|
|
_ret=$?
|
|
_ret=$?
|
|
else
|
|
else
|
|
# Issuer is not a root CA so no "-CAfile" option
|
|
# Issuer is not a root CA so no "-CAfile" option
|
|
openssl ocsp \
|
|
openssl ocsp \
|
|
- -issuer "${_issuer}" \
|
|
|
|
- -cert "${_pem}" \
|
|
|
|
- -url "${_ocsp_url}" \
|
|
|
|
- -header Host "${_ocsp_host}" \
|
|
|
|
- -respout "${_ocsp}" \
|
|
|
|
- -verify_other "${_issuer}" \
|
|
|
|
- -no_nonce
|
|
|
|
|
|
+ -issuer "${_issuer}" \
|
|
|
|
+ -cert "${_pem}" \
|
|
|
|
+ -url "${_ocsp_url}" \
|
|
|
|
+ -header Host "${_ocsp_host}" \
|
|
|
|
+ -respout "${_ocsp}" \
|
|
|
|
+ -verify_other "${_issuer}" \
|
|
|
|
+ -no_nonce
|
|
_ret=$?
|
|
_ret=$?
|
|
fi
|
|
fi
|
|
else
|
|
else
|
|
@@ -219,8 +219,8 @@ haproxy_deploy() {
|
|
|
|
|
|
# Check return code of openssl command
|
|
# Check return code of openssl command
|
|
if [ "${_ret}" != "0" ]; then
|
|
if [ "${_ret}" != "0" ]; then
|
|
- _err "Updating OCSP stapling failed with return code ${_ret}"
|
|
|
|
- return ${_ret}
|
|
|
|
|
|
+ _err "Updating OCSP stapling failed with return code ${_ret}"
|
|
|
|
+ return ${_ret}
|
|
fi
|
|
fi
|
|
else
|
|
else
|
|
# An OCSP file was already present but certificate did not have OCSP extension
|
|
# An OCSP file was already present but certificate did not have OCSP extension
|
|
@@ -228,7 +228,7 @@ haproxy_deploy() {
|
|
_err "OCSP was not requested but .ocsp file exists."
|
|
_err "OCSP was not requested but .ocsp file exists."
|
|
# Should remove the file at this step, although HAProxy just ignores it in this case
|
|
# Should remove the file at this step, although HAProxy just ignores it in this case
|
|
# rm -f "${_ocsp}" || _err "Problem removing stale .ocsp file"
|
|
# rm -f "${_ocsp}" || _err "Problem removing stale .ocsp file"
|
|
- fi
|
|
|
|
|
|
+ fi
|
|
fi
|
|
fi
|
|
|
|
|
|
# Reload HAProxy
|
|
# Reload HAProxy
|