|
|
@@ -366,6 +366,7 @@ _hasfield() {
|
|
|
return 1 #not contains
|
|
|
}
|
|
|
|
|
|
+# str index [sep]
|
|
|
_getfield() {
|
|
|
_str="$1"
|
|
|
_findex="$2"
|
|
|
@@ -453,7 +454,7 @@ if [ "$(printf '\x41')" != 'A' ]; then
|
|
|
fi
|
|
|
|
|
|
_ESCAPE_XARGS=""
|
|
|
-if [ "$(printf %s '\\x41' | xargs printf)" = 'A' ]; then
|
|
|
+if _exists xargs && [ "$(printf %s '\\x41' | xargs printf)" = 'A' ]; then
|
|
|
_ESCAPE_XARGS=1
|
|
|
fi
|
|
|
|
|
|
@@ -925,7 +926,7 @@ _sign() {
|
|
|
|
|
|
}
|
|
|
|
|
|
-#keylength
|
|
|
+#keylength or isEcc flag (empty str => not ecc)
|
|
|
_isEccKey() {
|
|
|
_length="$1"
|
|
|
|
|
|
@@ -1138,7 +1139,12 @@ _readKeyLengthFromCSR() {
|
|
|
echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *ASN1 OID:.*" | cut -d ':' -f 2 | tr -d ' '
|
|
|
else
|
|
|
_debug "RSA CSR"
|
|
|
- echo "$_outcsr" | tr "\t" " " | (_egrep_o "^ *Public.Key:.*" || _egrep_o "RSA Public.Key:.*") | cut -d '(' -f 2 | cut -d ' ' -f 1
|
|
|
+ _rkl="$(echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1)"
|
|
|
+ if [ "$_rkl" ]; then
|
|
|
+ echo "$_rkl"
|
|
|
+ else
|
|
|
+ echo "$_outcsr" | tr "\t" " " | _egrep_o "RSA Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1
|
|
|
+ fi
|
|
|
fi
|
|
|
}
|
|
|
|
|
|
@@ -1147,7 +1153,7 @@ _ss() {
|
|
|
|
|
|
if _exists "ss"; then
|
|
|
_debug "Using: ss"
|
|
|
- ss -ntpl | grep ":$_port "
|
|
|
+ ss -ntpl 2>/dev/null | grep ":$_port "
|
|
|
return 0
|
|
|
fi
|
|
|
|
|
|
@@ -1176,6 +1182,28 @@ _ss() {
|
|
|
return 1
|
|
|
}
|
|
|
|
|
|
+#outfile key cert cacert [password [name [caname]]]
|
|
|
+_toPkcs() {
|
|
|
+ _cpfx="$1"
|
|
|
+ _ckey="$2"
|
|
|
+ _ccert="$3"
|
|
|
+ _cca="$4"
|
|
|
+ pfxPassword="$5"
|
|
|
+ pfxName="$6"
|
|
|
+ pfxCaname="$7"
|
|
|
+
|
|
|
+ if [ "$pfxCaname" ]; then
|
|
|
+ ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName" -caname "$pfxCaname"
|
|
|
+ elif [ "$pfxName" ]; then
|
|
|
+ ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName"
|
|
|
+ elif [ "$pfxPassword" ]; then
|
|
|
+ ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword"
|
|
|
+ else
|
|
|
+ ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca"
|
|
|
+ fi
|
|
|
+
|
|
|
+}
|
|
|
+
|
|
|
#domain [password] [isEcc]
|
|
|
toPkcs() {
|
|
|
domain="$1"
|
|
|
@@ -1189,11 +1217,7 @@ toPkcs() {
|
|
|
|
|
|
_initpath "$domain" "$_isEcc"
|
|
|
|
|
|
- if [ "$pfxPassword" ]; then
|
|
|
- ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH" -password "pass:$pfxPassword"
|
|
|
- else
|
|
|
- ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH"
|
|
|
- fi
|
|
|
+ _toPkcs "$CERT_PFX_PATH" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$pfxPassword"
|
|
|
|
|
|
if [ "$?" = "0" ]; then
|
|
|
_info "Success, Pfx is exported to: $CERT_PFX_PATH"
|
|
|
@@ -1276,7 +1300,7 @@ createDomainKey() {
|
|
|
|
|
|
_initpath "$domain" "$_cdl"
|
|
|
|
|
|
- if [ ! -f "$CERT_KEY_PATH" ] || ([ "$FORCE" ] && ! [ "$IS_RENEW" ]); then
|
|
|
+ if [ ! -f "$CERT_KEY_PATH" ] || ([ "$FORCE" ] && ! [ "$IS_RENEW" ]) || [ "$Le_ForceNewDomainKey" = "1" ]; then
|
|
|
if _createkey "$_cdl" "$CERT_KEY_PATH"; then
|
|
|
_savedomainconf Le_Keylength "$_cdl"
|
|
|
_info "The domain key is here: $(__green $CERT_KEY_PATH)"
|
|
|
@@ -2191,7 +2215,9 @@ _initAPI() {
|
|
|
export ACME_KEY_CHANGE="https://acme-v01.api.letsencrypt.org/acme/key-change"
|
|
|
export ACME_NEW_AUTHZ="https://acme-v01.api.letsencrypt.org/acme/new-authz"
|
|
|
export ACME_NEW_ORDER="https://acme-v01.api.letsencrypt.org/acme/new-cert"
|
|
|
+ export ACME_NEW_ORDER_RES="new-cert"
|
|
|
export ACME_NEW_ACCOUNT="https://acme-v01.api.letsencrypt.org/acme/new-reg"
|
|
|
+ export ACME_NEW_ACCOUNT_RES="new-reg"
|
|
|
export ACME_REVOKE_CERT="https://acme-v01.api.letsencrypt.org/acme/revoke-cert"
|
|
|
fi
|
|
|
|
|
|
@@ -2211,16 +2237,22 @@ _initAPI() {
|
|
|
export ACME_NEW_AUTHZ
|
|
|
|
|
|
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-cert" *: *"[^"]*"' | cut -d '"' -f 3)
|
|
|
+ ACME_NEW_ORDER_RES="new-cert"
|
|
|
if [ -z "$ACME_NEW_ORDER" ]; then
|
|
|
ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-order" *: *"[^"]*"' | cut -d '"' -f 3)
|
|
|
+ ACME_NEW_ORDER_RES="new-order"
|
|
|
fi
|
|
|
export ACME_NEW_ORDER
|
|
|
+ export ACME_NEW_ORDER_RES
|
|
|
|
|
|
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-reg" *: *"[^"]*"' | cut -d '"' -f 3)
|
|
|
+ ACME_NEW_ACCOUNT_RES="new-reg"
|
|
|
if [ -z "$ACME_NEW_ACCOUNT" ]; then
|
|
|
ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-account" *: *"[^"]*"' | cut -d '"' -f 3)
|
|
|
+ ACME_NEW_ACCOUNT_RES="new-account"
|
|
|
fi
|
|
|
export ACME_NEW_ACCOUNT
|
|
|
+ export ACME_NEW_ACCOUNT_RES
|
|
|
|
|
|
ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revoke-cert" *: *"[^"]*"' | cut -d '"' -f 3)
|
|
|
export ACME_REVOKE_CERT
|
|
|
@@ -2237,7 +2269,7 @@ _initAPI() {
|
|
|
_debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
|
|
|
}
|
|
|
|
|
|
-#[domain] [keylength]
|
|
|
+#[domain] [keylength or isEcc flag]
|
|
|
_initpath() {
|
|
|
|
|
|
__initHome
|
|
|
@@ -2994,9 +3026,9 @@ _on_issue_err() {
|
|
|
fi
|
|
|
|
|
|
#trigger the validation to flush the pending authz
|
|
|
+ _debug2 "_chk_vlist" "$_chk_vlist"
|
|
|
if [ "$_chk_vlist" ]; then
|
|
|
(
|
|
|
- _debug2 "_chk_vlist" "$_chk_vlist"
|
|
|
_debug2 "start to deactivate authz"
|
|
|
ventries=$(echo "$_chk_vlist" | tr "$dvsep" ' ')
|
|
|
for ventry in $ventries; do
|
|
|
@@ -3068,14 +3100,13 @@ _regAccount() {
|
|
|
_initpath
|
|
|
_reg_length="$1"
|
|
|
|
|
|
+ mkdir -p "$CA_DIR"
|
|
|
if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
|
|
|
- mkdir -p "$CA_DIR"
|
|
|
_info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
|
|
|
mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
|
|
|
fi
|
|
|
|
|
|
if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
|
|
|
- mkdir -p "$CA_DIR"
|
|
|
_info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
|
|
|
mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
|
|
|
fi
|
|
|
@@ -3092,7 +3123,7 @@ _regAccount() {
|
|
|
fi
|
|
|
_initAPI
|
|
|
_updateTos=""
|
|
|
- _reg_res="new-reg"
|
|
|
+ _reg_res="$ACME_NEW_ACCOUNT_RES"
|
|
|
while true; do
|
|
|
_debug AGREEMENT "$AGREEMENT"
|
|
|
|
|
|
@@ -3122,7 +3153,7 @@ _regAccount() {
|
|
|
|
|
|
_accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
|
|
|
_debug "_accUri" "$_accUri"
|
|
|
-
|
|
|
+ _savecaconf "ACCOUNT_URL" "$_accUri"
|
|
|
_tos="$(echo "$responseHeaders" | grep "^Link:.*rel=\"terms-of-service\"" | _head_n 1 | _egrep_o "<.*>" | tr -d '<>')"
|
|
|
_debug "_tos" "$_tos"
|
|
|
if [ -z "$_tos" ]; then
|
|
|
@@ -3143,11 +3174,14 @@ _regAccount() {
|
|
|
return 1
|
|
|
fi
|
|
|
if [ "$code" = '202' ]; then
|
|
|
- _info "Update success."
|
|
|
+ _info "Update account tos info success."
|
|
|
|
|
|
CA_KEY_HASH="$(__calcAccountKeyHash)"
|
|
|
_debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
|
|
|
_savecaconf CA_KEY_HASH "$CA_KEY_HASH"
|
|
|
+ elif [ "$code" = '403' ]; then
|
|
|
+ _err "It seems that the account key is already deactivated, please use a new account key."
|
|
|
+ return 1
|
|
|
else
|
|
|
_err "Update account error."
|
|
|
return 1
|
|
|
@@ -3160,6 +3194,68 @@ _regAccount() {
|
|
|
|
|
|
}
|
|
|
|
|
|
+#Implement deactivate account
|
|
|
+deactivateaccount() {
|
|
|
+ _initpath
|
|
|
+
|
|
|
+ if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
|
|
|
+ _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
|
|
|
+ mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
|
|
|
+ fi
|
|
|
+
|
|
|
+ if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
|
|
|
+ _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
|
|
|
+ mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
|
|
|
+ fi
|
|
|
+
|
|
|
+ if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
|
|
|
+ _err "Account key is not found at: $ACCOUNT_KEY_PATH"
|
|
|
+ return 1
|
|
|
+ fi
|
|
|
+
|
|
|
+ _accUri=$(_readcaconf "ACCOUNT_URL")
|
|
|
+ _debug _accUri "$_accUri"
|
|
|
+
|
|
|
+ if [ -z "$_accUri" ]; then
|
|
|
+ _err "The account url is empty, please run '--update-account' first to update the account info first,"
|
|
|
+ _err "Then try again."
|
|
|
+ return 1
|
|
|
+ fi
|
|
|
+
|
|
|
+ if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
|
|
|
+ return 1
|
|
|
+ fi
|
|
|
+ _initAPI
|
|
|
+
|
|
|
+ if _send_signed_request "$_accUri" "{\"resource\": \"reg\", \"status\":\"deactivated\"}" && _contains "$response" '"deactivated"'; then
|
|
|
+ _info "Deactivate account success for $_accUri."
|
|
|
+ _accid=$(echo "$response" | _egrep_o "\"id\" *: *[^,]*," | cut -d : -f 2 | tr -d ' ,')
|
|
|
+ elif [ "$code" = "403" ]; then
|
|
|
+ _info "The account is already deactivated."
|
|
|
+ _accid=$(_getfield "$_accUri" "999" "/")
|
|
|
+ else
|
|
|
+ _err "Deactivate: account failed for $_accUri."
|
|
|
+ return 1
|
|
|
+ fi
|
|
|
+
|
|
|
+ _debug "Account id: $_accid"
|
|
|
+ if [ "$_accid" ]; then
|
|
|
+ _deactivated_account_path="$CA_DIR/deactivated/$_accid"
|
|
|
+ _debug _deactivated_account_path "$_deactivated_account_path"
|
|
|
+ if mkdir -p "$_deactivated_account_path"; then
|
|
|
+ _info "Moving deactivated account info to $_deactivated_account_path/"
|
|
|
+ mv "$CA_CONF" "$_deactivated_account_path/"
|
|
|
+ mv "$ACCOUNT_JSON_PATH" "$_deactivated_account_path/"
|
|
|
+ mv "$ACCOUNT_KEY_PATH" "$_deactivated_account_path/"
|
|
|
+ else
|
|
|
+ _err "Can not create dir: $_deactivated_account_path, try to remove the deactivated account key."
|
|
|
+ rm -f "$CA_CONF"
|
|
|
+ rm -f "$ACCOUNT_JSON_PATH"
|
|
|
+ rm -f "$ACCOUNT_KEY_PATH"
|
|
|
+ fi
|
|
|
+ fi
|
|
|
+}
|
|
|
+
|
|
|
# domain folder file
|
|
|
_findHook() {
|
|
|
_hookdomain="$1"
|
|
|
@@ -3350,7 +3446,7 @@ issue() {
|
|
|
else
|
|
|
_key=$(_readdomainconf Le_Keylength)
|
|
|
_debug "Read key length:$_key"
|
|
|
- if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ]; then
|
|
|
+ if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ] || [ "$Le_ForceNewDomainKey" = "1" ]; then
|
|
|
if ! createDomainKey "$_main_domain" "$_key_length"; then
|
|
|
_err "Create domain key error."
|
|
|
_clearup
|
|
|
@@ -3465,11 +3561,11 @@ issue() {
|
|
|
if [ "$d_api" ]; then
|
|
|
_info "Found domain api file: $d_api"
|
|
|
else
|
|
|
- _err "Add the following TXT record:"
|
|
|
- _err "Domain: '$(__green "$txtdomain")'"
|
|
|
- _err "TXT value: '$(__green "$txt")'"
|
|
|
- _err "Please be aware that you prepend _acme-challenge. before your domain"
|
|
|
- _err "so the resulting subdomain will be: $txtdomain"
|
|
|
+ _info "$(__red "Add the following TXT record:")"
|
|
|
+ _info "$(__red "Domain: '$(__green "$txtdomain")'")"
|
|
|
+ _info "$(__red "TXT value: '$(__green "$txt")'")"
|
|
|
+ _info "$(__red "Please be aware that you prepend _acme-challenge. before your domain")"
|
|
|
+ _info "$(__red "so the resulting subdomain will be: $txtdomain")"
|
|
|
continue
|
|
|
fi
|
|
|
|
|
|
@@ -3493,7 +3589,7 @@ issue() {
|
|
|
|
|
|
if [ "$?" != "0" ]; then
|
|
|
_clearup
|
|
|
- _on_issue_err "$_post_hook"
|
|
|
+ _on_issue_err "$_post_hook" "$vlist"
|
|
|
return 1
|
|
|
fi
|
|
|
dnsadded='1'
|
|
|
@@ -3756,7 +3852,7 @@ issue() {
|
|
|
_info "Verify finished, start to sign."
|
|
|
der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
|
|
|
|
|
|
- if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"; then
|
|
|
+ if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
|
|
|
_err "Sign failed."
|
|
|
_on_issue_err "$_post_hook"
|
|
|
return 1
|
|
|
@@ -3880,6 +3976,12 @@ issue() {
|
|
|
_cleardomainconf Le_Listen_V4
|
|
|
fi
|
|
|
|
|
|
+ if [ "$Le_ForceNewDomainKey" = "1" ]; then
|
|
|
+ _savedomainconf "Le_ForceNewDomainKey" "$Le_ForceNewDomainKey"
|
|
|
+ else
|
|
|
+ _cleardomainconf Le_ForceNewDomainKey
|
|
|
+ fi
|
|
|
+
|
|
|
Le_NextRenewTime=$(_math "$Le_CertCreateTime" + "$Le_RenewalDays" \* 24 \* 60 \* 60)
|
|
|
|
|
|
Le_NextRenewTimeStr=$(_time2str "$Le_NextRenewTime")
|
|
|
@@ -3949,6 +4051,11 @@ renew() {
|
|
|
return "$RENEW_SKIP"
|
|
|
fi
|
|
|
|
|
|
+ if [ "$IN_CRON" = "1" ] && [ -z "$Le_CertCreateTime" ]; then
|
|
|
+ _info "Skip invalid cert for: $Le_Domain"
|
|
|
+ return 0
|
|
|
+ fi
|
|
|
+
|
|
|
IS_RENEW="1"
|
|
|
issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress"
|
|
|
res="$?"
|
|
|
@@ -4474,26 +4581,51 @@ _deactivate() {
|
|
|
_d_type="$2"
|
|
|
_initpath
|
|
|
|
|
|
- _d_i=0
|
|
|
- _d_max_retry=9
|
|
|
- while [ "$_d_i" -lt "$_d_max_retry" ]; do
|
|
|
- _info "Deactivate: $_d_domain"
|
|
|
- _d_i="$(_math $_d_i + 1)"
|
|
|
+ if ! __get_domain_new_authz "$_d_domain"; then
|
|
|
+ _err "Can not get domain new authz token."
|
|
|
+ return 1
|
|
|
+ fi
|
|
|
|
|
|
- if ! __get_domain_new_authz "$_d_domain"; then
|
|
|
- _err "Can not get domain new authz token."
|
|
|
- return 1
|
|
|
- fi
|
|
|
+ authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
|
|
|
+ _debug "authzUri" "$authzUri"
|
|
|
|
|
|
- authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
|
|
|
- _debug "authzUri" "$authzUri"
|
|
|
+ if [ "$code" ] && [ ! "$code" = '201' ]; then
|
|
|
+ _err "new-authz error: $response"
|
|
|
+ return 1
|
|
|
+ fi
|
|
|
|
|
|
- if [ ! -z "$code" ] && [ ! "$code" = '201' ]; then
|
|
|
- _err "new-authz error: $response"
|
|
|
+ entries="$(echo "$response" | _egrep_o '{ *"type":"[^"]*", *"status": *"valid", *"uri"[^}]*')"
|
|
|
+ if [ -z "$entries" ]; then
|
|
|
+ _info "No valid entries found."
|
|
|
+ if [ -z "$thumbprint" ]; then
|
|
|
+ thumbprint="$(__calc_account_thumbprint)"
|
|
|
+ fi
|
|
|
+ _debug "Trigger validation."
|
|
|
+ vtype="$VTYPE_HTTP"
|
|
|
+ entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
|
|
|
+ _debug entry "$entry"
|
|
|
+ if [ -z "$entry" ]; then
|
|
|
+ _err "Error, can not get domain token $d"
|
|
|
return 1
|
|
|
fi
|
|
|
+ token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
|
|
|
+ _debug token "$token"
|
|
|
+
|
|
|
+ uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d : -f 2,3 | tr -d '"')"
|
|
|
+ _debug uri "$uri"
|
|
|
+
|
|
|
+ keyauthorization="$token.$thumbprint"
|
|
|
+ _debug keyauthorization "$keyauthorization"
|
|
|
+ __trigger_validation "$uri" "$keyauthorization"
|
|
|
|
|
|
- entry="$(printf "%s\n" "$response" | _egrep_o '{"type":"[^"]*","status":"valid","uri"[^}]*')"
|
|
|
+ fi
|
|
|
+
|
|
|
+ _d_i=0
|
|
|
+ _d_max_retry=$(echo "$entries" | wc -l)
|
|
|
+ while [ "$_d_i" -lt "$_d_max_retry" ]; do
|
|
|
+ _info "Deactivate: $_d_domain"
|
|
|
+ _d_i="$(_math $_d_i + 1)"
|
|
|
+ entry="$(echo "$entries" | sed -n "${_d_i}p")"
|
|
|
_debug entry "$entry"
|
|
|
|
|
|
if [ -z "$entry" ]; then
|
|
|
@@ -4515,16 +4647,16 @@ _deactivate() {
|
|
|
|
|
|
_info "Deactivate: $_vtype"
|
|
|
|
|
|
- if ! _send_signed_request "$authzUri" "{\"resource\": \"authz\", \"status\":\"deactivated\"}"; then
|
|
|
+ if _send_signed_request "$authzUri" "{\"resource\": \"authz\", \"status\":\"deactivated\"}" && _contains "$response" '"deactivated"'; then
|
|
|
+ _info "Deactivate: $_vtype success."
|
|
|
+ else
|
|
|
_err "Can not deactivate $_vtype."
|
|
|
- return 1
|
|
|
+ break
|
|
|
fi
|
|
|
|
|
|
- _info "Deactivate: $_vtype success."
|
|
|
-
|
|
|
done
|
|
|
_debug "$_d_i"
|
|
|
- if [ "$_d_i" -lt "$_d_max_retry" ]; then
|
|
|
+ if [ "$_d_i" -eq "$_d_max_retry" ]; then
|
|
|
_info "Deactivated success!"
|
|
|
else
|
|
|
_err "Deactivate failed."
|
|
|
@@ -4584,9 +4716,7 @@ _detect_profile() {
|
|
|
fi
|
|
|
fi
|
|
|
|
|
|
- if [ ! -z "$DETECTED_PROFILE" ]; then
|
|
|
- echo "$DETECTED_PROFILE"
|
|
|
- fi
|
|
|
+ echo "$DETECTED_PROFILE"
|
|
|
}
|
|
|
|
|
|
_initconf() {
|
|
|
@@ -4674,6 +4804,8 @@ _installalias() {
|
|
|
_setopt "$_envfile" "export LE_WORKING_DIR" "=" "\"$LE_WORKING_DIR\""
|
|
|
if [ "$_c_home" ]; then
|
|
|
_setopt "$_envfile" "export LE_CONFIG_HOME" "=" "\"$LE_CONFIG_HOME\""
|
|
|
+ else
|
|
|
+ _sed_i "/^export LE_CONFIG_HOME/d" "$_envfile"
|
|
|
fi
|
|
|
_setopt "$_envfile" "alias $PROJECT_ENTRY" "=" "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
|
|
|
|
|
|
@@ -4695,6 +4827,8 @@ _installalias() {
|
|
|
_setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
|
|
|
if [ "$_c_home" ]; then
|
|
|
_setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
|
|
|
+ else
|
|
|
+ _sed_i "/^setenv LE_CONFIG_HOME/d" "$_cshfile"
|
|
|
fi
|
|
|
_setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
|
|
|
_setopt "$_csh_profile" "source \"$_cshfile\""
|
|
|
@@ -4759,20 +4893,24 @@ install() {
|
|
|
|
|
|
_info "Installing to $LE_WORKING_DIR"
|
|
|
|
|
|
- if ! mkdir -p "$LE_WORKING_DIR"; then
|
|
|
- _err "Can not create working dir: $LE_WORKING_DIR"
|
|
|
- return 1
|
|
|
+ if [ ! -d "$LE_WORKING_DIR" ]; then
|
|
|
+ if ! mkdir -p "$LE_WORKING_DIR"; then
|
|
|
+ _err "Can not create working dir: $LE_WORKING_DIR"
|
|
|
+ return 1
|
|
|
+ fi
|
|
|
+
|
|
|
+ chmod 700 "$LE_WORKING_DIR"
|
|
|
fi
|
|
|
|
|
|
- chmod 700 "$LE_WORKING_DIR"
|
|
|
+ if [ ! -d "$LE_CONFIG_HOME" ]; then
|
|
|
+ if ! mkdir -p "$LE_CONFIG_HOME"; then
|
|
|
+ _err "Can not create config dir: $LE_CONFIG_HOME"
|
|
|
+ return 1
|
|
|
+ fi
|
|
|
|
|
|
- if ! mkdir -p "$LE_CONFIG_HOME"; then
|
|
|
- _err "Can not create config dir: $LE_CONFIG_HOME"
|
|
|
- return 1
|
|
|
+ chmod 700 "$LE_CONFIG_HOME"
|
|
|
fi
|
|
|
|
|
|
- chmod 700 "$LE_CONFIG_HOME"
|
|
|
-
|
|
|
cp "$PROJECT_ENTRY" "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
|
|
|
|
|
|
if [ "$?" != "0" ]; then
|
|
|
@@ -4930,6 +5068,7 @@ Commands:
|
|
|
--toPkcs8 Convert to pkcs8 format.
|
|
|
--update-account Update account info.
|
|
|
--register-account Register account key.
|
|
|
+ --deactivate-account Deactivate the account.
|
|
|
--create-account-key Create an account private key, professional use.
|
|
|
--create-domain-key Create an domain private key, professional use.
|
|
|
--createCSR, -ccsr Create CSR , professional use.
|
|
|
@@ -4990,6 +5129,7 @@ Parameters:
|
|
|
--renew-hook Command to be run once for each successfully renewed certificate.
|
|
|
--deploy-hook The hook file to deploy cert
|
|
|
--ocsp-must-staple, --ocsp Generate ocsp must Staple extension.
|
|
|
+ --always-force-new-domain-key Generate new domain key when renewal. Otherwise, the domain key is not changed by default.
|
|
|
--auto-upgrade [0|1] Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
|
|
|
--listen-v4 Force standalone/tls server to listen at ipv4.
|
|
|
--listen-v6 Force standalone/tls server to listen at ipv6.
|
|
|
@@ -5209,6 +5349,9 @@ _process() {
|
|
|
--registeraccount | --register-account)
|
|
|
_CMD="registeraccount"
|
|
|
;;
|
|
|
+ --deactivate-account)
|
|
|
+ _CMD="deactivateaccount"
|
|
|
+ ;;
|
|
|
--domain | -d)
|
|
|
_dvalue="$2"
|
|
|
|
|
|
@@ -5315,7 +5458,7 @@ _process() {
|
|
|
;;
|
|
|
--dns)
|
|
|
wvalue="dns"
|
|
|
- if ! _startswith "$2" "-"; then
|
|
|
+ if [ "$2" ] && ! _startswith "$2" "-"; then
|
|
|
wvalue="$2"
|
|
|
shift
|
|
|
fi
|
|
|
@@ -5470,6 +5613,14 @@ _process() {
|
|
|
--ocsp-must-staple | --ocsp)
|
|
|
Le_OCSP_Staple="1"
|
|
|
;;
|
|
|
+ --always-force-new-domain-key)
|
|
|
+ if [ -z "$2" ] || _startswith "$2" "-"; then
|
|
|
+ Le_ForceNewDomainKey=1
|
|
|
+ else
|
|
|
+ Le_ForceNewDomainKey="$2"
|
|
|
+ shift
|
|
|
+ fi
|
|
|
+ ;;
|
|
|
--log | --logfile)
|
|
|
_log="1"
|
|
|
_logfile="$2"
|
|
|
@@ -5616,6 +5767,9 @@ _process() {
|
|
|
updateaccount)
|
|
|
updateaccount
|
|
|
;;
|
|
|
+ deactivateaccount)
|
|
|
+ deactivateaccount
|
|
|
+ ;;
|
|
|
list)
|
|
|
list "$_listraw"
|
|
|
;;
|
David Kerr