diff --git a/acme.sh b/acme.sh index 1e8fd545..76015113 100755 --- a/acme.sh +++ b/acme.sh @@ -1,6 +1,6 @@ #!/usr/bin/env sh -VER=2.5.0 +VER=2.5.1 PROJECT_NAME="acme.sh" @@ -163,11 +163,11 @@ _hasfield() { for f in $(echo "$_str" | tr ',' ' ') ; do if [ "$f" = "$_field" ] ; then - _debug "'$_str' contains '$_field'" + _debug2 "'$_str' contains '$_field'" return 0 #contains ok fi done - _debug "'$_str' does not contain '$_field'" + _debug2 "'$_str' does not contain '$_field'" return 1 #not contains } @@ -440,16 +440,20 @@ _createcsr() { _debug _createcsr domain="$1" domainlist="$2" - key="$3" + csrkey="$3" csr="$4" csrconf="$5" _debug2 domain "$domain" _debug2 domainlist "$domainlist" + _debug2 csrkey "$csrkey" + _debug2 csr "$csr" + _debug2 csrconf "$csrconf" + + printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" > "$csrconf" + if [ -z "$domainlist" ] || [ "$domainlist" = "no" ]; then #single domain _info "Single domain" "$domain" - printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\n" > "$csrconf" - openssl req -new -sha256 -key "$key" -subj "/CN=$domain" -config "$csrconf" -out "$csr" else if _contains "$domainlist" "," ; then alt="DNS:$(echo $domainlist | sed "s/,/,DNS:/g")" @@ -458,9 +462,13 @@ _createcsr() { fi #multi _info "Multi domain" "$alt" - printf -- "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment\nsubjectAltName=$alt" > "$csrconf" - openssl req -new -sha256 -key "$key" -subj "/CN=$domain" -config "$csrconf" -out "$csr" + printf -- "\nsubjectAltName=$alt" >> "$csrconf" fi + if [ "$Le_OCSP_Stable" ] ; then + _savedomainconf Le_OCSP_Stable "$Le_OCSP_Stable" + printf -- "\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >> "$csrconf" + fi + openssl req -new -sha256 -key "$csrkey" -subj "/CN=$domain" -config "$csrconf" -out "$csr" } #_signcsr key csr conf cert @@ -1066,56 +1074,56 @@ _setopt() { #_savedomainconf key value #save to domain.conf _savedomainconf() { - key="$1" - value="$2" + _sdkey="$1" + _sdvalue="$2" if [ "$DOMAIN_CONF" ] ; then - _setopt "$DOMAIN_CONF" "$key" "=" "\"$value\"" + _setopt "$DOMAIN_CONF" "$_sdkey" "=" "\"$_sdvalue\"" else - _err "DOMAIN_CONF is empty, can not save $key=$value" + _err "DOMAIN_CONF is empty, can not save $_sdkey=$_sdvalue" fi } #_cleardomainconf key _cleardomainconf() { - key="$1" + _sdkey="$1" if [ "$DOMAIN_CONF" ] ; then - _sed_i "s/^$key.*$//" "$DOMAIN_CONF" + _sed_i "s/^$_sdkey.*$//" "$DOMAIN_CONF" else - _err "DOMAIN_CONF is empty, can not save $key=$value" + _err "DOMAIN_CONF is empty, can not save $_sdkey=$value" fi } #_readdomainconf key _readdomainconf() { - key="$1" + _sdkey="$1" if [ "$DOMAIN_CONF" ] ; then ( - eval $(grep "^$key *=" "$DOMAIN_CONF") - eval "printf \"%s\" \"\$$key\"" + eval $(grep "^$_sdkey *=" "$DOMAIN_CONF") + eval "printf \"%s\" \"\$$_sdkey\"" ) else - _err "DOMAIN_CONF is empty, can not read $key" + _err "DOMAIN_CONF is empty, can not read $_sdkey" fi } #_saveaccountconf key value _saveaccountconf() { - key="$1" - value="$2" + _sckey="$1" + _scvalue="$2" if [ "$ACCOUNT_CONF_PATH" ] ; then - _setopt "$ACCOUNT_CONF_PATH" "$key" "=" "\"$value\"" + _setopt "$ACCOUNT_CONF_PATH" "$_sckey" "=" "\"$_scvalue\"" else - _err "ACCOUNT_CONF_PATH is empty, can not save $key=$value" + _err "ACCOUNT_CONF_PATH is empty, can not save $_sckey=$_scvalue" fi } #_clearaccountconf key _clearaccountconf() { - key="$1" + _scvalue="$1" if [ "$ACCOUNT_CONF_PATH" ] ; then - _sed_i "s/^$key.*$//" "$ACCOUNT_CONF_PATH" + _sed_i "s/^$_scvalue.*$//" "$ACCOUNT_CONF_PATH" else - _err "ACCOUNT_CONF_PATH is empty, can not clear $key" + _err "ACCOUNT_CONF_PATH is empty, can not clear $_scvalue" fi } @@ -1357,7 +1365,7 @@ _initpath() { fi if [ -z "$DOMAIN_SSL_CONF" ] ; then - DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.ssl.conf" + DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf" fi if [ -z "$CSR_PATH" ] ; then @@ -3079,6 +3087,7 @@ Parameters: --pre-hook Command to be run before obtaining any certificates. --post-hook Command to be run after attempting to obtain/renew certificates. No matter the obain/renew is success or failed. --renew-hook Command to be run once for each successfully renewed certificate. + --ocsp-must-staple, --ocsp Generate ocsp must Staple extension. " } @@ -3431,6 +3440,9 @@ _process() { _renew_hook="$2" shift ;; + --ocsp-must-staple|--ocsp) + Le_OCSP_Stable="1" + ;; *) _err "Unknown parameter : $1" return 1