Skip to content

Commit 9a3bd79

Browse files
author
Marius Burkard
committed
- add error handling and do not use certbot cert dir on acme.sh
1 parent 1810597 commit 9a3bd79

File tree

4 files changed

+85
-42
lines changed

4 files changed

+85
-42
lines changed

‎install/lib/installer_base.lib.php‎

Lines changed: 71 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -2807,8 +2807,27 @@ public function make_ispconfig_ssl_cert() {
28072807
}
28082808
}
28092809

2810+
//* Define and check ISPConfig SSL folder */
2811+
$ssl_dir = $conf['ispconfig_install_dir'].'/interface/ssl';
2812+
if(!@is_dir($ssl_dir)) {
2813+
mkdir($ssl_dir, 0755, true);
2814+
}
2815+
2816+
$ssl_crt_file = $ssl_dir.'/ispserver.crt';
2817+
$ssl_csr_file = $ssl_dir.'/ispserver.csr';
2818+
$ssl_key_file = $ssl_dir.'/ispserver.key';
2819+
$ssl_pem_file = $ssl_dir.'/ispserver.pem';
2820+
2821+
$date = new DateTime();
2822+
28102823
// Request for certs if no LE SSL folder for server fqdn exist
2811-
$le_live_dir = '/etc/letsencrypt/live/' . $hostname;
2824+
$le_live_dir = '/usr/local/ispconfig/server/scripts/' . $hostname;
2825+
if(!@is_dir($le_live_dir)) {
2826+
$le_live_dir = '/root/.acme.sh/' . $hostname;
2827+
if(!@is_dir($le_live_dir)) {
2828+
$le_live_dir = '/etc/letsencrypt/live/' . $hostname;
2829+
}
2830+
}
28122831
if (!@is_dir($le_live_dir) && (($svr_ip4 && in_array($svr_ip4, $dns_ips)) || ($svr_ip6 && in_array($svr_ip6, $dns_ips)))) {
28132832

28142833
// This script is needed earlier to check and open http port 80 or standalone might fail
@@ -2868,30 +2887,47 @@ public function make_ispconfig_ssl_cert() {
28682887
$this->make_acme_vhost($hostname, 'apache');
28692888
}
28702889

2890+
$issued_successfully = false;
2891+
28712892
// Attempt to use Neilpang acme.sh first, as it is now the preferred LE client
28722893
if (is_executable($acme)) {
28732894

2895+
$out = null;
2896+
$ret = null;
28742897
if($conf['nginx']['installed'] == true || $conf['apache']['installed'] == true) {
2875-
exec("$acme --issue -w /usr/local/ispconfig/interface/acme -d $hostname $renew_hook");
2898+
exec("$acme --issue -w /usr/local/ispconfig/interface/acme -d $hostname $renew_hook", $out, $ret);
28762899
}
28772900
// Else, it is not webserver, so we use standalone
28782901
else {
2879-
exec("$acme --issue --standalone -d $hostname $hook");
2902+
exec("$acme --issue --standalone -d " . escapeshellarg($hostname) . " $hook", $out, $ret);
28802903
}
28812904

2882-
// Define LE certs name and path, then install them
2883-
if (!@is_dir($le_live_dir)) mkdir($le_live_dir, 0755, true);
2884-
$acme_cert = "--cert-file $le_live_dir/cert.pem";
2885-
$acme_key = "--key-file $le_live_dir/privkey.pem";
2886-
$acme_ca = "--ca-file $le_live_dir/chain.pem";
2887-
$acme_chain = "--fullchain-file $le_live_dir/fullchain.pem";
2888-
exec("$acme --install-cert -d $hostname $acme_cert $acme_key $acme_ca $acme_chain");
2905+
if($ret == 0) {
2906+
// Backup existing ispserver ssl files
2907+
if(file_exists($ssl_crt_file)) {
2908+
rename($ssl_crt_file, $ssl_crt_file . '-' . $date->format('YmdHis') . '.bak');
2909+
}
2910+
if(file_exists($ssl_key_file)) {
2911+
rename($ssl_key_file, $ssl_key_file . '-' . $date->format('YmdHis') . '.bak');
2912+
}
2913+
if(file_exists($ssl_pem_file)) {
2914+
rename($ssl_pem_file, $ssl_pem_file . '-' . $date->format('YmdHis') . '.bak');
2915+
}
28892916

2917+
// Define LE certs name and path, then install them
2918+
//$acme_cert = "--cert-file $le_live_dir/cert.pem";
2919+
$acme_key = "--key-file " . escapeshellarg($ssl_key_file);
2920+
$acme_chain = "--fullchain-file " . escapeshellarg($ssl_crt_file);
2921+
exec("$acme --install-cert -d $hostname $acme_key $acme_chain");
2922+
$issued_successfully = true;
2923+
}
28902924
// Else, we attempt to use the official LE certbot client certbot
28912925
} else {
28922926

28932927
// But only if it is otherwise available
28942928
if(is_executable($le_client)) {
2929+
$out = null;
2930+
$ret = null;
28952931

28962932
// Get its version info due to be used for webroot arguement issues
28972933
$le_info = exec($le_client . ' --version 2>&1', $ret, $val);
@@ -2904,11 +2940,28 @@ public function make_ispconfig_ssl_cert() {
29042940
$certonly = 'certonly --agree-tos --non-interactive --expand --rsa-key-size 4096';
29052941

29062942
// If this is a webserver
2907-
if($conf['nginx']['installed'] == true || $conf['apache']['installed'] == true)
2908-
exec("$le_client $certonly $acme_version --authenticator webroot --webroot-path /usr/local/ispconfig/interface/acme --email postmaster@$hostname -d $hostname $renew_hook");
2943+
if($conf['nginx']['installed'] == true || $conf['apache']['installed'] == true) {
2944+
exec("$le_client $certonly $acme_version --authenticator webroot --webroot-path /usr/local/ispconfig/interface/acme --email " . escapeshellarg('postmaster@$hostname') . " -d " . escapeshellarg($hostname) . " $renew_hook", $out, $ret);
2945+
}
29092946
// Else, it is not webserver, so we use standalone
2910-
else
2911-
exec("$le_client $certonly $acme_version --standalone --email postmaster@$hostname -d $hostname $hook");
2947+
else {
2948+
exec("$le_client $certonly $acme_version --standalone --email " . escapeshellarg('postmaster@$hostname') . " -d " . escapeshellarg($hostname) . " $hook", $out, $ret);
2949+
}
2950+
2951+
if($ret == 0) {
2952+
// Backup existing ispserver ssl files
2953+
if(file_exists($ssl_crt_file)) {
2954+
rename($ssl_crt_file, $ssl_crt_file . '-' . $date->format('YmdHis') . '.bak');
2955+
}
2956+
if(file_exists($ssl_key_file)) {
2957+
rename($ssl_key_file, $ssl_key_file . '-' . $date->format('YmdHis') . '.bak');
2958+
}
2959+
if(file_exists($ssl_pem_file)) {
2960+
rename($ssl_pem_file, $ssl_pem_file . '-' . $date->format('YmdHis') . '.bak');
2961+
}
2962+
2963+
$issued_successfully = true;
2964+
}
29122965
}
29132966
}
29142967

@@ -2917,33 +2970,13 @@ public function make_ispconfig_ssl_cert() {
29172970
symlink($vhost_conf_dir.'/ispconfig.conf', $vhost_conf_enabled_dir.'/000-ispconfig.conf');
29182971
}
29192972
}
2973+
} elseif(($svr_ip4 && in_array($svr_ip4, $dns_ips)) || ($svr_ip6 && in_array($svr_ip6, $dns_ips))) {
2974+
// the directory already exists so we have to assume that it was created previously
2975+
$issued_successfully = true;
29202976
}
29212977

2922-
//* Define and check ISPConfig SSL folder */
2923-
$ssl_dir = $conf['ispconfig_install_dir'].'/interface/ssl';
2924-
if(!@is_dir($ssl_dir)) mkdir($ssl_dir, 0755, true);
2925-
2926-
$ssl_crt_file = $ssl_dir.'/ispserver.crt';
2927-
$ssl_csr_file = $ssl_dir.'/ispserver.csr';
2928-
$ssl_key_file = $ssl_dir.'/ispserver.key';
2929-
$ssl_pem_file = $ssl_dir.'/ispserver.pem';
2930-
2931-
$date = new DateTime();
2932-
29332978
// If the LE SSL certs for this hostname exists
2934-
if (is_dir($le_live_dir) && (($svr_ip4 && in_array($svr_ip4, $dns_ips)) || ($svr_ip6 && in_array($svr_ip6, $dns_ips)))) {
2935-
2936-
// Backup existing ispserver ssl files
2937-
if (file_exists($ssl_crt_file)) rename($ssl_crt_file, $ssl_crt_file . '-' .$date->format('YmdHis') . '.bak');
2938-
if (file_exists($ssl_key_file)) rename($ssl_key_file, $ssl_key_file . '-' .$date->format('YmdHis') . '.bak');
2939-
if (file_exists($ssl_pem_file)) rename($ssl_pem_file, $ssl_pem_file . '-' .$date->format('YmdHis') . '.bak');
2940-
2941-
// Create symlink to LE fullchain and key for ISPConfig
2942-
symlink($le_live_dir.'/fullchain.pem', $ssl_crt_file);
2943-
symlink($le_live_dir.'/privkey.pem', $ssl_key_file);
2944-
2945-
} else {
2946-
2979+
if(!is_dir($le_live_dir) || !$issued_successfully) {
29472980
// We can still use the old self-signed method
29482981
$ssl_pw = substr(md5(mt_rand()), 0, 6);
29492982
exec("openssl genrsa -des3 -passout pass:$ssl_pw -out $ssl_key_file 4096");

‎server/scripts/letsencrypt_post_hook.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
## If you need a custom hook file, create a file with the same name in
1414
## /usr/local/ispconfig/server/conf-custom/scripts/
15-
if [[ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_post_hook.sh" ]] ; then
15+
if [ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_post_hook.sh" ] ; then
1616
. /usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_post_hook.sh && exit 0 || exit 1;
1717
fi
1818

‎server/scripts/letsencrypt_pre_hook.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
## If you need a custom hook file, create a file with the same name in
1414
## /usr/local/ispconfig/server/conf-custom/scripts/
15-
if [[ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_pre_hook.sh" ]] ; then
15+
if [ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_pre_hook.sh" ] ; then
1616
. /usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_pre_hook.sh && exit 0 || exit 1 ;
1717
fi
1818

‎server/scripts/letsencrypt_renew_hook.sh‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,21 @@
1212

1313
## If you need a custom hook file, create a file with the same name in
1414
## /usr/local/ispconfig/server/conf-custom/scripts/
15-
if [[ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_renew_hook.sh" ]] ; then
15+
if [ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_renew_hook.sh" ] ; then
1616
. /usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_renew_hook.sh && exit 0 || exit 1;
1717
fi
1818

19-
lelive=/etc/letsencrypt/live/$(hostname -f); if [ -d "$lelive" ]; then
19+
hostname=$(hostname -f)
20+
acme=$(which /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh)
21+
if [ -e "/usr/local/ispconfig/server/scripts/${hostname}" ] ; then
22+
lelive="/usr/local/ispconfig/server/scripts/${hostname}" ;
23+
elif [ -e "/root/.acme.sh/${hostname}" ] ; then
24+
lelive="/root/.acme.sh/${hostname}" ;
25+
else
26+
lelive="/etc/letsencrypt/live/${hostname}" ;
27+
fi
28+
29+
if [ -d "$lelive" ]; then
2030
cd /usr/local/ispconfig/interface/ssl; ibak=ispserver.*.bak; ipem=ispserver.pem; icrt=ispserver.crt; ikey=ispserver.key
2131
if ls $ibak 1> /dev/null 2>&1; then rm $ibak; fi
2232
if [ -e "$ipem" ]; then mv $ipem $ipem-$(date +"%y%m%d%H%M%S").bak; cat $ikey $icrt > $ipem; chmod 600 $ipem; fi

0 commit comments

Comments
 (0)