Skip to content

Commit d2b75bd

Browse files
author
Marius Burkard
committed
Merge branch '6238-installer-certificate-symlink-handling' into 'develop'
Resolve "installer certificate symlink handling" Closes #6238 See merge request ispconfig/ispconfig3!1527
2 parents 2b30a07 + c8171a0 commit d2b75bd

File tree

2 files changed

+60
-39
lines changed

2 files changed

+60
-39
lines changed

‎install/lib/installer_base.lib.php‎

Lines changed: 59 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ private function install_acme() {
5252
}
5353

5454
public function update_acme() {
55-
$acme = explode("\n", shell_exec('which /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh'));
55+
$acme = explode("\n", shell_exec('which acme.sh /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh'));
5656
$acme = reset($acme);
5757
$val = 0;
5858

@@ -2965,15 +2965,15 @@ public function make_ispconfig_ssl_cert() {
29652965
$le_client = reset($le_client);
29662966

29672967
// Check for Neilpang acme.sh as well
2968-
$acme = explode("\n", shell_exec('which /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh'));
2968+
$acme = explode("\n", shell_exec('which acme.sh /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh'));
29692969
$acme = reset($acme);
29702970

29712971
if((!$acme || !is_executable($acme)) && (!$le_client || !is_executable($le_client))) {
29722972
$success = $this->install_acme();
29732973
if(!$success) {
29742974
swriteln('Failed installing acme.sh. Will not be able to issue certificate during install.');
29752975
} else {
2976-
$acme = explode("\n", shell_exec('which /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh'));
2976+
$acme = explode("\n", shell_exec('which acme.sh /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh'));
29772977
$acme = reset($acme);
29782978
if($acme && is_executable($acme)) {
29792979
swriteln('Installed acme.sh and using it for certificate creation during install.');
@@ -3016,14 +3016,30 @@ public function make_ispconfig_ssl_cert() {
30163016
$issued_successfully = false;
30173017

30183018
// Backup existing ispserver ssl files
3019-
if(file_exists($ssl_crt_file) || is_link($ssl_crt_file)) {
3020-
copy($ssl_crt_file, $ssl_crt_file . '-temporary.bak');
3021-
}
3022-
if(file_exists($ssl_key_file) || is_link($ssl_key_file)) {
3023-
copy($ssl_key_file, $ssl_key_file . '-temporary.bak');
3024-
}
3025-
if(file_exists($ssl_pem_file) || is_link($ssl_pem_file)) {
3026-
copy($ssl_pem_file, $ssl_pem_file . '-temporary.bak');
3019+
//
3020+
// We may find valid or broken symlinks or actual files here.
3021+
//
3022+
// - dangling links are broken and get perm renamed (should just delete?).
3023+
// possibly web server can't start because vhost file points to non-existing cert files,
3024+
// we're not trying to catch or fix that (and not making it worse)
3025+
//
3026+
// - link to valid file is tmp renamed, and file copied to original name.
3027+
// if cert request is successful, remove the old symlink;
3028+
// if cert request fails, remove file copy and rename symlink to original name
3029+
//
3030+
// - actual file copied to tmp name.
3031+
// if cert request is successful, rename tmp copy to perm rename;
3032+
// if cert request fails, delete tmp copy
3033+
$cert_files = array( $ssl_crt_file, $ssl_key_file, $ssl_pem_file );
3034+
foreach ($cert_files as $f) {
3035+
if (is_link($f) && ! file_exists($f)) {
3036+
rename($f, $f.'-'.$date->format('YmdHis').'.bak');
3037+
} elseif (is_link($f)) {
3038+
rename($f, $f.'-temporary.bak');
3039+
copy($f.'-temporary.bak', $f);
3040+
} elseif(file_exists($f)) {
3041+
copy($f, $f.'-temporary.bak');
3042+
}
30273043
}
30283044

30293045
// Attempt to use Neilpang acme.sh first, as it is now the preferred LE client
@@ -3062,26 +3078,28 @@ public function make_ispconfig_ssl_cert() {
30623078
umask($old_umask);
30633079

30643080
// Make temporary backup of self-signed certs permanent
3065-
if(file_exists($ssl_crt_file.'-temporary.bak') || is_link($ssl_crt_file.'-temporary.bak'))
3066-
rename($ssl_crt_file.'-temporary.bak', $ssl_crt_file.'-'.$date->format('YmdHis').'.bak');
3067-
if(file_exists($ssl_key_file.'-temporary.bak') || is_link($ssl_key_file.'-temporary.bak'))
3068-
rename($ssl_key_file.'-temporary.bak', $ssl_key_file.'-'.$date->format('YmdHis').'.bak');
3069-
if(file_exists($ssl_pem_file.'-temporary.bak') || is_link($ssl_pem_file.'-temporary.bak'))
3070-
rename($ssl_pem_file.'-temporary.bak', $ssl_pem_file.'-'.$date->format('YmdHis').'.bak');
3081+
foreach ($cert_files as $f) {
3082+
if (is_link($f.'-temporary.bak')) {
3083+
unlink($f.'-temporary.bak');
3084+
} elseif(file_exists($f.'-temporary.bak')) {
3085+
rename($f.'-temporary.bak', $f.'-'.$date->format('YmdHis').'.bak');
3086+
}
3087+
}
30713088

30723089
} else {
30733090
swriteln('Issuing certificate via acme.sh failed. Please check that your hostname can be verified by letsencrypt');
30743091

30753092
umask($old_umask);
30763093

3077-
// Restore temporary backup of self-signed certs
3078-
if(file_exists($ssl_crt_file.'-temporary.bak') || is_link($ssl_crt_file.'-temporary.bak'))
3079-
rename($ssl_crt_file.'-temporary.bak', $ssl_crt_file);
3080-
if(file_exists($ssl_key_file.'-temporary.bak') || is_link($ssl_key_file.'-temporary.bak'))
3081-
rename($ssl_key_file.'-temporary.bak', $ssl_key_file);
3082-
if(file_exists($ssl_pem_file.'-temporary.bak') || is_link($ssl_pem_file.'-temporary.bak'))
3083-
rename($ssl_pem_file.'-temporary.bak', $ssl_pem_file);
3084-
3094+
// Restore/cleanup temporary backup of self-signed certs
3095+
foreach ($cert_files as $f) {
3096+
if (is_link($f.'-temporary.bak')) {
3097+
@unlink($f);
3098+
rename($f.'-temporary.bak', $f);
3099+
} elseif(file_exists($f.'-temporary.bak')) {
3100+
unlink($f.'-temporary.bak');
3101+
}
3102+
}
30853103
}
30863104
// Else, we attempt to use the official LE certbot client certbot
30873105
} else {
@@ -3120,23 +3138,26 @@ public function make_ispconfig_ssl_cert() {
31203138
$issued_successfully = true;
31213139

31223140
// Make temporary backup of self-signed certs permanent
3123-
if(file_exists($ssl_crt_file.'-temporary.bak') || is_link($ssl_crt_file.'-temporary.bak'))
3124-
rename($ssl_crt_file.'-temporary.bak', $ssl_crt_file.'-'.$date->format('YmdHis').'.bak');
3125-
if(file_exists($ssl_key_file.'-temporary.bak') || is_link($ssl_key_file.'-temporary.bak'))
3126-
rename($ssl_key_file.'-temporary.bak', $ssl_key_file.'-'.$date->format('YmdHis').'.bak');
3127-
if(file_exists($ssl_pem_file.'-temporary.bak') || is_link($ssl_pem_file.'-temporary.bak'))
3128-
rename($ssl_pem_file.'-temporary.bak', $ssl_pem_file.'-'.$date->format('YmdHis').'.bak');
3141+
foreach ($cert_files as $f) {
3142+
if (is_link($f.'-temporary.bak')) {
3143+
unlink($f.'-temporary.bak');
3144+
} elseif(file_exists($f.'-temporary.bak')) {
3145+
rename($f.'-temporary.bak', $f.'-'.$date->format('YmdHis').'.bak');
3146+
}
3147+
}
31293148

31303149
} else {
31313150
swriteln('Issuing certificate via certbot failed. Please check log files and make sure that your hostname can be verified by letsencrypt');
31323151

3133-
// Restore temporary backup of self-signed certs
3134-
if(file_exists($ssl_crt_file.'-temporary.bak') || is_link($ssl_crt_file.'-temporary.bak'))
3135-
rename($ssl_crt_file.'-temporary.bak', $ssl_crt_file);
3136-
if(file_exists($ssl_key_file.'-temporary.bak') || is_link($ssl_key_file.'-temporary.bak'))
3137-
rename($ssl_key_file.'-temporary.bak', $ssl_key_file);
3138-
if(file_exists($ssl_pem_file.'-temporary.bak') || is_link($ssl_pem_file.'-temporary.bak'))
3139-
rename($ssl_pem_file.'-temporary.bak', $ssl_pem_file);
3152+
// Restore/cleanup temporary backup of self-signed certs
3153+
foreach ($cert_files as $f) {
3154+
if (is_link($f.'-temporary.bak')) {
3155+
@unlink($f);
3156+
rename($f.'-temporary.bak', $f);
3157+
} elseif(file_exists($f.'-temporary.bak')) {
3158+
unlink($f.'-temporary.bak');
3159+
}
3160+
}
31403161

31413162
}
31423163
} else {

‎server/lib/classes/letsencrypt.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ public function __construct(){
4444
}
4545

4646
public function get_acme_script() {
47-
$acme = explode("\n", shell_exec('which /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh'));
47+
$acme = explode("\n", shell_exec('which acme.sh /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh'));
4848
$acme = reset($acme);
4949
if(is_executable($acme)) {
5050
return $acme;

0 commit comments

Comments
 (0)