wcp/bin/v-add-letsencrypt-user at 02f677645b2194020d43dbd511812a5eb45dce14 · ghzhost/wcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
#!/bin/bash
# info: register letsencrypt user account
# options: USER
#
# The function creates and register LetsEncrypt account


#----------------------------------------------------------#
#                    Variable&Function                     #
#----------------------------------------------------------#

# Argument definition
user=$1

# Includes
source $HESTIA/func/main.sh
source $HESTIA/conf/hestia.conf

# LE API
LE_API='https://acme-v02.api.letsencrypt.org'

if [[ "$LE_STAGING" = 'yes' ]]; then
    LE_API='https://acme-staging-v02.api.letsencrypt.org'
fi

# encode base64
encode_base64() {
    cat |base64 |tr '+/' '-_' |tr -d '\r\n='
}

# Let's Encrypt v2 curl function
query_le_v2() {
    protected='{"nonce": "'$3'",'
    protected=''$protected' "url": "'$1'",'
    protected=''$protected' "alg": "RS256", "jwk": '$jwk'}'
    content="Content-Type: application/jose+json"

    payload_=$(echo -n "$2" |encode_base64)
    protected_=$(echo -n "$protected" |encode_base64)
    signature_=$(printf "%s" "$protected_.$payload_" |\
        openssl dgst -sha256 -binary -sign $USER_DATA/ssl/user.key |\
        encode_base64)

    post_data='{"protected":"'"$protected_"'",'
    post_data=$post_data'"payload":"'"$payload_"'",'
    post_data=$post_data'"signature":"'"$signature_"'"}'

    curl -s -i -d "$post_data" "$1" -H "$content"
}


#----------------------------------------------------------#
#                    Verifications                         #
#----------------------------------------------------------#

check_args '1' "$#" 'USER'
is_format_valid 'user'
is_object_valid 'user' 'USER' "$user"
if [ -e "$USER_DATA/ssl/le.conf" ]; then
    source "$USER_DATA/ssl/le.conf"
fi
if [ ! -z "$KID" ]; then
    exit
fi


#----------------------------------------------------------#
#                       Action                             #
#----------------------------------------------------------#


# Defining user email
if [[ -z "$EMAIL" ]]; then
    EMAIL=$(get_user_value '$CONTACT')
fi

# Defining user agreement
agreement=''

# Generating user key
KEY="$USER_DATA/ssl/user.key"
if [ ! -e "$KEY" ]; then
    openssl genrsa -out $KEY 4096 >/dev/null 2>&1
    chmod 600 $KEY
fi

# Defining key exponent
if [ -z "$EXPONENT" ]; then
    EXPONENT=$(openssl pkey -inform pem -in "$KEY" -noout -text_pub |\
        grep Exponent: |cut -f 2 -d '(' |cut -f 1 -d ')' |sed -e 's/x//' |\
        xxd -r -p |encode_base64)
fi

# Defining key modulus
if [ -z "$MODULUS" ]; then
    MODULUS=$(openssl rsa -in "$KEY" -modulus -noout |\
        sed -e 's/^Modulus=//' |xxd -r -p |encode_base64)
fi

# Defining JWK
jwk='{"e":"'$EXPONENT'","kty":"RSA","n":"'"$MODULUS"'"}'

# Defining key thumbnail
if [ -z "$THUMB" ]; then
    THUMB="$(echo -n "$jwk" |openssl dgst -sha256 -binary |encode_base64)"
fi


# Requesting ACME nonce
nonce=$(curl -s -I "$LE_API/directory" |grep -i nonce |cut -f2 -d\ |tr -d '\r\n')

# Creating ACME account
url="$LE_API/acme/new-acct"
payload='{"termsOfServiceAgreed": true}'
answer=$(query_le_v2 "$url" "$payload" "$nonce")
kid=$(echo "$answer" |grep -i location: |cut -f2 -d ' '|tr -d '\r')

# Checking answer status
status=$(echo "$answer" |grep HTTP/ |tail -n1 |cut -f2 -d ' ')
if [[ "${status:0:2}" -ne "20" ]]; then
    check_result $E_CONNECT "Let's Encrypt acc registration failed $status"
fi


#----------------------------------------------------------#
#                        Hestia                            #
#----------------------------------------------------------#

# Adding le.conf
if [ ! -e "$USER_DATA/ssl/le.conf" ]; then
    echo "EXPONENT='$EXPONENT'" > $USER_DATA/ssl/le.conf
    echo "MODULUS='$MODULUS'" >> $USER_DATA/ssl/le.conf
    echo "THUMB='$THUMB'" >> $USER_DATA/ssl/le.conf
    echo "EMAIL='$EMAIL'" >> $USER_DATA/ssl/le.conf
    echo "KID='$kid'" >> $USER_DATA/ssl/le.conf
    chmod 660  $USER_DATA/ssl/le.conf
else
    sed -i '/^KID=/d' $USER_DATA/ssl/le.conf
    echo "KID='$kid'" >> $USER_DATA/ssl/le.conf
fi

# Logging
log_event "$OK" "$ARGUMENTS"

exit