Skip to content

Commit 41eb0d8

Browse files
serghey-rodinserghey-rodin
committed
LetsEncrypt core API support
1 parent 872cd3a commit 41eb0d8

File tree

7 files changed

+656
-28
lines changed

7 files changed

+656
-28
lines changed

‎bin/v-add-letsencrypt-domain‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
#!/bin/bash
2+
# info: adding letsencrypt ssl cetificate for domain
3+
# options: USER DOMAIN [ALIASES] [RESTART]
4+
#
5+
# The function turns on SSL support for a domain. Parameter ssl_dir is a path
6+
# to directory where 2 or 3 ssl files can be found. Certificate file
7+
# domain.tld.crt and its key domain.tld.key are mandatory. Certificate
8+
# authority domain.tld.ca file is optional. If home directory parameter
9+
# (ssl_home) is not set, https domain uses public_shtml as separate
10+
# documentroot directory.
11+
12+
13+
#----------------------------------------------------------#
14+
# Variable&Function #
15+
#----------------------------------------------------------#
16+
17+
# Argument definition
18+
user=$1
19+
domain=$2
20+
aliases=$3
21+
restart=$4
22+
23+
# Includes
24+
source $VESTA/func/main.sh
25+
source $VESTA/func/domain.sh
26+
source $VESTA/conf/vesta.conf
27+
28+
29+
#----------------------------------------------------------#
30+
# Verifications #
31+
#----------------------------------------------------------#
32+
33+
check_args '2' "$#" 'USER DOMAIN [RESTART]'
34+
is_format_valid 'user' 'domain'
35+
is_system_enabled "$WEB_SYSTEM" 'WEB_SYSTEM'
36+
is_system_enabled "$WEB_SSL" 'SSL_SUPPORT'
37+
is_object_valid 'user' 'USER' "$user"
38+
is_object_unsuspended 'user' 'USER' "$user"
39+
is_object_valid 'web' 'DOMAIN' "$domain"
40+
is_object_unsuspended 'web' 'DOMAIN' "$domain"
41+
42+
43+
#----------------------------------------------------------#
44+
# Action #
45+
#----------------------------------------------------------#
46+
47+
# Registering LetsEncrypt user account
48+
$BIN/v-add-letsencrypt-user $user
49+
check_result $? "LE account registration" >/dev/null
50+
source $USER_DATA/ssl/le.conf
51+
email=$EMAIL
52+
53+
# Validating domain and aliases
54+
i=1
55+
for alias in $(echo $domain,$aliases |tr ',' '\n' |sort -u); do
56+
$BIN/v-check-letsencrypt-domain $user $alias
57+
check_result $? "LE domain validation" >/dev/null
58+
if [ "$i" -gt 6 ]; then
59+
check_result $E_LIMIT "LE can't sign more than 6 domains"
60+
fi
61+
i=$((i++))
62+
done
63+
64+
# Generating CSR
65+
ssl_dir=$($BIN/v-generate-ssl-cert "$domain" "$email" "US" "California" \
66+
"San Francisco" "Vesta" "IT" "$aliases" |tail -n1 |awk '{print $2}')
67+
68+
# Signing CSR
69+
crt=$($BIN/v-sign-letsencrypt-csr $user $domain $ssl_dir)
70+
check_result $? "$crt"
71+
echo "$crt" > $ssl_dir/$domain.crt
72+
73+
# Dowloading CA certificate
74+
le_certs='https://letsencrypt.org/certs'
75+
x1='lets-encrypt-x1-cross-signed.pem.txt'
76+
x3='lets-encrypt-x3-cross-signed.pem.txt'
77+
issuer=$(openssl x509 -text -in $ssl_dir/$domain.crt |grep "Issuer:")
78+
if [ -z "$(echo $issuer|grep X3)" ]; then
79+
curl -s $le_certs/$x1 > $ssl_dir/$domain.ca
80+
else
81+
curl -s $le_certs/$x3 > $ssl_dir/$domain.ca
82+
fi
83+
84+
# Adding SSL
85+
$BIN/v-delete-web-domain-ssl $user $domain >/dev/null 2>&1
86+
$BIN/v-add-web-domain-ssl $user $domain $ssl_dir
87+
check_result $? "SSL install" >/dev/null
88+
89+
90+
#----------------------------------------------------------#
91+
# Vesta #
92+
#----------------------------------------------------------#
93+
94+
# Logging
95+
log_event "$OK" "$ARGUMENTS"
96+
97+
exit

‎bin/v-add-letsencrypt-user‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
#!/bin/bash
2+
# info: register letsencrypt user account
3+
# options: USER [EMAIL]
4+
#
5+
# The function creates and register LetsEncript account key
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument definition
13+
user=$1
14+
email=$2
15+
key_size=2048
16+
17+
# Includes
18+
source $VESTA/func/main.sh
19+
source $VESTA/conf/vesta.conf
20+
21+
# encode base64
22+
encode_base64() {
23+
cat |base64 |tr '+/' '-_' |tr -d '\r\n='
24+
}
25+
26+
27+
#----------------------------------------------------------#
28+
# Verifications #
29+
#----------------------------------------------------------#
30+
31+
check_args '1' "$#" 'USER [EMAIL]'
32+
is_format_valid 'user'
33+
is_object_valid 'user' 'USER' "$user"
34+
if [ -e "$USER_DATA/ssl/le.conf" ]; then
35+
exit
36+
fi
37+
38+
39+
#----------------------------------------------------------#
40+
# Action #
41+
#----------------------------------------------------------#
42+
43+
api='https://acme-v01.api.letsencrypt.org'
44+
agreement='https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf'
45+
if [ -z "$email" ]; then
46+
email=$(get_user_value '$CONTACT')
47+
fi
48+
49+
# Generating key
50+
key="$USER_DATA/ssl/user.key"
51+
if [ ! -e "$key" ]; then
52+
openssl genrsa -out $key $key_size >/dev/null 2>&1
53+
chmod 600 $key
54+
fi
55+
56+
# Defining key exponent
57+
exponent=$(openssl pkey -inform perm -in "$key" -noout -text_pub |\
58+
grep Exponent: |cut -f 2 -d '(' |cut -f 1 -d ')' |sed -e 's/x//' |\
59+
xxd -r -p |encode_base64)
60+
61+
# Defining key modulus
62+
modulus=$(openssl rsa -in "$key" -modulus -noout |\
63+
sed -e 's/^Modulus=//' |xxd -r -p |encode_base64)
64+
65+
# Defining key thumb
66+
thumb='{"e":"'$exponent'","kty":"RSA","n":"'"$modulus"'"}'
67+
thumb="$(echo -n "$thumb" |openssl dgst -sha256 -binary |encode_base64)"
68+
69+
# Defining JWK header
70+
header='{"e":"'$exponent'","kty":"RSA","n":"'"$modulus"'"}'
71+
header='{"alg":"RS256","jwk":'"$header"'}'
72+
73+
# Requesting nonce
74+
nonce=$(curl -s -I "$api/directory" |grep Nonce |cut -f 2 -d \ |tr -d '\r\n')
75+
protected=$(echo -n '{"nonce":"'"$nonce"'"}' |encode_base64)
76+
77+
# Defining registration query
78+
query='{"resource":"new-reg","contact":["mailto:'"$email"'"],'
79+
query=$query'"agreement":"'$agreement'"}'
80+
payload=$(echo -n "$query" |encode_base64)
81+
signature=$(printf "%s" "$protected.$payload" |\
82+
openssl dgst -sha256 -binary -sign "$key" |encode_base64)
83+
data='{"header":'"$header"',"protected":"'"$protected"'",'
84+
data=$data'"payload":"'"$payload"'","signature":"'"$signature"'"}'
85+
86+
# Sending request to LetsEncrypt API
87+
answer=$(curl -s -i -d "$data" "$api/acme/new-reg")
88+
status=$(echo "$answer" |grep HTTP/1.1 |tail -n1 |cut -f2 -d ' ')
89+
90+
# Checking http answer status
91+
if [[ "$status" -ne "201" ]] && [[ "$status" -ne "409" ]]; then
92+
check_result $E_CONNECT "LetsEncrypt account registration $status"
93+
fi
94+
95+
96+
#----------------------------------------------------------#
97+
# Vesta #
98+
#----------------------------------------------------------#
99+
100+
# Adding le.conf
101+
echo "EMAIL='$email'" > $USER_DATA/ssl/le.conf
102+
echo "EXPONENT='$exponent'" >> $USER_DATA/ssl/le.conf
103+
echo "MODULUS='$modulus'" >> $USER_DATA/ssl/le.conf
104+
echo "THUMB='$thumb'" >> $USER_DATA/ssl/le.conf
105+
chmod 660 $USER_DATA/ssl/le.conf
106+
107+
108+
# Logging
109+
log_event "$OK" "$ARGUMENTS"
110+
111+
exit

‎bin/v-check-letsencrypt-domain‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
#!/bin/bash
2+
# info: check letsencrypt domain
3+
# options: USER DOMAIN
4+
#
5+
# The function check and validates domain with LetsEncript
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument definition
13+
user=$1
14+
domain=$(idn -t --quiet -u "$2" )
15+
domain=$(echo $domain | tr '[:upper:]' '[:lower:]')
16+
17+
# Includes
18+
source $VESTA/func/main.sh
19+
source $VESTA/conf/vesta.conf
20+
21+
# encode base64
22+
encode_base64() {
23+
cat |base64 |tr '+/' '-_' |tr -d '\r\n='
24+
}
25+
26+
27+
#----------------------------------------------------------#
28+
# Verifications #
29+
#----------------------------------------------------------#
30+
31+
check_args '2' "$#" 'USER DOMAIN'
32+
is_format_valid 'user' 'domain'
33+
is_system_enabled "$WEB_SYSTEM" 'WEB_SYSTEM'
34+
is_object_valid 'user' 'USER' "$user"
35+
is_object_unsuspended 'user' 'USER' "$user"
36+
if [ ! -e "$USER_DATA/ssl/le.conf" ]; then
37+
check_result $E_NOTEXIST "LetsEncrypt key doesn't exist"
38+
fi
39+
check_domain=$(grep -w "$domain'" $USER_DATA/web.conf)
40+
if [ -z "$check_domain" ]; then
41+
check_result $E_NOTEXIST "domain $domain doesn't exist"
42+
fi
43+
44+
45+
#----------------------------------------------------------#
46+
# Action #
47+
#----------------------------------------------------------#
48+
49+
source $USER_DATA/ssl/le.conf
50+
api='https://acme-v01.api.letsencrypt.org'
51+
r_domain=$(echo "$check_domain" |cut -f 2 -d \')
52+
key="$USER_DATA/ssl/user.key"
53+
exponent="$EXPONENT"
54+
modulus="$MODULUS"
55+
thumb="$THUMB"
56+
57+
# Defining JWK header
58+
header='{"e":"'$exponent'","kty":"RSA","n":"'"$modulus"'"}'
59+
header='{"alg":"RS256","jwk":'"$header"'}'
60+
61+
# Requesting nonce
62+
nonce=$(curl -s -I "$api/directory" |grep Nonce |cut -f2 -d \ |tr -d '\r\n')
63+
protected=$(echo -n '{"nonce":"'"$nonce"'"}' |encode_base64)
64+
65+
# Defining ACME query (request challenge)
66+
query='{"resource":"new-authz","identifier"'
67+
query=$query':{"type":"dns","value":"'"$domain"'"}}'
68+
payload=$(echo -n "$query" |encode_base64)
69+
signature=$(printf "%s" "$protected.$payload" |\
70+
openssl dgst -sha256 -binary -sign "$key" |encode_base64)
71+
data='{"header":'"$header"',"protected":"'"$protected"'",'
72+
data=$data'"payload":"'"$payload"'","signature":"'"$signature"'"}'
73+
74+
# Sending request to LetsEncrypt API
75+
answer=$(curl -s -i -d "$data" "$api/acme/new-authz")
76+
77+
# Checking http answer status
78+
status=$(echo "$answer" |grep HTTP/1.1 |tail -n1 |cut -f2 -d ' ')
79+
if [[ "$status" -ne "201" ]]; then
80+
check_result $E_CONNECT "LetsEncrypt challenge request $status"
81+
fi
82+
83+
# Parsing domain nonce,token and uri
84+
nonce=$(echo "$answer" |grep Nonce |cut -f2 -d \ |tr -d '\r\n')
85+
protected=$(echo -n '{"nonce":"'"$nonce"'"}' |encode_base64)
86+
token=$(echo "$answer" |tr ',' '\n' |grep -A 3 http-01 |grep token)
87+
token=$(echo "$token" |cut -f 4 -d \")
88+
uri=$(echo "$answer" |tr ',' '\n' |grep -A 3 http-01 |grep uri)
89+
uri=$(echo "$uri" |cut -f 4 -d \")
90+
91+
# Adding location wrapper for request challenge
92+
if [ "$WEB_SYSTEM" = 'nginx' ] || [ "$PROXY_SYSTEM" = 'nginx' ]; then
93+
conf="$HOMEDIR/$user/conf/web/nginx.$r_domain.conf_letsencrypt"
94+
if [ ! -e "$conf" ]; then
95+
echo 'location ~ "^/\.well-known/acme-challenge/(.*)$" {' > $conf
96+
echo ' default_type text/plain;' >> $conf
97+
echo ' return 200 "$1.'$thumb'";' >> $conf
98+
echo '}' >> $conf
99+
if [ ! -z "$PROXY_SYSTEM" ]; then
100+
$BIN/v-restart-proxy
101+
check_result $? "Proxy restart failed" >/dev/null
102+
else
103+
$BIN/v-restart-web
104+
check_result $? "Web restart failed" >/dev/null
105+
fi
106+
fi
107+
else
108+
acme="$HOMEDIR/$user/web/$r_domain/public_html/.well-known/acme-challenge"
109+
echo "$token" > $acme/$token.$thumb
110+
chown -R $user:$user $HOMEDIR/$user/web/$r_domain/public_html/.well-known
111+
fi
112+
113+
# Defining ACME query (request validation)
114+
query='{"resource":"challenge","type":"http-01","keyAuthorization"'
115+
query=$query':"'$token.$thumb'","token":"'$token'"}'
116+
payload=$(echo -n "$query" |encode_base64)
117+
signature=$(printf "%s" "$protected.$payload" |\
118+
openssl dgst -sha256 -binary -sign "$key" |encode_base64)
119+
data='{"header":'"$header"',"protected":"'"$protected"'",'
120+
data=$data'"payload":"'"$payload"'","signature":"'"$signature"'"}'
121+
122+
# Sending request to LetsEncrypt API
123+
answer=$(curl -s -i -d "$data" "$uri")
124+
125+
# Checking domain validation status
126+
status=$(echo $answer |tr ',' '\n' |grep status |cut -f 4 -d \")
127+
location=$(echo "$answer" |grep Location: |awk '{print $2}' |tr -d '\r\n')
128+
while [ "$status" = 'pending' ] ; do
129+
answer=$(curl -s -i "$location")
130+
status=$(echo "$answer" |tr ',' '\n' |grep status |cut -f 4 -d \")
131+
done
132+
if [ "$status" = 'invalid' ]; then
133+
detail="$(echo $answer |tr ',' '\n' |grep detail |cut -f 4 -d \")"
134+
check_result $E_CONNECT "$detail"
135+
fi
136+
137+
138+
#----------------------------------------------------------#
139+
# Vesta #
140+
#----------------------------------------------------------#
141+
142+
# Logging
143+
log_event "$OK" "$ARGUMENTS"
144+
145+
exit

0 commit comments

Comments
 (0)