Skip to content

Commit 667ce34

Browse files
ScIT-RaphaelScIT-Raphael
committed
ACME v2 support
1 parent bd177ae commit 667ce34

File tree

2 files changed

+118
-46
lines changed

2 files changed

+118
-46
lines changed

‎bin/v-add-letsencrypt-user‎

Lines changed: 111 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# info: register letsencrypt user account
3-
# options: USER [EMAIL]
3+
# options: USER [TYPE]
44
#
55
# The function creates and register LetsEncript account key
66

@@ -11,7 +11,7 @@
1111

1212
# Argument definition
1313
user=$1
14-
email=$2
14+
type=${2-1}
1515
key_size=4096
1616

1717
# Includes
@@ -28,85 +28,155 @@ encode_base64() {
2828
# Verifications #
2929
#----------------------------------------------------------#
3030

31-
check_args '1' "$#" 'USER [EMAIL]'
31+
check_args '1' "$#" 'USER [TYPE]'
3232
is_format_valid 'user'
3333
is_object_valid 'user' 'USER' "$user"
3434
if [ -e "$USER_DATA/ssl/le.conf" ]; then
35-
exit
35+
source "$USER_DATA/ssl/le.conf"
36+
if [ "$type" -eq 1 ] && [ ! -z "$EMAIL" ]; then
37+
exit
38+
fi
39+
if [ "$type" -eq 2 ] && [ ! -z "$KID" ]; then
40+
exit
41+
fi
3642
fi
3743

3844

3945
#----------------------------------------------------------#
4046
# Action #
4147
#----------------------------------------------------------#
4248

43-
api='https://acme-v01.api.letsencrypt.org'
44-
if [ -z "$email" ]; then
49+
# Defining LE API endpoint
50+
if [ "$type" -eq 1 ]; then
51+
api='https://acme-v01.api.letsencrypt.org'
52+
else
53+
api='https://acme-v02.api.letsencrypt.org'
54+
fi
55+
56+
# Defining user email
57+
if [ $type -eq 1 ]; then
4558
email=$(get_user_value '$CONTACT')
4659
fi
4760

48-
agreement=$(curl -s -I "$api/terms" |grep Location |cut -f 2 -d \ |tr -d '\r\n')
61+
# Defining user agreement
62+
if [ "$type" -eq 1 ]; then
63+
agreement=$(curl -s -I "$api/terms" |grep Location |\
64+
cut -f 2 -d \ |tr -d '\r\n')
65+
else
66+
#agreement=$(curl -s "$api/directory" |grep termsOfService |\
67+
# cut -f 4 -d '"')
68+
agreement=''
69+
fi
4970

50-
# Generating key
71+
# Generating user key
5172
key="$USER_DATA/ssl/user.key"
5273
if [ ! -e "$key" ]; then
5374
openssl genrsa -out $key $key_size >/dev/null 2>&1
5475
chmod 600 $key
5576
fi
5677

5778
# Defining key exponent
58-
exponent=$(openssl pkey -inform pem -in "$key" -noout -text_pub |\
59-
grep Exponent: |cut -f 2 -d '(' |cut -f 1 -d ')' |sed -e 's/x//' |\
60-
xxd -r -p |encode_base64)
79+
if [ -z "$EXPONENT" ]; then
80+
exponent=$(openssl pkey -inform pem -in "$key" -noout -text_pub |\
81+
grep Exponent: |cut -f 2 -d '(' |cut -f 1 -d ')' |sed -e 's/x//' |\
82+
xxd -r -p |encode_base64)
83+
else
84+
exponent="$EXPONENT"
85+
fi
6186

6287
# Defining key modulus
63-
modulus=$(openssl rsa -in "$key" -modulus -noout |\
64-
sed -e 's/^Modulus=//' |xxd -r -p |encode_base64)
88+
if [ -z "$MODULUS" ]; then
89+
modulus=$(openssl rsa -in "$key" -modulus -noout |\
90+
sed -e 's/^Modulus=//' |xxd -r -p |encode_base64)
91+
else
92+
modulus="$MODULUS"
93+
fi
6594

66-
# Defining key thumb
67-
thumb='{"e":"'$exponent'","kty":"RSA","n":"'"$modulus"'"}'
68-
thumb="$(echo -n "$thumb" |openssl dgst -sha256 -binary |encode_base64)"
95+
# Defining JWK token
96+
jwk='{"e":"'$exponent'","kty":"RSA","n":"'"$modulus"'"}'
6997

70-
# Defining JWK header
71-
header='{"e":"'$exponent'","kty":"RSA","n":"'"$modulus"'"}'
72-
header='{"alg":"RS256","jwk":'"$header"'}'
98+
# Defining key thumbnail
99+
if [ -z "$THUMB" ]; then
100+
thumb="$(echo -n "$jwk" |openssl dgst -sha256 -binary |encode_base64)"
101+
else
102+
thumb="$THUMB"
103+
fi
73104

74-
# Requesting nonce
105+
# Requesting ACME nonce
75106
nonce=$(curl -s -I "$api/directory" |grep Nonce |cut -f 2 -d \ |tr -d '\r\n')
76-
protected=$(echo -n '{"nonce":"'"$nonce"'"}' |encode_base64)
77107

78-
# Defining registration query
79-
query='{"resource":"new-reg","contact":["mailto:'"$email"'"],'
80-
query=$query'"agreement":"'$agreement'"}'
81-
payload=$(echo -n "$query" |encode_base64)
82-
signature=$(printf "%s" "$protected.$payload" |\
83-
openssl dgst -sha256 -binary -sign "$key" |encode_base64)
84-
data='{"header":'"$header"',"protected":"'"$protected"'",'
85-
data=$data'"payload":"'"$payload"'","signature":"'"$signature"'"}'
108+
# Defining payload and protected data for v1 and v2
109+
if [ "$type" -eq 1 ]; then
110+
header='{"alg":"RS256","jwk":'"$jwk"'}'
111+
protected='{"nonce":"'"$nonce"'"}'
112+
payload='{"resource":"new-reg","contact":["mailto:'"$email"'"],'
113+
payload=$payload'"agreement":"'$agreement'"}'
114+
115+
else
116+
protected='{"nonce": "'$nonce'",'
117+
protected=''$protected' "url": "'$api/acme/new-acct'",'
118+
protected=''$protected' "alg": "RS256", "jwk": '$jwk'}'
119+
payload='{"termsOfServiceAgreed": true}'
120+
fi
121+
122+
# Encoding data
123+
protected=$(echo -n "$protected" |encode_base64)
124+
payload=$(echo -n "$payload" |encode_base64)
86125

87-
# Sending request to LetsEncrypt API
88-
answer=$(curl -s -i -d "$data" "$api/acme/new-reg")
89-
status=$(echo "$answer" |grep HTTP/1.1 |tail -n1 |cut -f2 -d ' ')
126+
# Signing request
127+
signature=$(printf "%s" "$protected.$payload" |\
128+
openssl dgst -sha256 -binary -sign "$key" |\
129+
encode_base64)
130+
131+
if [ "$type" -eq 1 ]; then
132+
data='{"header":'"$header"',"protected":"'"$protected"'",'
133+
data=$data'"payload":"'"$payload"'","signature":"'"$signature"'"}'
134+
135+
answer=$(curl -s -i -d "$data" "$api/acme/new-reg")
136+
status=$(echo "$answer" |grep HTTP/1.1 |tail -n1 |cut -f2 -d ' ')
137+
else
138+
data='{"protected":"'"$protected"'",'
139+
data=$data'"payload":"'"$payload"'",'
140+
data=$data'"signature":"'"$signature"'"}'
141+
142+
answer=$(curl -s -i -d "$data" "$api/acme/new-acct" \
143+
-H "Content-Type: application/jose+json")
144+
status=$(echo "$answer" |grep HTTP/1.1 |tail -n1 |cut -f2 -d ' ')
145+
kid=$(echo "$answer" |grep Location: |cut -f2 -d ' '|tr -d '\r')
146+
fi
90147

91148
# Checking http answer status
92-
if [[ "$status" -ne "201" ]] && [[ "$status" -ne "409" ]]; then
149+
if [[ "${status:0:2}" -ne "20" ]] && [[ "$status" -ne "409" ]]; then
93150
check_result $E_CONNECT "LetsEncrypt account registration $status"
94151
fi
95152

96153

97154
#----------------------------------------------------------#
98-
# Hestia #
155+
# Vesta #
99156
#----------------------------------------------------------#
100157

101158
# Adding le.conf
102-
echo "EMAIL='$email'" > $USER_DATA/ssl/le.conf
103-
echo "EXPONENT='$exponent'" >> $USER_DATA/ssl/le.conf
104-
echo "MODULUS='$modulus'" >> $USER_DATA/ssl/le.conf
105-
echo "THUMB='$thumb'" >> $USER_DATA/ssl/le.conf
106-
chmod 660 $USER_DATA/ssl/le.conf
107-
159+
if [ ! -e "$USER_DATA/ssl/le.conf" ]; then
160+
echo "EXPONENT='$exponent'" > $USER_DATA/ssl/le.conf
161+
echo "MODULUS='$modulus'" >> $USER_DATA/ssl/le.conf
162+
echo "THUMB='$thumb'" >> $USER_DATA/ssl/le.conf
163+
if [ "$type" -eq 1]; then
164+
echo "EMAIL='$email'" >> $USER_DATA/ssl/le.conf
165+
else
166+
echo "KID='$kid'" >> $USER_DATA/ssl/le.conf
167+
fi
168+
chmod 660 $USER_DATA/ssl/le.conf
169+
else
170+
if [ "$type" -eq 1 ]; then
171+
sed -i '/^EMAIL=/d' $USER_DATA/ssl/le.conf
172+
echo "EMAIL='$email'" >> $USER_DATA/ssl/le.conf
173+
else
174+
sed -i '/^KID=/d' $USER_DATA/ssl/le.conf
175+
echo "KID='$kid'" >> $USER_DATA/ssl/le.conf
176+
fi
177+
fi
108178

109179
# Logging
110180
log_event "$OK" "$ARGUMENTS"
111181

112-
exit
182+
exit

‎bin/v-list-letsencrypt-user‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ json_list() {
2323
"EMAIL": "'$EMAIL'",
2424
"EXPONENT": "'$EXPONENT'",
2525
"MODULUS": "'$MODULUS'",
26-
"THUMB: "'$THUMB'"
26+
"THUMB": "'$THUMB'",
27+
"KID": "'$KID'"
2728
}'
2829
echo '}'
2930
}
@@ -35,17 +36,18 @@ shell_list() {
3536
echo "THUMB: $THUMB"
3637
echo "EXPONENT: $EXPONENT"
3738
echo "MODULUS: $MODULUS"
39+
echo "KID: $KID"
3840
}
3941

4042
# PLAIN list function
4143
plain_list() {
42-
echo -e "$user\t$EMAIL\t$EXPONENT\t$MODULUS\t$THUMB"
44+
echo -e "$user\t$EMAIL\t$EXPONENT\t$MODULUS\t$THUMB\t$KID"
4345
}
4446

4547
# CSV list function
4648
csv_list() {
47-
echo "USER,EMAIL,EXPONENT,MODULUS,THUMB"
48-
echo "$user,$EMAIL,$EXPONENT,$MODULUS,$THUMB"
49+
echo "USER,EMAIL,EXPONENT,MODULUS,THUMB,KID"
50+
echo "$user,$EMAIL,$EXPONENT,$MODULUS,$THUMB,$KID"
4951
}
5052

5153

@@ -79,4 +81,4 @@ esac
7981
# Hestia #
8082
#----------------------------------------------------------#
8183

82-
exit
84+
exit

0 commit comments

Comments
 (0)