mirror of
https://github.com/acmesh-official/acme.sh.git
synced 2025-07-12 03:48:52 +00:00
Merge remote-tracking branch 'upstream/master' into ssh-deploy
This commit is contained in:
David Kerr
@ -1,19 +1,21 @@
|
||||
# Using deploy api
|
||||
|
||||
Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
|
||||
|
||||
Here are the scripts to deploy the certs/key to the server/services.
|
||||
|
||||
## 1. Deploy the certs to your cpanel host.
|
||||
|
||||
(cpanel deploy hook is not finished yet, this is just an example.)
|
||||
|
||||
Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
|
||||
|
||||
|
||||
Then you can deploy now:
|
||||
|
||||
```sh
|
||||
export DEPLOY_CPANEL_USER=myusername
|
||||
export DEPLOY_CPANEL_PASSWORD=PASSWORD
|
||||
acme.sh --deploy -d example.com --deploy --deploy-hook cpanel
|
||||
acme.sh --deploy -d example.com --deploy-hook cpanel
|
||||
```
|
||||
|
||||
## 2. Deploy ssl cert on kong proxy engine based on api.
|
||||
@ -24,6 +26,8 @@ Before you can deploy your cert, you must [issue the cert first](https://github.
|
||||
|
||||
## 3. Deploy the cert to remote server through SSH access.
|
||||
|
||||
Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
|
||||
|
||||
The ssh deploy plugin allows you to deploy certificates to a remote host
|
||||
using SSH command to connect to the remote server. The ssh plugin is invoked
|
||||
with the following command...
|
||||
@ -107,7 +111,6 @@ user
|
||||
Any backups older than 180 days will be deleted when new certificates
|
||||
are deployed. This defaults to "yes" set to "no" to disable backup.
|
||||
|
||||
|
||||
###Eamples using SSH deploy
|
||||
The following example illustrates deploying certifcates to a QNAP NAS
|
||||
(tested with QTS version 4.2.3)
|
||||
@ -165,3 +168,47 @@ export DEPLOY_SSH_BACKUP=no
|
||||
/var/lib/unifi/unifi.example.com.p12 \
|
||||
&& service unifi restart
|
||||
```
|
||||
|
||||
## 4. Deploy the cert to local vsftpd server.
|
||||
|
||||
```sh
|
||||
acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
|
||||
```
|
||||
|
||||
The default vsftpd conf file is `/etc/vsftpd.conf`, if your vsftpd conf is not in the default location, you can specify one:
|
||||
|
||||
```sh
|
||||
export DEPLOY_VSFTPD_CONF="/etc/vsftpd.conf"
|
||||
|
||||
acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
|
||||
```
|
||||
|
||||
The default command to restart vsftpd server is `service vsftpd restart`, if it doesn't work, you can specify one:
|
||||
|
||||
```sh
|
||||
export DEPLOY_VSFTPD_RELOAD="/etc/init.d/vsftpd restart"
|
||||
|
||||
acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
|
||||
```
|
||||
|
||||
## 5. Deploy the cert to local exim4 server.
|
||||
|
||||
```sh
|
||||
acme.sh --deploy -d ftp.example.com --deploy-hook exim4
|
||||
```
|
||||
|
||||
The default exim4 conf file is `/etc/exim/exim.conf`, if your exim4 conf is not in the default location, you can specify one:
|
||||
|
||||
```sh
|
||||
export DEPLOY_EXIM4_CONF="/etc/exim4/exim4.conf.template"
|
||||
|
||||
acme.sh --deploy -d ftp.example.com --deploy-hook exim4
|
||||
```
|
||||
|
||||
The default command to restart exim4 server is `service exim4 restart`, if it doesn't work, you can specify one:
|
||||
|
||||
```sh
|
||||
export DEPLOY_EXIM4_RELOAD="/etc/init.d/exim4 restart"
|
||||
|
||||
acme.sh --deploy -d ftp.example.com --deploy-hook exim4
|
||||
```
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
#Here is a script to deploy cert to dovecot server.
|
||||
#Here is a script to deploy cert to apache server.
|
||||
|
||||
#returns 0 means success, otherwise error.
|
||||
|
||||
|
||||
@ -4,6 +4,9 @@
|
||||
|
||||
#returns 0 means success, otherwise error.
|
||||
|
||||
#DEPLOY_EXIM4_CONF="/etc/exim/exim.conf"
|
||||
#DEPLOY_EXIM4_RELOAD="service exim4 restart"
|
||||
|
||||
######## Public functions #####################
|
||||
|
||||
#domain keyfile certfile cafile fullchain
|
||||
@ -20,7 +23,92 @@ exim4_deploy() {
|
||||
_debug _cca "$_cca"
|
||||
_debug _cfullchain "$_cfullchain"
|
||||
|
||||
_err "deploy cert to exim4 server, Not implemented yet"
|
||||
return 1
|
||||
_ssl_path="/etc/acme.sh/exim4"
|
||||
if ! mkdir -p "$_ssl_path"; then
|
||||
_err "Can not create folder:$_ssl_path"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_info "Copying key and cert"
|
||||
_real_key="$_ssl_path/exim4.key"
|
||||
if ! cat "$_ckey" >"$_real_key"; then
|
||||
_err "Error: write key file to: $_real_key"
|
||||
return 1
|
||||
fi
|
||||
_real_fullchain="$_ssl_path/exim4.pem"
|
||||
if ! cat "$_cfullchain" >"$_real_fullchain"; then
|
||||
_err "Error: write key file to: $_real_fullchain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
DEFAULT_EXIM4_RELOAD="service exim4 restart"
|
||||
_reload="${DEPLOY_EXIM4_RELOAD:-$DEFAULT_EXIM4_RELOAD}"
|
||||
|
||||
if [ -z "$IS_RENEW" ]; then
|
||||
DEFAULT_EXIM4_CONF="/etc/exim/exim.conf"
|
||||
if [ ! -f "$DEFAULT_EXIM4_CONF" ]; then
|
||||
DEFAULT_EXIM4_CONF="/etc/exim4/exim4.conf.template"
|
||||
fi
|
||||
_exim4_conf="${DEPLOY_EXIM4_CONF:-$DEFAULT_EXIM4_CONF}"
|
||||
_debug _exim4_conf "$_exim4_conf"
|
||||
if [ ! -f "$_exim4_conf" ]; then
|
||||
if [ -z "$DEPLOY_EXIM4_CONF" ]; then
|
||||
_err "exim4 conf is not found, please define DEPLOY_EXIM4_CONF"
|
||||
return 1
|
||||
else
|
||||
_err "It seems that the specified exim4 conf is not valid, please check."
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
if [ ! -w "$_exim4_conf" ]; then
|
||||
_err "The file $_exim4_conf is not writable, please change the permission."
|
||||
return 1
|
||||
fi
|
||||
_backup_conf="$DOMAIN_BACKUP_PATH/exim4.conf.bak"
|
||||
_info "Backup $_exim4_conf to $_backup_conf"
|
||||
cp "$_exim4_conf" "$_backup_conf"
|
||||
|
||||
_info "Modify exim4 conf: $_exim4_conf"
|
||||
if _setopt "$_exim4_conf" "tls_certificate" "=" "$_real_fullchain" \
|
||||
&& _setopt "$_exim4_conf" "tls_privatekey" "=" "$_real_key"; then
|
||||
_info "Set config success!"
|
||||
else
|
||||
_err "Config exim4 server error, please report bug to us."
|
||||
_info "Restoring exim4 conf"
|
||||
if cat "$_backup_conf" >"$_exim4_conf"; then
|
||||
_info "Restore conf success"
|
||||
eval "$_reload"
|
||||
else
|
||||
_err "Opps, error restore exim4 conf, please report bug to us."
|
||||
fi
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
_info "Run reload: $_reload"
|
||||
if eval "$_reload"; then
|
||||
_info "Reload success!"
|
||||
if [ "$DEPLOY_EXIM4_CONF" ]; then
|
||||
_savedomainconf DEPLOY_EXIM4_CONF "$DEPLOY_EXIM4_CONF"
|
||||
else
|
||||
_cleardomainconf DEPLOY_EXIM4_CONF
|
||||
fi
|
||||
if [ "$DEPLOY_EXIM4_RELOAD" ]; then
|
||||
_savedomainconf DEPLOY_EXIM4_RELOAD "$DEPLOY_EXIM4_RELOAD"
|
||||
else
|
||||
_cleardomainconf DEPLOY_EXIM4_RELOAD
|
||||
fi
|
||||
return 0
|
||||
else
|
||||
_err "Reload error, restoring"
|
||||
if cat "$_backup_conf" >"$_exim4_conf"; then
|
||||
_info "Restore conf success"
|
||||
eval "$_reload"
|
||||
else
|
||||
_err "Opps, error restore exim4 conf, please report bug to us."
|
||||
fi
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
|
||||
}
|
||||
|
||||
@ -4,6 +4,9 @@
|
||||
|
||||
#returns 0 means success, otherwise error.
|
||||
|
||||
#DEPLOY_VSFTPD_CONF="/etc/vsftpd.conf"
|
||||
#DEPLOY_VSFTPD_RELOAD="service vsftpd restart"
|
||||
|
||||
######## Public functions #####################
|
||||
|
||||
#domain keyfile certfile cafile fullchain
|
||||
@ -20,7 +23,88 @@ vsftpd_deploy() {
|
||||
_debug _cca "$_cca"
|
||||
_debug _cfullchain "$_cfullchain"
|
||||
|
||||
_err "deploy cert to vsftpd server, Not implemented yet"
|
||||
return 1
|
||||
_ssl_path="/etc/acme.sh/vsftpd"
|
||||
if ! mkdir -p "$_ssl_path"; then
|
||||
_err "Can not create folder:$_ssl_path"
|
||||
return 1
|
||||
fi
|
||||
|
||||
_info "Copying key and cert"
|
||||
_real_key="$_ssl_path/vsftpd.key"
|
||||
if ! cat "$_ckey" >"$_real_key"; then
|
||||
_err "Error: write key file to: $_real_key"
|
||||
return 1
|
||||
fi
|
||||
_real_fullchain="$_ssl_path/vsftpd.chain.pem"
|
||||
if ! cat "$_cfullchain" >"$_real_fullchain"; then
|
||||
_err "Error: write key file to: $_real_fullchain"
|
||||
return 1
|
||||
fi
|
||||
|
||||
DEFAULT_VSFTPD_RELOAD="service vsftpd restart"
|
||||
_reload="${DEPLOY_VSFTPD_RELOAD:-$DEFAULT_VSFTPD_RELOAD}"
|
||||
|
||||
if [ -z "$IS_RENEW" ]; then
|
||||
DEFAULT_VSFTPD_CONF="/etc/vsftpd.conf"
|
||||
_vsftpd_conf="${DEPLOY_VSFTPD_CONF:-$DEFAULT_VSFTPD_CONF}"
|
||||
if [ ! -f "$_vsftpd_conf" ]; then
|
||||
if [ -z "$DEPLOY_VSFTPD_CONF" ]; then
|
||||
_err "vsftpd conf is not found, please define DEPLOY_VSFTPD_CONF"
|
||||
return 1
|
||||
else
|
||||
_err "It seems that the specified vsftpd conf is not valid, please check."
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
if [ ! -w "$_vsftpd_conf" ]; then
|
||||
_err "The file $_vsftpd_conf is not writable, please change the permission."
|
||||
return 1
|
||||
fi
|
||||
_backup_conf="$DOMAIN_BACKUP_PATH/vsftpd.conf.bak"
|
||||
_info "Backup $_vsftpd_conf to $_backup_conf"
|
||||
cp "$_vsftpd_conf" "$_backup_conf"
|
||||
|
||||
_info "Modify vsftpd conf: $_vsftpd_conf"
|
||||
if _setopt "$_vsftpd_conf" "rsa_cert_file" "=" "$_real_fullchain" \
|
||||
&& _setopt "$_vsftpd_conf" "rsa_private_key_file" "=" "$_real_key" \
|
||||
&& _setopt "$_vsftpd_conf" "ssl_enable" "=" "YES"; then
|
||||
_info "Set config success!"
|
||||
else
|
||||
_err "Config vsftpd server error, please report bug to us."
|
||||
_info "Restoring vsftpd conf"
|
||||
if cat "$_backup_conf" >"$_vsftpd_conf"; then
|
||||
_info "Restore conf success"
|
||||
eval "$_reload"
|
||||
else
|
||||
_err "Opps, error restore vsftpd conf, please report bug to us."
|
||||
fi
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
_info "Run reload: $_reload"
|
||||
if eval "$_reload"; then
|
||||
_info "Reload success!"
|
||||
if [ "$DEPLOY_VSFTPD_CONF" ]; then
|
||||
_savedomainconf DEPLOY_VSFTPD_CONF "$DEPLOY_VSFTPD_CONF"
|
||||
else
|
||||
_cleardomainconf DEPLOY_VSFTPD_CONF
|
||||
fi
|
||||
if [ "$DEPLOY_VSFTPD_RELOAD" ]; then
|
||||
_savedomainconf DEPLOY_VSFTPD_RELOAD "$DEPLOY_VSFTPD_RELOAD"
|
||||
else
|
||||
_cleardomainconf DEPLOY_VSFTPD_RELOAD
|
||||
fi
|
||||
return 0
|
||||
else
|
||||
_err "Reload error, restoring"
|
||||
if cat "$_backup_conf" >"$_vsftpd_conf"; then
|
||||
_info "Restore conf success"
|
||||
eval "$_reload"
|
||||
else
|
||||
_err "Opps, error restore vsftpd conf, please report bug to us."
|
||||
fi
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user