update process
5 years ago
33 changed files with 724 additions and 138 deletions
Split View
Diff Options
-
+5 -0.gitattributes
-
+9 -0.gitignore
-
+3 -4Makefile
-
+75 -11README.md
-
+63 -0dns_scripts/00GoDaddy-README.txt
-
+76 -0dns_scripts/dns_add_cpanel
-
+185 -0dns_scripts/dns_add_del_aliyun.sh
-
+2 -1dns_scripts/dns_add_godaddy
-
+2 -1dns_scripts/dns_add_nsupdate
-
+69 -0dns_scripts/dns_del_cpanel
-
+3 -2dns_scripts/dns_del_godaddy
-
+2 -1dns_scripts/dns_del_nsupdate
-
+31 -6dns_scripts/dns_godaddy
-
+1 -1dns_scripts/dns_route53.py
-
+5 -14test/17-test-spaces-in-sans-dns01.bats
-
+5 -14test/17-test-spaces-in-sans-http01.bats
-
+3 -2test/18-retry-dns-add.bats
-
+30 -14test/35-preferred-chain.bats
-
+94 -0test/36-full-chain-inc-root.bats
-
+5 -6test/Dockerfile-alpine
-
+2 -3test/Dockerfile-centos6
-
+4 -5test/Dockerfile-centos7
-
+5 -6test/Dockerfile-centos7-duckdns
-
+4 -5test/Dockerfile-centos8
-
+5 -6test/Dockerfile-debian
-
+4 -4test/Dockerfile-ubuntu
-
+4 -4test/Dockerfile-ubuntu-duckdns
-
+5 -6test/Dockerfile-ubuntu16
-
+5 -6test/Dockerfile-ubuntu18
-
+2 -0test/test_helper.bash
-
+7 -7test/u1-test-get_auth_dns-dig.bats
-
+7 -7test/u2-test-get_auth_dns-drill.bats
-
+2 -2test/u5-test-get_auth_dns-no-root-servers.bats
+ 5
- 0
.gitattributes
View File
| @ -1,6 +1,11 @@ | |||
| # Files not to include in .zip/.tar.gz archives | |||
| # | |||
| .git* export-ignore | |||
| # Handle line endings automatically for files detected as text | |||
| # and leave all files detected as binary untouched. | |||
| * text=auto | |||
| # Make all text files lf formatted | |||
| * text eol=lf | |||
+ 9
- 0
.gitignore
View File
| @ -0,0 +1,9 @@ | |||
| *~ | |||
| *# | |||
| *.swp | |||
| *.tmp | |||
| *.bak | |||
| *.tdy | |||
| *.tar.gz | |||
| *.orig | |||
| JSON.sh | |||
+ 3
- 4
Makefile
View File
+ 75
- 11
README.md
View File
+ 63
- 0
dns_scripts/00GoDaddy-README.txt
View File
| @ -0,0 +1,63 @@ | |||
| Using GoDaddy DNS for LetsEncrypt domain validation. | |||
| Quick guide to setting up getssl for domain validation of | |||
| GoDaddy DNS domains. | |||
| There are two prerequisites to using getssl with GoDaddy DNS: | |||
| 1) Obtain an API access key from developer.godaddy.com | |||
| At first sign-up, you will be required to take a "test" key. | |||
| This is NOT what you need. Accept it, then get a "Production" | |||
| key. At this writing, there is no charge - but you must have | |||
| a GoDaddy customer account. | |||
| You must get the API key for the account which owns the domain | |||
| that you want to get certificates for. If the domains that you | |||
| manage are owned by more than one account, get a key for each. | |||
| The access key consists of a "Key" and a "Secret". You need | |||
| both. | |||
| 2) Obtain JSON.sh - https://github.com/dominictarr/JSON.sh | |||
| With those in hand, the installation procedure is: | |||
| 1) Put JSON.sh in the getssl DNS scripts directory | |||
| Default: /usr/share/getssl/dns_scripts | |||
| 2) Open your config file (the global file in ~/.getssl/getssl.cfg | |||
| or the per-account file in ~/.getssl/example.net/getssl.cfg | |||
| 3) Set the following options: | |||
| VALIDATE_VIA_DNS="true" | |||
| DNS_ADD_COMMAND="/usr/share/getssl/dns_scripts/dns_add_godaddy" | |||
| DNS_DEL_COMMAND="/usr/share/getssl/dns_scripts/dns_del_godaddy" | |||
| # The API key for your account/this domain | |||
| export GODADDY_KEY="..." GODADDY_SECRET="..." | |||
| # The base domain name(s) in which the challege records are stored | |||
| # E.g. if www.example.net is in the example.net zone: | |||
| export GODADDY_BASE="example.com example.net" | |||
| 4) Set any other options that you wish (per the standard | |||
| directions.) Use the test CA to make sure that | |||
| everything is setup correctly. | |||
| That's it. getssl example.net will now validate with DNS. | |||
| To trace record additions and removals, run getssl as | |||
| GODADDY_TRACE=Y getssl example.net | |||
| There are additional options, which are documented in the | |||
| *godaddy" files and dns_godaddy -h. | |||
| Copyright (C) 2017, 2018 Timothe Litt litt at acm _dot org | |||
| This sofware may be freely used providing this notice is included with | |||
| all copies. The name of the author may not be used to endorse | |||
| any other product or derivative work. No warranty is provided | |||
| and the user assumes all responsibility for use of this software. | |||
| Report any issues to https://github.com/tlhackque/getssl/issues. | |||
| Enjoy. | |||
+ 76
- 0
dns_scripts/dns_add_cpanel
View File
| @ -0,0 +1,76 @@ | |||
| #!/usr/bin/env bash | |||
| # Need to add your email address and API key to cpanel below or set as env variables | |||
| user=${CPANEL_USERNAME:-''} | |||
| password=${CPANEL_PASSWORD:-''} | |||
| url=${CPANEL_URL:-''} # e.g. https://www.cpanel-host.test:2083 | |||
| apitoken=${CPANEL_APITOKEN:-''} | |||
| fulldomain="${1}" | |||
| token="${2}" | |||
| # Check initial parameters | |||
| if [[ -z "$fulldomain" ]]; then | |||
| echo "DNS script requires full domain name as first parameter" | |||
| exit 1 | |||
| fi | |||
| if [[ -z "$token" ]]; then | |||
| echo "DNS script requires challenge token as second parameter" | |||
| exit 1 | |||
| fi | |||
| if [[ -z "$user" ]]; then | |||
| echo "CPANEL_USERNAME (username) parameter not set" | |||
| exit 1 | |||
| fi | |||
| if [[ -z "$apitoken" ]] && [[ -z "$password" ]]; then | |||
| echo "Must set either CPANEL_APITOKEN or CPANEL_PASSWORD in dns script, environment variable or getssl.cfg" | |||
| exit 1 | |||
| fi | |||
| if [[ -z "$url" ]]; then | |||
| echo "CPANEL_URL (url) parameter not set" | |||
| exit 1 | |||
| fi | |||
| # Setup | |||
| request_func="${url}/json-api/cpanel?cpanel_jsonapi_apiversion=2&cpanel_jsonapi_module=ZoneEdit" | |||
| if [[ -n $apitoken ]]; then | |||
| curl_params=( -H "Authorization: cpanel $user:$apitoken" ) | |||
| else | |||
| auth_string=$(echo -ne "$user:$password" | base64 --wrap 0) | |||
| curl_params=( -H "Authorization: Basic $auth_string" ) | |||
| fi | |||
| # Check if domain is a CNAME | |||
| res=$(dig CNAME "$fulldomain") | |||
| domain=$(echo "$res"| awk '$4 ~ "CNAME" {print $5}' |sed 's/\.$//g') | |||
| if [[ -n "$domain" ]]; then | |||
| name=".${fulldomain%.$domain}" | |||
| else | |||
| domain=$fulldomain | |||
| name="" | |||
| fi | |||
| # Check to see if challenge dns entry already exists (update or delete?) | |||
| request_params="&cpanel_jsonapi_func=fetchzone_records&domain=${domain}&type=TXT&name=_acme-challenge.${fulldomain}." | |||
| resp=$(curl --silent "${curl_params[@]}" "$request_func$request_params") | |||
| if [[ "$resp" = *\"error\":* ]]; then | |||
| echo -n "cpanel fetchzone records failed: " | |||
| echo "$resp" | awk -F"error" '{ print $2 }' | awk -F\" '{ print $3 }' | |||
| exit 1 | |||
| fi | |||
| # If no existing record, create a new TXT record, otherwise edit the existing record | |||
| if [[ "$resp" == *\"data\":[]* ]]; then | |||
| request_params="&cpanel_jsonapi_func=add_zone_record&domain=$domain&type=TXT&name=_acme-challenge$name&txtdata=$token" | |||
| else | |||
| # shellcheck disable=SC2001 | |||
| line=$(echo "$resp" | sed -e 's/.*line":\([0-9]*\),.*/\1/') | |||
| request_params="&cpanel_jsonapi_func=edit_zone_record&domain=$domain&type=TXT&name=_acme-challenge$name&txtdata=${token}&line=${line}" | |||
| fi | |||
| resp=$(curl --silent "${curl_params[@]}" "$request_func$request_params") | |||
| if [[ "$resp" = *\"status\":0* ]]; then | |||
| echo -n "cpanel edit zone record failed: " | |||
| echo "$resp" | awk -F"statusmsg" '{ print $2 }' | awk -F\" '{ print $3 }' | |||
| exit 1 | |||
| fi | |||
+ 185
- 0
dns_scripts/dns_add_del_aliyun.sh
View File
| @ -0,0 +1,185 @@ | |||
| #!/bin/bash | |||
| #https://blog.aymar.cn | |||
| #https://protocol.aymar.cn | |||
| PROGNAME=${0##*/} | |||
| VERSION="2021年3月22日 16:07:05" | |||
| Ali_API="https://dns.aliyuncs.com/" | |||
| _timestamp=$(date -u +"%Y-%m-%dT%H%%3A%M%%3A%SZ") | |||
| __debug="0" | |||
| __delete="0" | |||
| #Wildcard certificates | |||
| #A partial example getssl.cfg file is: | |||
| #VALIDATE_VIA_DNS=true | |||
| #DNS_ADD_COMMAND=/root/.getssl/dns_add_del_aliyun.sh | |||
| #DNS_DEL_COMMAND=/root/.getssl/dns_add_del_aliyun.sh | |||
| # either configure KeyId & KeySecret here or export environment variables in getssl.cfg | |||
| AccessKeyId=${ALI_KeyId:-''} | |||
| AccessKeySecret=${ALI_KeySecret:-''} | |||
| usage() { # print out the program usage | |||
| echo "Usage: $PROGNAME [-a|--add <Domain Name> <RecordValue>] [-d|--delete <Full.DomainName.com>] [-s|--search <Full.DomainName.com> ] [-h|--help] [-t|--type] "\ | |||
| "[-q|--quiet] [-c|--check] [-S|--status] [-l|--lock #] [-T|--ttl] [-u|--update] [-w|--weight] [-L|--Line]" | |||
| } | |||
| help_message() { # print out the help message | |||
| cat <<- _EOF_ | |||
| $PROGNAME Version. $VERSION | |||
| $(usage) | |||
| Options: | |||
| -a, --add Add Domain Record 域名 ip (默认类型TXT） | |||
| -d, --delete Delete Domain Record 域名 (默认类型TXT） | |||
| -s, --search Search Domain Record 域名 | |||
| -t, --type Record Type 类型（A、MX、CNAME、TXT、REDIRECT_URL、FORWORD_URL、NS、AAAA、SRV） | |||
| _EOF_ | |||
| } | |||
| _arg_check(){ | |||
| [ -z "$1" ] || _arg_count=$1 | |||
| shift | |||
| [ ${#} -lt $_arg_count ] && help_message && exit 1 || (echo $2 | grep "^-") && help_message && exit 1 | |||
| #If the number of arguments <$_ARG_COUNT print help and exit, and if the second argument begins with “-” print help and exit | |||
| return 0 | |||
| } | |||
| #[ ${#} -lt 2 ] && help_message && exit 1 #Same as below | |||
| #[ -z "$2" ] && help_message && exit 1 #Same as below | |||
| _arg_check 2 $@ | |||
| _debug (){ | |||
| if [ "$__debug" -eq 1 ]; then | |||
| echo -e "\033[1;31m # debug: $(date "+%m %d %T") | Func: ${FUNCNAME[@]} | Line:${BASH_LINENO[@]} \033[0m" "\n $@ " #"Current FUNCNAME ${FUNCNAME} #$LINENO " #"$(($RANDOM%10))" | |||
| fi | |||
| return 0 | |||
| } | |||
| _requires() { | |||
| _cmds='' # Check if the commands exists | |||
| if [[ "$#" -gt 0 ]]; then | |||
| for i in "$@"; do | |||
| if eval type type >/dev/null 2>&1; then | |||
| eval type "$i" >/dev/null 2>&1 | |||
| elif command >/dev/null 2>&1; then | |||
| command -v "$i" >/dev/null 2>&1 | |||
| else | |||
| which "$i" >/dev/null 2>&1 | |||
| fi | |||
| #[ "$?" -eq 0 ] && _debug "checking for $i exists = ok" || _cmds=$_cmds"$i: " | |||
| #shellcheck disable=SC2181 | |||
| if [ "$?" -eq 0 ]; then | |||
| #_debug "checking for $i exists = ok" | |||
| continue | |||
| else | |||
| _cmds=$_cmds"$i: " | |||
| fi | |||
| done | |||
| else | |||
| echo "Usage: _requires [command] " | |||
| return 1 | |||
| fi | |||
| [ -n "$_cmds" ] && { echo -e "\033[1;31m $_cmds command not found \033[0m" && return 1 ;} || return 0 | |||
| } | |||
| _requires openssl | |||
| #shellcheck disable=SC2120 | |||
| _hex_dump() { #ascii hex | |||
| local _str='' | |||
| [ $# -gt 0 ] && _str=$@ || read _str | |||
| local _str_len=${#_str} | |||
| local i=1 | |||
| while [ "$i" -le "$_str_len" ]; do | |||
| local _str_c="$(printf "%s" "$_str" | cut -c "$i")" | |||
| printf " %02x" "'$_str_c" | |||
| i=$(($i + 1)) | |||
| done | |||
| #printf "%s" " 0a" | |||
| } | |||
| _urlencode() { | |||
| local length="${#1}" | |||
| local i='' | |||
| for i in $(awk "BEGIN { for ( i=0; i<$length; i++ ) print i }") | |||
| do | |||
| #local _strc="$(printf "%s" "$1" | cut -c "$i")" #i=1; i<=$length; i++ | |||
| local _strc="${1:$i:1}" | |||
| case $_strc in [a-zA-Z0-9.~_-]) printf "%s" "$_strc" ;; *) printf "%%%02X" "'$_strc" ;; | |||
| esac | |||
| done | |||
| } | |||
| _signature(){ | |||
| signature='' | |||
| _hexkey=$(printf "%s" "$AccessKeySecret&" | _hex_dump |sed 's/ //g') | |||
| #signature=$(printf "%s" "GET&%2F&$(_urlencode "$query")" | openssl dgst -sha1 -hmac $(printf "%s" "$AccessKeySecret&" | _hex_dump |sed 's/ //g'| xxd -r -p ) -binary | openssl base64 -e) | |||
| signature=$(printf "%s" "GET&%2F&$(_urlencode "$query")" | openssl dgst -sha1 -mac HMAC -macopt "hexkey:$_hexkey" -binary | openssl base64 -e) | |||
| signature=$(_urlencode "$signature") | |||
| } | |||
| _query() { | |||
| [ -n "$__type" ] && { [[ "$_Action" = "AddDomainRecord" ]] && _Type="$__type" || { [ "$_Action" = "DescribeDomainRecords" ] && _TypeKeyWord="$__type"; } ; } | |||
| query='' | |||
| [ -n $AccessKeyId ] && query=$query'AccessKeyId='$AccessKeyId | |||
| query=$query'&Action='"$1" | |||
| [ -z $_DomainNames ] || query=$query'&DomainName='$_DomainNames | |||
| query=$query'&Format=json' | |||
| [ -z $_RR ] || query=$query'&RR='$_RR | |||
| [ -z $_RRKeyWord ] || query=$query'&RRKeyWord='$_RRKeyWord | |||
| [ -z $_RecordId ] || query=$query'&RecordId='$_RecordId | |||
| query=$query'&SignatureMethod=HMAC-SHA1' | |||
| query=$query"&SignatureNonce=$(date +"%s%N")" | |||
| query=$query'&SignatureVersion=1.0' | |||
| query=$query'&Timestamp='$_timestamp | |||
| [ -z $_Type ] || query=$query'&Type='$_Type | |||
| [ -z $_TypeKeyWord ] || query=$query'&TypeKeyWord='$_TypeKeyWord | |||
| [ -z $_Value ] || query=$query'&Value='$_Value | |||
| [ -z $_ValueKeyWord ] || query=$query'&ValueKeyWord='$_ValueKeyWord | |||
| query=$query'&Version=2015-01-09' | |||
| #_debug "$query" | |||
| _signature | |||
| return 0 | |||
| } | |||
| _Get_RecordIds(){ | |||
| _Action="DescribeDomainRecords" | |||
| _query $_Action $_DomainNames | |||
| url="${Ali_API}?${query}&Signature=${signature}" | |||
| _debug $url | |||
| _RecordIds=$(curl -k -s $url | grep -Po 'RecordId[": "]+\K[^"]+') && __delete="1" #RecordId requisite | |||
| _debug $_RecordIds | |||
| return 0 | |||
| } | |||
| __type='TXT' | |||
| _DomainNames=$(printf "%s" $1| awk -F"." '{if(NF>=2){print $(NF-1)"."$NF}}') #awk -F\. '{print $(NF-1) FS $NF}') #requisite | |||
| _RRKeyWord="_acme-challenge" | |||
| _Get_RecordIds | |||
| _RRKeyWord='' | |||
| _TypeKeyWord='' | |||
| _ValueKeyWord='' | |||
| if [ "$__delete" = "1" ];then | |||
| _Action="DeleteDomainRecord" #Action requisite | |||
| _DomainNames='' | |||
| for _RecordId in ${_RecordIds[@]} #Delete multiple txt domain record | |||
| do | |||
| _debug "_RecordId" $_RecordId | |||
| _query $_Action $_RecordId | |||
| url="${Ali_API}?${query}&Signature=${signature}" | |||
| _debug $url | |||
| curl -k -s $url && ( echo -e "\n\033[1;32m Aliyun DNS record _acme-challenge.$1 has been deleted \033[0m") | |||
| done | |||
| else | |||
| _Action="AddDomainRecord" #requisite | |||
| _RR=$(printf "_acme-challenge.%s" $1| awk -F'.' '{if(NF>2){gsub("."$(NF-1)"."$NF,"");print}}') #requisite | |||
| _Value=$2 #requisite | |||
| _query $_Action $_DomainNames | |||
| url="${Ali_API}?${query}&Signature=${signature}" | |||
| _debug $url | |||
| curl -k -s $url && (echo -e "\n\033[1;32m Start Checking aliyun DNS record _acme-challenge.$1 \033[0m") | |||
| exit 0 | |||
| fi | |||
+ 2
- 1
dns_scripts/dns_add_godaddy
View File
+ 2
- 1
dns_scripts/dns_add_nsupdate
View File
+ 69
- 0
dns_scripts/dns_del_cpanel
View File
| @ -0,0 +1,69 @@ | |||
| #!/usr/bin/env bash | |||
| # Need to add your email address and API key to cpanel below or set as env variables | |||
| user=${CPANEL_USERNAME:-''} | |||
| password=${CPANEL_PASSWORD:-''} | |||
| url=${CPANEL_URL:-''} # e.g. https://www.cpanel-host.test:2083 | |||
| apitoken=${CPANEL_APITOKEN:-''} | |||
| fulldomain="${1}" | |||
| # Check initial parameters | |||
| if [[ -z "$fulldomain" ]]; then | |||
| echo "DNS script requires full domain name as first parameter" | |||
| exit 1 | |||
| fi | |||
| if [[ -z "$user" ]]; then | |||
| echo "CPANEL_USERNAME (username) parameter not set" | |||
| exit 1 | |||
| fi | |||
| if [[ -z "$apitoken" ]] && [[ -z "$password" ]]; then | |||
| echo "Must set either CPANEL_APITOKEN or CPANEL_PASSWORD in dns script, environment variable or getssl.cfg" | |||
| exit 1 | |||
| fi | |||
| if [[ -z "$url" ]]; then | |||
| echo "CPANEL_URL (url) parameter not set" | |||
| exit 1 | |||
| fi | |||
| # Setup | |||
| request_func="${url}/json-api/cpanel?cpanel_jsonapi_apiversion=2&cpanel_jsonapi_module=ZoneEdit" | |||
| if [[ -n $apitoken ]]; then | |||
| curl_params=( -H "Authorization: cpanel $user:$apitoken" ) | |||
| else | |||
| auth_string=$(echo -ne "$user:$password" | base64 --wrap 0) | |||
| curl_params=( -H "Authorization: Basic $auth_string" ) | |||
| fi | |||
| # Check if domain is a CNAME | |||
| res=$(dig CNAME "$fulldomain") | |||
| domain=$(echo "$res"| awk '$4 ~ "CNAME" {print $5}' |sed 's/\.$//g') | |||
| if [[ -n "$domain" ]]; then | |||
| name=".${fulldomain%.$domain}" | |||
| else | |||
| domain=$fulldomain | |||
| name="" | |||
| fi | |||
| # Find line number of existing record | |||
| request_params="&cpanel_jsonapi_func=fetchzone_records&domain=${domain}&type=TXT&name=_acme-challenge.${fulldomain}." | |||
| resp=$(curl --silent "${curl_params[@]}" "$request_func$request_params") | |||
| if [[ "$resp" = *\"error\":* ]]; then | |||
| echo -n "cpanel fetchzone records failed: " | |||
| echo "$resp" | awk -F"error" '{ print $2 }' | awk -F\" '{ print $3 }' | |||
| exit 1 | |||
| fi | |||
| # shellcheck disable=SC2001 | |||
| line=$(echo "$resp" | sed -e 's/.*line":\([0-9]*\),.*/\1/') | |||
| if [[ "$line" != "" ]]; then | |||
| # Delete the challenge token | |||
| request_params="&cpanel_jsonapi_func=remove_zone_record&domain=$domain&type=TXT&name=_acme-challenge$name&line=$line" | |||
| resp=$(curl --silent "${curl_params[@]}" "$request_func$request_params") | |||
| fi | |||
| if [[ "$resp" = *\"status\":0* ]]; then | |||
| echo -n "cpanel remove zone record failed: " | |||
| echo "$resp" | awk -F"statusmsg" '{ print $2 }' | awk -F\" '{ print $3 }' | |||
| exit 1 | |||
| fi | |||
+ 3
- 2
dns_scripts/dns_del_godaddy
View File
+ 2
- 1
dns_scripts/dns_del_nsupdate
View File
+ 31
- 6
dns_scripts/dns_godaddy
View File
+ 1
- 1
dns_scripts/dns_route53.py
View File
+ 5
- 14
test/17-test-spaces-in-sans-dns01.bats
View File
+ 5
- 14
test/17-test-spaces-in-sans-http01.bats
View File
+ 3
- 2
test/18-retry-dns-add.bats
View File
+ 30
- 14
test/35-preferred-chain.bats
View File
+ 94
- 0
test/36-full-chain-inc-root.bats
View File
| @ -0,0 +1,94 @@ | |||
| #! /usr/bin/env bats | |||
| load '/bats-support/load.bash' | |||
| load '/bats-assert/load.bash' | |||
| load '/getssl/test/test_helper.bash' | |||
| # This is run for every test | |||
| setup() { | |||
| if [ -z "$STAGING" ]; then | |||
| export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt | |||
| fi | |||
| } | |||
| @test "Use FULL_CHAIN_INCLUDE_ROOT to include the root certificate in the fullchain" { | |||
| CONFIG_FILE="getssl-dns01.cfg" | |||
| setup_environment | |||
| init_getssl | |||
| cat <<- EOF > ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg | |||
| FULL_CHAIN_INCLUDE_ROOT="true" | |||
| EOF | |||
| create_certificate | |||
| assert_success | |||
| check_output_for_errors | |||
| if [ -n "$STAGING" ]; then | |||
| PREFERRED_CHAIN="(STAGING) Doctored Durian Root CA X3" | |||
| else | |||
| # pebble doesn't support CA Issuers so the fullchain.crt will just contain the certificate (code path means it won't contain the intermediate cert in this case) | |||
| # This is testing that requesting FULL_CHAIN_INCLUDE_ROOT doesn't fail if there is no CA Issuers in the certificate | |||
| PREFERRED_CHAIN=$(openssl crl2pkcs7 -nocrl -certfile "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.crt" | openssl pkcs7 -print_certs -text -noout | grep Subject: | tail -1 | awk -F"CN=" '{ print $2 }') | |||
| fi | |||
| final_issuer=$(openssl crl2pkcs7 -nocrl -certfile "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/fullchain.crt" | openssl pkcs7 -print_certs -text -noout | grep Subject: | tail -1 | awk -F"CN=" '{ print $2 }') | |||
| # verify certificate includes the chain root | |||
| if [[ "${PREFERRED_CHAIN}" != "$final_issuer" ]]; then | |||
| echo "# PREFERRED_CHAIN=$PREFERRED_CHAIN" | |||
| echo "# final_issuer=$final_issuer" | |||
| fi | |||
| [ "${PREFERRED_CHAIN}" = "$final_issuer" ] | |||
| } | |||
| @test "Use FULL_CHAIN_INCLUDE_ROOT with dual certificates" { | |||
| if [ -n "$STAGING" ]; then | |||
| PREFERRED_CHAIN="(STAGING) Doctored Durian Root CA X3" | |||
| fi | |||
| CONFIG_FILE="getssl-dns01.cfg" | |||
| setup_environment | |||
| init_getssl | |||
| cat <<- EOF > ${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/getssl_test_specific.cfg | |||
| FULL_CHAIN_INCLUDE_ROOT="true" | |||
| DUAL_RSA_ECDSA="true" | |||
| ACCOUNT_KEY_TYPE="prime256v1" | |||
| PRIVATE_KEY_ALG="prime256v1" | |||
| CHECK_REMOTE="false" | |||
| EOF | |||
| create_certificate | |||
| assert_success | |||
| check_output_for_errors | |||
| check_certificates | |||
| assert [ -e "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/chain.ec.crt" ] | |||
| assert [ -e "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/fullchain.ec.crt" ] | |||
| assert [ -e "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.ec.crt" ] | |||
| if [ -n "$STAGING" ]; then | |||
| PREFERRED_CHAIN="(STAGING) Doctored Durian Root CA X3" | |||
| else | |||
| # pebble doesn't support CA Issuers so the fullchain.crt will just contain the certificate (code path means it won't contain the intermediate cert in this case) | |||
| # This is testing that requesting FULL_CHAIN_INCLUDE_ROOT doesn't fail if there is no CA Issuers in the certificate | |||
| PREFERRED_CHAIN=$(openssl crl2pkcs7 -nocrl -certfile "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/${GETSSL_CMD_HOST}.crt" | openssl pkcs7 -print_certs -text -noout | grep Subject: | tail -1 | awk -F"CN=" '{ print $2 }') | |||
| fi | |||
| # verify both rsa and ecdsa certificates include the chain root | |||
| final_issuer=$(openssl crl2pkcs7 -nocrl -certfile "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/fullchain.crt" | openssl pkcs7 -print_certs -text -noout | grep Subject: | tail -1 | awk -F"CN=" '{ print $2 }') | |||
| if [[ "${PREFERRED_CHAIN}" != "$final_issuer" ]]; then | |||
| echo "# PREFERRED_CHAIN=$PREFERRED_CHAIN" | |||
| echo "# final_issuer=$final_issuer" | |||
| fi | |||
| [ "${PREFERRED_CHAIN}" = "$final_issuer" ] | |||
| ecdsa_final_issuer=$(openssl crl2pkcs7 -nocrl -certfile "${INSTALL_DIR}/.getssl/${GETSSL_CMD_HOST}/fullchain.ec.crt" | openssl pkcs7 -print_certs -text -noout | grep Subject: | tail -1 | awk -F"CN=" '{ print $2 }') | |||
| if [[ "$PREFERRED_CHAIN" != "$ecdsa_final_issuer" ]]; then | |||
| echo "# PREFERRED_CHAIN=$PREFERRED_CHAIN" | |||
| echo "# ecdsa_final_issuer=$ecdsa_final_issuer" | |||
| fi | |||
| [ "${PREFERRED_CHAIN}" = "$ecdsa_final_issuer" ] | |||
| } | |||