#!/bin/sh email="-m $EMAIL" if [ "$LETSENCRYPT_SERVER" != "" ]; then L_S="--server $LETSENCRYPT_SERVER" fi if [ "$EAB_KID" != "" ]; then EK="--eab-kid $EAB_KID" fi if [ "$EAB_HMAC_KEY" != "" ]; then EHK="--eab-hmac-key $EAB_HMAC_KEY" fi TIMEOUT=$TIMEOUT if [[ -z "$TIMEOUT" ]]; then TIMEOUT=5; fi RESTART=$RESTART if [[ -z "$RESTART" ]]; then RESTART=5; fi sending_error_msg() { echo "there was unsucessfuly created "$DOMAIN" at date: "$DATE; } start_letsencrypt() { mkdir -p /acme.sh/$DOMAIN/ ; RESPONSE=$(/usr/local/bin/acme.sh $email $L_S $EK $EHK --issue --standalone --keylength 4096 -d $DOMAIN --cert-file /acme.sh/$DOMAIN/cert.pem --key-file /acme.sh/$DOMAIN/key.pem --fullchain-file /acme.sh/$DOMAIN/fullchain.pem); if [[ "$(echo $?)" == "1" ]]; then for retries in $(seq 0 $((RESTART + 1))); do if [[ $retries -le $RESTART ]] ; then # Check certificate issuer ISSUER=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -text -noout |grep -w CN |grep Issuer | cut -d '=' -f2); SUBJECT=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -text -noout |grep -w CN |grep Subject | cut -d '=' -f2); if [ "$ISSUER" == "$SUBJECT" ]; then echo "Self signed certificate found"; RESPONSE=$(/usr/local/bin/acme.sh $email $L_S $EK $EHK --issue --standalone --keylength 4096 -d $DOMAIN --cert-file /acme.sh/$DOMAIN/cert.pem --key-file /acme.sh/$DOMAIN/key.pem --fullchain-file /acme.sh/$DOMAIN/fullchain.pem); if [[ "$(echo $?)" != "1" ]]; then sleep $TIMEOUT; echo "Restarting number is only: "$retries" so try again" fi else sleep $TIMEOUT; echo "Restarting number is only: "$retries" so try again" fi else echo "Reached retrying limit: "$RESTART" ,giving up" fi done else echo "Created or renew successfuly the certificate for $DOMAIN" fi } check_new_cert() { #DATE=$(date +%s) if [[ -f /acme.sh/$DOMAIN/key.pem && -f /acme.sh/$DOMAIN/fullchain.pem && -f /acme.sh/$DOMAIN/cert.pem ]] ; then #D1=$(date -r /acme.sh/$DOMAIN/fullchain.pem +%s) #DIFF=$(expr $DATE - $D1); #if [ $DIFF < 3600 ]; then touch /acme.sh/$DOMAIN/new_certificate; fi NEW=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -fingerprint -noout) if [ "$ORIGINAL" != "$NEW" ]; then touch /acme.sh/$DOMAIN/new_certificate; fi else sending_error_msg $DOMAIN $DATE; fi } LETSENCRYPT_FILE=$(find /acme.sh/ -type f -name letsencrypt); if [ -n "$LETSENCRYPT_FILE" ] ; then DOMAIN=$(jq -r .DOMAIN $LETSENCRYPT_FILE) ; ORIGINAL=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -fingerprint -noout) start_letsencrypt; rm $LETSENCRYPT_FILE; check_new_cert else cd /domains for i in `ls` ; do DOMAIN=$(jq -r .DOMAIN $i) ; ORIGINAL=$(openssl x509 -in /acme.sh/$DOMAIN/fullchain.pem -fingerprint -noout) start_letsencrypt $DOMAIN; check_new_cert done ; fi