@@ -1466,7 +1466,7 @@ _toPkcs() {
14661466 ${ACME_OPENSSL_BIN:- openssl} pkcs12 -export -out " $_cpfx " " $_ckey " " $_ccert " " $_cca "
14671467 fi
14681468 if [ " $? " = " 0" ; then
1469- _savedomainconf " Le_PFXPassword" " $pfxPassword "
1469+ _savedomainconf " Le_PFXPassword" " $pfxPassword " " base64 "
14701470 fi
14711471
14721472}
@@ -2783,6 +2783,7 @@ _clearAPI() {
27832783 ACME_REVOKE_CERT=" "
27842784 ACME_NEW_NONCE=" "
27852785 ACME_AGREEMENT=" "
2786+ ACME_RENEWAL_INFO=" "
27862787}
27872788
27882789# server
@@ -2827,13 +2828,17 @@ _initAPI() {
28272828 ACME_AGREEMENT=$( echo " $response " | _egrep_o ' termsOfService" *: *"[^"]*"' | cut -d ' "' )
28282829 export ACME_AGREEMENT
28292830
2831+ ACME_RENEWAL_INFO=$( echo " $response " | _egrep_o ' renewalInfo" *: *"[^"]*"' | cut -d ' "' )
2832+ export ACME_RENEWAL_INFO
2833+
28302834 _debug " ACME_KEY_CHANGE" " $ACME_KEY_CHANGE "
28312835 _debug " ACME_NEW_AUTHZ" " $ACME_NEW_AUTHZ "
28322836 _debug " ACME_NEW_ORDER" " $ACME_NEW_ORDER "
28332837 _debug " ACME_NEW_ACCOUNT" " $ACME_NEW_ACCOUNT "
28342838 _debug " ACME_REVOKE_CERT" " $ACME_REVOKE_CERT "
28352839 _debug " ACME_AGREEMENT" " $ACME_AGREEMENT "
28362840 _debug " ACME_NEW_NONCE" " $ACME_NEW_NONCE "
2841+ _debug " ACME_RENEWAL_INFO" " $ACME_RENEWAL_INFO "
28372842 if [ " $ACME_NEW_ACCOUNT " && [ " $ACME_NEW_ORDER " ; then
28382843 return 0
28392844 fi
@@ -4465,7 +4470,7 @@ issue() {
44654470 Le_NextRenewTime=$( _readdomainconf Le_NextRenewTime)
44664471 _debug Le_NextRenewTime " $Le_NextRenewTime "
44674472 if [ -z " $FORCE " && [ " $Le_NextRenewTime " && [ " $( _time) " -lt " $Le_NextRenewTime " ; then
4468- _valid_to_saved=$( _readdomainconf Le_Valid_to )
4473+ _valid_to_saved=$( _readdomainconf Le_Valid_To )
44694474 if [ " $_valid_to_saved " && ! _startswith " $_valid_to_saved " " +" ; then
44704475 _info " The domain is set to be valid to: $_valid_to_saved "
44714476 _info " It cannot be renewed automatically"
@@ -5450,10 +5455,10 @@ $_authorizations_map"
54505455 _savedomainconf " Le_NextRenewTime" " $Le_NextRenewTime "
54515456
54525457 # convert to pkcs12
5458+ Le_PFXPassword=" $( _readdomainconf Le_PFXPassword) "
54535459 if [ " $Le_PFXPassword " ; then
54545460 _toPkcs " $CERT_PFX_PATH " " $CERT_KEY_PATH " " $CERT_PATH " " $CA_CERT_PATH " " $Le_PFXPassword "
54555461 fi
5456- export CERT_PFX_PATH
54575462
54585463 if [ " $_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain " ; then
54595464 _savedomainconf " Le_RealCertPath" " $_real_cert "
@@ -5563,6 +5568,10 @@ renew() {
55635568 Le_RenewHook=" $( _readdomainconf Le_RenewHook) "
55645569 Le_Preferred_Chain=" $( _readdomainconf Le_Preferred_Chain) "
55655570 Le_Certificate_Profile=" $( _readdomainconf Le_Certificate_Profile) "
5571+ Le_Valid_From=" $( _readdomainconf Le_Valid_From) "
5572+ Le_Valid_To=" $( _readdomainconf Le_Valid_To) "
5573+ Le_ExtKeyUse=" $( _readdomainconf Le_ExtKeyUse) "
5574+
55665575 # When renewing from an old version, the empty Le_Keylength means 2048.
55675576 # Note, do not use DEFAULT_DOMAIN_KEY_LENGTH as that value may change over
55685577 # time but an empty value implies 2048 specifically.
@@ -5744,6 +5753,10 @@ signcsr() {
57445753 _local_addr=" ${11} "
57455754 _challenge_alias=" ${12} "
57465755 _preferred_chain=" ${13} "
5756+ _valid_f=" ${14} "
5757+ _valid_t=" ${15} "
5758+ _cert_prof=" ${16} "
5759+ _en_key_usage=" ${17} "
57475760
57485761 _csrsubj=$( _readSubjectFromCSR " $_csrfile " )
57495762 if [ " $? " != " 0" ; then
@@ -5787,7 +5800,7 @@ signcsr() {
57875800 _info " Copying CSR to: $CSR_PATH "
57885801 cp " $_csrfile " " $CSR_PATH "
57895802
5790- issue " $_csrW " " $_csrsubj " " $_csrdomainlist " " $_csrkeylength " " $_real_cert " " $_real_key " " $_real_ca " " $_reload_cmd " " $_real_fullchain " " $_pre_hook " " $_post_hook " " $_renew_hook " " $_local_addr " " $_challenge_alias " " $_preferred_chain "
5803+ issue " $_csrW " " $_csrsubj " " $_csrdomainlist " " $_csrkeylength " " $_real_cert " " $_real_key " " $_real_ca " " $_reload_cmd " " $_real_fullchain " " $_pre_hook " " $_post_hook " " $_renew_hook " " $_local_addr " " $_challenge_alias " " $_preferred_chain " " $_valid_f " " $_valid_t " " $_cert_prof " " $_en_key_usage "
57915804
57925805}
57935806
@@ -5840,7 +5853,8 @@ list() {
58405853 if [ -z " $_domain " ; then
58415854 printf " %s\n" " Main_Domain${_sep} KeyLength${_sep} SAN_Domains${_sep} Profile${_sep} CA${_sep} Created${_sep} Renew"
58425855 fi
5843- for di in " ${CERT_HOME} " * .* ,* :* }/; do
5856+ for di in " ${CERT_HOME} " * .* " ${CERT_HOME} " * :* ; do
5857+ [ -d " $di " || continue
58445858 d=$( basename " $di " )
58455859 _debug d " $d "
58465860 (
@@ -6537,6 +6551,36 @@ deactivate() {
65376551 done
65386552}
65396553
6554+ # cert
6555+ _getAKI () {
6556+ _cert=" $1 "
6557+ openssl x509 -in " $_cert " | grep " X509v3 Authority Key Identifier" | _tail_n 1 | tr -d ' :'
6558+ }
6559+
6560+ # cert
6561+ _getSerial () {
6562+ _cert=" $1 "
6563+ openssl x509 -in " $_cert " | cut -d = -f 2
6564+ }
6565+
6566+ # cert
6567+ _get_ARI () {
6568+ _cert=" $1 "
6569+ _aki=$( _getAKI " $_cert " )
6570+ _ser=$( _getSerial " $_cert " )
6571+ _debug2 " _aki" " $_aki "
6572+ _debug2 " _ser" " $_ser "
6573+
6574+ _akiurl=" $( echo " $_aki " | _h2b | _base64 | tr -d = | _url_encode) "
6575+ _debug2 " _akiurl" " $_akiurl "
6576+ _serurl=" $( echo " $_ser " | _h2b | _base64 | tr -d = | _url_encode) "
6577+ _debug2 " _serurl" " $_serurl "
6578+
6579+ _ARI_URL=" $ACME_RENEWAL_INFO /$_akiurl .$_serurl "
6580+ _get " $_ARI_URL "
6581+
6582+ }
6583+
65406584# Detect profile file if not specified as environment variable
65416585_detect_profile () {
65426586 if [ -n " $PROFILE " -a -f " $PROFILE " ; then
@@ -8112,7 +8156,7 @@ _process() {
81128156 deploy " $_domain " " $_deploy_hook " " $_ecc "
81138157 ;;
81148158 signcsr)
8115- signcsr " $_csr " " $_webroot " " $_cert_file " " $_key_file " " $_ca_file " " $_reloadcmd " " $_fullchain_file " " $_pre_hook " " $_post_hook " " $_renew_hook " " $_local_address " " $_challenge_alias " " $_preferred_chain "
8159+ signcsr " $_csr " " $_webroot " " $_cert_file " " $_key_file " " $_ca_file " " $_reloadcmd " " $_fullchain_file " " $_pre_hook " " $_post_hook " " $_renew_hook " " $_local_address " " $_challenge_alias " " $_preferred_chain " " $_valid_from " " $_valid_to " " $_certificate_profile " " $_extended_key_usage "
81168160 ;;
81178161 showcsr)
81188162 showcsr " $_csr " " $_domain "
0 commit comments