From 08d9f95505bb11c3d1b6a8c649362ede7dab4138 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Mon, 13 Jun 2016 23:14:00 +0200 Subject: =?UTF-8?q?Rename=20=E2=80=98letsencrypt-tiny=E2=80=99=20to=20?= =?UTF-8?q?=E2=80=98lacme=E2=80=99.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- letsencrypt | 704 ------------------------------------------------------------ 1 file changed, 704 deletions(-) delete mode 100755 letsencrypt (limited to 'letsencrypt') diff --git a/letsencrypt b/letsencrypt deleted file mode 100755 index d11b569..0000000 --- a/letsencrypt +++ /dev/null @@ -1,704 +0,0 @@ -#!/usr/bin/perl -T - -#---------------------------------------------------------------------- -# Let's Encrypt ACME client -# Copyright © 2016 Guilhem Moulin -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with this program. If not, see . -#---------------------------------------------------------------------- - -use strict; -use warnings; - -our $VERSION = '0.0.1'; -my $NAME = 'letsencrypt'; - -use Errno qw/EADDRINUSE EINTR/; -use Fcntl qw/F_GETFD F_SETFD FD_CLOEXEC SEEK_SET/; -use File::Temp (); -use Getopt::Long qw/:config posix_default no_ignore_case gnu_getopt auto_version/; -use List::Util 'first'; -use POSIX (); -use Socket qw/PF_INET PF_INET6 PF_UNIX INADDR_ANY IN6ADDR_ANY - SOCK_STREAM SOL_SOCKET SO_REUSEADDR SHUT_RDWR/; - -use Config::Tiny (); -use Net::SSLeay (); - -# Clean up PATH -$ENV{PATH} = join ':', qw{/usr/bin /bin}; -delete @ENV{qw/IFS CDPATH ENV BASH_ENV/}; - -my ($COMMAND, %OPTS, $CONFFILE, $CONFIG, @CLEANUP); -$SIG{$_} = sub() { exit 1 } foreach qw/INT TERM/; # run the END block upon SIGINT/SIGTERM - - -############################################################################# -# Parse and validate configuration -# -sub usage(;$$) { - my $rv = shift // 0; - if ($rv) { - my $msg = shift; - print STDERR $msg."\n" if defined $msg; - print STDERR "Try '$NAME --help' or consult the manpage for more information.\n"; - } - else { - print STDERR "Usage: $NAME [--config=FILE] [--socket=PATH] [OPTIONS] COMMAND [ARGUMENT ..]\n" - ."Consult the manpage for more information.\n"; - } - exit $rv; -} -usage(1) unless GetOptions(\%OPTS, qw/config=s config-certs=s socket=s agreement-uri=s debug help|h/); -usage(0) if $OPTS{help}; - -$COMMAND = shift(@ARGV) // usage(1, "Missing command"); -$COMMAND = $COMMAND =~ /\A(new-reg|reg=\p{Print}*|new-cert|revoke-cert)\z/ ? $1 - : usage(1, "Invalid command: $COMMAND"); # validate and untaint $COMMAND -@ARGV = map { /\A(\p{Print}*)\z/ ? $1 : die } @ARGV; # untaint @ARGV - -do { - my $conffile = $OPTS{config} // first { -f $_ } - ( "./$NAME.conf" - , ($ENV{XDG_CONFIG_HOME} // "$ENV{HOME}/.config")."/letsencrypt-tiny/$NAME.conf" - , "/etc/letsencrypt-tiny/$NAME.conf" - ); - die "Error: Can't find configuration file\n" unless defined $conffile; - print STDERR "Using configuration file: $conffile\n" if $OPTS{debug}; - open $CONFFILE, '<', $conffile or die "Can't open $conffile: $!\n"; - my $conf = do { local $/ = undef, <$CONFFILE> }; - # don't close $CONFFILE so we can pass it to the client - - my $h = Config::Tiny::->read_string($conf) or die Config::Tiny::->errstr()."\n"; - my $defaults = delete $h->{_} // {}; - my %valid = ( - client => { - socket => (defined $ENV{XDG_RUNTIME_DIR} ? "$ENV{XDG_RUNTIME_DIR}/S.letsencrypt" : undef), - user => 'nobody', - group => 'nogroup', - command => '/usr/lib/letsencrypt-tiny/client', - # the rest is for the ACME client - map {$_ => undef} qw/server timeout SSL_verify SSL_version SSL_cipher_list/ - }, - webserver => { - listen => ':80', - 'challenge-directory' => '/var/www/acme-challenge', - user => 'www-data', - group => 'www-data', - command => '/usr/lib/letsencrypt-tiny/webserver', - iptables => 'Yes' - - } - ); - foreach my $s (keys %valid) { - my $h = delete $h->{$s} // {}; - my %v = map { $_ => delete $h->{$_} // $valid{$s}->{$_} } keys %{$valid{$s}}; - die "Unknown option(s) in [$s]: ".join(', ', keys %$h)."\n" if %$h; - $h->{$_} //= $defaults->{$_} foreach keys %$defaults; - $CONFIG->{$s} = \%v; - } - die "Invalid section(s): ".join(', ', keys %$h)."\n" if %$h; - $CONFIG->{_} = $defaults; -}; - -# Regular expressions for domain validation -my $RE_LABEL = qr/[0-9a-z](?:[0-9a-z\x2D]{0,61}[0-9a-z])?/aai; -my $RE_DOMAIN = qr/$RE_LABEL(?:\.$RE_LABEL)+/; - - -############################################################################# -# Generate a Certificate Signing Request (in DER format) -# -sub gen_csr(%) { - my %args = @_; - return unless defined $args{'certificate-key'} and defined $args{subject}; - return if defined $args{hash} and !grep { $args{hash} eq $_ } qw/md5 rmd160 sha1 sha224 sha256 sha384 sha512/; - - my $config = File::Temp::->new(SUFFIX => '.conf', TMPDIR => 1) // die; - $config->print( - "[ req ]\n", - "distinguished_name = req_distinguished_name\n", - "req_extensions = v3_req\n", - - "[ req_distinguished_name ]\n", - - "[ v3_req ]\n", - # XXX Golang errors on extensions marked critical - # https://github.com/letsencrypt/boulder/issues/565 - #"basicConstraints = critical, CA:FALSE\n", - "basicConstraints = CA:FALSE\n", - "subjectKeyIdentifier = hash\n" - ); - #$config->print("keyUsage = critical, $args{keyUsage}\n") if defined $args{keyUsage}; - $config->print("keyUsage = $args{keyUsage}\n") if defined $args{keyUsage}; - $config->print("subjectAltName = $args{subjectAltName}\n") if defined $args{subjectAltName}; - $config->close() or die "Can't close: $!"; - - my @args = (qw/-new -batch -key/, $args{'certificate-key'}); - push @args, "-$args{hash}" if defined $args{hash}; - push @args, '-subj', $args{subject}, '-config', $config->filename(), qw/-reqexts v3_req/; - - open my $fh, '-|', qw/openssl req -outform DER/, @args or die "fork: $!"; - my $csr = do { local $/ = undef; <$fh> }; - close $fh or $! ? die "Can't close: $!" : return; - - if ($OPTS{debug}) { - # print out the CSR in text form - pipe my $rd, my $wd or die "pipe: $!"; - my $pid = fork // die "fork: $!"; - unless ($pid) { - open STDIN, '<&', $rd or die "Can't dup: $!"; - open STDOUT, '>&', \*STDERR or die "Can't dup: $!"; - exec qw/openssl req -noout -text -inform DER/ or die; - } - $rd->close() or die "Can't close: $!"; - $wd->print($csr); - $wd->close() or die "Can't close: $!"; - - waitpid $pid => 0; - die $? if $? > 0; - } - - return $csr; -} - - -############################################################################# -# Get the timestamp of the given cert's expiration date. -# Internally the expiration date is stored as a RFC3339 string (such as -# yyyy-mm-ddThh:mm:ssZ); we convert it to a timestamp manually. -# -sub x509_enddate($) { - my $filename = shift; - my ($bio, $x509, $time, $dt); - - $bio = Net::SSLeay::BIO_new_file($filename, 'r'); - $x509 = Net::SSLeay::PEM_read_bio_X509($bio) if defined $bio; - $time = Net::SSLeay::X509_get_notAfter($x509) if defined $x509; - $dt = Net::SSLeay::P_ASN1_TIME_get_isotime($time) if defined $time; - - my $t; - if (defined $dt and $dt =~ s/\A(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})//) { - # RFC3339 datetime strings; assume epoch is on January 1 of $epoch_year - my ($y, $m, $d, $h, $min, $s) = ($1, $2, $3, $4, $5, $6); - my (undef,undef,undef,undef,undef,$epoch_year,undef,undef,undef) = gmtime(0); - $t = 0; - foreach (($epoch_year+1900) .. $y-1) { - $t += 365*86400; - $t += 86400 if ($_ % 4 == 0 and $_ % 100 != 0) or ($_ % 400 == 0); # leap - } - - if ($m > 1) { - my @m = (31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31); - $m[1]++ if ($y % 4 == 0 and $y % 100 != 0) or ($y % 400 == 0); # leap - $t += 86400*$m[$_] for (0 .. $m-2); - } - - $t += 86400*($d-1); - $t += $s + 60*($min + 60*$h); - - $dt =~ s/\A\.(\d{1,9})\d*//; # ignore nanosecs - - if ($dt =~ /\A([+-])(\d{2}):(\d{2})\z/) { - my $tz = 60*($3 + 60*$2); - $t = $1 eq '-' ? ($t+$tz) : ($t-$tz); - } - } - - Net::SSLeay::X509_free($x509) if defined $x509; - Net::SSLeay::BIO_free($bio) if defined $bio; - return $t; -} - - -############################################################################# -# Drop privileges and chdir afterwards -# -sub drop_privileges($$$) { - my ($user, $group, $dir) = @_; - - # set effective and real gid; also set the list of supplementary gids to that single gid - if ($group ne '') { - my $gid = getgrnam($group) // die "Can't getgrnam($group): $!"; - $) = "$gid $gid"; - die "Can't setgroups: $!" if $@; - POSIX::setgid($gid) or die "Can't setgid: $!"; - die "Couldn't setgid/setguid" unless $( eq "$gid $gid" and $) eq "$gid $gid"; # safety check - } - - # set effective and real uid - if ($user ne '') { - my $uid = getpwnam($user) // die "Can't getpwnam($user): $!"; - POSIX::setuid($uid) or die "Can't setuid: $!"; - die "Couldn't setuid/seteuid" unless $< == $uid and $> == $uid; # safety check - } - - chdir $dir or die "Can't chdir to $dir: $!"; -} - - -############################################################################# -# Ensure the FD_CLOEXEC bit is $set on $fd -# -sub set_FD_CLOEXEC($$) { - my ($fd, $set) = @_; - my $flags = fcntl($fd, F_GETFD, 0) or die "Can't fcntl F_GETFD: $!"; - my $flags2 = $set ? ($flags | FD_CLOEXEC) : ($flags & ~FD_CLOEXEC); - return if $flags == $flags2; - fcntl($fd, F_SETFD, $flags2) or die "Can't fcntl F_SETFD: $!"; -} - - -############################################################################# -# Try to spawn a webserver to serve ACME challenges, and return the -# temporary challenge directory. -# If a webserver is already listening, symlink the 'challenge-directory' -# configuration option to the temporary challenge directory. -# Otherwise, bind(2) a socket, pass its fileno to the webserver -# component, and optionally install iptables rules. -# -sub spawn_webserver() { - # create a temporary directory; give write access to the ACME client - # and read access to the webserver - my $tmpdir = File::Temp::->newdir(CLEANUP => 1, TMPDIR => 1) // die; - chmod 0755, $tmpdir or die "Can't chmod: $!"; - if ((my $username = $CONFIG->{client}->{user}) ne '') { - my $uid = getpwnam($username) // die "Can't getgrnam($username): $!"; - chown($uid, -1, $tmpdir) or die "Can't chown: $!"; - } - - my $conf = $CONFIG->{webserver}; - my ($fam, $addr, $port) = (PF_INET, $conf->{listen}, 80); - $port = $1 if $addr =~ s/:(\d+)$//; - $addr = Socket::inet_ntop(PF_INET, INADDR_ANY) if $addr eq ''; - $fam = PF_INET6 if $addr =~ s/^\[(.+)\]$/$1/; - - my $proto = getprotobyname("tcp") // die; - socket(my $srv, $fam, SOCK_STREAM, $proto) or die "socket: $!"; - setsockopt($srv, SOL_SOCKET, SO_REUSEADDR, pack("l", 1)) or die "setsockopt: $!"; - $addr = Socket::inet_pton($fam, $addr) // die "Invalid address $conf->{listen}\n"; - my $sockaddr = $fam == PF_INET ? Socket::pack_sockaddr_in($port, $addr) - : $fam == PF_INET6 ? Socket::pack_sockaddr_in6($port, $addr) - : die; - - # try to bind aginst the specified address:port - bind($srv, $sockaddr) or do { - die "Can't bind to $conf->{listen}: $!" if $! != EADDRINUSE; - print STDERR "[$$] Using existing webserver on $conf->{listen}\n" if $OPTS{debug}; - my $dir = $conf->{'challenge-directory'}; - symlink $tmpdir, $dir or die "Can't symlink $dir -> $tmpdir: $!"; - push @CLEANUP, sub() { - print STDERR "Unlinking $dir\n" if $OPTS{debug}; - unlink $dir or warn "Warning: Can't unlink $dir: $!"; - }; - return $tmpdir; - }; - listen($srv, 5) or die "listen: $!"; - - # spawn the webserver component - my $pid = fork() // "fork: $!"; - unless ($pid) { - drop_privileges($conf->{user}, $conf->{group}, $tmpdir); - set_FD_CLOEXEC($srv, 0); - $ENV{DEBUG} = $OPTS{debug}; - # use execve(2) rather than a Perl pseudo-process to ensure that - # the child doesn't have access to the parent's memory - exec $conf->{command}, fileno($srv) or die; - } - - print STDERR "[$$] Forking ACME webserver, child PID $pid\n" if $OPTS{debug}; - set_FD_CLOEXEC($srv, 1); - push @CLEANUP, sub() { - print STDERR "[$$] Shutting down ACME webserver\n" if $OPTS{debug}; - shutdown($srv, SHUT_RDWR) or warn "shutdown: $!"; - kill 15 => $pid; - waitpid $pid => 0; - }; - - return $tmpdir if lc ($conf->{iptables} // 'Yes') eq 'no'; - - # install iptables - my $iptables_bin = $fam == PF_INET ? 'iptables' : $fam == PF_INET6 ? 'ip6tables' : die; - my $iptables_tmp = File::Temp::->new(TMPDIR => 1) // die; - set_FD_CLOEXEC($iptables_tmp, 1); - - my $pid2 = fork() // die "fork: $!"; - unless ($pid2) { - open STDIN, '<', '/dev/null' or die "Can't open /dev/null: $!"; - open STDOUT, '>&', $iptables_tmp or die "Can't dup: $!"; - $| = 1; # turn off buffering for STDOUT - exec "/sbin/$iptables_bin-save", "-c" or die; - } - waitpid $pid2 => 0; - die "Error: /sbin/$iptables_bin-save exited with value ".($? >> 8) if $? > 0; - - # seek back to the begining, as we'll restore directly from the - # handle and not from the file. XXX if there was a way in Perl to - # use open(2) with the O_TMPFILE flag we would use that to avoid - # creating a file to start with - seek($iptables_tmp, SEEK_SET, 0) or die "Can't seek: $!"; - - push @CLEANUP, sub() { - print STDERR "[$$] Restoring iptables\n" if $OPTS{debug}; - my $pid2 = fork() // die "fork: $!"; - unless ($pid2) { - open STDIN, '<&', $iptables_tmp or die "Can't dup: $!"; - open STDOUT, '>', '/dev/null' or die "Can't open /dev/null: $!"; - exec "/sbin/$iptables_bin-restore", "-c" or die; - } - waitpid $pid2 => 0; - warn "Warning: /sbin/$iptables_bin-restore exited with value ".($? >> 8) if $? > 0; - }; - - # it's safe to install the new iptables to open $port now that the - # restore hook is in place - my $mask = $fam == PF_INET ? ($addr eq INADDR_ANY ? '0' : '32') - : $fam == PF_INET6 ? ($addr eq IN6ADDR_ANY ? '0' : '128') - : die; - my $dest = Socket::inet_ntop($fam, $addr) .'/'. $mask; - - system ("/sbin/$iptables_bin", qw/-I INPUT -p tcp -m tcp -m state/, - '-d', $dest, '--dport', $port, - '--state', 'NEW,ESTABLISHED', '-j', 'ACCEPT') == 0 or die; - system ("/sbin/$iptables_bin", qw/-I OUTPUT -p tcp -m tcp -m state/, - '-s', $dest, '--sport', $port, - '--state', 'ESTABLISHED', '-j', 'ACCEPT') == 0 or die; - - return $tmpdir; -} - - -############################################################################# -# Spawn the client component, and wait for it to return. -# If $args->{in} is defined, the data is written to the client's STDIN. -# If $args->{out} is defined, its value is set to client's STDOUT data. -# -sub acme_client($@) { - my $args = shift; - my @args = @_; - - my @stat; - my $conf = $CONFIG->{client}; - my $sockname = $OPTS{socket} // $conf->{socket} // die "Missing socket option\n"; - $sockname = $sockname =~ /\A(\p{Print}+)\z/ ? $1 : die "Invalid socket name\n"; # untaint $sockname - - # ensure we're the only user with write access to the parent dir - my $dirname = $sockname =~ s/[^\/]+$//r; - @stat = stat($dirname) or die "Can't stat $dirname: $!"; - die "Error: insecure permissions on $dirname\n" if ($stat[2] & 0022) != 0; - - # ensure we're the only user with read/write access to the socket - @stat = stat($sockname) or die "Can't stat $sockname: $! (Is letsencrypt-accountd running?)\n"; - die "Error: insecure permissions on $sockname\n" if ($stat[2] & 0066) != 0; - - # connect(2) to the socket - socket(my $client, PF_UNIX, SOCK_STREAM, 0) or die "socket: $!"; - my $sockaddr = Socket::sockaddr_un($sockname) // die "Invalid address $sockname\n"; - until (connect($client, $sockaddr)) { - next if $! == EINTR; # try again if connect(2) was interrupted by a signal - die "connect: $!"; - } - - # use execve(2) rather than a Perl pseudo-process to ensure that the - # child doesn't have access to the parent's memory - my @fileno = map { fileno($_) =~ /^(\d+)$/ ? $1 : die } ($CONFFILE, $client); # untaint fileno - spawn({%$args{qw/in out/}, child => sub() { - drop_privileges($conf->{user}, $conf->{group}, $args->{chdir} // '/'); - set_FD_CLOEXEC($_, 0) foreach ($CONFFILE, $client); - seek($CONFFILE, SEEK_SET, 0) or die "Can't seek: $!"; - $ENV{DEBUG} = $OPTS{debug}; - }}, $conf->{command}, $COMMAND, @fileno, @args); -} - -sub spawn($@) { - my $args = shift; - my @exec = @_; - - # create communication pipes if needed - my ($in_rd, $in_wd, $out_rd, $out_wd); - if (defined $args->{in}) { - pipe $in_rd, $in_wd or die "pipe: $!"; - } - if (defined $args->{out}) { - pipe $out_rd, $out_wd or die "pipe: $!"; - } - - my $pid = fork() // "fork: $!"; - unless ($pid) { - # child - $args->{child}->() if defined $args->{child}; - if (defined $args->{in}) { - close $in_wd or die "Can't close: $!"; - open STDIN, '<&', $in_rd or die "Can't dup: $!"; - } else { - open STDIN, '<', '/dev/null' or die "Can't open /dev/null: $!"; - } - if (defined $args->{out}) { - close $out_rd or die "Can't close: $!"; - open STDOUT, '>&', $out_wd or die "Can't dup: $!"; - } else { - open STDOUT, '>', '/dev/null' or die "Can't open /dev/null: $!"; - } - exec { $exec[0] } @exec or die; - } - push @CLEANUP, sub() { - kill 15 => $pid; - waitpid $pid => 0; - }; - - # parent - print STDERR "[$$] Forking $exec[0], child PID $pid\n" if $OPTS{debug}; - if (defined $args->{in}) { - $in_rd->close() or die "Can't close: $!"; - $in_wd->print($args->{in}); - $in_wd->close() or die "Can't close: $!"; - } - if (defined $args->{out}) { - $out_wd->close() or die "Can't close: $!"; - ${$args->{out}} = do { local $/ = undef; $out_rd->getline() }; - $out_rd->close() or die "Can't close: $!"; - } - waitpid $pid => 0; - pop @CLEANUP; - undef ${$args->{out}} if defined $args->{out} and $? > 0; - return $? > 255 ? ($? >> 8) : $? > 0 ? 1 : 0; -} - - -############################################################################# -# Install the certificate -# -sub install_cert($$@) { - my $filename = shift; - my $x509 = shift; - - open my $fh, '>', $filename or die "Can't open $filename: $!"; - print $fh $x509; - foreach (@_) { # append the chain - open my $fh2, '<', $_ or die "Can't open $_: $!"; - my $ca = do { local $/ = undef; $fh2->getline() }; - print $fh $ca; - close $fh2 or die "Can't close: $!"; - } - close $fh or die "Can't close: $!"; -} - - -############################################################################# -# new-reg [--agreement-uri=URI] [CONTACT ..] -# reg=URI [--agreement-uri=URI] [CONTACT ..] -# -if ($COMMAND eq 'new-reg' or $COMMAND =~ /^reg=/) { - die "Invalid registration URI (use the 'new-reg' command to determine the URI)\n" - if $COMMAND eq 'reg='; - $OPTS{'agreement-uri'} = $OPTS{'agreement-uri'} =~ /\A(\p{Print}+)\z/ ? $1 - : die "Invalid value for --agreement-uri\n" - if defined $OPTS{'agreement-uri'}; - - unshift @ARGV, ($OPTS{'agreement-uri'} // ''); - exit acme_client({}, @ARGV); -} - - -############################################################################# -# new-cert [SECTION ..] -# TODO: renewal without the account key, see -# https://github.com/letsencrypt/acme-spec/pull/168 -# -elsif ($COMMAND eq 'new-cert') { - my $conf; - do { - my $conffile = $OPTS{'config-certs'} // $CONFIG->{_}->{'config-certs'} // first { -f $_ } - ( "./$NAME-certs.conf" - , ($ENV{XDG_CONFIG_HOME} // "$ENV{HOME}/.config")."/letsencrypt-tiny/$NAME-certs.conf" - , "/etc/letsencrypt-tiny/$NAME-certs.conf" - ); - die "Error: Can't find certificate configuration file\n" unless defined $conffile; - my $h = Config::Tiny::->read($conffile) or die Config::Tiny::->errstr()."\n"; - my $defaults = delete $h->{_} // {}; - my @valid = qw/certificate certificate-chain certificate-key min-days CAfile - hash keyUsage subject subjectAltName chown chmod notify/; - foreach my $s (keys %$h) { - $conf->{$s} = { map { $_ => delete $h->{$s}->{$_} } @valid }; - die "Unknown option(s) in [$s]: ".join(', ', keys %{$h->{$s}})."\n" if %{$h->{$s}}; - $conf->{$s}->{$_} //= $defaults->{$_} foreach keys %$defaults; - } - }; - - my $challenge_dir; - my $rv = 0; - foreach my $s (@ARGV ? @ARGV : keys %$conf) { - my $conf = $conf->{$s} // do { - print STDERR "Warning: No such section $s, skipping\n"; - $rv = 1; - next; - }; - - my $certtype = first { defined $conf->{$_} } qw/certificate certificate-chain/; - unless (defined $certtype) { - print STDERR "[$s] Warning: Missing 'certificate' and 'certificate-chain', skipping\n"; - $rv = 1; - next; - } - - # skip certificates that expire at least $conf->{'min-days'} days in the future - if (-f $conf->{$certtype} and defined (my $t = x509_enddate($conf->{$certtype}))) { - my $d = $conf->{'min-days'} // 10; - if ($d > 0 and $t - time > $d*86400) { - my $d = POSIX::strftime('%Y-%m-%d %H:%M:%S UTC', gmtime($t)); - print STDERR "[$s] Valid until $d, skipping\n"; - next; - } - } - - # generate the CSR - my $csr = gen_csr(%$conf{qw/certificate-key subject subjectAltName keyUsage hash/}) // do { - print STDERR "[$s] Warning: Couldn't generate CSR, skipping\n"; - $rv = 1; - next; - }; - - # spawn the webserver if not done already - $challenge_dir //= spawn_webserver(); - - # list all authorization domains to request - my @authz; - push @authz, $1 if defined $conf->{subject} =~ /\A.*\/CN=($RE_DOMAIN)\z/o; - if (defined $conf->{subjectAltName}) { - foreach my $d (split /,/, $conf->{subjectAltName}) { - next unless $d =~ s/\A\s*DNS://; - if ($d =~ /\A$RE_DOMAIN\z/o) { - push @authz, $d unless grep {$_ eq $d} @authz; - } else { - print STDERR "[$s] Warning: Ignoring invalid domain $d\n"; - } - } - } - - my ($x509, $csr_pubkey, $x509_pubkey); - print STDERR "[$s] Will request authorization for: ".join(", ", @authz), "\n" if $OPTS{debug}; - if (acme_client({chdir => $challenge_dir, in => $csr, out => \$x509}, @authz)) { - print STDERR "[$s] Error: Couldn't issue X.509 certificate!\n"; - $rv = 1; - next; - } - - # extract pubkeys from CSR and cert, and ensure they match - spawn({in => $csr, out => \$csr_pubkey }, qw/openssl req -inform DER -noout -pubkey/); - spawn({in => $x509, out => \$x509_pubkey}, qw/openssl x509 -inform PEM -noout -pubkey/); - unless (defined $x509_pubkey and defined $csr_pubkey and $x509_pubkey eq $csr_pubkey) { - print STDERR "[$s] Error: Received bogus X.509 certificate from ACME server!\n"; - $rv = 1; - next; - }; - - # verify certificate validity against the CA - $conf->{CAfile} //= '/usr/share/letsencrypt-tiny/lets-encrypt-x3-cross-signed.pem'; - if ($conf->{CAfile} ne '' and spawn({in => $x509}, 'openssl', 'verify', '-CAfile', $conf->{CAfile}, - qw/-purpose sslserver -x509_strict/)) { - print STDERR "[$s] Error: Received invalid X.509 certificate from ACME server!\n"; - $rv = 1; - next; - } - - # install certificate - if (defined $conf->{'certificate'}) { - print STDERR "Installing X.509 certificate $conf->{'certificate'}\n"; - install_cert($conf->{'certificate'}, $x509); - } - if (defined $conf->{'certificate-chain'}) { - print STDERR "Installing X.509 certificate chain $conf->{'certificate-chain'}\n"; - install_cert($conf->{'certificate-chain'}, $x509, $conf->{CAfile}); - } - - if (defined $conf->{chown}) { - my ($user, $group) = split /:/, $conf->{chown}, 2; - my $uid = getpwnam($user) // die "Can't getpwnam($user): $!"; - my $gid = defined $group ? (getgrnam($group) // die "Can't getgrnam($group): $!") : -1; - foreach (grep defined, @$conf{qw/certificate certificate-chain/}) { - chown($uid, $gid, $_) or die "Can't chown: $!"; - } - } - if (defined $conf->{chmod}) { - my $mode = oct($conf->{chmod}) // die; - foreach (grep defined, @$conf{qw/certificate certificate-chain/}) { - chmod($mode, $_) or die "Can't chown: $!"; - } - } - - my @certopts = join ',', qw/no_header no_version no_pubkey no_sigdump/; - open my $fh, '|-', qw/openssl x509 -noout -fingerprint -sha256 -text -certopt/, @certopts - or die "fork: $!"; - print $fh $x509; - close $fh or die $! ? - "Can't close: $!" : - "Error: x509(1ssl) exited with value ".($? >> 8)."\n"; - - if (defined $conf->{notify}) { - print STDERR "Running notification command `$conf->{notify}`\n"; - if (system($conf->{notify}) != 0) { - print STDERR "Warning: notification command exited with value ".($? >> 8)."\n"; - $rv = 1; - } - } - } - undef $challenge_dir; - exit $rv; -} - - -############################################################################# -# revoke-cert FILE [FILE ..] -# -elsif ($COMMAND eq 'revoke-cert') { - die "Nothing to revoke\n" unless @ARGV; - my $rv = 0; - foreach my $filename (@ARGV) { - print STDERR "Revoking $filename\n"; - - # conversion PEM -> DER - open my $fh, '-|', qw/openssl x509 -outform DER -in/, $filename or die "fork: $!"; - my $der = do { local $/ = undef; <$fh> }; - close $fh or die $! ? - "Can't close: $!" : - "Error: x509(1ssl) exited with value ".($? >> 8)."\n"; - - my @certopts = join ',', qw/no_header no_version no_pubkey no_sigdump no_extensions/; - open my $fh2, '|-', qw/openssl x509 -inform DER -noout -fingerprint -sha256 -text -certopt/, @certopts - or die "fork: $!"; - print $fh2 $der; - close $fh2 or die $! ? - "Can't close: $!" : - "Error: x509(1ssl) exited with value ".($? >> 8)."\n"; - - if (acme_client({in => $der})) { - print STDERR "Warning: Couldn't revoke $filename\n"; - $rv = 1; - } - } - exit $rv; -} - - -############################################################################# -# -else { - die "Unknown command $COMMAND" -} - - -END { - local $?; - $_->() foreach reverse @CLEANUP; -} -- cgit v1.2.3