mirror of
https://github.com/therootcompany/greenlock.js.git
synced 2024-11-16 17:29:00 +00:00
Compare commits
No commits in common. "master" and "v1.5.1" have entirely different histories.
73
.gitignore
vendored
73
.gitignore
vendored
@ -1,26 +1,15 @@
|
|||||||
greenlock.json*
|
letsencrypt.work
|
||||||
TODO*
|
letsencrypt.logs
|
||||||
link.sh
|
letsencrypt.config
|
||||||
.env
|
|
||||||
.greenlockrc
|
|
||||||
# generated by init
|
|
||||||
app.js
|
|
||||||
server.js
|
|
||||||
example.js
|
|
||||||
|
|
||||||
# ---> Node
|
|
||||||
# Logs
|
# Logs
|
||||||
logs
|
logs
|
||||||
*.log
|
*.log
|
||||||
npm-debug.log*
|
|
||||||
yarn-debug.log*
|
|
||||||
yarn-error.log*
|
|
||||||
|
|
||||||
# Runtime data
|
# Runtime data
|
||||||
pids
|
pids
|
||||||
*.pid
|
*.pid
|
||||||
*.seed
|
*.seed
|
||||||
*.pid.lock
|
|
||||||
|
|
||||||
# Directory for instrumented libs generated by jscoverage/JSCover
|
# Directory for instrumented libs generated by jscoverage/JSCover
|
||||||
lib-cov
|
lib-cov
|
||||||
@ -28,61 +17,15 @@ lib-cov
|
|||||||
# Coverage directory used by tools like istanbul
|
# Coverage directory used by tools like istanbul
|
||||||
coverage
|
coverage
|
||||||
|
|
||||||
# nyc test coverage
|
# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
|
||||||
.nyc_output
|
|
||||||
|
|
||||||
# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
|
|
||||||
.grunt
|
.grunt
|
||||||
|
|
||||||
# Bower dependency directory (https://bower.io/)
|
|
||||||
bower_components
|
|
||||||
|
|
||||||
# node-waf configuration
|
# node-waf configuration
|
||||||
.lock-wscript
|
.lock-wscript
|
||||||
|
|
||||||
# Compiled binary addons (https://nodejs.org/api/addons.html)
|
# Compiled binary addons (http://nodejs.org/api/addons.html)
|
||||||
build/Release
|
build/Release
|
||||||
|
|
||||||
# Dependency directories
|
# Dependency directory
|
||||||
node_modules/
|
# https://www.npmjs.org/doc/misc/npm-faq.html#should-i-check-my-node_modules-folder-into-git
|
||||||
jspm_packages/
|
node_modules
|
||||||
|
|
||||||
# TypeScript v1 declaration files
|
|
||||||
typings/
|
|
||||||
|
|
||||||
# Optional npm cache directory
|
|
||||||
.npm
|
|
||||||
|
|
||||||
# Optional eslint cache
|
|
||||||
.eslintcache
|
|
||||||
|
|
||||||
# Optional REPL history
|
|
||||||
.node_repl_history
|
|
||||||
|
|
||||||
# Output of 'npm pack'
|
|
||||||
*.tgz
|
|
||||||
|
|
||||||
# Yarn Integrity file
|
|
||||||
.yarn-integrity
|
|
||||||
|
|
||||||
# dotenv environment variables file
|
|
||||||
.env
|
|
||||||
|
|
||||||
# parcel-bundler cache (https://parceljs.org/)
|
|
||||||
.cache
|
|
||||||
|
|
||||||
# next.js build output
|
|
||||||
.next
|
|
||||||
|
|
||||||
# nuxt.js build output
|
|
||||||
.nuxt
|
|
||||||
|
|
||||||
# vuepress build output
|
|
||||||
.vuepress/dist
|
|
||||||
|
|
||||||
# Serverless directories
|
|
||||||
.serverless
|
|
||||||
|
|
||||||
# FuseBox cache
|
|
||||||
.fusebox/
|
|
||||||
|
|
||||||
|
|||||||
@ -1,8 +0,0 @@
|
|||||||
{
|
|
||||||
"bracketSpacing": true,
|
|
||||||
"printWidth": 80,
|
|
||||||
"singleQuote": true,
|
|
||||||
"tabWidth": 4,
|
|
||||||
"trailingComma": "none",
|
|
||||||
"useTabs": false
|
|
||||||
}
|
|
||||||
542
LICENSE
542
LICENSE
@ -1,312 +1,230 @@
|
|||||||
Mozilla Public License Version 2.0
|
At your option you may choose either of the following licenses:
|
||||||
|
|
||||||
1. Definitions
|
* The MIT License (MIT)
|
||||||
|
* The Apache License 2.0 (Apache-2.0)
|
||||||
1.1. "Contributor" means each individual or legal entity that creates, contributes
|
|
||||||
to the creation of, or owns Covered Software.
|
|
||||||
|
The MIT License (MIT)
|
||||||
1.2. "Contributor Version" means the combination of the Contributions of others
|
|
||||||
(if any) used by a Contributor and that particular Contributor's Contribution.
|
Copyright (c) 2015 AJ ONeal
|
||||||
|
|
||||||
1.3. "Contribution" means Covered Software of a particular Contributor.
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
1.4. "Covered Software" means Source Code Form to which the initial Contributor
|
in the Software without restriction, including without limitation the rights
|
||||||
has attached the notice in Exhibit A, the Executable Form of such Source Code
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
Form, and Modifications of such Source Code Form, in each case including portions
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
thereof.
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
1.5. "Incompatible With Secondary Licenses" means
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
(a) that the initial Contributor has attached the notice described in Exhibit
|
|
||||||
B to the Covered Software; or
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
(b) that the Covered Software was made available under the terms of version
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
1.1 or earlier of the License, but not also under the terms of a Secondary
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
License.
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
1.6. "Executable Form" means any form of the work other than Source Code Form.
|
SOFTWARE.
|
||||||
|
|
||||||
1.7. "Larger Work" means a work that combines Covered Software with other
|
|
||||||
material, in a separate file or files, that is not Covered Software.
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
1.8. "License" means this document.
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
1.9. "Licensable" means having the right to grant, to the maximum extent possible,
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
whether at the time of the initial grant or subsequently, any and all of the
|
|
||||||
rights conveyed by this License.
|
1. Definitions.
|
||||||
|
|
||||||
1.10. "Modifications" means any of the following:
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
(a) any file in Source Code Form that results from an addition to, deletion
|
|
||||||
from, or modification of the contents of Covered Software; or
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
(b) any new file in Source Code Form that contains any Covered Software.
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
1.11. "Patent Claims" of a Contributor means any patent claim(s), including
|
other entities that control, are controlled by, or are under common
|
||||||
without limitation, method, process, and apparatus claims, in any patent Licensable
|
control with that entity. For the purposes of this definition,
|
||||||
by such Contributor that would be infringed, but for the grant of the License,
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
by the making, using, selling, offering for sale, having made, import, or
|
direction or management of such entity, whether by contract or
|
||||||
transfer of either its Contributions or its Contributor Version.
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
1.12. "Secondary License" means either the GNU General Public License, Version
|
|
||||||
2.0, the GNU Lesser General Public License, Version 2.1, the GNU Affero General
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
Public License, Version 3.0, or any later versions of those licenses.
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
1.13. "Source Code Form" means the form of the work preferred for making modifications.
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
1.14. "You" (or "Your") means an individual or a legal entity exercising rights
|
source, and configuration files.
|
||||||
under this License. For legal entities, "You" includes any entity that controls,
|
|
||||||
is controlled by, or is under common control with You. For purposes of this
|
"Object" form shall mean any form resulting from mechanical
|
||||||
definition, "control" means (a) the power, direct or indirect, to cause the
|
transformation or translation of a Source form, including but
|
||||||
direction or management of such entity, whether by contract or otherwise,
|
not limited to compiled object code, generated documentation,
|
||||||
or (b) ownership of more than fifty percent (50%) of the outstanding shares
|
and conversions to other media types.
|
||||||
or beneficial ownership of such entity.
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
2. License Grants and Conditions
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
2.1. Grants
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
license:
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
(a) under intellectual property rights (other than patent or trademark) Licensable
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
by such Contributor to use, reproduce, make available, modify, display, perform,
|
of this License, Derivative Works shall not include works that remain
|
||||||
distribute, and otherwise exploit its Contributions, either on an unmodified
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
basis, with Modifications, or as part of a Larger Work; and
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
(b) under Patent Claims of such Contributor to make, use, sell, offer for
|
"Contribution" shall mean any work of authorship, including
|
||||||
sale, have made, import, and otherwise transfer either its Contributions or
|
the original version of the Work and any modifications or additions
|
||||||
its Contributor Version.
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
2.2. Effective Date
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
The licenses granted in Section 2.1 with respect to any Contribution become
|
means any form of electronic, verbal, or written communication sent
|
||||||
effective for each Contribution on the date the Contributor first distributes
|
to the Licensor or its representatives, including but not limited to
|
||||||
such Contribution.
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
2.3. Limitations on Grant Scope
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
The licenses granted in this Section 2 are the only rights granted under this
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
License. No additional rights or licenses will be implied from the distribution
|
|
||||||
or licensing of Covered Software under this License. Notwithstanding Section
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
2.1(b) above, no patent license is granted by a Contributor:
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
(a) for any code that a Contributor has removed from Covered Software; or
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
(b) for infringements caused by: (i) Your and any other third party's modifications
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
of Covered Software, or (ii) the combination of its Contributions with other
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
software (except as part of its Contributor Version); or
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
(c) under Patent Claims infringed by Covered Software in the absence of its
|
Work and such Derivative Works in Source or Object form.
|
||||||
Contributions.
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
This License does not grant any rights in the trademarks, service marks, or
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
logos of any Contributor (except as may be necessary to comply with the notice
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
requirements in Section 3.4).
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
2.4. Subsequent Licenses
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
No Contributor makes additional grants as a result of Your choice to distribute
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
the Covered Software under a subsequent version of this License (see Section
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
10.2) or under the terms of a Secondary License (if permitted under the terms
|
institute patent litigation against any entity (including a
|
||||||
of Section 3.3).
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
2.5. Representation
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
Each Contributor represents that the Contributor believes its Contributions
|
as of the date such litigation is filed.
|
||||||
are its original creation(s) or it has sufficient rights to grant the rights
|
|
||||||
to its Contributions conveyed by this License.
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
2.6. Fair Use
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
This License is not intended to limit any rights You have under applicable
|
|
||||||
copyright doctrines of fair use, fair dealing, or other equivalents.
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
2.7. Conditions
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
|
stating that You changed the files; and
|
||||||
Section 2.1.
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
3. Responsibilities
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
3.1. Distribution of Source Form
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
All distribution of Covered Software in Source Code Form, including any Modifications
|
|
||||||
that You create or to which You contribute, must be under the terms of this
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
License. You must inform recipients that the Source Code Form of the Covered
|
distribution, then any Derivative Works that You distribute must
|
||||||
Software is governed by the terms of this License, and how they can obtain
|
include a readable copy of the attribution notices contained
|
||||||
a copy of this License. You may not attempt to alter or restrict the recipients'
|
within such NOTICE file, excluding those notices that do not
|
||||||
rights in the Source Code Form.
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
3.2. Distribution of Executable Form
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
If You distribute Covered Software in Executable Form then:
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
(a) such Covered Software must also be made available in Source Code Form,
|
of the NOTICE file are for informational purposes only and
|
||||||
as described in Section 3.1, and You must inform recipients of the Executable
|
do not modify the License. You may add Your own attribution
|
||||||
Form how they can obtain a copy of such Source Code Form by reasonable means
|
notices within Derivative Works that You distribute, alongside
|
||||||
in a timely manner, at a charge no more than the cost of distribution to the
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
recipient; and
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
(b) You may distribute such Executable Form under the terms of this License,
|
|
||||||
or sublicense it under different terms, provided that the license for the
|
You may add Your own copyright statement to Your modifications and
|
||||||
Executable Form does not attempt to limit or alter the recipients' rights
|
may provide additional or different license terms and conditions
|
||||||
in the Source Code Form under this License.
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
3.3. Distribution of a Larger Work
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
You may create and distribute a Larger Work under terms of Your choice, provided
|
|
||||||
that You also comply with the requirements of this License for the Covered
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
Software. If the Larger Work is a combination of Covered Software with a work
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
governed by one or more Secondary Licenses, and the Covered Software is not
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
Incompatible With Secondary Licenses, this License permits You to additionally
|
this License, without any additional terms or conditions.
|
||||||
distribute such Covered Software under the terms of such Secondary License(s),
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
so that the recipient of the Larger Work may, at their option, further distribute
|
the terms of any separate license agreement you may have executed
|
||||||
the Covered Software under the terms of either this License or such Secondary
|
with Licensor regarding such Contributions.
|
||||||
License(s).
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
3.4. Notices
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
You may not remove or alter the substance of any license notices (including
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
copyright notices, patent notices, disclaimers of warranty, or limitations
|
|
||||||
of liability) contained within the Source Code Form of the Covered Software,
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
except that You may alter any license notices to the extent required to remedy
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
known factual inaccuracies.
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
3.5. Application of Additional Terms
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
You may choose to offer, and to charge a fee for, warranty, support, indemnity
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
or liability obligations to one or more recipients of Covered Software. However,
|
appropriateness of using or redistributing the Work and assume any
|
||||||
You may do so only on Your own behalf, and not on behalf of any Contributor.
|
risks associated with Your exercise of permissions under this License.
|
||||||
You must make it absolutely clear that any such warranty, support, indemnity,
|
|
||||||
or liability obligation is offered by You alone, and You hereby agree to indemnify
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
every Contributor for any liability incurred by such Contributor as a result
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
of warranty, support, indemnity or liability terms You offer. You may include
|
unless required by applicable law (such as deliberate and grossly
|
||||||
additional disclaimers of warranty and limitations of liability specific to
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
any jurisdiction.
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
4. Inability to Comply Due to Statute or Regulation
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
If it is impossible for You to comply with any of the terms of this License
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
with respect to some or all of the Covered Software due to statute, judicial
|
other commercial damages or losses), even if such Contributor
|
||||||
order, or regulation then You must: (a) comply with the terms of this License
|
has been advised of the possibility of such damages.
|
||||||
to the maximum extent possible; and (b) describe the limitations and the code
|
|
||||||
they affect. Such description must be placed in a text file included with
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
all distributions of the Covered Software under this License. Except to the
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
extent prohibited by statute or regulation, such description must be sufficiently
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
detailed for a recipient of ordinary skill to be able to understand it.
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
5. Termination
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
5.1. The rights granted under this License will terminate automatically if
|
defend, and hold each Contributor harmless for any liability
|
||||||
You fail to comply with any of its terms. However, if You become compliant,
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
then the rights granted under this License from a particular Contributor are
|
of your accepting any such warranty or additional liability.
|
||||||
reinstated (a) provisionally, unless and until such Contributor explicitly
|
|
||||||
and finally terminates Your grants, and (b) on an ongoing basis, if such Contributor
|
END OF TERMS AND CONDITIONS
|
||||||
fails to notify You of the non-compliance by some reasonable means prior to
|
|
||||||
60 days after You have come back into compliance. Moreover, Your grants from
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
a particular Contributor are reinstated on an ongoing basis if such Contributor
|
|
||||||
notifies You of the non-compliance by some reasonable means, this is the first
|
To apply the Apache License to your work, attach the following
|
||||||
time You have received notice of non-compliance with this License from such
|
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||||
Contributor, and You become compliant prior to 30 days after Your receipt
|
replaced with your own identifying information. (Don't include
|
||||||
of the notice.
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
5.2. If You initiate litigation against any entity by asserting a patent infringement
|
file or class name and description of purpose be included on the
|
||||||
claim (excluding declaratory judgment actions, counter-claims, and cross-claims)
|
same "printed page" as the copyright notice for easier
|
||||||
alleging that a Contributor Version directly or indirectly infringes any patent,
|
identification within third-party archives.
|
||||||
then the rights granted to You by any and all Contributors for the Covered
|
|
||||||
Software under Section 2.1 of this License shall terminate.
|
Copyright 2015 AJ ONeal
|
||||||
|
|
||||||
5.3. In the event of termination under Sections 5.1 or 5.2 above, all end
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
user license agreements (excluding distributors and resellers) which have
|
you may not use this file except in compliance with the License.
|
||||||
been validly granted by You or Your distributors under this License prior
|
You may obtain a copy of the License at
|
||||||
to termination shall survive termination.
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
6. Disclaimer of Warranty
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
Covered Software is provided under this License on an "as is" basis, without
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
warranty of any kind, either expressed, implied, or statutory, including,
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
without limitation, warranties that the Covered Software is free of defects,
|
See the License for the specific language governing permissions and
|
||||||
merchantable, fit for a particular purpose or non-infringing. The entire risk
|
limitations under the License.
|
||||||
as to the quality and performance of the Covered Software is with You. Should
|
|
||||||
any Covered Software prove defective in any respect, You (not any Contributor)
|
|
||||||
assume the cost of any necessary servicing, repair, or correction. This disclaimer
|
|
||||||
of warranty constitutes an essential part of this License. No use of any Covered
|
|
||||||
Software is authorized under this License except under this disclaimer.
|
|
||||||
|
|
||||||
7. Limitation of Liability
|
|
||||||
|
|
||||||
Under no circumstances and under no legal theory, whether tort (including
|
|
||||||
negligence), contract, or otherwise, shall any Contributor, or anyone who
|
|
||||||
distributes Covered Software as permitted above, be liable to You for any
|
|
||||||
direct, indirect, special, incidental, or consequential damages of any character
|
|
||||||
including, without limitation, damages for lost profits, loss of goodwill,
|
|
||||||
work stoppage, computer failure or malfunction, or any and all other commercial
|
|
||||||
damages or losses, even if such party shall have been informed of the possibility
|
|
||||||
of such damages. This limitation of liability shall not apply to liability
|
|
||||||
for death or personal injury resulting from such party's negligence to the
|
|
||||||
extent applicable law prohibits such limitation. Some jurisdictions do not
|
|
||||||
allow the exclusion or limitation of incidental or consequential damages,
|
|
||||||
so this exclusion and limitation may not apply to You.
|
|
||||||
|
|
||||||
8. Litigation
|
|
||||||
|
|
||||||
Any litigation relating to this License may be brought only in the courts
|
|
||||||
of a jurisdiction where the defendant maintains its principal place of business
|
|
||||||
and such litigation shall be governed by laws of that jurisdiction, without
|
|
||||||
reference to its conflict-of-law provisions. Nothing in this Section shall
|
|
||||||
prevent a party's ability to bring cross-claims or counter-claims.
|
|
||||||
|
|
||||||
9. Miscellaneous
|
|
||||||
|
|
||||||
This License represents the complete agreement concerning the subject matter
|
|
||||||
hereof. If any provision of this License is held to be unenforceable, such
|
|
||||||
provision shall be reformed only to the extent necessary to make it enforceable.
|
|
||||||
Any law or regulation which provides that the language of a contract shall
|
|
||||||
be construed against the drafter shall not be used to construe this License
|
|
||||||
against a Contributor.
|
|
||||||
|
|
||||||
10. Versions of the License
|
|
||||||
|
|
||||||
10.1. New Versions
|
|
||||||
|
|
||||||
Mozilla Foundation is the license steward. Except as provided in Section 10.3,
|
|
||||||
no one other than the license steward has the right to modify or publish new
|
|
||||||
versions of this License. Each version will be given a distinguishing version
|
|
||||||
number.
|
|
||||||
|
|
||||||
10.2. Effect of New Versions
|
|
||||||
|
|
||||||
You may distribute the Covered Software under the terms of the version of
|
|
||||||
the License under which You originally received the Covered Software, or under
|
|
||||||
the terms of any subsequent version published by the license steward.
|
|
||||||
|
|
||||||
10.3. Modified Versions
|
|
||||||
|
|
||||||
If you create software not governed by this License, and you want to create
|
|
||||||
a new license for such software, you may create and use a modified version
|
|
||||||
of this License if you rename the license and remove any references to the
|
|
||||||
name of the license steward (except to note that such modified license differs
|
|
||||||
from this License).
|
|
||||||
|
|
||||||
10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
|
|
||||||
|
|
||||||
If You choose to distribute Source Code Form that is Incompatible With Secondary
|
|
||||||
Licenses under the terms of this version of the License, the notice described
|
|
||||||
in Exhibit B of this License must be attached. Exhibit A - Source Code Form
|
|
||||||
License Notice
|
|
||||||
|
|
||||||
This Source Code Form is subject to the terms of the Mozilla Public License,
|
|
||||||
v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain
|
|
||||||
one at http://mozilla.org/MPL/2.0/.
|
|
||||||
|
|
||||||
If it is not possible or desirable to put the notice in a particular file,
|
|
||||||
then You may include the notice in a location (such as a LICENSE file in a
|
|
||||||
relevant directory) where a recipient would be likely to look for such a notice.
|
|
||||||
|
|
||||||
You may add additional accurate notices of copyright ownership.
|
|
||||||
|
|
||||||
Exhibit B - "Incompatible With Secondary Licenses" Notice
|
|
||||||
|
|
||||||
This Source Code Form is "Incompatible With Secondary Licenses", as defined
|
|
||||||
by the Mozilla Public License, v. 2.0.
|
|
||||||
|
|||||||
@ -1,403 +0,0 @@
|
|||||||
# Migrating Guide
|
|
||||||
|
|
||||||
Greenlock v4 is the current version.
|
|
||||||
|
|
||||||
# v3 to v4
|
|
||||||
|
|
||||||
v4 is a very minor, but breaking, change from v3
|
|
||||||
|
|
||||||
### `configFile` is replaced with `configDir`
|
|
||||||
|
|
||||||
The default config file `./greenlock.json` is now `./greenlock.d/config.json`.
|
|
||||||
|
|
||||||
This was change was mode to eliminate unnecessary configuration that was inadvertantly introduced in v3.
|
|
||||||
|
|
||||||
### `.greenlockrc` is auto-generated
|
|
||||||
|
|
||||||
`.greenlockrc` exists for the sake of tooling - so that the CLI, Web API, and your code naturally stay in sync.
|
|
||||||
|
|
||||||
It looks like this:
|
|
||||||
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"manager": {
|
|
||||||
"module": "@greenlock/manager"
|
|
||||||
},
|
|
||||||
"configDir": "./greenlock.d"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
If you deploy to a read-only filesystem, it is best that you create the `.greenlockrc` file as part
|
|
||||||
of your image and use that rather than including any configuration in your code.
|
|
||||||
|
|
||||||
# v2 to v4
|
|
||||||
|
|
||||||
**Greenlock Express** uses Greenlock directly, the same as before.
|
|
||||||
|
|
||||||
All options described for `Greenlock.create({...})` also apply to the Greenlock Express `init()` callback.
|
|
||||||
|
|
||||||
# Overview of Major Differences
|
|
||||||
|
|
||||||
- Reduced API
|
|
||||||
- No code in the config
|
|
||||||
- (config is completely serializable)
|
|
||||||
- Manager callbacks replace `approveDomains`
|
|
||||||
- Greenlock Express does more, with less config
|
|
||||||
- cluster is supported out-of-the-box
|
|
||||||
- high-performance
|
|
||||||
- scalable
|
|
||||||
- ACME challenges are simplified
|
|
||||||
- init
|
|
||||||
- zones (dns-01)
|
|
||||||
- set
|
|
||||||
- get
|
|
||||||
- remove
|
|
||||||
- Store callbacks are simplified
|
|
||||||
- accounts
|
|
||||||
- checkKeypairs
|
|
||||||
- certificates
|
|
||||||
- checkKeypairs
|
|
||||||
- check
|
|
||||||
- set
|
|
||||||
|
|
||||||
# Greenlock JavaScript API greatly reduced
|
|
||||||
|
|
||||||
Whereas before there were many different methods with nuance differences,
|
|
||||||
now there's just `create`, `get`, `renew`, and sometimes `add` ().
|
|
||||||
|
|
||||||
- Greenlock.create({ maintainerEmail, packageAgent, notify })
|
|
||||||
- Greenlock.get({ servername, wildname, duplicate, force })
|
|
||||||
- (just a convenience wrapper around renew)
|
|
||||||
- Greenlock.renew({ subject, altnames, issuedBefore, expiresAfter })
|
|
||||||
- (retrieves, issues, renews, all-in-one)
|
|
||||||
- _optional_ Greenlock.add({ subject, altnames, subscriberEmail })
|
|
||||||
- (partially replaces `approveDomains`)
|
|
||||||
|
|
||||||
Also, some disambiguation on terms:
|
|
||||||
|
|
||||||
- `domains` was often ambiguous and confusing, it has been replaced by:
|
|
||||||
- `subject` refers to the subject of a certificate - the primary domain
|
|
||||||
- `altnames` refers to the domains in the SAN (Subject Alternative Names) section of the certificate
|
|
||||||
- `servername` refers to the TLS (SSL) SNI (Server Name Indication) request for a cetificate
|
|
||||||
- `wildname` refers to the wildcard version of the servername (ex: `www.example.com => *.example.com`)
|
|
||||||
|
|
||||||
When you create an instance of Greenlock, you only supply package and maintainer info.
|
|
||||||
|
|
||||||
All other configuration is A) optional and B) handled by the _Manager_.
|
|
||||||
|
|
||||||
```js
|
|
||||||
'use strict';
|
|
||||||
|
|
||||||
var pkg = require('./package.json');
|
|
||||||
|
|
||||||
var Greenlock = require('greenlock');
|
|
||||||
var greenlock = Greenlock.create({
|
|
||||||
// used for the ACME client User-Agent string as per RFC 8555 and RFC 7231
|
|
||||||
packageAgent: pkg.name + '/' + pkg.version,
|
|
||||||
|
|
||||||
// used as the contact for critical bug and security notices
|
|
||||||
// should be the same as pkg.author.email
|
|
||||||
maintainerEmail: 'jon@example.com',
|
|
||||||
|
|
||||||
// used for logging background events and errors
|
|
||||||
notify: function(ev, args) {
|
|
||||||
if ('error' === ev || 'warning' === ev) {
|
|
||||||
console.error(ev, args);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
console.info(ev, args);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
By default **no certificates will be issued**. See the _manager_ section.
|
|
||||||
|
|
||||||
When you want to get a single certificate, you use `get`, which will:
|
|
||||||
|
|
||||||
- will return null if neither the `servername` or its `wildname` (wildcard) variant can be found
|
|
||||||
- retrieve a non-expired certificate, if possible
|
|
||||||
- will renew the certificate in the background, if stale
|
|
||||||
- will wait for the certificate to be issued if new
|
|
||||||
|
|
||||||
```js
|
|
||||||
greenlock
|
|
||||||
.get({ servername: 'www.example.com' })
|
|
||||||
.then(function(result) {
|
|
||||||
if (!result) {
|
|
||||||
// certificate is not on the approved list
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
var fullchain = result.pems.cert + '\n' + result.pems.chain + '\n';
|
|
||||||
var privkey = result.pems.privkey;
|
|
||||||
|
|
||||||
return {
|
|
||||||
fullchain: fullchain,
|
|
||||||
privkey: privkey
|
|
||||||
};
|
|
||||||
})
|
|
||||||
.catch(function(e) {
|
|
||||||
// something went wrong in the renew process
|
|
||||||
console.error(e);
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
By default **no certificates will be issued**. See the _manager_ section.
|
|
||||||
|
|
||||||
When you want to renew certificates, _en masse_, you use `renew`, which will:
|
|
||||||
|
|
||||||
- check all certificates matching the given criteria
|
|
||||||
- only renew stale certificates by default
|
|
||||||
- return error objects (will NOT throw exception for failed renewals)
|
|
||||||
|
|
||||||
```js
|
|
||||||
greenlock
|
|
||||||
.renew({})
|
|
||||||
.then(function(results) {
|
|
||||||
if (!result.length) {
|
|
||||||
// no certificates found
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
// [{ site, error }]
|
|
||||||
return results;
|
|
||||||
})
|
|
||||||
.catch(function(e) {
|
|
||||||
// an unexpected error, not related to renewal
|
|
||||||
console.error(e);
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
Options:
|
|
||||||
|
|
||||||
| Option | Description |
|
|
||||||
| ------------- | -------------------------------------------------------------------------- |
|
|
||||||
| `altnames` | only check and renew certs matching these altnames (including wildcards) |
|
|
||||||
| `renewBefore` | only check and renew certs marked for renewal before the given date, in ms |
|
|
||||||
| `duplicate` | renew certificates regardless of timing |
|
|
||||||
| `force` | allow silly things, like tiny `renewOffset`s |
|
|
||||||
|
|
||||||
By default **no certificates will be issued**. See the _manager_ section.
|
|
||||||
|
|
||||||
# Greenlock Express Example
|
|
||||||
|
|
||||||
The options that must be returned from `init()` are the same that are used in `Greenlock.create()`,
|
|
||||||
with a few extra that are specific to Greenlock Express:
|
|
||||||
|
|
||||||
```js
|
|
||||||
require('@root/greenlock-express')
|
|
||||||
.init(function() {
|
|
||||||
// This object will be passed to Greenlock.create()
|
|
||||||
|
|
||||||
var options = {
|
|
||||||
// some options, like cluster, are special to Greenlock Express
|
|
||||||
|
|
||||||
cluster: false,
|
|
||||||
|
|
||||||
// The rest are the same as for Greenlock
|
|
||||||
|
|
||||||
packageAgent: pkg.name + '/' + pkg.version,
|
|
||||||
maintainerEmail: 'jon@example.com',
|
|
||||||
notify: function(ev, args) {
|
|
||||||
console.info(ev, args);
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
return options;
|
|
||||||
})
|
|
||||||
.serve(function(glx) {
|
|
||||||
// will start servers on port 80 and 443
|
|
||||||
|
|
||||||
glx.serveApp(function(req, res) {
|
|
||||||
res.end('Hello, Encrypted World!');
|
|
||||||
});
|
|
||||||
|
|
||||||
// you can get access to the raw server (i.e. for websockets)
|
|
||||||
|
|
||||||
glx.httpsServer(); // returns raw server object
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
# _Manager_ replaces `approveDomains`
|
|
||||||
|
|
||||||
`approveDomains` was always a little confusing. Most people didn't need it.
|
|
||||||
|
|
||||||
Instead, now there is a simple config file that will work for most people,
|
|
||||||
as well as a set of callbacks for easy configurability.
|
|
||||||
|
|
||||||
### Default Manager
|
|
||||||
|
|
||||||
The default manager is `@greenlock/manager` and the default `configDir` is `./.greenlock.d`.
|
|
||||||
|
|
||||||
The config file should look something like this:
|
|
||||||
|
|
||||||
`./greenlock.d/config.json`:
|
|
||||||
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"subscriberEmail": "jon@example.com",
|
|
||||||
"agreeToTerms": true,
|
|
||||||
"sites": {
|
|
||||||
"example.com": {
|
|
||||||
"subject": "example.com",
|
|
||||||
"altnames": ["example.com", "www.example.com"]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
You can specify a `acme-dns-01-*` or `acme-http-01-*` challenge plugin globally, or per-site.
|
|
||||||
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"subscriberEmail": "jon@example.com",
|
|
||||||
"agreeToTerms": true,
|
|
||||||
"sites": {
|
|
||||||
"example.com": {
|
|
||||||
"subject": "example.com",
|
|
||||||
"altnames": ["example.com", "www.example.com"],
|
|
||||||
"challenges": {
|
|
||||||
"dns-01": {
|
|
||||||
"module": "acme-dns-01-digitalocean",
|
|
||||||
"token": "apikey-xxxxx"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
The same is true with `greenlock-store-*` plugins:
|
|
||||||
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"subscriberEmail": "jon@example.com",
|
|
||||||
"agreeToTerms": true,
|
|
||||||
"sites": {
|
|
||||||
"example.com": {
|
|
||||||
"subject": "example.com",
|
|
||||||
"altnames": ["example.com", "www.example.com"]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"store": {
|
|
||||||
"module": "greenlock-store-fs",
|
|
||||||
"basePath": "~/.config/greenlock"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
### Customer Manager, the lazy way
|
|
||||||
|
|
||||||
At the very least you have to implement `get({ servername, wildname })`.
|
|
||||||
|
|
||||||
```js
|
|
||||||
var greenlock = Greenlock.create({
|
|
||||||
packageAgent: pkg.name + '/' + pkg.version,
|
|
||||||
maintainerEmail: 'jon@example.com',
|
|
||||||
notify: notify,
|
|
||||||
|
|
||||||
packageRoot: __dirname,
|
|
||||||
manager: {
|
|
||||||
module: './manager.js'
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
function notify(ev, args) {
|
|
||||||
if ('error' === ev || 'warning' === ev) {
|
|
||||||
console.error(ev, args);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
console.info(ev, args);
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
In the simplest case you can ignore all incoming options
|
|
||||||
and return a single site config in the same format as the config file
|
|
||||||
|
|
||||||
`./manager.js`:
|
|
||||||
|
|
||||||
```js
|
|
||||||
'use strict';
|
|
||||||
|
|
||||||
module.exports.create = function() {
|
|
||||||
return {
|
|
||||||
get: async function({ servername }) {
|
|
||||||
// do something to fetch the site
|
|
||||||
var site = {
|
|
||||||
subject: 'example.com',
|
|
||||||
altnames: ['example.com', 'www.example.com']
|
|
||||||
};
|
|
||||||
|
|
||||||
return site;
|
|
||||||
}
|
|
||||||
};
|
|
||||||
};
|
|
||||||
```
|
|
||||||
|
|
||||||
If you want to use wildcards or local domains for a specific domain, you must specify the `dns-01` challenge plugin to use:
|
|
||||||
|
|
||||||
```js
|
|
||||||
'use strict';
|
|
||||||
|
|
||||||
module.exports.create = function() {
|
|
||||||
return {
|
|
||||||
get: async function({ servername }) {
|
|
||||||
// do something to fetch the site
|
|
||||||
var site = {
|
|
||||||
subject: 'example.com',
|
|
||||||
altnames: ['example.com', 'www.example.com'],
|
|
||||||
|
|
||||||
// dns-01 challenge
|
|
||||||
challenges: {
|
|
||||||
'dns-01': {
|
|
||||||
module: 'acme-dns-01-namedotcom',
|
|
||||||
apikey: 'xxxx'
|
|
||||||
}
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
return site;
|
|
||||||
}
|
|
||||||
};
|
|
||||||
};
|
|
||||||
```
|
|
||||||
|
|
||||||
### Customer Manager, Complete
|
|
||||||
|
|
||||||
See <https://git.rootprojects.org/root/greenlock-manager-test.js#quick-start>
|
|
||||||
|
|
||||||
# ACME Challenge Plugins
|
|
||||||
|
|
||||||
The ACME challenge plugins are just a few simple callbacks:
|
|
||||||
|
|
||||||
- `init`
|
|
||||||
- `zones` (dns-01 only)
|
|
||||||
- `set`
|
|
||||||
- `get`
|
|
||||||
- `remove`
|
|
||||||
|
|
||||||
They are described here:
|
|
||||||
|
|
||||||
- [dns-01 documentation](https://git.rootprojects.org/root/acme-dns-01-test.js)
|
|
||||||
- [http-01 documentation](https://git.rootprojects.org/root/acme-http-01-test.js)
|
|
||||||
|
|
||||||
# Key and Cert Store Plugins
|
|
||||||
|
|
||||||
Again, these are just a few simple callbacks:
|
|
||||||
|
|
||||||
- `certificates.checkKeypair`
|
|
||||||
- `certificates.check`
|
|
||||||
- `certificates.setKeypair`
|
|
||||||
- `certificates.set`
|
|
||||||
- `accounts.checkKeypair`
|
|
||||||
- `accounts.check` (optional)
|
|
||||||
- `accounts.setKeypair`
|
|
||||||
- `accounts.set` (optional)
|
|
||||||
|
|
||||||
The name `check` is used instead of `get` because they only need to return something if it exists. They do not need to fail, nor do they need to generate anything.
|
|
||||||
|
|
||||||
They are described here:
|
|
||||||
|
|
||||||
- [greenlock store documentation](https://git.rootprojects.org/root/greenlock-store-test.js)
|
|
||||||
|
|
||||||
If you are just implenting in-house and are not going to publish a module, you can also do some hack things like this:
|
|
||||||
814
README.md
814
README.md
@ -1,667 +1,311 @@
|
|||||||
# New Documentation & [v4 Migration Guide](https://git.rootprojects.org/root/greenlock.js/src/branch/master/MIGRATION_GUIDE.md)
|
[](https://gitter.im/Daplie/letsencrypt-express?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
|
||||||
|
|
||||||
We're still working on the full documentation for this new version,
|
| **letsencrypt** (library)
|
||||||
so please be patient.
|
| [letsencrypt-cli](https://github.com/Daplie/letsencrypt-cli)
|
||||||
|
| [letsencrypt-express](https://github.com/Daplie/letsencrypt-express)
|
||||||
|
| [letsencrypt-koa](https://github.com/Daplie/letsencrypt-koa)
|
||||||
|
| [letsencrypt-hapi](https://github.com/Daplie/letsencrypt-hapi)
|
||||||
|
|
|
||||||
|
|
||||||
To start, check out the
|
letsencrypt
|
||||||
[Migration Guide](https://git.rootprojects.org/root/greenlock.js/src/branch/master/MIGRATION_GUIDE.md).
|
===========
|
||||||
|
|
||||||
|
Automatic [Let's Encrypt](https://letsencrypt.org) HTTPS Certificates for node.js
|
||||||
|
|
||||||
|
* [Automatic HTTPS with ExpressJS](https://github.com/Daplie/letsencrypt-express)
|
||||||
|
* [Automatic live renewal](https://github.com/Daplie/letsencrypt-express#how-automatic)
|
||||||
|
* On-the-fly HTTPS certificates for Dynamic DNS (in-process, no server restart)
|
||||||
|
* Works with node cluster out of the box
|
||||||
|
* usable [via commandline](https://github.com/Daplie/letsencrypt-cli) as well
|
||||||
|
* Free SSL (HTTPS Certificates for TLS)
|
||||||
|
* [90-day certificates](https://letsencrypt.org/2015/11/09/why-90-days.html)
|
||||||
|
|
||||||
# [Greenlock](https://git.rootprojects.org/root/greenlock.js) is Let's Encrypt for JavaScript
|
**See Also**
|
||||||
|
|
||||||
| Built by [Root](https://rootprojects.org) for [Hub](https://rootprojects.org/hub/)
|
* [Let's Encrypt in (exactly) 90 seconds with Caddy](https://daplie.com/articles/lets-encrypt-in-literally-90-seconds/)
|
||||||
|
* [lego](https://github.com/xenolf/lego): Let's Encrypt for golang
|
||||||
|
|
||||||
Greenlock™ is an Automated Certificate Management Environement 🔐.
|
STOP
|
||||||
|
====
|
||||||
|
|
||||||
| **Greenlock** | [Greenlock Express](https://git.rootprojects.org/root/greenlock-express.js) | [ACME.js](https://git.rootprojects.org/root/acme.js) |
|
**These aren't the droids you're looking for.**
|
||||||
|
|
||||||
It uses **Let's Encrypt** to generate Free SSL Certificates, including **Wildcard** SSL.
|
This is a low-level library for implementing CLIs,
|
||||||
It supports **Automated Renewal** of certs for Fully Automated HTTPS.
|
system tools, and abstracting storage backends (file vs db, etc).
|
||||||
|
This is not the thing to use in your webserver directly.
|
||||||
|
|
||||||
It's written in plain JavaScript and works in Node, Browsers, and WebPack.
|
### Use [letsencrypt-express](https://github.com/Daplie/letsencrypt-express) if...
|
||||||
|
|
||||||
the easiest way to integrate Let's Encrypt into your projects, products, and infrastructure.
|
you are planning to use one of these:
|
||||||
|
|
||||||
- [x] **Wildcard** Certificates
|
* `express`
|
||||||
- [x] **IoT** Environments
|
* `connect`
|
||||||
- [x] **Enterprise** and **On-Prem**
|
* raw `https`
|
||||||
- [x] **Private** Networks
|
* raw `spdy`
|
||||||
- [x] **Localhost** Development
|
* `restify` (same as raw https)
|
||||||
- [x] **Web Hosting** Providers
|
* `hapi` See [letsencrypt-hapi](https://github.com/Daplie/letsencrypt-hapi)
|
||||||
- [x] **Commercial** support
|
* `koa` See [letsencrypt-koa](https://github.com/Daplie/letsencrypt-koa)
|
||||||
|
* `rill` (similar to koa example)
|
||||||
|
|
||||||
We've built it simple enough for Hobbyists, and robust enough for the Enterprise.
|
### Use [letsencrypt-cli](https://github.com/Daplie/letsencrypt-cli) if...
|
||||||
|
|
||||||
<!--
|
You are planning to use one of these:
|
||||||
# Localhost Development
|
|
||||||
|
|
||||||
<details>
|
* `bash`
|
||||||
<summary>HTTPS on Localhost</summary>
|
* `fish`
|
||||||
TODO
|
* `zsh`
|
||||||
|
* `cmd.exe`
|
||||||
|
* `PowerShell`
|
||||||
|
|
||||||
</details>
|
Install
|
||||||
|
=======
|
||||||
# WebServer with Automatic HTTPS
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Learn more about the Greenlock Web Server</summary>
|
|
||||||
TODO
|
|
||||||
</details>
|
|
||||||
|
|
||||||
# Commandline
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Learn more about the Greenlock CLI</summary>
|
|
||||||
TODO
|
|
||||||
</details>
|
|
||||||
|
|
||||||
-->
|
|
||||||
|
|
||||||
# Quick Start
|
|
||||||
|
|
||||||
Greenlock is fully-automated, **SSL Certificate Manager** for IoT, Web Hosting, and Enterprise On-Prem, Edge, and Hybrid Cloud.
|
|
||||||
|
|
||||||
(though we started building it for [Home Servers](https://rootprojects.org/hub/))
|
|
||||||
|
|
||||||
You can use it for one-off certificates, like `certbot`,
|
|
||||||
but it is _much_ more powerful than that.
|
|
||||||
|
|
||||||
By setting just a few callbacks to let it know where it should store private keys and certificates,
|
|
||||||
it will automatically renew any certificate that you add to it, as long as the process is running.
|
|
||||||
|
|
||||||
Certificates are renewed every 45 days by default, and renewal checks will happen several times a day.
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>1. Configure</summary>
|
|
||||||
|
|
||||||
```js
|
|
||||||
'use strict';
|
|
||||||
|
|
||||||
var pkg = require('./package.json');
|
|
||||||
var Greenlock = require('greenlock');
|
|
||||||
var greenlock = Greenlock.create({
|
|
||||||
packageRoot: __dirname,
|
|
||||||
configDir: "./greenlock.d/",
|
|
||||||
packageAgent: pkg.name + '/' + pkg.version,
|
|
||||||
maintainerEmail: pkg.author,
|
|
||||||
staging: true,
|
|
||||||
notify: function(event, details) {
|
|
||||||
if ('error' === event) {
|
|
||||||
// `details` is an error object in this case
|
|
||||||
console.error(details);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
greenlock.manager
|
|
||||||
.defaults({
|
|
||||||
agreeToTerms: true,
|
|
||||||
subscriberEmail: 'webhosting@example.com'
|
|
||||||
})
|
|
||||||
.then(function(fullConfig) {
|
|
||||||
// ...
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>2. Add Domains</summary>
|
|
||||||
|
|
||||||
The `subject` (primary domain on certificate) will be the id,
|
|
||||||
so it's very important that the order of the given domains
|
|
||||||
be deterministic.
|
|
||||||
|
|
||||||
```js
|
|
||||||
var altnames = ['example.com', 'www.example.com'];
|
|
||||||
|
|
||||||
greenlock
|
|
||||||
.add({
|
|
||||||
subject: altnames[0],
|
|
||||||
altnames: altnames
|
|
||||||
})
|
|
||||||
.then(function() {
|
|
||||||
// saved config to db (or file system)
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
Issuance and renewal will start immediately, and run continually.
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>3. Test for Success</summary>
|
|
||||||
|
|
||||||
The `store` callbacks will be called every any of your certificates
|
|
||||||
are renewed.
|
|
||||||
|
|
||||||
However, you can do a quick one-off check with `get`.
|
|
||||||
|
|
||||||
It will return a certificate immediately (if available),
|
|
||||||
or wait for the renewal to complete (or for it to fail again).
|
|
||||||
|
|
||||||
```js
|
|
||||||
greenlock
|
|
||||||
.get({ servername: subject })
|
|
||||||
.then(function(pems) {
|
|
||||||
if (pems && pems.privkey && pems.cert && pems.chain) {
|
|
||||||
console.info('Success');
|
|
||||||
}
|
|
||||||
//console.log(pems);
|
|
||||||
})
|
|
||||||
.catch(function(e) {
|
|
||||||
console.error('Big bad error:', e.code);
|
|
||||||
console.error(e);
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
# JavaScript API
|
|
||||||
|
|
||||||
<!--
|
|
||||||
<details>
|
|
||||||
<summary>Greenlock API (shared among JS implementations)</summary>
|
|
||||||
-->
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Greenlock.create({ configDir, packageAgent, maintainerEmail, staging })</summary>
|
|
||||||
|
|
||||||
## Greenlock.create()
|
|
||||||
|
|
||||||
Creates an instance of greenlock with _environment_-level values.
|
|
||||||
|
|
||||||
```js
|
|
||||||
|
|
||||||
var pkg = require('./package.json');
|
|
||||||
var gl = Greenlock.create({
|
|
||||||
configDir: './greenlock.d/',
|
|
||||||
|
|
||||||
// Staging for testing environments
|
|
||||||
staging: true,
|
|
||||||
|
|
||||||
// This should be the contact who receives critical bug and security notifications
|
|
||||||
// Optionally, you may receive other (very few) updates, such as important new features
|
|
||||||
maintainerEmail: 'jon@example.com',
|
|
||||||
|
|
||||||
// for an RFC 8555 / RFC 7231 ACME client user agent
|
|
||||||
packageAgent: pkg.name + '/' pkg.version
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
| Parameter | Description |
|
|
||||||
| --------------- | ------------------------------------------------------------------------------------ |
|
|
||||||
| configDir | the directory to use for file-based plugins |
|
|
||||||
| maintainerEmail | the developer contact for critical bug and security notifications |
|
|
||||||
| packageAgent | if you publish your package for others to use, `require('./package.json').name` here |
|
|
||||||
| staging | use the Let's Encrypt staging URL instead of the production URL |
|
|
||||||
| directoryUrl | for use with other (not Let's Encrypt) ACME services, and the Pebble test server |
|
|
||||||
|
|
||||||
<!--
|
|
||||||
| maintainerUpdates | (default: false) receive occasional non-critical notifications |
|
|
||||||
maintainerUpdates: true // default: false
|
|
||||||
-->
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Greenlock#manager.defaults()</summary>
|
|
||||||
|
|
||||||
## Greenlock#manager.defaults()
|
|
||||||
|
|
||||||
Acts as a getter when given no arguments.
|
|
||||||
|
|
||||||
Otherwise sets default, site-wide values as described below.
|
|
||||||
|
|
||||||
```js
|
|
||||||
greenlock.manager.defaults({
|
|
||||||
// The "Let's Encrypt Subscriber" (often the same as the maintainer)
|
|
||||||
// NOT the end customer (except where that is also the maintainer)
|
|
||||||
subscriberEmail: 'jon@example.com',
|
|
||||||
agreeToTerms: true
|
|
||||||
challenges: {
|
|
||||||
"http-01": {
|
|
||||||
module: "acme-http-01-webroot",
|
|
||||||
webroot: "/path/to/webroot"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
| Parameter | Description |
|
|
||||||
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| agreeToTerms | (default: false) either 'true' or a function that presents the Terms of Service and returns it once accepted |
|
|
||||||
| challenges['http-01'] | provide an http-01 challenge module |
|
|
||||||
| challenges['dns-01'] | provide a dns-01 challenge module |
|
|
||||||
| challenges['tls-alpn-01'] | provide a tls-alpn-01 challenge module |
|
|
||||||
| challenges[type].module | the name of your challenge module |
|
|
||||||
| challenges[type].xxxx | module-specific options |
|
|
||||||
| renewOffset | **leave the default** Other than for testing, leave this at the default of 45 days before expiration date (`'-45d'`) . Can also be set like `5w`, meaning 5 weeks after issue date |
|
|
||||||
| servername | the default servername to use for non-sni requests (many IoT clients) |
|
|
||||||
| subscriberEmail | the contact who agrees to the Let's Encrypt Subscriber Agreement and the Greenlock Terms of Service<br>this contact receives renewal failure notifications |
|
|
||||||
| store | override the default storage module |
|
|
||||||
| store.module | the name of your storage module |
|
|
||||||
| store.xxxx | options specific to your storage module |
|
|
||||||
|
|
||||||
<!--
|
|
||||||
|
|
||||||
| serverId | an arbitrary name to distinguish this server within a cluster of servers |
|
|
||||||
|
|
||||||
-->
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Greenlock#add({ subject, altnames })</summary>
|
|
||||||
|
|
||||||
## Greenlock#add()
|
|
||||||
|
|
||||||
Greenlock is a **Automated Certificate Management Environment**.
|
|
||||||
|
|
||||||
Once you add a "site", it will begin to automatically renew, immediately.
|
|
||||||
|
|
||||||
The certificates will provided to the `store` callbacks as soon as they are ready, and whenever they renew.
|
|
||||||
Failure to renew will be reported to the `notify` callback.
|
|
||||||
|
|
||||||
You can also retrieve them one-off with `get`.
|
|
||||||
|
|
||||||
```js
|
|
||||||
gl.add({
|
|
||||||
subject: 'example.com',
|
|
||||||
altnames: ['example.com', 'www.example.com', 'exampleapi.com']
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
| Parameter | Description |
|
|
||||||
| --------------- | -------------------------------------------------------------------------------------------- |
|
|
||||||
| subject | the first domain on, and identifier of the certificate |
|
|
||||||
| altnames | first domain, plus additional domains<br>note: the order should always be the same |
|
|
||||||
| subscriberEmail | if different from the default (i.e. multi-tenant, whitelabel) |
|
|
||||||
| challenges | (same as main config) use if this site needs to use non-default http-01 or dns-01 validation |
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Greenlock#get({ servername })</summary>
|
|
||||||
|
|
||||||
## Greenlock#get()
|
|
||||||
|
|
||||||
**Disclaimer**: This is only intended for testing, demos, and SNICallback
|
|
||||||
(in [Greenlock Express](https://git.rootprojects.org/root/greenlock-express.js)).
|
|
||||||
|
|
||||||
Greenlock is intended to be left running to allow it to fetech and renew certifictates automatically.
|
|
||||||
|
|
||||||
It is intended that you use the `store` callbacks to new certificates instantly as soon as they renew.
|
|
||||||
This also protects you from accidentally stampeding the Let's Encrypt API with hundreds (or thousands)
|
|
||||||
of certificate requests.
|
|
||||||
|
|
||||||
- [Store Callback Documentation](https://git.rootprojects.org/root/greenlock-store-test.js)
|
|
||||||
|
|
||||||
```js
|
|
||||||
return greenlock.get({ servername }).then(function(site) {
|
|
||||||
if (!site) {
|
|
||||||
console.log(servername + ' was not found in any site config');
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
var privkey = site.pems.privkey;
|
|
||||||
var fullchain = site.pems.cert + '\n' + site.pems.chain + '\n';
|
|
||||||
console.log(privkey);
|
|
||||||
console.log(fullchain);
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
| Parameter | Description |
|
|
||||||
| ---------- | ------------------------------------------------------------- |
|
|
||||||
| servername | any altname listed on the certificate (including the subject) |
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Greenlock#renew({ renewBefore })</summary>
|
|
||||||
|
|
||||||
## Greenlock#renew()
|
|
||||||
|
|
||||||
This will renew only domains that have reached their `renewAt` or are within the befault `renewOffset`.
|
|
||||||
|
|
||||||
**Note**: This runs at regular intervals, multiple times a day, in the background.
|
|
||||||
You are not required to call it. If you implement the `store` callbacks, the certificates
|
|
||||||
will automatically be saved (and if you don't implement them, they all get saved to disk).
|
|
||||||
|
|
||||||
```js
|
|
||||||
return greenlock.renew({}).then(function(results) {
|
|
||||||
results.forEach(function(site) {
|
|
||||||
if (site.error) {
|
|
||||||
console.error(site.subject, site.error);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
console.log('Renewed certificate for', site.subject, site.altnames);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
| Parameter | Type | Description |
|
|
||||||
| ----------- | ---- | ------------------------------------------------------------------------------- |
|
|
||||||
| (optional) | | ALL parameters are optional, but some should be paired |
|
|
||||||
| force | bool | force silly options, such as tiny durations |
|
|
||||||
| renewBefore | ms | Check domains that are scheduled to renew before the given date in milliseconds |
|
|
||||||
|
|
||||||
<!--
|
|
||||||
| issuedBefore | ms | Check domains issued before the given date in milliseconds |
|
|
||||||
| expiresBefore | ms | Check domains that expire before the given date in milliseconds |
|
|
||||||
-->
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Greenlock#remove({ subject })</summary>
|
|
||||||
|
|
||||||
## Greenlock#manager.remove()
|
|
||||||
|
|
||||||
To stop certificates from being renewed, you must remove them.
|
|
||||||
|
|
||||||
If you are implementing your own `manager` callbacks, I recommend that you mark them as deleted
|
|
||||||
(i.e. `deleted_at` in your database) rather than actually removing them. Just in case.
|
|
||||||
|
|
||||||
```js
|
|
||||||
gl.remove({
|
|
||||||
subject: 'example.com'
|
|
||||||
}).then(function(siteConfig) {
|
|
||||||
// save the old site config elsewhere, just in case you need it again
|
|
||||||
});
|
|
||||||
```
|
|
||||||
|
|
||||||
| Parameter | Description |
|
|
||||||
| --------- | ------------------------------------------------------ |
|
|
||||||
| subject | the first domain on, and identifier of the certificate |
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Events</summary>
|
|
||||||
|
|
||||||
Most of the events bubble from ACME.js.
|
|
||||||
|
|
||||||
See https://git.rootprojects.org/root/acme.js#api-overview
|
|
||||||
|
|
||||||
_TODO_: document the greenlock-specific events.
|
|
||||||
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<!--
|
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Node.js</summary>
|
|
||||||
-->
|
|
||||||
|
|
||||||
# Install
|
|
||||||
|
|
||||||
Greenlock comes with reasonable defaults but when you install it,
|
|
||||||
you should also install any plugins that you need.
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
npm install --save @root/greenlock@v4
|
npm install --save letsencrypt
|
||||||
npm install --save @greenlock/manager
|
|
||||||
npm install --save greenlock-store-fs
|
|
||||||
npm install --save acme-http-01-standalone
|
|
||||||
```
|
```
|
||||||
|
|
||||||
<!--
|
Usage
|
||||||
|
=====
|
||||||
|
|
||||||
TODO
|
### letsencrypt
|
||||||
|
|
||||||
</details>
|
There are **NO DEFAULTS**.
|
||||||
|
|
||||||
<details>
|
A number of **constants** (such as LE.stagingServerUrl and LE.configDir)
|
||||||
<summary>Express.js</summary>
|
are exported for your convenience, but all required options must be specified by the library invoking the call.
|
||||||
|
|
||||||
```js
|
Open an issue if you need a variable for something that isn't there yet.
|
||||||
'use strict';
|
|
||||||
|
|
||||||
var Greenlock = require(@root/greenlock-express);
|
```javascript
|
||||||
|
var LE = require('letsencrypt');
|
||||||
|
|
||||||
var greenlock = Greenlock.create({
|
|
||||||
// for security and critical bug notices
|
|
||||||
maintainerEmail: 'jon@example.com'
|
|
||||||
|
|
||||||
// for
|
var config = {
|
||||||
maintainerNewsletter: true
|
server: LE.stagingServerUrl // or LE.productionServerUrl
|
||||||
|
|
||||||
|
, configDir: require('homedir')() + '/letsencrypt/etc' // or /etc/letsencrypt or wherever
|
||||||
|
|
||||||
|
, privkeyPath: ':config/live/:hostname/privkey.pem' //
|
||||||
|
, fullchainPath: ':config/live/:hostname/fullchain.pem' // Note: both that :config and :hostname
|
||||||
|
, certPath: ':config/live/:hostname/cert.pem' // will be templated as expected
|
||||||
|
, chainPath: ':config/live/:hostname/chain.pem' //
|
||||||
|
|
||||||
|
, debug: false
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
var handlers = {
|
||||||
|
setChallenge: function (opts, hostname, key, val, cb) {} // called during the ACME server handshake, before validation
|
||||||
|
, removeChallenge: function (opts, hostname, key, cb) {} // called after validation on both success and failure
|
||||||
|
, getChallenge: function (opts, hostname, key, cb) {} // this is special because it is called by the webserver
|
||||||
|
// (see letsencrypt-cli/bin & letsencrypt-express/standalone),
|
||||||
|
// not by the library itself
|
||||||
|
|
||||||
|
, agreeToTerms: function (tosUrl, cb) {} // gives you an async way to expose the legal agreement
|
||||||
|
// (terms of use) to your users before accepting
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
var le = LE.create(config, handlers);
|
||||||
|
|
||||||
|
// checks :conf/renewal/:hostname.conf
|
||||||
|
le.register({ // and either renews or registers
|
||||||
|
|
||||||
|
domains: ['example.com'] // CHANGE TO YOUR DOMAIN
|
||||||
|
, email: 'user@email.com' // CHANGE TO YOUR EMAIL
|
||||||
|
, agreeTos: false // set to true to automatically accept an agreement
|
||||||
|
// which you have pre-approved (not recommended)
|
||||||
|
}, function (err) {
|
||||||
|
|
||||||
|
if (err) {
|
||||||
|
// Note: you must have a webserver running
|
||||||
|
// and expose handlers.getChallenge to it
|
||||||
|
// in order to pass validation
|
||||||
|
// See letsencrypt-cli and or letsencrypt-express
|
||||||
|
console.error('[Error]: node-letsencrypt/examples/standalone');
|
||||||
|
console.error(err.stack);
|
||||||
|
} else {
|
||||||
|
console.log('success');
|
||||||
|
}
|
||||||
});
|
});
|
||||||
```
|
```
|
||||||
|
|
||||||
</details>
|
**However**, due to the nature of what this library does, it has a few more "moving parts"
|
||||||
|
than what makes sense to show in a minimal snippet.
|
||||||
|
|
||||||
<details>
|
API
|
||||||
<summary>WebPack</summary>
|
===
|
||||||
TODO
|
|
||||||
</details>
|
|
||||||
|
|
||||||
<details>
|
```javascript
|
||||||
<summary>VanillaJS for Browsers</summary>
|
LetsEncrypt.create(leConfig, handlers, backend) // wraps a given "backend" (the python or node client)
|
||||||
TODO
|
LetsEncrypt.stagingServer // string of staging server for testing
|
||||||
</details>
|
|
||||||
|
|
||||||
-->
|
le.middleware() // middleware for serving webrootPath to /.well-known/acme-challenge
|
||||||
|
le.sniCallback(hostname, function (err, tlsContext) {}) // uses fetch (below) and formats for https.SNICallback
|
||||||
|
le.register({ domains, email, agreeTos, ... }, cb) // registers or renews certs for a domain
|
||||||
|
le.fetch({domains, email, agreeTos, ... }, cb) // fetches certs from in-memory cache, occasionally refreshes from disk
|
||||||
|
le.validate(domains, cb) // do some sanity checks before attempting to register
|
||||||
|
le.registrationFailureCallback(err, args, certInfo, cb) // called when registration fails (not implemented yet)
|
||||||
|
```
|
||||||
|
|
||||||
# Easy to Customize
|
### `LetsEncrypt.create(backend, leConfig, handlers)`
|
||||||
|
|
||||||
<!-- greenlock-manager-test => greenlock-manager-custom -->
|
#### leConfig
|
||||||
|
|
||||||
<!--
|
The arguments passed here (typically `webpathRoot`, `configDir`, etc) will be merged with
|
||||||
- [greenlock.js/examples/](https://git.rootprojects.org/root/greenlock.js/src/branch/master/examples)
|
any `args` (typically `domains`, `email`, and `agreeTos`) and passed to the backend whenever
|
||||||
-->
|
it is called.
|
||||||
|
|
||||||
<details>
|
Typically the backend wrapper will already merge any necessary backend-specific arguments.
|
||||||
<summary>SSL Cert & Domain Management</summary>
|
|
||||||
|
|
||||||
## SSL Certificate & Domain Management
|
**Example**:
|
||||||
|
```javascript
|
||||||
|
{ webrootPath: __dirname, '/acme-challenge'
|
||||||
|
, fullchainTpl: '/live/:hostname/fullchain.pem'
|
||||||
|
, privkeyTpl: '/live/:hostname/fullchain.pem'
|
||||||
|
, configDir: '/etc/letsencrypt'
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
Full Docs: https://git.rootprojects.org/root/greenlock-manager-test.js
|
Note: `webrootPath` can be set as a default, semi-locally with `webrootPathTpl`, or per
|
||||||
|
registration as `webrootPath` (which overwrites `leConfig.webrootPath`).
|
||||||
|
|
||||||
This is what keeps the mapping of domains <-> certificates.
|
#### handlers *optional*
|
||||||
In many cases it will interact with the same database as the Key & Cert Store, and probably the code as well.
|
|
||||||
|
|
||||||
- set({ subject, altnames, renewAt })
|
`h.setChallenge(hostnames, name, value, cb)`:
|
||||||
- find({ servernames, renewBefore })
|
|
||||||
```js
|
|
||||||
// should return a list of site configs:
|
|
||||||
[
|
|
||||||
{
|
|
||||||
subject: 'example.com',
|
|
||||||
altnames: ['example.com', 'exampleapi.com'],
|
|
||||||
renewAt: 1575197231760
|
|
||||||
},
|
|
||||||
{
|
|
||||||
subject: '*.example.com',
|
|
||||||
altnames: ['*.example.com'],
|
|
||||||
renewAt: 1575197231760,
|
|
||||||
challenges: {
|
|
||||||
'dns-01': {
|
|
||||||
module: 'acme-dns-01-dnsimple',
|
|
||||||
apikey: 'xxxx'
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
];
|
|
||||||
```
|
|
||||||
- remove({ subject })
|
|
||||||
- defaults() (both getter and setter)
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"subscriberEmail": "jane@example.com",
|
|
||||||
"agreeToTerms": true,
|
|
||||||
"challenges": {
|
|
||||||
"http-01": {
|
|
||||||
"module": "acme-http-01-standalone"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
</details>
|
default is to write to fs
|
||||||
|
|
||||||
<details>
|
`h.getChallenge(hostnames, value cb)`
|
||||||
<summary>Key & Cert Storage</summary>
|
|
||||||
|
|
||||||
## Key and Certificate Store
|
default is to read from fs
|
||||||
|
|
||||||
Full Docs: https://git.rootprojects.org/root/greenlock-store-test.js
|
`h.sniRegisterCallback(args, currentCerts, cb)`
|
||||||
|
|
||||||
This set of callbacks update your service with new certificates and keypairs.
|
The default is to immediately call `cb(null, null)` and register (or renew) in the background
|
||||||
|
during the `SNICallback` phase. Right now it isn't reasonable to renew during SNICallback,
|
||||||
|
but around February when it is possible to use ECDSA keys (as opposed to RSA at present),
|
||||||
|
registration will take very little time.
|
||||||
|
|
||||||
### Account Keys (JWK)
|
This will not be called while another registration is already in progress.
|
||||||
|
|
||||||
(though typically you only have one account key - because you only have one subscriber email)
|
**SECURITY WARNING**: If you use this option with a custom `h.validate()`, make sure that `args.domains`
|
||||||
|
refers to domains you expect, otherwise an attacker will spoof SNI and cause your server to rate-limit
|
||||||
|
letsencrypt.org and get blocked. Note that `le.validate()` will check A records before attempting to
|
||||||
|
register to help prevent such possible attacks.
|
||||||
|
|
||||||
- accounts.setKeypair({ email, keypair })
|
`h.validate(domains, cb)`
|
||||||
- accounts.checkKeypair({ email })
|
|
||||||
|
|
||||||
### Certificate Keys (JWK + PEM)
|
When specified this will override `le.validate()`. You will need to do this if the ip address of this
|
||||||
|
server is not one specified in the A records for your domain.
|
||||||
|
|
||||||
(typically you have one for each set of domains, and each load balancer)
|
### `le.middleware()`
|
||||||
|
|
||||||
- certificates.setKeypair({ subject, keypair })
|
An express handler for `/.well-known/acme-challenge/<challenge>`.
|
||||||
- certificates.checkKeypair({ subject })
|
Will call `getChallenge([hostname], key, cb)` if present or otherwise read `challenge` from disk.
|
||||||
(these are fine to implement the same as above, swapping subject/email)
|
|
||||||
|
|
||||||
### Certificate PEMs
|
Example:
|
||||||
|
```javascript
|
||||||
|
app.use('/', le.middleware())
|
||||||
|
```
|
||||||
|
|
||||||
- certificates.set({ subject, pems })
|
### `le.sniCallback(hostname, function (err, tlsContext) {});`
|
||||||
- certificates.check({ subject })
|
|
||||||
|
|
||||||
</details>
|
Will call `fetch`. If fetch does not return certificates or returns expired certificates
|
||||||
|
it will call `sniRegisterCallback(args, currentCerts, cb)` and then return the error,
|
||||||
|
the new certificates, or call `fetch` a final time.
|
||||||
|
|
||||||
<details>
|
Example:
|
||||||
<summary>ACME HTTP-01 Challenges</summary>
|
```javascript
|
||||||
|
var server = require('https').createServer({ SNICallback: le.sniCallback, cert: '...', key: '...' });
|
||||||
|
server.on('request', app);
|
||||||
|
```
|
||||||
|
|
||||||
## ACME Challenge HTTP-01 Strategies
|
### `le.register({ domains, email, agreeTos, ... }, cb)`
|
||||||
|
|
||||||
Full Docs: https://git.rootprojects.org/root/acme-http-01-test.js
|
Get certificates for a domain
|
||||||
|
|
||||||
This validation and authorization strategy is done over plain HTTP on Port 80.
|
Example:
|
||||||
|
```javascript
|
||||||
|
le.register({
|
||||||
|
domains: ['example.com', 'www.example.com']
|
||||||
|
, email: 'user@example.com'
|
||||||
|
, webrootPath: '/srv/www/example.com/public'
|
||||||
|
, agreeTos: true
|
||||||
|
}, function (err, certs) {
|
||||||
|
// err is some error
|
||||||
|
|
||||||
These are used to set files containing tokens that Let's Encrypt will fetch from each domain
|
console.log(certs);
|
||||||
before authorizing a certificate.
|
/*
|
||||||
|
{ cert: "contents of fullchain.pem"
|
||||||
|
, key: "contents of privkey.pem"
|
||||||
|
, renewedAt: <date in milliseconds>
|
||||||
|
, duration: <duration in milliseconds (90-days)>
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
});
|
||||||
|
```
|
||||||
|
|
||||||
**NOT for Wildcards**.
|
### `le.isValidDomain(hostname)`
|
||||||
|
|
||||||
- init({ request })
|
returns `true` if `hostname` is a valid ascii or punycode domain name.
|
||||||
- set({ challenge: { type, token, keyAuthorization, challengeUrl } })
|
|
||||||
- get({ challenge: { type, token } })
|
|
||||||
- remove({ challenge: { type, token } })
|
|
||||||
|
|
||||||
<!--
|
(also exposed on the main exported module as `LetsEncrypt.isValidDomain()`)
|
||||||
TODO: getAcmeHttp01Challenge
|
|
||||||
-->
|
|
||||||
|
|
||||||
</details>
|
### `le.validate(args, cb)`
|
||||||
|
|
||||||
<details>
|
Used internally, but exposed for convenience. Checks `LetsEncrypt.isValidDomain()`
|
||||||
<summary>ACME DNS-01 Challenges</summary>
|
and then checks to see that the current server
|
||||||
|
|
||||||
## ACME Challenge DNS-01 Strategies
|
Called before `backend.register()` to validate the following:
|
||||||
|
|
||||||
Full Docs https://git.rootprojects.org/root/acme-dns-01-test.js
|
* the hostnames don't use any illegal characters
|
||||||
|
* the server's actual public ip (via api.apiify.org)
|
||||||
|
* the A records for said hostnames
|
||||||
|
|
||||||
This validation and authorization strategy is done over DNS on UDP and TCP ports 53.
|
### `le.fetch(args, cb)`
|
||||||
|
|
||||||
**For Wildcards**
|
Used internally, but exposed for convenience.
|
||||||
|
|
||||||
These are used to set TXT records containing tokens that Let's Encrypt will fetch for
|
Checks in-memory cache of certificates for `args.domains` and calls then calls `backend.fetch(args, cb)`
|
||||||
each domain before authorizing a certificate.
|
**after** merging `args` if necessary.
|
||||||
|
|
||||||
- init({ request })
|
### `le.registrationFailureCallback(err, args, certInfo, cb)`
|
||||||
- zones()
|
|
||||||
- set({ challenge: { type, dnsZone, dnsPrefix, dnsHost, keyAuthorizationDigest } })
|
|
||||||
- get({ challenge: { type, dnsZone, dnsPrefix, dnsHost } })
|
|
||||||
- remove({ challenge: { type, dnsZone, dnsPrefix, dnsHost } })
|
|
||||||
|
|
||||||
</details>
|
Not yet implemented
|
||||||
|
|
||||||
<details>
|
|
||||||
<summary>Notes on HTTP-01 & DNS-01 Integrations</summary>
|
|
||||||
|
|
||||||
## Notes on HTTP-01 & DNS-01 Integrations
|
This is what `args` looks like:
|
||||||
|
|
||||||
For Public Web Servers running on a VPS, the **default HTTP-01 challenge plugin**
|
```javascript
|
||||||
will work just fine, for most people.
|
{ domains: ['example.com', 'www.example.com']
|
||||||
|
, email: 'user@email.com'
|
||||||
|
, agreeTos: true
|
||||||
|
, configDir: '/etc/letsencrypt'
|
||||||
|
, fullchainTpl: '/live/:hostname/fullchain.pem' // :hostname will be replaced with the domainname
|
||||||
|
, privkeyTpl: '/live/:hostname/privkey.pem'
|
||||||
|
, webrootPathTpl: '/srv/www/:hostname/public'
|
||||||
|
, webrootPath: '/srv/www/example.com/public' // templated from webrootPathTpl
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
However, for environments that cannot be verified via public HTTP, such as
|
This is what the implementation should look like:
|
||||||
|
|
||||||
- **Wildcard Certificates**
|
(it's expected that the client will follow the same conventions as
|
||||||
- **IoT Environments**
|
the python client, but it's not necessary)
|
||||||
- **Enterprise On-Prem**
|
|
||||||
- **Private Networks**
|
|
||||||
|
|
||||||
Greenlock provides an easy way to integrate Let's Encrypt with your existing services
|
Change History
|
||||||
through a variety of **DNS-01** challenges.
|
==============
|
||||||
|
|
||||||
### Why not use dns01 for everything?
|
* v1.5.0 now using letiny-core v2.0.0 and rsa-compat
|
||||||
|
* v1.4.x I can't remember... but it's better!
|
||||||
|
* v1.1.0 Added letiny-core, removed node-letsencrypt-python
|
||||||
|
* v1.0.2 Works with node-letsencrypt-python
|
||||||
|
* v1.0.0 Thar be dragons
|
||||||
|
|
||||||
Typically file propagation is faster and more reliably than DNS propagation.
|
LICENSE
|
||||||
Therefore, http-01 will be preferred to dns-01 except when wildcards or **private domains** are in use.
|
=======
|
||||||
|
|
||||||
http-01 will only be supplied as a defaut if no other challenge is provided.
|
Dual-licensed MIT and Apache-2.0
|
||||||
|
|
||||||
</details>
|
See LICENSE
|
||||||
|
|
||||||
# Ready-made Integrations
|
|
||||||
|
|
||||||
Greenlock Express integrates between Let's Encrypt's ACME Challenges and many popular services.
|
|
||||||
|
|
||||||
| Type | Service | Plugin |
|
|
||||||
| ----------- | ----------------------------------------------------------------------------------- | ------------------------ |
|
|
||||||
| dns-01 | CloudFlare | acme-dns-01-cloudflare |
|
|
||||||
| dns-01 | [Digital Ocean](https://git.rootprojects.org/root/acme-dns-01-digitalocean.js) | acme-dns-01-digitalocean |
|
|
||||||
| dns-01 | [DNSimple](https://git.rootprojects.org/root/acme-dns-01-dnsimple.js) | acme-dns-01-dnsimple |
|
|
||||||
| dns-01 | [DuckDNS](https://git.rootprojects.org/root/acme-dns-01-duckdns.js) | acme-dns-01-duckdns |
|
|
||||||
| http-01 | File System / [Web Root](https://git.rootprojects.org/root/acme-http-01-webroot.js) | acme-http-01-webroot |
|
|
||||||
| dns-01 | [GoDaddy](https://git.rootprojects.org/root/acme-dns-01-godaddy.js) | acme-dns-01-godaddy |
|
|
||||||
| dns-01 | [Gandi](https://git.rootprojects.org/root/acme-dns-01-gandi.js) | acme-dns-01-gandi |
|
|
||||||
| dns-01 | [NameCheap](https://git.rootprojects.org/root/acme-dns-01-namecheap.js) | acme-dns-01-namecheap |
|
|
||||||
| dns-01 | [Name.com](https://git.rootprojects.org/root/acme-dns-01-namedotcom.js) | acme-dns-01-namedotcom |
|
|
||||||
| dns-01 | Route53 (AWS) | acme-dns-01-route53 |
|
|
||||||
| http-01 | S3 (AWS, Digital Ocean, Scaleway) | acme-http-01-s3 |
|
|
||||||
| dns-01 | [Vultr](https://git.rootprojects.org/root/acme-dns-01-vultr.js) | acme-dns-01-vultr |
|
|
||||||
| dns-01 | [Build your own](https://git.rootprojects.org/root/acme-dns-01-test.js) | acme-dns-01-test |
|
|
||||||
| http-01 | [Build your own](https://git.rootprojects.org/root/acme-http-01-test.js) | acme-http-01-test |
|
|
||||||
| tls-alpn-01 | [Contact us](mailto:support@therootcompany.com) | - |
|
|
||||||
|
|
||||||
Search `acme-http-01-` or `acme-dns-01-` on npm to find more.
|
|
||||||
|
|
||||||
# Commercial Support
|
|
||||||
|
|
||||||
Do you need...
|
|
||||||
|
|
||||||
- training?
|
|
||||||
- specific features?
|
|
||||||
- different integrations?
|
|
||||||
- bugfixes, on _your_ timeline?
|
|
||||||
- custom code, built by experts?
|
|
||||||
- commercial support and licensing?
|
|
||||||
|
|
||||||
You're welcome to [contact us](mailto:aj@therootcompany.com) in regards to IoT, On-Prem,
|
|
||||||
Enterprise, and Internal installations, integrations, and deployments.
|
|
||||||
|
|
||||||
We have both commercial support and commercial licensing available.
|
|
||||||
|
|
||||||
We also offer consulting for all-things-ACME and Let's Encrypt.
|
|
||||||
|
|
||||||
# Legal & Rules of the Road
|
|
||||||
|
|
||||||
Greenlock™ is a [trademark](https://rootprojects.org/legal/#trademark) of AJ ONeal
|
|
||||||
|
|
||||||
The rule of thumb is "attribute, but don't confuse". For example:
|
|
||||||
|
|
||||||
> Built with [Greenlock Express](https://git.rootprojects.org/root/greenlock.js) (a [Root](https://rootprojects.org) project).
|
|
||||||
|
|
||||||
Please [contact us](mailto:aj@therootcompany.com) if you have any questions in regards to our trademark,
|
|
||||||
attribution, and/or visible source policies. We want to build great software and a great community.
|
|
||||||
|
|
||||||
[Greenlock™](https://git.rootprojects.org/root/greenlock.js) |
|
|
||||||
MPL-2.0 |
|
|
||||||
[Terms of Use](https://therootcompany.com/legal/#terms) |
|
|
||||||
[Privacy Policy](https://therootcompany.com/legal/#privacy)
|
|
||||||
|
|||||||
219
accounts.js
219
accounts.js
@ -1,219 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var A = module.exports;
|
|
||||||
var U = require('./utils.js');
|
|
||||||
var E = require('./errors.js');
|
|
||||||
|
|
||||||
var pending = {};
|
|
||||||
|
|
||||||
A._getOrCreate = function(gnlck, mconf, db, acme, args) {
|
|
||||||
var email = args.subscriberEmail || mconf.subscriberEmail;
|
|
||||||
|
|
||||||
if (!email) {
|
|
||||||
throw E.NO_SUBSCRIBER('get account', args.subject);
|
|
||||||
}
|
|
||||||
|
|
||||||
// TODO send welcome message with benefit info
|
|
||||||
return U._validMx(email)
|
|
||||||
.catch(function() {
|
|
||||||
throw E.NO_SUBSCRIBER('get account', args.subcriberEmail);
|
|
||||||
})
|
|
||||||
.then(function() {
|
|
||||||
if (pending[email]) {
|
|
||||||
return pending[email];
|
|
||||||
}
|
|
||||||
|
|
||||||
pending[email] = A._rawGetOrCreate(
|
|
||||||
gnlck,
|
|
||||||
mconf,
|
|
||||||
db,
|
|
||||||
acme,
|
|
||||||
args,
|
|
||||||
email
|
|
||||||
)
|
|
||||||
.catch(function(e) {
|
|
||||||
delete pending[email];
|
|
||||||
throw e;
|
|
||||||
})
|
|
||||||
.then(function(result) {
|
|
||||||
delete pending[email];
|
|
||||||
return result;
|
|
||||||
});
|
|
||||||
|
|
||||||
return pending[email];
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
// What we really need out of this is the private key and the ACME "key" id
|
|
||||||
A._rawGetOrCreate = function(gnlck, mconf, db, acme, args, email) {
|
|
||||||
var p;
|
|
||||||
if (db.check) {
|
|
||||||
p = A._checkStore(gnlck, mconf, db, acme, args, email);
|
|
||||||
} else {
|
|
||||||
p = Promise.resolve(null);
|
|
||||||
}
|
|
||||||
|
|
||||||
return p.then(function(fullAccount) {
|
|
||||||
if (!fullAccount) {
|
|
||||||
return A._newAccount(gnlck, mconf, db, acme, args, email, null);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (fullAccount.keypair && fullAccount.key && fullAccount.key.kid) {
|
|
||||||
return fullAccount;
|
|
||||||
}
|
|
||||||
|
|
||||||
return A._newAccount(gnlck, mconf, db, acme, args, email, fullAccount);
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
A._newAccount = function(gnlck, mconf, db, acme, args, email, fullAccount) {
|
|
||||||
var keyType = args.accountKeyType || mconf.accountKeyType;
|
|
||||||
var query = {
|
|
||||||
subject: args.subject,
|
|
||||||
email: email,
|
|
||||||
subscriberEmail: email,
|
|
||||||
customerEmail: args.customerEmail,
|
|
||||||
account: fullAccount || {},
|
|
||||||
directoryUrl:
|
|
||||||
args.directoryUrl ||
|
|
||||||
mconf.directoryUrl ||
|
|
||||||
gnlck._defaults.directoryUrl
|
|
||||||
};
|
|
||||||
|
|
||||||
return U._getOrCreateKeypair(db, args.subject, query, keyType).then(
|
|
||||||
function(kresult) {
|
|
||||||
var keypair = kresult.keypair;
|
|
||||||
var accReg = {
|
|
||||||
subscriberEmail: email,
|
|
||||||
agreeToTerms:
|
|
||||||
args.agreeToTerms ||
|
|
||||||
mconf.agreeToTerms ||
|
|
||||||
gnlck._defaults.agreeToTerms,
|
|
||||||
accountKey: keypair.privateKeyJwk || keypair.private,
|
|
||||||
debug: args.debug
|
|
||||||
};
|
|
||||||
return acme.accounts.create(accReg).then(function(receipt) {
|
|
||||||
var reg = {
|
|
||||||
keypair: keypair,
|
|
||||||
receipt: receipt,
|
|
||||||
// shudder... not actually a KeyID... but so it is called anyway...
|
|
||||||
kid:
|
|
||||||
receipt &&
|
|
||||||
receipt.key &&
|
|
||||||
(receipt.key.kid || receipt.kid),
|
|
||||||
email: args.email,
|
|
||||||
subscriberEmail: email,
|
|
||||||
customerEmail: args.customerEmail
|
|
||||||
};
|
|
||||||
|
|
||||||
var keyP;
|
|
||||||
if (kresult.exists) {
|
|
||||||
keyP = Promise.resolve();
|
|
||||||
} else {
|
|
||||||
query.keypair = keypair;
|
|
||||||
query.receipt = receipt;
|
|
||||||
/*
|
|
||||||
query.server = gnlck._defaults.directoryUrl.replace(
|
|
||||||
/^https?:\/\//i,
|
|
||||||
''
|
|
||||||
);
|
|
||||||
*/
|
|
||||||
keyP = db.setKeypair(query, keypair);
|
|
||||||
}
|
|
||||||
|
|
||||||
return keyP
|
|
||||||
.then(function() {
|
|
||||||
if (!db.set) {
|
|
||||||
return Promise.resolve({
|
|
||||||
keypair: keypair
|
|
||||||
});
|
|
||||||
}
|
|
||||||
return db.set(
|
|
||||||
{
|
|
||||||
// id to be set by Store
|
|
||||||
email: email,
|
|
||||||
subscriberEmail: email,
|
|
||||||
customerEmail: args.customerEmail,
|
|
||||||
agreeTos: true,
|
|
||||||
agreeToTerms: true,
|
|
||||||
directoryUrl:
|
|
||||||
args.directoryUrl ||
|
|
||||||
mconf.directoryUrl ||
|
|
||||||
gnlck._defaults.directoryUrl
|
|
||||||
/*
|
|
||||||
server: gnlck._defaults.directoryUrl.replace(
|
|
||||||
/^https?:\/\//i,
|
|
||||||
''
|
|
||||||
)
|
|
||||||
*/
|
|
||||||
},
|
|
||||||
reg
|
|
||||||
);
|
|
||||||
})
|
|
||||||
.then(function(fullAccount) {
|
|
||||||
if (fullAccount && 'object' !== typeof fullAccount) {
|
|
||||||
throw new Error(
|
|
||||||
"accounts.set should either return 'null' or an object with an 'id' string"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!fullAccount) {
|
|
||||||
fullAccount = {};
|
|
||||||
}
|
|
||||||
fullAccount.keypair = keypair;
|
|
||||||
if (!fullAccount.key) {
|
|
||||||
fullAccount.key = {};
|
|
||||||
}
|
|
||||||
fullAccount.key.kid = reg.kid;
|
|
||||||
|
|
||||||
return fullAccount;
|
|
||||||
});
|
|
||||||
});
|
|
||||||
}
|
|
||||||
);
|
|
||||||
};
|
|
||||||
|
|
||||||
A._checkStore = function(gnlck, mconf, db, acme, args, email) {
|
|
||||||
if ((args.domain || args.domains) && !args.subject) {
|
|
||||||
console.warn("use 'subject' instead of 'domain'");
|
|
||||||
args.subject = args.domain;
|
|
||||||
}
|
|
||||||
|
|
||||||
var account = args.account;
|
|
||||||
if (!account) {
|
|
||||||
account = {};
|
|
||||||
}
|
|
||||||
|
|
||||||
if (args.accountKey) {
|
|
||||||
console.warn(
|
|
||||||
'rather than passing accountKey, put it directly into your account key store'
|
|
||||||
);
|
|
||||||
// TODO we probably don't need this
|
|
||||||
return U._importKeypair(args.accountKey);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!db.check) {
|
|
||||||
return Promise.resolve(null);
|
|
||||||
}
|
|
||||||
|
|
||||||
return db
|
|
||||||
.check({
|
|
||||||
//keypair: undefined,
|
|
||||||
//receipt: undefined,
|
|
||||||
email: email,
|
|
||||||
subscriberEmail: email,
|
|
||||||
customerEmail: args.customerEmail || mconf.customerEmail,
|
|
||||||
account: account,
|
|
||||||
directoryUrl:
|
|
||||||
args.directoryUrl ||
|
|
||||||
mconf.directoryUrl ||
|
|
||||||
gnlck._defaults.directoryUrl
|
|
||||||
})
|
|
||||||
.then(function(fullAccount) {
|
|
||||||
if (!fullAccount) {
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
return fullAccount;
|
|
||||||
});
|
|
||||||
};
|
|
||||||
91
bin/add.js
91
bin/add.js
@ -1,91 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var args = process.argv.slice(3);
|
|
||||||
var cli = require('./lib/cli.js');
|
|
||||||
//var path = require('path');
|
|
||||||
//var pkgpath = path.join(__dirname, '..', 'package.json');
|
|
||||||
//var pkgpath = path.join(process.cwd(), 'package.json');
|
|
||||||
|
|
||||||
var Flags = require('./lib/flags.js');
|
|
||||||
|
|
||||||
Flags.init().then(function({ flagOptions, greenlock, mconf }) {
|
|
||||||
var myFlags = {};
|
|
||||||
[
|
|
||||||
'subject',
|
|
||||||
'altnames',
|
|
||||||
'renew-offset',
|
|
||||||
'subscriber-email',
|
|
||||||
'customer-email',
|
|
||||||
'server-key-type',
|
|
||||||
'challenge-http-01',
|
|
||||||
'challenge-http-01-xxxx',
|
|
||||||
'challenge-dns-01',
|
|
||||||
'challenge-dns-01-xxxx',
|
|
||||||
'challenge-tls-alpn-01',
|
|
||||||
'challenge-tls-alpn-01-xxxx',
|
|
||||||
'challenge',
|
|
||||||
'challenge-xxxx',
|
|
||||||
'challenge-json',
|
|
||||||
'force-save'
|
|
||||||
].forEach(function(k) {
|
|
||||||
myFlags[k] = flagOptions[k];
|
|
||||||
});
|
|
||||||
|
|
||||||
cli.parse(myFlags);
|
|
||||||
cli.main(function(argList, flags) {
|
|
||||||
Flags.mangleFlags(flags, mconf);
|
|
||||||
main(argList, flags, greenlock);
|
|
||||||
}, args);
|
|
||||||
});
|
|
||||||
|
|
||||||
async function main(_, flags, greenlock) {
|
|
||||||
if (!flags.subject || !flags.altnames) {
|
|
||||||
console.error(
|
|
||||||
'--subject and --altnames must be provided and should be valid domains'
|
|
||||||
);
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
greenlock
|
|
||||||
.add(flags)
|
|
||||||
.catch(function(err) {
|
|
||||||
console.error();
|
|
||||||
console.error('error:', err.message);
|
|
||||||
console.error();
|
|
||||||
process.exit(1);
|
|
||||||
})
|
|
||||||
.then(function() {
|
|
||||||
return greenlock
|
|
||||||
._config({
|
|
||||||
servername:
|
|
||||||
flags.altnames[
|
|
||||||
Math.floor(Math.random() * flags.altnames.length)
|
|
||||||
]
|
|
||||||
})
|
|
||||||
.then(function(site) {
|
|
||||||
if (!site) {
|
|
||||||
console.info();
|
|
||||||
console.info(
|
|
||||||
'Internal bug or configuration mismatch: No config found.'
|
|
||||||
);
|
|
||||||
console.info();
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
console.info();
|
|
||||||
Object.keys(site).forEach(function(k) {
|
|
||||||
if ('defaults' === k) {
|
|
||||||
console.info(k + ':');
|
|
||||||
Object.keys(site.defaults).forEach(function(key) {
|
|
||||||
var value = JSON.stringify(site.defaults[key]);
|
|
||||||
console.info('\t' + key + ':' + value);
|
|
||||||
});
|
|
||||||
} else {
|
|
||||||
console.info(k + ': ' + JSON.stringify(site[k]));
|
|
||||||
}
|
|
||||||
});
|
|
||||||
});
|
|
||||||
});
|
|
||||||
}
|
|
||||||
378
bin/certonly.js
378
bin/certonly.js
@ -1,378 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var mkdirp = require('@root/mkdirp');
|
|
||||||
var cli = require('./cli.js');
|
|
||||||
|
|
||||||
cli.parse({
|
|
||||||
'directory-url': [
|
|
||||||
false,
|
|
||||||
' ACME Directory Resource URL',
|
|
||||||
'string',
|
|
||||||
'https://acme-v02.api.letsencrypt.org/directory',
|
|
||||||
'server,acme-url'
|
|
||||||
],
|
|
||||||
email: [
|
|
||||||
false,
|
|
||||||
' Email used for registration and recovery contact. (default: null)',
|
|
||||||
'email'
|
|
||||||
],
|
|
||||||
'agree-tos': [
|
|
||||||
false,
|
|
||||||
" Agree to the Greenlock and Let's Encrypt Subscriber Agreements",
|
|
||||||
'boolean',
|
|
||||||
false
|
|
||||||
],
|
|
||||||
'community-member': [
|
|
||||||
false,
|
|
||||||
' Submit stats to and get updates from Greenlock',
|
|
||||||
'boolean',
|
|
||||||
false
|
|
||||||
],
|
|
||||||
domains: [
|
|
||||||
false,
|
|
||||||
' Domain names to apply. For multiple domains you can enter a comma separated list of domains as a parameter. (default: [])',
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
'renew-offset': [
|
|
||||||
false,
|
|
||||||
' Positive (time after issue) or negative (time before expiry) offset, such as 30d or -45d',
|
|
||||||
'string',
|
|
||||||
'45d'
|
|
||||||
],
|
|
||||||
'renew-within': [
|
|
||||||
false,
|
|
||||||
' (ignored) use renew-offset instead',
|
|
||||||
'ignore',
|
|
||||||
undefined
|
|
||||||
],
|
|
||||||
'cert-path': [
|
|
||||||
false,
|
|
||||||
' Path to where new cert.pem is saved',
|
|
||||||
'string',
|
|
||||||
':configDir/live/:hostname/cert.pem'
|
|
||||||
],
|
|
||||||
'fullchain-path': [
|
|
||||||
false,
|
|
||||||
' Path to where new fullchain.pem (cert + chain) is saved',
|
|
||||||
'string',
|
|
||||||
':configDir/live/:hostname/fullchain.pem'
|
|
||||||
],
|
|
||||||
'bundle-path': [
|
|
||||||
false,
|
|
||||||
' Path to where new bundle.pem (fullchain + privkey) is saved',
|
|
||||||
'string',
|
|
||||||
':configDir/live/:hostname/bundle.pem'
|
|
||||||
],
|
|
||||||
'chain-path': [
|
|
||||||
false,
|
|
||||||
' Path to where new chain.pem is saved',
|
|
||||||
'string',
|
|
||||||
':configDir/live/:hostname/chain.pem'
|
|
||||||
],
|
|
||||||
'privkey-path': [
|
|
||||||
false,
|
|
||||||
' Path to where privkey.pem is saved',
|
|
||||||
'string',
|
|
||||||
':configDir/live/:hostname/privkey.pem'
|
|
||||||
],
|
|
||||||
'config-dir': [
|
|
||||||
false,
|
|
||||||
' Configuration directory.',
|
|
||||||
'string',
|
|
||||||
'~/letsencrypt/etc/'
|
|
||||||
],
|
|
||||||
store: [
|
|
||||||
false,
|
|
||||||
' The name of the storage module to use',
|
|
||||||
'string',
|
|
||||||
'greenlock-store-fs'
|
|
||||||
],
|
|
||||||
'store-xxxx': [
|
|
||||||
false,
|
|
||||||
' An option for the chosen storage module, such as --store-apikey or --store-bucket',
|
|
||||||
'bag'
|
|
||||||
],
|
|
||||||
'store-json': [
|
|
||||||
false,
|
|
||||||
' A JSON string containing all option for the chosen store module (instead of --store-xxxx)',
|
|
||||||
'json',
|
|
||||||
'{}'
|
|
||||||
],
|
|
||||||
challenge: [
|
|
||||||
false,
|
|
||||||
' The name of the HTTP-01, DNS-01, or TLS-ALPN-01 challenge module to use',
|
|
||||||
'string',
|
|
||||||
'@greenlock/acme-http-01-fs'
|
|
||||||
],
|
|
||||||
'challenge-xxxx': [
|
|
||||||
false,
|
|
||||||
' An option for the chosen challenge module, such as --challenge-apikey or --challenge-bucket',
|
|
||||||
'bag'
|
|
||||||
],
|
|
||||||
'challenge-json': [
|
|
||||||
false,
|
|
||||||
' A JSON string containing all option for the chosen challenge module (instead of --challenge-xxxx)',
|
|
||||||
'json',
|
|
||||||
'{}'
|
|
||||||
],
|
|
||||||
'skip-dry-run': [
|
|
||||||
false,
|
|
||||||
' Use with caution (and test with the staging url first). Creates an Order on the ACME server without a self-test.',
|
|
||||||
'boolean'
|
|
||||||
],
|
|
||||||
'skip-challenge-tests': [
|
|
||||||
false,
|
|
||||||
' Use with caution (and with the staging url first). Presents challenges to the ACME server without first testing locally.',
|
|
||||||
'boolean'
|
|
||||||
],
|
|
||||||
'http-01-port': [
|
|
||||||
false,
|
|
||||||
' Required to be 80 for live servers. Do not use. For special test environments only.',
|
|
||||||
'int'
|
|
||||||
],
|
|
||||||
'dns-01': [false, ' Use DNS-01 challange type', 'boolean', false],
|
|
||||||
standalone: [
|
|
||||||
false,
|
|
||||||
' Obtain certs using a "standalone" webserver.',
|
|
||||||
'boolean',
|
|
||||||
false
|
|
||||||
],
|
|
||||||
manual: [
|
|
||||||
false,
|
|
||||||
' Print the token and key to the screen and wait for you to hit enter, giving you time to copy it somewhere before continuing (uses acme-http-01-cli or acme-dns-01-cli)',
|
|
||||||
'boolean',
|
|
||||||
false
|
|
||||||
],
|
|
||||||
debug: [false, ' show traces and logs', 'boolean', false],
|
|
||||||
root: [
|
|
||||||
false,
|
|
||||||
' public_html / webroot path (may use the :hostname template such as /srv/www/:hostname)',
|
|
||||||
'string',
|
|
||||||
undefined,
|
|
||||||
'webroot-path'
|
|
||||||
],
|
|
||||||
|
|
||||||
//
|
|
||||||
// backwards compat
|
|
||||||
//
|
|
||||||
duplicate: [
|
|
||||||
false,
|
|
||||||
' Allow getting a certificate that duplicates an existing one/is an early renewal',
|
|
||||||
'boolean',
|
|
||||||
false
|
|
||||||
],
|
|
||||||
'rsa-key-size': [
|
|
||||||
false,
|
|
||||||
' (ignored) use server-key-type or account-key-type instead',
|
|
||||||
'ignore',
|
|
||||||
2048
|
|
||||||
],
|
|
||||||
'server-key-path': [
|
|
||||||
false,
|
|
||||||
' Path to privkey.pem to use for certificate (default: generate new)',
|
|
||||||
'string',
|
|
||||||
undefined,
|
|
||||||
'domain-key-path'
|
|
||||||
],
|
|
||||||
'server-key-type': [
|
|
||||||
false,
|
|
||||||
" One of 'RSA' (2048), 'RSA-3084', 'RSA-4096', 'ECDSA' (P-256), or 'P-384'. For best compatibility, security, and efficiency use the default (More bits != More security)",
|
|
||||||
'string',
|
|
||||||
'RSA'
|
|
||||||
],
|
|
||||||
'account-key-path': [
|
|
||||||
false,
|
|
||||||
' Path to privkey.pem to use for account (default: generate new)',
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
'account-key-type': [
|
|
||||||
false,
|
|
||||||
" One of 'ECDSA' (P-256), 'P-384', 'RSA', 'RSA-3084', or 'RSA-4096'. Stick with 'ECDSA' (P-256) unless you need 'RSA' (2048) for legacy compatibility. (More bits != More security)",
|
|
||||||
'string',
|
|
||||||
'P-256'
|
|
||||||
],
|
|
||||||
webroot: [false, ' (ignored) for certbot compatibility', 'ignore', false],
|
|
||||||
//, 'standalone-supported-challenges': [ false, " Supported challenges, order preferences are randomly chosen. (default: http-01,tls-alpn-01)", 'string', 'http-01']
|
|
||||||
'work-dir': [
|
|
||||||
false,
|
|
||||||
' for certbot compatibility (ignored)',
|
|
||||||
'string',
|
|
||||||
'~/letsencrypt/var/lib/'
|
|
||||||
],
|
|
||||||
'logs-dir': [
|
|
||||||
false,
|
|
||||||
' for certbot compatibility (ignored)',
|
|
||||||
'string',
|
|
||||||
'~/letsencrypt/var/log/'
|
|
||||||
],
|
|
||||||
'acme-version': [
|
|
||||||
false,
|
|
||||||
' (ignored) ACME is now RFC 8555 and prior drafts are no longer supported',
|
|
||||||
'ignore',
|
|
||||||
'rfc8555'
|
|
||||||
]
|
|
||||||
});
|
|
||||||
|
|
||||||
// ignore certonly and extraneous arguments
|
|
||||||
cli.main(function(_, options) {
|
|
||||||
console.info('');
|
|
||||||
|
|
||||||
[
|
|
||||||
'configDir',
|
|
||||||
'privkeyPath',
|
|
||||||
'certPath',
|
|
||||||
'chainPath',
|
|
||||||
'fullchainPath',
|
|
||||||
'bundlePath'
|
|
||||||
].forEach(function(k) {
|
|
||||||
if (options[k]) {
|
|
||||||
options.storeOpts[k] = options[k];
|
|
||||||
}
|
|
||||||
delete options[k];
|
|
||||||
});
|
|
||||||
|
|
||||||
if (options.workDir) {
|
|
||||||
options.challengeOpts.workDir = options.workDir;
|
|
||||||
delete options.workDir;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (options.debug) {
|
|
||||||
console.debug(options);
|
|
||||||
}
|
|
||||||
|
|
||||||
var args = {};
|
|
||||||
var homedir = require('os').homedir();
|
|
||||||
|
|
||||||
Object.keys(options).forEach(function(key) {
|
|
||||||
var val = options[key];
|
|
||||||
|
|
||||||
if ('string' === typeof val) {
|
|
||||||
val = val.replace(/^~/, homedir);
|
|
||||||
}
|
|
||||||
|
|
||||||
key = key.replace(/\-([a-z0-9A-Z])/g, function(c) {
|
|
||||||
return c[1].toUpperCase();
|
|
||||||
});
|
|
||||||
args[key] = val;
|
|
||||||
});
|
|
||||||
|
|
||||||
Object.keys(args).forEach(function(key) {
|
|
||||||
var val = args[key];
|
|
||||||
|
|
||||||
if ('string' === typeof val) {
|
|
||||||
val = val.replace(/(\:configDir)|(\:config)/, args.configDir);
|
|
||||||
}
|
|
||||||
|
|
||||||
args[key] = val;
|
|
||||||
});
|
|
||||||
|
|
||||||
if (args.domains) {
|
|
||||||
args.domains = args.domains.split(',');
|
|
||||||
}
|
|
||||||
|
|
||||||
if (
|
|
||||||
!(Array.isArray(args.domains) && args.domains.length) ||
|
|
||||||
!args.email ||
|
|
||||||
!args.agreeTos ||
|
|
||||||
(!args.server && !args.directoryUrl)
|
|
||||||
) {
|
|
||||||
console.error('\nUsage:\n\ngreenlock certonly --standalone \\');
|
|
||||||
console.error(
|
|
||||||
'\t--agree-tos --email user@example.com --domains example.com \\'
|
|
||||||
);
|
|
||||||
console.error('\t--config-dir ~/acme/etc \\');
|
|
||||||
console.error('\nSee greenlock --help for more details\n');
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (args.http01Port) {
|
|
||||||
// [@agnat]: Coerce to string. cli returns a number although we request a string.
|
|
||||||
args.http01Port = '' + args.http01Port;
|
|
||||||
args.http01Port = args.http01Port.split(',').map(function(port) {
|
|
||||||
return parseInt(port, 10);
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
function run() {
|
|
||||||
var challenges = {};
|
|
||||||
if (/http.?01/i.test(args.challenge)) {
|
|
||||||
challenges['http-01'] = args.challengeOpts;
|
|
||||||
}
|
|
||||||
if (/dns.?01/i.test(args.challenge)) {
|
|
||||||
challenges['dns-01'] = args.challengeOpts;
|
|
||||||
}
|
|
||||||
if (/alpn.?01/i.test(args.challenge)) {
|
|
||||||
challenges['tls-alpn-01'] = args.challengeOpts;
|
|
||||||
}
|
|
||||||
if (!Object.keys(challenges).length) {
|
|
||||||
throw new Error(
|
|
||||||
"Could not determine the challenge type for '" +
|
|
||||||
args.challengeOpts.module +
|
|
||||||
"'. Expected a name like @you/acme-xxxx-01-foo. Please name the module with http-01, dns-01, or tls-alpn-01."
|
|
||||||
);
|
|
||||||
}
|
|
||||||
args.challengeOpts.module = args.challenge;
|
|
||||||
args.storeOpts.module = args.store;
|
|
||||||
|
|
||||||
console.log('\ngot to the run step');
|
|
||||||
require(args.challenge);
|
|
||||||
require(args.store);
|
|
||||||
|
|
||||||
var greenlock = require('../').create({
|
|
||||||
maintainerEmail: args.maintainerEmail || 'coolaj86@gmail.com',
|
|
||||||
manager: './manager.js',
|
|
||||||
configFile: '~/.config/greenlock/certs.json',
|
|
||||||
challenges: challenges,
|
|
||||||
store: args.storeOpts,
|
|
||||||
renewOffset: args.renewOffset || '30d',
|
|
||||||
renewStagger: '1d'
|
|
||||||
});
|
|
||||||
|
|
||||||
// for long-running processes
|
|
||||||
if (args.renewEvery) {
|
|
||||||
setInterval(function() {
|
|
||||||
greenlock.renew({
|
|
||||||
period: args.renewEvery
|
|
||||||
});
|
|
||||||
}, args.renewEvery);
|
|
||||||
}
|
|
||||||
|
|
||||||
// TODO should greenlock.add simply always include greenlock.renew?
|
|
||||||
// the concern is conflating error events
|
|
||||||
return greenlock
|
|
||||||
.add({
|
|
||||||
subject: args.subject,
|
|
||||||
altnames: args.altnames,
|
|
||||||
subscriberEmail: args.subscriberEmail || args.email
|
|
||||||
})
|
|
||||||
.then(function(changes) {
|
|
||||||
console.info(changes);
|
|
||||||
// renew should always
|
|
||||||
return greenlock
|
|
||||||
.renew({
|
|
||||||
subject: args.subject,
|
|
||||||
force: false
|
|
||||||
})
|
|
||||||
.then(function() {});
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('greenlock-store-fs' !== args.store) {
|
|
||||||
run();
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
// TODO remove mkdirp and let greenlock-store-fs do this?
|
|
||||||
mkdirp(args.storeOpts.configDir, function(err) {
|
|
||||||
if (!err) {
|
|
||||||
run();
|
|
||||||
}
|
|
||||||
|
|
||||||
console.error(
|
|
||||||
"Could not create --config-dir '" + args.configDir + "':",
|
|
||||||
err.code
|
|
||||||
);
|
|
||||||
console.error("Try setting --config-dir '/tmp'");
|
|
||||||
return;
|
|
||||||
});
|
|
||||||
}, process.argv.slice(3));
|
|
||||||
@ -1,96 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var args = process.argv.slice(3);
|
|
||||||
var cli = require('./lib/cli.js');
|
|
||||||
//var path = require('path');
|
|
||||||
//var pkgpath = path.join(__dirname, '..', 'package.json');
|
|
||||||
//var pkgpath = path.join(process.cwd(), 'package.json');
|
|
||||||
|
|
||||||
var Flags = require('./lib/flags.js');
|
|
||||||
|
|
||||||
Flags.init().then(function({ flagOptions, greenlock, mconf }) {
|
|
||||||
var myFlags = {};
|
|
||||||
['all', 'subject', 'servername' /*, 'servernames', 'altnames'*/].forEach(
|
|
||||||
function(k) {
|
|
||||||
myFlags[k] = flagOptions[k];
|
|
||||||
}
|
|
||||||
);
|
|
||||||
|
|
||||||
cli.parse(myFlags);
|
|
||||||
cli.main(function(argList, flags) {
|
|
||||||
Flags.mangleFlags(flags, mconf);
|
|
||||||
main(argList, flags, greenlock);
|
|
||||||
}, args);
|
|
||||||
});
|
|
||||||
|
|
||||||
async function main(_, flags, greenlock) {
|
|
||||||
var servernames = [flags.subject]
|
|
||||||
.concat([flags.servername])
|
|
||||||
//.concat(flags.servernames)
|
|
||||||
//.concat(flags.altnames)
|
|
||||||
.filter(Boolean);
|
|
||||||
delete flags.subject;
|
|
||||||
delete flags.altnames;
|
|
||||||
flags.servernames = servernames;
|
|
||||||
if (!flags.all && flags.servernames.length > 1) {
|
|
||||||
console.error('Error: should specify either --subject OR --servername');
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
} else if (!flags.all && flags.servernames.length !== 1) {
|
|
||||||
console.error('error: missing --servername <example.com>');
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if (!flags.all) {
|
|
||||||
flags.servername = flags.servernames[0];
|
|
||||||
} else if (flags.servername) {
|
|
||||||
console.error(
|
|
||||||
'error: missing cannot have --all and --servername / --subject'
|
|
||||||
);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
delete flags.servernames;
|
|
||||||
|
|
||||||
var getter = function() {
|
|
||||||
return greenlock._config(flags);
|
|
||||||
};
|
|
||||||
if (flags.all) {
|
|
||||||
getter = function() {
|
|
||||||
return greenlock._configAll(flags);
|
|
||||||
};
|
|
||||||
}
|
|
||||||
return getter()
|
|
||||||
.catch(function(err) {
|
|
||||||
console.error();
|
|
||||||
console.error('error:', err.message);
|
|
||||||
//console.log(err.stack);
|
|
||||||
console.error();
|
|
||||||
process.exit(1);
|
|
||||||
})
|
|
||||||
.then(function(sites) {
|
|
||||||
if (!sites) {
|
|
||||||
console.info();
|
|
||||||
if (flags.all) {
|
|
||||||
console.info('No configs found');
|
|
||||||
} else {
|
|
||||||
console.info('No config found for', flags.servername);
|
|
||||||
}
|
|
||||||
console.info();
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if (!Array.isArray(sites)) {
|
|
||||||
sites = [sites];
|
|
||||||
}
|
|
||||||
|
|
||||||
sites.forEach(function(site) {
|
|
||||||
console.info();
|
|
||||||
console.info(
|
|
||||||
'Config for ' +
|
|
||||||
JSON.stringify(flags.servername || site.subject) +
|
|
||||||
':'
|
|
||||||
);
|
|
||||||
console.info(JSON.stringify(site, null, 2));
|
|
||||||
});
|
|
||||||
});
|
|
||||||
}
|
|
||||||
@ -1,62 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var args = process.argv.slice(3);
|
|
||||||
var cli = require('./lib/cli.js');
|
|
||||||
//var path = require('path');
|
|
||||||
//var pkgpath = path.join(__dirname, '..', 'package.json');
|
|
||||||
//var pkgpath = path.join(process.cwd(), 'package.json');
|
|
||||||
|
|
||||||
var Flags = require('./lib/flags.js');
|
|
||||||
|
|
||||||
Flags.init({ forceSave: true }).then(function({
|
|
||||||
flagOptions,
|
|
||||||
greenlock,
|
|
||||||
mconf
|
|
||||||
}) {
|
|
||||||
var myFlags = {};
|
|
||||||
[
|
|
||||||
'agree-to-terms',
|
|
||||||
'account-key-type',
|
|
||||||
'server-key-type',
|
|
||||||
'subscriber-email',
|
|
||||||
'renew-offset',
|
|
||||||
'store',
|
|
||||||
'store-xxxx',
|
|
||||||
'challenge-http-01-xxxx',
|
|
||||||
'challenge-dns-01',
|
|
||||||
'challenge-dns-01-xxxx',
|
|
||||||
'challenge-tls-alpn-01',
|
|
||||||
'challenge-tls-alpn-01-xxxx',
|
|
||||||
'challenge',
|
|
||||||
'challenge-xxxx',
|
|
||||||
'challenge-http-01'
|
|
||||||
].forEach(function(k) {
|
|
||||||
myFlags[k] = flagOptions[k];
|
|
||||||
});
|
|
||||||
|
|
||||||
cli.parse(myFlags);
|
|
||||||
cli.main(function(argList, flags) {
|
|
||||||
Flags.mangleFlags(flags, mconf, null, { forceSave: true });
|
|
||||||
main(argList, flags, greenlock);
|
|
||||||
}, args);
|
|
||||||
});
|
|
||||||
|
|
||||||
async function main(_, flags, greenlock) {
|
|
||||||
greenlock.manager
|
|
||||||
.defaults(flags)
|
|
||||||
.catch(function(err) {
|
|
||||||
console.error();
|
|
||||||
console.error('error:', err.message);
|
|
||||||
//console.log(err.stack);
|
|
||||||
console.error();
|
|
||||||
process.exit(1);
|
|
||||||
})
|
|
||||||
.then(function() {
|
|
||||||
return greenlock.manager.defaults();
|
|
||||||
})
|
|
||||||
.then(function(dconf) {
|
|
||||||
console.info();
|
|
||||||
console.info('Global config');
|
|
||||||
console.info(JSON.stringify(dconf, null, 2));
|
|
||||||
});
|
|
||||||
}
|
|
||||||
@ -1,26 +0,0 @@
|
|||||||
#!/usr/bin/env node
|
|
||||||
'use strict';
|
|
||||||
|
|
||||||
var args = process.argv.slice(2);
|
|
||||||
var arg0 = args[0];
|
|
||||||
//console.log(args);
|
|
||||||
|
|
||||||
var found = [
|
|
||||||
'certonly',
|
|
||||||
'add',
|
|
||||||
'update',
|
|
||||||
'config',
|
|
||||||
'defaults',
|
|
||||||
'remove',
|
|
||||||
'init'
|
|
||||||
].some(function(k) {
|
|
||||||
if (k === arg0) {
|
|
||||||
require('./' + k);
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
if (!found) {
|
|
||||||
console.error(arg0 + ': command not yet implemented');
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
162
bin/init.js
162
bin/init.js
@ -1,162 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var P = require('../plugins.js');
|
|
||||||
var args = process.argv.slice(3);
|
|
||||||
var cli = require('./lib/cli.js');
|
|
||||||
var Greenlock = require('../');
|
|
||||||
|
|
||||||
var Flags = require('./lib/flags.js');
|
|
||||||
|
|
||||||
var flagOptions = Flags.flags();
|
|
||||||
var myFlags = {};
|
|
||||||
[
|
|
||||||
'config-dir',
|
|
||||||
'maintainer-email',
|
|
||||||
'cluster',
|
|
||||||
'manager',
|
|
||||||
'manager-xxxx'
|
|
||||||
].forEach(function(k) {
|
|
||||||
myFlags[k] = flagOptions[k];
|
|
||||||
});
|
|
||||||
|
|
||||||
cli.parse(myFlags);
|
|
||||||
cli.main(async function(argList, flags) {
|
|
||||||
var pkgRoot = process.cwd();
|
|
||||||
var manager = flags.manager;
|
|
||||||
|
|
||||||
if (['fs', 'cloud'].includes(manager)) {
|
|
||||||
manager = '@greenlock/manager';
|
|
||||||
}
|
|
||||||
if (['cloud'].includes(manager)) {
|
|
||||||
flags.managerOpts.cloud = true;
|
|
||||||
}
|
|
||||||
|
|
||||||
flags.manager = flags.managerOpts;
|
|
||||||
delete flags.managerOpts;
|
|
||||||
flags.manager.module = manager;
|
|
||||||
|
|
||||||
try {
|
|
||||||
if ('.' === String(manager)[0]) {
|
|
||||||
manager = require('path').resolve(pkgRoot, manager);
|
|
||||||
}
|
|
||||||
P._loadSync(manager);
|
|
||||||
} catch (e) {
|
|
||||||
try {
|
|
||||||
P._installSync(manager);
|
|
||||||
} catch (e) {
|
|
||||||
console.error(
|
|
||||||
'error:',
|
|
||||||
JSON.stringify(manager),
|
|
||||||
'could not be loaded, and could not be installed.'
|
|
||||||
);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
var greenlock = Greenlock.create({
|
|
||||||
packageRoot: pkgRoot,
|
|
||||||
manager: flags.manager,
|
|
||||||
configDir: flags.configDir,
|
|
||||||
maintainerEmail: flags.maintainerEmail,
|
|
||||||
_mustPackage: true
|
|
||||||
});
|
|
||||||
await greenlock.manager.defaults();
|
|
||||||
|
|
||||||
//writeGreenlockJs(pkgdir, flags);
|
|
||||||
writeServerJs(pkgRoot, flags);
|
|
||||||
writeAppJs(pkgRoot);
|
|
||||||
|
|
||||||
/*
|
|
||||||
rc._bin_mode = true;
|
|
||||||
var Greenlock = require('../');
|
|
||||||
// this is a copy, so it's safe to modify
|
|
||||||
var greenlock = Greenlock.create(rc);
|
|
||||||
var mconf = await greenlock.manager.defaults();
|
|
||||||
var flagOptions = Flags.flags(mconf, myOpts);
|
|
||||||
*/
|
|
||||||
}, args);
|
|
||||||
|
|
||||||
/*
|
|
||||||
function writeGreenlockJs(pkgdir, flags) {
|
|
||||||
var greenlockJs = 'greenlock.js';
|
|
||||||
var fs = require('fs');
|
|
||||||
var path = require('path');
|
|
||||||
var tmpl = fs.readFileSync(
|
|
||||||
path.join(__dirname, 'tmpl/greenlock.tmpl.js'),
|
|
||||||
'utf8'
|
|
||||||
);
|
|
||||||
|
|
||||||
try {
|
|
||||||
fs.accessSync(path.join(pkgdir, greenlockJs));
|
|
||||||
console.warn("[skip] '%s' exists", greenlockJs);
|
|
||||||
return;
|
|
||||||
} catch (e) {
|
|
||||||
// continue
|
|
||||||
}
|
|
||||||
|
|
||||||
if (flags.maintainerEmail) {
|
|
||||||
tmpl = tmpl.replace(
|
|
||||||
/pkg.author/g,
|
|
||||||
JSON.stringify(flags.maintainerEmail)
|
|
||||||
);
|
|
||||||
}
|
|
||||||
fs.writeFileSync(path.join(pkgdir, greenlockJs), tmpl);
|
|
||||||
console.info("created '%s'", greenlockJs);
|
|
||||||
}
|
|
||||||
*/
|
|
||||||
|
|
||||||
function writeServerJs(pkgdir, flags) {
|
|
||||||
var serverJs = 'server.js';
|
|
||||||
var fs = require('fs');
|
|
||||||
var path = require('path');
|
|
||||||
var tmpl;
|
|
||||||
|
|
||||||
try {
|
|
||||||
fs.accessSync(path.join(pkgdir, serverJs));
|
|
||||||
console.warn("[skip] '%s' exists", serverJs);
|
|
||||||
return;
|
|
||||||
} catch (e) {
|
|
||||||
// continue
|
|
||||||
}
|
|
||||||
|
|
||||||
if (flags.cluster) {
|
|
||||||
tmpl = fs.readFileSync(
|
|
||||||
path.join(__dirname, 'tmpl/cluster.tmpl.js'),
|
|
||||||
'utf8'
|
|
||||||
);
|
|
||||||
tmpl = tmpl.replace(/cluster: false/g, 'cluster: true');
|
|
||||||
} else {
|
|
||||||
tmpl = fs.readFileSync(
|
|
||||||
path.join(__dirname, 'tmpl/server.tmpl.js'),
|
|
||||||
'utf8'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (flags.maintainerEmail) {
|
|
||||||
tmpl = tmpl
|
|
||||||
.replace(/pkg.author/g, JSON.stringify(flags.maintainerEmail))
|
|
||||||
.replace(/\/\/maintainerEmail/g, 'maintainerEmail');
|
|
||||||
}
|
|
||||||
|
|
||||||
fs.writeFileSync(path.join(pkgdir, serverJs), tmpl);
|
|
||||||
console.info("created '%s'", serverJs);
|
|
||||||
}
|
|
||||||
|
|
||||||
function writeAppJs(pkgdir) {
|
|
||||||
var appJs = 'app.js';
|
|
||||||
var fs = require('fs');
|
|
||||||
var path = require('path');
|
|
||||||
var tmpl = fs.readFileSync(
|
|
||||||
path.join(__dirname, 'tmpl/app.tmpl.js'),
|
|
||||||
'utf8'
|
|
||||||
);
|
|
||||||
|
|
||||||
try {
|
|
||||||
fs.accessSync(path.join(pkgdir, appJs));
|
|
||||||
console.warn("[skip] '%s' exists", appJs);
|
|
||||||
return;
|
|
||||||
} catch (e) {
|
|
||||||
fs.writeFileSync(path.join(pkgdir, appJs), tmpl);
|
|
||||||
console.info("created '%s'", appJs);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
240
bin/lib/cli.js
240
bin/lib/cli.js
@ -1,240 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var CLI = module.exports;
|
|
||||||
|
|
||||||
var defaultConf;
|
|
||||||
var defaultOpts;
|
|
||||||
var bags = [];
|
|
||||||
|
|
||||||
CLI.parse = function(conf) {
|
|
||||||
var opts = (defaultOpts = {});
|
|
||||||
defaultConf = conf;
|
|
||||||
|
|
||||||
Object.keys(conf).forEach(function(k) {
|
|
||||||
var v = conf[k];
|
|
||||||
if (!v) {
|
|
||||||
console.error(
|
|
||||||
'Developer Error: missing cli flag definition for',
|
|
||||||
JSON.stringify(k)
|
|
||||||
);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
var aliases = v[5];
|
|
||||||
var bag;
|
|
||||||
var bagName;
|
|
||||||
|
|
||||||
// the name of the argument set is now the 0th argument
|
|
||||||
v.unshift(k);
|
|
||||||
// v[0] flagname
|
|
||||||
// v[1] short flagname
|
|
||||||
// v[2] description
|
|
||||||
// v[3] type
|
|
||||||
// v[4] default value
|
|
||||||
// v[5] aliases
|
|
||||||
|
|
||||||
if ('bag' === v[3]) {
|
|
||||||
bag = v[0]; // 'bag-option-xxxx' => '--bag-option-'
|
|
||||||
bag = '--' + bag.replace(/xxx.*/, '');
|
|
||||||
bags.push(bag);
|
|
||||||
|
|
||||||
bagName = toBagName(bag.replace(/^--/, ''));
|
|
||||||
opts[bagName] = {};
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('json' === v[3]) {
|
|
||||||
bagName = toBagName(v[0].replace(/-json$/, '')); // 'bag-option-json' => 'bagOptionOpts'
|
|
||||||
opts[bagName] = {};
|
|
||||||
} else if ('ignore' !== v[3] && 'undefined' !== typeof v[4]) {
|
|
||||||
// set the default values (where 'undefined' is not an allowed value)
|
|
||||||
opts[toCamel(k)] = v[4];
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!aliases) {
|
|
||||||
aliases = [];
|
|
||||||
} else if ('string' === typeof aliases) {
|
|
||||||
aliases = aliases.split(',');
|
|
||||||
}
|
|
||||||
aliases.forEach(function(alias) {
|
|
||||||
if (alias in conf) {
|
|
||||||
throw new Error(
|
|
||||||
"Cannot alias '" +
|
|
||||||
alias +
|
|
||||||
"' from '" +
|
|
||||||
k +
|
|
||||||
"': option already exists"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
conf[alias] = v;
|
|
||||||
});
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
CLI.main = function(cb, args) {
|
|
||||||
var leftovers = [];
|
|
||||||
var conf = defaultConf;
|
|
||||||
var opts = defaultOpts;
|
|
||||||
|
|
||||||
if (!opts) {
|
|
||||||
throw new Error("you didn't call `CLI.parse(configuration)`");
|
|
||||||
}
|
|
||||||
|
|
||||||
// TODO what's the existing API for this?
|
|
||||||
if (!args) {
|
|
||||||
args = process.argv.slice(2);
|
|
||||||
}
|
|
||||||
|
|
||||||
var flag;
|
|
||||||
var cnf;
|
|
||||||
var typ;
|
|
||||||
|
|
||||||
function grab(bag) {
|
|
||||||
var bagName = toBagName(bag);
|
|
||||||
if (bag !== flag.slice(0, bag.length)) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
opts[bagName][toCamel(flag.slice(bag.length))] = args.shift();
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
while (args.length) {
|
|
||||||
// take one off the top
|
|
||||||
flag = args.shift();
|
|
||||||
|
|
||||||
// mind the gap
|
|
||||||
if ('--' === flag) {
|
|
||||||
leftovers = leftovers.concat(args);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
// help!
|
|
||||||
if (
|
|
||||||
'--help' === flag ||
|
|
||||||
'-h' === flag ||
|
|
||||||
'/?' === flag ||
|
|
||||||
'help' === flag
|
|
||||||
) {
|
|
||||||
printHelp(conf);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
// only long names are actually used
|
|
||||||
if ('--' !== flag.slice(0, 2)) {
|
|
||||||
console.error("error: unrecognized flag '" + flag + "'");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
cnf = conf[flag.slice(2)];
|
|
||||||
if (!cnf) {
|
|
||||||
// look for arbitrary flags
|
|
||||||
if (bags.some(grab)) {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
// other arbitrary args are not used
|
|
||||||
console.error("unrecognized elided flag '" + flag + "'");
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
// encourage switching to non-aliased version
|
|
||||||
if (flag !== '--' + cnf[0]) {
|
|
||||||
console.warn(
|
|
||||||
"use of '" +
|
|
||||||
flag +
|
|
||||||
"' is deprecated, use '--" +
|
|
||||||
cnf[0] +
|
|
||||||
"' instead"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
// look for xxx-json flags
|
|
||||||
if ('json' === cnf[3]) {
|
|
||||||
try {
|
|
||||||
var json = JSON.parse(args.shift());
|
|
||||||
var bagName = toBagName(cnf[0].replace(/-json$/, ''));
|
|
||||||
Object.keys(json).forEach(function(k) {
|
|
||||||
opts[bagName][k] = json[k];
|
|
||||||
});
|
|
||||||
} catch (e) {
|
|
||||||
console.error("Could not parse option '" + flag + "' as JSON:");
|
|
||||||
console.error(e.message);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
// set booleans, otherwise grab the next arg in line
|
|
||||||
typ = cnf[3];
|
|
||||||
// TODO --no-<whatever> to negate
|
|
||||||
if (Boolean === typ || 'boolean' === typ) {
|
|
||||||
opts[toCamel(cnf[0])] = true;
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
opts[toCamel(cnf[0])] = args.shift();
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
cb(leftovers, opts);
|
|
||||||
};
|
|
||||||
|
|
||||||
function toCamel(str) {
|
|
||||||
return str.replace(/-([a-z0-9])/g, function(m) {
|
|
||||||
return m[1].toUpperCase();
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
function toBagName(bag) {
|
|
||||||
// trim leading and trailing '-'
|
|
||||||
bag = bag.replace(/^-+/g, '').replace(/-+$/g, '');
|
|
||||||
return toCamel(bag) + 'Opts'; // '--bag-option-' => bagOptionOpts
|
|
||||||
}
|
|
||||||
|
|
||||||
function printHelp(conf) {
|
|
||||||
var flagLen = 0;
|
|
||||||
var typeLen = 0;
|
|
||||||
var defLen = 0;
|
|
||||||
|
|
||||||
Object.keys(conf).forEach(function(k) {
|
|
||||||
flagLen = Math.max(flagLen, conf[k][0].length);
|
|
||||||
typeLen = Math.max(typeLen, conf[k][3].length);
|
|
||||||
if ('undefined' !== typeof conf[k][4]) {
|
|
||||||
defLen = Math.max(
|
|
||||||
defLen,
|
|
||||||
'(Default: )'.length + String(conf[k][4]).length
|
|
||||||
);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
Object.keys(conf).forEach(function(k) {
|
|
||||||
var v = conf[k];
|
|
||||||
|
|
||||||
// skip aliases
|
|
||||||
if (v[0] !== k) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
var def = v[4];
|
|
||||||
if ('undefined' === typeof def) {
|
|
||||||
def = '';
|
|
||||||
} else {
|
|
||||||
def = '(default: ' + JSON.stringify(def) + ')';
|
|
||||||
}
|
|
||||||
|
|
||||||
var msg =
|
|
||||||
' --' +
|
|
||||||
v[0].padEnd(flagLen) +
|
|
||||||
' ' +
|
|
||||||
v[3].padStart(typeLen + 1) +
|
|
||||||
' ' +
|
|
||||||
(v[2] || '') +
|
|
||||||
' ' +
|
|
||||||
def; /*.padStart(defLen)*/
|
|
||||||
// v[0] flagname
|
|
||||||
// v[1] short flagname
|
|
||||||
// v[2] description
|
|
||||||
// v[3] type
|
|
||||||
// v[4] default value
|
|
||||||
// v[5] aliases
|
|
||||||
|
|
||||||
console.info(msg);
|
|
||||||
});
|
|
||||||
}
|
|
||||||
400
bin/lib/flags.js
400
bin/lib/flags.js
@ -1,400 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var Flags = module.exports;
|
|
||||||
|
|
||||||
//var path = require('path');
|
|
||||||
var pkgRoot = process.cwd();
|
|
||||||
//var Init = require('../../lib/init.js');
|
|
||||||
|
|
||||||
// These are ALL options
|
|
||||||
// The individual CLI files each select a subset of them
|
|
||||||
Flags.flags = function(mconf, myOpts) {
|
|
||||||
// Current Manager Config
|
|
||||||
if (!mconf) {
|
|
||||||
mconf = {};
|
|
||||||
}
|
|
||||||
|
|
||||||
// Extra Override Options
|
|
||||||
if (!myOpts) {
|
|
||||||
myOpts = {};
|
|
||||||
}
|
|
||||||
|
|
||||||
return {
|
|
||||||
all: [
|
|
||||||
false,
|
|
||||||
'search all site configs rather than by --subject or --servernames',
|
|
||||||
'boolean'
|
|
||||||
],
|
|
||||||
'agree-to-terms': [
|
|
||||||
false,
|
|
||||||
"agree to the Let's Encrypts Subscriber Agreement and Greenlock Terms of Use",
|
|
||||||
'boolean'
|
|
||||||
],
|
|
||||||
subject: [
|
|
||||||
false,
|
|
||||||
'the "subject" (primary domain) of the certificate',
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
altnames: [
|
|
||||||
false,
|
|
||||||
'the "subject alternative names" (additional domains) on the certificate, the first of which MUST be the subject',
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
servername: [
|
|
||||||
false,
|
|
||||||
'a name that matches a subject or altname',
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
servernames: [
|
|
||||||
false,
|
|
||||||
'a list of names that matches a subject or altname',
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
cluster: [false, 'initialize with cluster mode on', 'boolean', false],
|
|
||||||
'renew-offset': [
|
|
||||||
false,
|
|
||||||
"time to wait until renewing the cert such as '45d' (45 days after being issued) or '-3w' (3 weeks before expiration date)",
|
|
||||||
'string',
|
|
||||||
mconf.renewOffset
|
|
||||||
],
|
|
||||||
'customer-email': [
|
|
||||||
false,
|
|
||||||
"the email address of the owner of the domain or site (not necessarily the Let's Encrypt or ACME subscriber)",
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
'subscriber-email': [
|
|
||||||
false,
|
|
||||||
"the email address of the Let's Encrypt or ACME Account subscriber (not necessarily the domain owner)",
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
'config-dir': [
|
|
||||||
false,
|
|
||||||
'the directory in which config.json and other config and storage files should be written',
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
'maintainer-email': [
|
|
||||||
false,
|
|
||||||
'the maintainance contact for security and critical bug notices',
|
|
||||||
'string'
|
|
||||||
],
|
|
||||||
'account-key-type': [
|
|
||||||
false,
|
|
||||||
"either 'P-256' (ECDSA) or 'RSA-2048' - although other values are technically supported, they don't make sense and won't work with many services (More bits != More security)",
|
|
||||||
'string',
|
|
||||||
mconf.accountKeyType
|
|
||||||
],
|
|
||||||
'server-key-type': [
|
|
||||||
false,
|
|
||||||
"either 'RSA-2048' or 'P-256' (ECDSA) - although other values are technically supported, they don't make sense and won't work with many services (More bits != More security)",
|
|
||||||
'string',
|
|
||||||
mconf.serverKeyType
|
|
||||||
],
|
|
||||||
store: [
|
|
||||||
false,
|
|
||||||
'the module name or file path of the store module to use',
|
|
||||||
'string'
|
|
||||||
//mconf.store.module
|
|
||||||
],
|
|
||||||
'store-xxxx': [
|
|
||||||
false,
|
|
||||||
'an option for the chosen store module, such as --store-apikey or --store-bucket',
|
|
||||||
'bag'
|
|
||||||
],
|
|
||||||
manager: [
|
|
||||||
false,
|
|
||||||
'the module name or file path of the manager module to use',
|
|
||||||
'string',
|
|
||||||
'@greenlock/manager'
|
|
||||||
],
|
|
||||||
'manager-xxxx': [
|
|
||||||
false,
|
|
||||||
'an option for the chosen manager module, such as --manager-apikey or --manager-dburl',
|
|
||||||
'bag'
|
|
||||||
],
|
|
||||||
challenge: [
|
|
||||||
false,
|
|
||||||
'the module name or file path of the HTTP-01, DNS-01, or TLS-ALPN-01 challenge module to use',
|
|
||||||
'string',
|
|
||||||
''
|
|
||||||
/*
|
|
||||||
Object.keys(mconf.challenges)
|
|
||||||
.map(function(typ) {
|
|
||||||
return mconf.challenges[typ].module;
|
|
||||||
})
|
|
||||||
.join(',')
|
|
||||||
*/
|
|
||||||
],
|
|
||||||
'challenge-xxxx': [
|
|
||||||
false,
|
|
||||||
'an option for the chosen challenge module, such as --challenge-apikey or --challenge-bucket',
|
|
||||||
'bag'
|
|
||||||
],
|
|
||||||
'challenge-json': [
|
|
||||||
false,
|
|
||||||
'a JSON string containing all option for the chosen challenge module (instead of --challenge-xxxx)',
|
|
||||||
'json',
|
|
||||||
'{}'
|
|
||||||
],
|
|
||||||
'challenge-http-01': [
|
|
||||||
false,
|
|
||||||
'the module name or file path of the HTTP-01 to add',
|
|
||||||
'string'
|
|
||||||
//(mconf.challenges['http-01'] || {}).module
|
|
||||||
],
|
|
||||||
'challenge-http-01-xxxx': [
|
|
||||||
false,
|
|
||||||
'an option for the chosen challenge module, such as --challenge-http-01-apikey or --challenge-http-01-bucket',
|
|
||||||
'bag'
|
|
||||||
],
|
|
||||||
'challenge-dns-01': [
|
|
||||||
false,
|
|
||||||
'the module name or file path of the DNS-01 to add',
|
|
||||||
'string'
|
|
||||||
//(mconf.challenges['dns-01'] || {}).module
|
|
||||||
],
|
|
||||||
'challenge-dns-01-xxxx': [
|
|
||||||
false,
|
|
||||||
'an option for the chosen challenge module, such as --challenge-dns-01-apikey or --challenge-dns-01-bucket',
|
|
||||||
'bag'
|
|
||||||
],
|
|
||||||
'challenge-tls-alpn-01': [
|
|
||||||
false,
|
|
||||||
'the module name or file path of the DNS-01 to add',
|
|
||||||
'string'
|
|
||||||
//(mconf.challenges['tls-alpn-01'] || {}).module
|
|
||||||
],
|
|
||||||
'challenge-tls-alpn-01-xxxx': [
|
|
||||||
false,
|
|
||||||
'an option for the chosen challenge module, such as --challenge-tls-alpn-01-apikey or --challenge-tls-alpn-01-bucket',
|
|
||||||
'bag'
|
|
||||||
],
|
|
||||||
'force-save': [
|
|
||||||
false,
|
|
||||||
"save all options for this site, even if it's the same as the defaults",
|
|
||||||
'boolean',
|
|
||||||
myOpts.forceSave || false
|
|
||||||
]
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
Flags.init = async function(myOpts) {
|
|
||||||
var Greenlock = require('../../');
|
|
||||||
|
|
||||||
// this is a copy, so it's safe to modify
|
|
||||||
var greenlock = Greenlock.create({
|
|
||||||
packageRoot: pkgRoot,
|
|
||||||
_mustPackage: true,
|
|
||||||
_init: true,
|
|
||||||
_bin_mode: true
|
|
||||||
});
|
|
||||||
var mconf = await greenlock.manager.defaults();
|
|
||||||
var flagOptions = Flags.flags(mconf, myOpts);
|
|
||||||
return {
|
|
||||||
flagOptions,
|
|
||||||
greenlock,
|
|
||||||
mconf
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
Flags.mangleFlags = function(flags, mconf, sconf, extras) {
|
|
||||||
if (extras) {
|
|
||||||
if (extras.forceSave) {
|
|
||||||
flags.forceSave = true;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
//console.log('debug a:', flags);
|
|
||||||
|
|
||||||
if ('altnames' in flags) {
|
|
||||||
flags.altnames = (flags.altnames || '').split(/[,\s]+/).filter(Boolean);
|
|
||||||
}
|
|
||||||
if ('servernames' in flags) {
|
|
||||||
flags.servernames = (flags.servernames || '')
|
|
||||||
.split(/[,\s]+/)
|
|
||||||
.filter(Boolean);
|
|
||||||
}
|
|
||||||
|
|
||||||
var store;
|
|
||||||
if (flags.store) {
|
|
||||||
store = flags.storeOpts;
|
|
||||||
store.module = flags.store;
|
|
||||||
flags.store = store;
|
|
||||||
} else {
|
|
||||||
delete flags.store;
|
|
||||||
}
|
|
||||||
delete flags.storeOpts;
|
|
||||||
|
|
||||||
// If this is additive, make an object to hold all values
|
|
||||||
var isAdditive = [
|
|
||||||
['http-01', 'Http01'],
|
|
||||||
['dns-01', 'Dns01'],
|
|
||||||
['tls-alpn-01', 'TlsAlpn01']
|
|
||||||
].some(function(types) {
|
|
||||||
var typCamel = types[1];
|
|
||||||
var modname = 'challenge' + typCamel;
|
|
||||||
if (flags[modname]) {
|
|
||||||
if (!flags.challenges) {
|
|
||||||
flags.challenges = {};
|
|
||||||
}
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
});
|
|
||||||
if (isAdditive && sconf) {
|
|
||||||
// copy over the old
|
|
||||||
var schallenges = sconf.challenges || {};
|
|
||||||
Object.keys(schallenges).forEach(function(k) {
|
|
||||||
if (!flags.challenges[k]) {
|
|
||||||
flags.challenges[k] = schallenges[k];
|
|
||||||
}
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
var typ;
|
|
||||||
var challenge;
|
|
||||||
if (flags.challenge) {
|
|
||||||
// this varient of the flag is exclusive
|
|
||||||
flags.challenges = {};
|
|
||||||
isAdditive = false;
|
|
||||||
|
|
||||||
if (/http-01/.test(flags.challenge)) {
|
|
||||||
typ = 'http-01';
|
|
||||||
} else if (/dns-01/.test(flags.challenge)) {
|
|
||||||
typ = 'dns-01';
|
|
||||||
} else if (/tls-alpn-01/.test(flags.challenge)) {
|
|
||||||
typ = 'tls-alpn-01';
|
|
||||||
}
|
|
||||||
|
|
||||||
var modname = 'challenge';
|
|
||||||
var optsname = 'challengeOpts';
|
|
||||||
challenge = flags[optsname];
|
|
||||||
// JSON may already have module name
|
|
||||||
if (challenge.module) {
|
|
||||||
if (flags[modname] && challenge.module !== flags[modname]) {
|
|
||||||
console.error(
|
|
||||||
'module names do not match:',
|
|
||||||
JSON.stringify(challenge.module),
|
|
||||||
JSON.stringify(flags[modname])
|
|
||||||
);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
challenge.module = flags[modname];
|
|
||||||
}
|
|
||||||
flags.challenges[typ] = challenge;
|
|
||||||
|
|
||||||
var chall = mconf.challenges[typ];
|
|
||||||
if (chall && challenge.module === chall.module) {
|
|
||||||
var keys = Object.keys(challenge);
|
|
||||||
var same =
|
|
||||||
!keys.length ||
|
|
||||||
keys.every(function(k) {
|
|
||||||
return chall[k] === challenge[k];
|
|
||||||
});
|
|
||||||
if (same && !flags.forceSave) {
|
|
||||||
delete flags.challenges;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
delete flags.challenge;
|
|
||||||
delete flags.challengeOpts;
|
|
||||||
|
|
||||||
// Add each of the values, including the existing
|
|
||||||
[
|
|
||||||
['http-01', 'Http01'],
|
|
||||||
['dns-01', 'Dns01'],
|
|
||||||
['tls-alpn-01', 'TlsAlpn01']
|
|
||||||
].forEach(function(types) {
|
|
||||||
var typ = types[0];
|
|
||||||
var typCamel = types[1];
|
|
||||||
var modname = 'challenge' + typCamel;
|
|
||||||
var optsname = 'challenge' + typCamel + 'Opts';
|
|
||||||
var chall = mconf.challenges[typ];
|
|
||||||
var challenge = flags[optsname];
|
|
||||||
|
|
||||||
// this variant of the flag is additive
|
|
||||||
if (isAdditive && chall && flags.forceSave) {
|
|
||||||
if (flags.challenges && !flags.challenges[typ]) {
|
|
||||||
flags.challenges[typ] = chall;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!flags[modname]) {
|
|
||||||
delete flags[modname];
|
|
||||||
delete flags[optsname];
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
// JSON may already have module name
|
|
||||||
if (challenge.module) {
|
|
||||||
if (flags[modname] && challenge.module !== flags[modname]) {
|
|
||||||
console.error(
|
|
||||||
'module names do not match:',
|
|
||||||
JSON.stringify(challenge.module),
|
|
||||||
JSON.stringify(flags[modname])
|
|
||||||
);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
challenge.module = flags[modname];
|
|
||||||
}
|
|
||||||
if (flags[modname]) {
|
|
||||||
if (!flags.challenges) {
|
|
||||||
flags.challenges = {};
|
|
||||||
}
|
|
||||||
flags.challenges[typ] = challenge;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Check to see if this is already what's set in the defaults
|
|
||||||
if (chall && challenge.module === chall.module) {
|
|
||||||
var keys = Object.keys(challenge);
|
|
||||||
// Check if all of the options are also the same
|
|
||||||
var same =
|
|
||||||
!keys.length ||
|
|
||||||
keys.every(function(k) {
|
|
||||||
return chall[k] === challenge[k];
|
|
||||||
});
|
|
||||||
if (same && !flags.forceSave) {
|
|
||||||
// If it's already the global, don't make it the per-site
|
|
||||||
delete flags[modname];
|
|
||||||
delete flags[optsname];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
delete flags[modname];
|
|
||||||
delete flags[optsname];
|
|
||||||
});
|
|
||||||
|
|
||||||
[
|
|
||||||
['accountKeyType', [/256/, /384/, /EC/], 'EC-P256'],
|
|
||||||
['serverKeyType', [/RSA/], 'RSA-2048']
|
|
||||||
].forEach(function(k) {
|
|
||||||
var key = k[0];
|
|
||||||
var vals = k[1];
|
|
||||||
var val = flags[key];
|
|
||||||
if (val) {
|
|
||||||
if (
|
|
||||||
!vals.some(function(v) {
|
|
||||||
return v.test(val);
|
|
||||||
})
|
|
||||||
) {
|
|
||||||
flags[key] = k[2];
|
|
||||||
console.warn(
|
|
||||||
key,
|
|
||||||
"does not allow the value '",
|
|
||||||
val,
|
|
||||||
"' using the default '",
|
|
||||||
k[2],
|
|
||||||
"' instead."
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
Object.keys(flags).forEach(function(k) {
|
|
||||||
if (flags[k] === mconf[k] && !flags.forceSave) {
|
|
||||||
delete flags[k];
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
//console.log('debug z:', flags);
|
|
||||||
delete flags.forceSave;
|
|
||||||
};
|
|
||||||
@ -1,55 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var args = process.argv.slice(3);
|
|
||||||
var cli = require('./lib/cli.js');
|
|
||||||
//var path = require('path');
|
|
||||||
//var pkgpath = path.join(__dirname, '..', 'package.json');
|
|
||||||
//var pkgpath = path.join(process.cwd(), 'package.json');
|
|
||||||
|
|
||||||
var Flags = require('./lib/flags.js');
|
|
||||||
|
|
||||||
Flags.init().then(function({ flagOptions, greenlock, mconf }) {
|
|
||||||
var myFlags = {};
|
|
||||||
['subject'].forEach(function(k) {
|
|
||||||
myFlags[k] = flagOptions[k];
|
|
||||||
});
|
|
||||||
|
|
||||||
cli.parse(myFlags);
|
|
||||||
cli.main(function(argList, flags) {
|
|
||||||
Flags.mangleFlags(flags, mconf);
|
|
||||||
main(argList, flags, greenlock);
|
|
||||||
}, args);
|
|
||||||
});
|
|
||||||
|
|
||||||
async function main(_, flags, greenlock) {
|
|
||||||
if (!flags.subject) {
|
|
||||||
console.error('--subject must be provided as a valid domain');
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
greenlock
|
|
||||||
.remove(flags)
|
|
||||||
.catch(function(err) {
|
|
||||||
console.error();
|
|
||||||
console.error('error:', err.message);
|
|
||||||
//console.log(err.stack);
|
|
||||||
console.error();
|
|
||||||
process.exit(1);
|
|
||||||
})
|
|
||||||
.then(function(site) {
|
|
||||||
if (!site) {
|
|
||||||
console.info();
|
|
||||||
console.info('No config found for', flags.subject);
|
|
||||||
console.info();
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
console.info();
|
|
||||||
console.info(
|
|
||||||
'Deleted config for ' + JSON.stringify(flags.subject) + ':'
|
|
||||||
);
|
|
||||||
console.info(JSON.stringify(site, null, 2));
|
|
||||||
console.info();
|
|
||||||
});
|
|
||||||
}
|
|
||||||
@ -1,9 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
// Here's a vanilla HTTP app to start,
|
|
||||||
// but feel free to replace it with Express, Koa, etc
|
|
||||||
var app = function(req, res) {
|
|
||||||
res.end('Hello, Encrypted World!');
|
|
||||||
};
|
|
||||||
|
|
||||||
module.exports = app;
|
|
||||||
@ -1,30 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
require('greenlock-express')
|
|
||||||
.init(function() {
|
|
||||||
// var pkg = require('./package.json');
|
|
||||||
|
|
||||||
return {
|
|
||||||
// where to find .greenlockrc and set default paths
|
|
||||||
packageRoot: __dirname,
|
|
||||||
|
|
||||||
// name & version for ACME client user agent
|
|
||||||
//packageAgent: pkg.name + '/' + pkg.version,
|
|
||||||
|
|
||||||
// contact for security and critical bug notices
|
|
||||||
//maintainerEmail: pkg.author,
|
|
||||||
|
|
||||||
// where to look for configuration
|
|
||||||
configDir: './greenlock.d',
|
|
||||||
|
|
||||||
// whether or not to run at cloudscale
|
|
||||||
cluster: true
|
|
||||||
};
|
|
||||||
})
|
|
||||||
.ready(function(glx) {
|
|
||||||
var app = require('./app.js');
|
|
||||||
|
|
||||||
// Serves on 80 and 443
|
|
||||||
// Get's SSL certificates magically!
|
|
||||||
glx.serveApp(app);
|
|
||||||
});
|
|
||||||
@ -1,13 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var pkg = require('./package.json');
|
|
||||||
module.exports = require('@root/greenlock').create({
|
|
||||||
// name & version for ACME client user agent
|
|
||||||
packageAgent: pkg.name + '/' + pkg.version,
|
|
||||||
|
|
||||||
// contact for security and critical bug notices
|
|
||||||
//maintainerEmail: pkg.author,
|
|
||||||
|
|
||||||
// where to find .greenlockrc and set default paths
|
|
||||||
packageRoot: __dirname
|
|
||||||
});
|
|
||||||
@ -1,20 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var app = require('./app.js');
|
|
||||||
|
|
||||||
require('greenlock-express')
|
|
||||||
.init({
|
|
||||||
packageRoot: __dirname,
|
|
||||||
|
|
||||||
// contact for security and critical bug notices
|
|
||||||
//maintainerEmail: pkg.author,
|
|
||||||
|
|
||||||
// where to look for configuration
|
|
||||||
configDir: './greenlock.d',
|
|
||||||
|
|
||||||
// whether or not to run at cloudscale
|
|
||||||
cluster: false
|
|
||||||
})
|
|
||||||
// Serves on 80 and 443
|
|
||||||
// Get's SSL certificates magically!
|
|
||||||
.serve(app);
|
|
||||||
@ -1,79 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var args = process.argv.slice(3);
|
|
||||||
var cli = require('./lib/cli.js');
|
|
||||||
var Flags = require('./lib/flags.js');
|
|
||||||
|
|
||||||
Flags.init().then(function({ flagOptions, greenlock, mconf }) {
|
|
||||||
var myFlags = {};
|
|
||||||
[
|
|
||||||
'subject',
|
|
||||||
'altnames',
|
|
||||||
'renew-offset',
|
|
||||||
'subscriber-email',
|
|
||||||
'customer-email',
|
|
||||||
'server-key-type',
|
|
||||||
'challenge-http-01',
|
|
||||||
'challenge-http-01-xxxx',
|
|
||||||
'challenge-dns-01',
|
|
||||||
'challenge-dns-01-xxxx',
|
|
||||||
'challenge-tls-alpn-01',
|
|
||||||
'challenge-tls-alpn-01-xxxx',
|
|
||||||
'challenge',
|
|
||||||
'challenge-xxxx',
|
|
||||||
'challenge-json',
|
|
||||||
'force-save'
|
|
||||||
].forEach(function(k) {
|
|
||||||
myFlags[k] = flagOptions[k];
|
|
||||||
});
|
|
||||||
|
|
||||||
cli.parse(myFlags);
|
|
||||||
cli.main(async function(argList, flags) {
|
|
||||||
var sconf = await greenlock._config({ servername: flags.subject });
|
|
||||||
Flags.mangleFlags(flags, mconf, sconf);
|
|
||||||
main(argList, flags, greenlock);
|
|
||||||
}, args);
|
|
||||||
});
|
|
||||||
|
|
||||||
async function main(_, flags, greenlock) {
|
|
||||||
if (!flags.subject) {
|
|
||||||
console.error('--subject must be provided as a valid domain');
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
greenlock
|
|
||||||
.update(flags)
|
|
||||||
.catch(function(err) {
|
|
||||||
console.error();
|
|
||||||
console.error('error:', err.message);
|
|
||||||
console.error();
|
|
||||||
process.exit(1);
|
|
||||||
})
|
|
||||||
.then(function() {
|
|
||||||
return greenlock
|
|
||||||
._config({ servername: flags.subject })
|
|
||||||
.then(function(site) {
|
|
||||||
if (!site) {
|
|
||||||
console.info();
|
|
||||||
console.info('No config found for', flags.subject);
|
|
||||||
console.info();
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
console.info();
|
|
||||||
Object.keys(site).forEach(function(k) {
|
|
||||||
if ('defaults' === k) {
|
|
||||||
console.info(k + ':');
|
|
||||||
Object.keys(site.defaults).forEach(function(key) {
|
|
||||||
var value = JSON.stringify(site.defaults[key]);
|
|
||||||
console.info('\t' + key + ':' + value);
|
|
||||||
});
|
|
||||||
} else {
|
|
||||||
console.info(k + ': ' + JSON.stringify(site[k]));
|
|
||||||
}
|
|
||||||
});
|
|
||||||
});
|
|
||||||
});
|
|
||||||
}
|
|
||||||
324
certificates.js
324
certificates.js
@ -1,324 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var C = module.exports;
|
|
||||||
var U = require('./utils.js');
|
|
||||||
var CSR = require('@root/csr');
|
|
||||||
var Enc = require('@root/encoding');
|
|
||||||
var Keypairs = require('@root/keypairs');
|
|
||||||
|
|
||||||
var pending = {};
|
|
||||||
var rawPending = {};
|
|
||||||
|
|
||||||
// What the abbreviations mean
|
|
||||||
//
|
|
||||||
// gnlkc => greenlock
|
|
||||||
// mconf => manager config
|
|
||||||
// db => greenlock store instance
|
|
||||||
// acme => instance of ACME.js
|
|
||||||
// chs => instances of challenges
|
|
||||||
// acc => account
|
|
||||||
// args => site / extra options
|
|
||||||
|
|
||||||
// Certificates
|
|
||||||
C._getOrOrder = function(gnlck, mconf, db, acme, chs, acc, args) {
|
|
||||||
var email = args.subscriberEmail || mconf.subscriberEmail;
|
|
||||||
|
|
||||||
var id = args.altnames
|
|
||||||
.slice(0)
|
|
||||||
.sort()
|
|
||||||
.join(' ');
|
|
||||||
if (pending[id]) {
|
|
||||||
return pending[id];
|
|
||||||
}
|
|
||||||
|
|
||||||
pending[id] = C._rawGetOrOrder(
|
|
||||||
gnlck,
|
|
||||||
mconf,
|
|
||||||
db,
|
|
||||||
acme,
|
|
||||||
chs,
|
|
||||||
acc,
|
|
||||||
email,
|
|
||||||
args
|
|
||||||
)
|
|
||||||
.then(function(pems) {
|
|
||||||
delete pending[id];
|
|
||||||
return pems;
|
|
||||||
})
|
|
||||||
.catch(function(err) {
|
|
||||||
delete pending[id];
|
|
||||||
throw err;
|
|
||||||
});
|
|
||||||
|
|
||||||
return pending[id];
|
|
||||||
};
|
|
||||||
|
|
||||||
// Certificates
|
|
||||||
C._rawGetOrOrder = function(gnlck, mconf, db, acme, chs, acc, email, args) {
|
|
||||||
return C._check(gnlck, mconf, db, args).then(function(pems) {
|
|
||||||
// Nice and fresh? We're done!
|
|
||||||
if (pems) {
|
|
||||||
if (!C._isStale(gnlck, mconf, args, pems)) {
|
|
||||||
// return existing unexpired (although potentially stale) certificates when available
|
|
||||||
// there will be an additional .renewing property if the certs are being asynchronously renewed
|
|
||||||
//pems._type = 'current';
|
|
||||||
return pems;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// We're either starting fresh or freshening up...
|
|
||||||
var p = C._rawOrder(gnlck, mconf, db, acme, chs, acc, email, args);
|
|
||||||
var evname = pems ? 'cert_renewal' : 'cert_issue';
|
|
||||||
p.then(function(newPems) {
|
|
||||||
// notify in the background
|
|
||||||
var renewAt = C._renewWithStagger(gnlck, mconf, args, newPems);
|
|
||||||
gnlck._notify(evname, {
|
|
||||||
renewAt: renewAt,
|
|
||||||
subject: args.subject,
|
|
||||||
altnames: args.altnames
|
|
||||||
});
|
|
||||||
gnlck._notify('_cert_issue', {
|
|
||||||
renewAt: renewAt,
|
|
||||||
subject: args.subject,
|
|
||||||
altnames: args.altnames,
|
|
||||||
pems: newPems
|
|
||||||
});
|
|
||||||
}).catch(function(err) {
|
|
||||||
if (!err.context) {
|
|
||||||
err.context = evname;
|
|
||||||
}
|
|
||||||
err.subject = args.subject;
|
|
||||||
err.altnames = args.altnames;
|
|
||||||
gnlck._notify('error', err);
|
|
||||||
});
|
|
||||||
|
|
||||||
// No choice but to hang tight and wait for it
|
|
||||||
if (
|
|
||||||
!pems ||
|
|
||||||
pems.renewAt < Date.now() - 24 * 60 * 60 * 1000 ||
|
|
||||||
pems.expiresAt <= Date.now() + 24 * 60 * 60 * 1000
|
|
||||||
) {
|
|
||||||
return p;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Wait it out
|
|
||||||
// TODO should we call this waitForRenewal?
|
|
||||||
if (args.waitForRenewal) {
|
|
||||||
return p;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Let the certs renew in the background
|
|
||||||
return pems;
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
// we have another promise here because it the optional renewal
|
|
||||||
// may resolve in a different stack than the returned pems
|
|
||||||
C._rawOrder = function(gnlck, mconf, db, acme, chs, acc, email, args) {
|
|
||||||
var id = args.altnames
|
|
||||||
.slice(0)
|
|
||||||
.sort()
|
|
||||||
.join(' ');
|
|
||||||
if (rawPending[id]) {
|
|
||||||
return rawPending[id];
|
|
||||||
}
|
|
||||||
|
|
||||||
var keyType = args.serverKeyType || mconf.serverKeyType;
|
|
||||||
var query = {
|
|
||||||
subject: args.subject,
|
|
||||||
certificate: args.certificate || {},
|
|
||||||
directoryUrl:
|
|
||||||
args.directoryUrl ||
|
|
||||||
mconf.directoryUrl ||
|
|
||||||
gnlck._defaults.directoryUrl
|
|
||||||
};
|
|
||||||
rawPending[id] = U._getOrCreateKeypair(db, args.subject, query, keyType)
|
|
||||||
.then(function(kresult) {
|
|
||||||
var serverKeypair = kresult.keypair;
|
|
||||||
var domains = args.altnames.slice(0);
|
|
||||||
|
|
||||||
return CSR.csr({
|
|
||||||
jwk: serverKeypair.privateKeyJwk || serverKeypair.private,
|
|
||||||
domains: domains,
|
|
||||||
encoding: 'der'
|
|
||||||
})
|
|
||||||
.then(function(csrDer) {
|
|
||||||
// TODO let CSR support 'urlBase64' ?
|
|
||||||
return Enc.bufToUrlBase64(csrDer);
|
|
||||||
})
|
|
||||||
.then(function(csr) {
|
|
||||||
function notify(ev, opts) {
|
|
||||||
gnlck._notify(ev, opts);
|
|
||||||
}
|
|
||||||
var certReq = {
|
|
||||||
debug: args.debug || gnlck._defaults.debug,
|
|
||||||
|
|
||||||
challenges: chs,
|
|
||||||
account: acc, // only used if accounts.key.kid exists
|
|
||||||
accountKey:
|
|
||||||
acc.keypair.privateKeyJwk || acc.keypair.private,
|
|
||||||
keypair: acc.keypair, // TODO
|
|
||||||
csr: csr,
|
|
||||||
domains: domains, // because ACME.js v3 uses `domains` still, actually
|
|
||||||
onChallengeStatus: notify,
|
|
||||||
notify: notify // TODO
|
|
||||||
|
|
||||||
// TODO handle this in acme-v2
|
|
||||||
//subject: args.subject,
|
|
||||||
//altnames: args.altnames.slice(0),
|
|
||||||
};
|
|
||||||
return acme.certificates
|
|
||||||
.create(certReq)
|
|
||||||
.then(U._attachCertInfo);
|
|
||||||
})
|
|
||||||
.then(function(pems) {
|
|
||||||
if (kresult.exists) {
|
|
||||||
return pems;
|
|
||||||
}
|
|
||||||
query.keypair = serverKeypair;
|
|
||||||
return db.setKeypair(query, serverKeypair).then(function() {
|
|
||||||
return pems;
|
|
||||||
});
|
|
||||||
});
|
|
||||||
})
|
|
||||||
.then(function(pems) {
|
|
||||||
// TODO put this in the docs
|
|
||||||
// { cert, chain, privkey, subject, altnames, issuedAt, expiresAt }
|
|
||||||
// Note: the query has been updated
|
|
||||||
query.pems = pems;
|
|
||||||
return db.set(query);
|
|
||||||
})
|
|
||||||
.then(function() {
|
|
||||||
return C._check(gnlck, mconf, db, args);
|
|
||||||
})
|
|
||||||
.then(function(bundle) {
|
|
||||||
// TODO notify Manager
|
|
||||||
delete rawPending[id];
|
|
||||||
return bundle;
|
|
||||||
})
|
|
||||||
.catch(function(err) {
|
|
||||||
// Todo notify manager
|
|
||||||
delete rawPending[id];
|
|
||||||
throw err;
|
|
||||||
});
|
|
||||||
|
|
||||||
return rawPending[id];
|
|
||||||
};
|
|
||||||
|
|
||||||
// returns pems, if they exist
|
|
||||||
C._check = function(gnlck, mconf, db, args) {
|
|
||||||
var query = {
|
|
||||||
subject: args.subject,
|
|
||||||
// may contain certificate.id
|
|
||||||
certificate: args.certificate,
|
|
||||||
directoryUrl:
|
|
||||||
args.directoryUrl ||
|
|
||||||
mconf.directoryUrl ||
|
|
||||||
gnlck._defaults.directoryUrl
|
|
||||||
};
|
|
||||||
return db.check(query).then(function(pems) {
|
|
||||||
if (!pems) {
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
pems = U._attachCertInfo(pems);
|
|
||||||
|
|
||||||
// For eager management
|
|
||||||
if (args.subject && !U._certHasDomain(pems, args.subject)) {
|
|
||||||
// TODO report error, but continue the process as with no cert
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
// For lazy SNI requests
|
|
||||||
if (args.domain && !U._certHasDomain(pems, args.domain)) {
|
|
||||||
// TODO report error, but continue the process as with no cert
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
return U._getKeypair(db, args.subject, query)
|
|
||||||
.then(function(keypair) {
|
|
||||||
return Keypairs.export({
|
|
||||||
jwk: keypair.privateKeyJwk || keypair.private,
|
|
||||||
encoding: 'pem'
|
|
||||||
}).then(function(pem) {
|
|
||||||
pems.privkey = pem;
|
|
||||||
return pems;
|
|
||||||
});
|
|
||||||
})
|
|
||||||
.catch(function() {
|
|
||||||
// TODO report error, but continue the process as with no cert
|
|
||||||
return null;
|
|
||||||
});
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
// Certificates
|
|
||||||
C._isStale = function(gnlck, mconf, args, pems) {
|
|
||||||
if (args.duplicate) {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
var renewAt = C._renewableAt(gnlck, mconf, args, pems);
|
|
||||||
|
|
||||||
if (Date.now() >= renewAt) {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
return false;
|
|
||||||
};
|
|
||||||
|
|
||||||
C._renewWithStagger = function(gnlck, mconf, args, pems) {
|
|
||||||
var renewOffset = C._renewOffset(gnlck, mconf, args, pems);
|
|
||||||
var renewStagger;
|
|
||||||
try {
|
|
||||||
renewStagger = U._parseDuration(
|
|
||||||
args.renewStagger || mconf.renewStagger || 0
|
|
||||||
);
|
|
||||||
} catch (e) {
|
|
||||||
renewStagger = U._parseDuration(
|
|
||||||
args.renewStagger || mconf.renewStagger
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
// TODO check this beforehand
|
|
||||||
if (!args.force && renewStagger / renewOffset >= 0.5) {
|
|
||||||
renewStagger = renewOffset * 0.1;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (renewOffset > 0) {
|
|
||||||
// stagger forward, away from issued at
|
|
||||||
return Math.round(
|
|
||||||
pems.issuedAt + renewOffset + Math.random() * renewStagger
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
// stagger backward, toward issued at
|
|
||||||
return Math.round(
|
|
||||||
pems.expiresAt + renewOffset - Math.random() * renewStagger
|
|
||||||
);
|
|
||||||
};
|
|
||||||
C._renewOffset = function(gnlck, mconf, args /*, pems*/) {
|
|
||||||
var renewOffset = U._parseDuration(
|
|
||||||
args.renewOffset || mconf.renewOffset || 0
|
|
||||||
);
|
|
||||||
var week = 1000 * 60 * 60 * 24 * 6;
|
|
||||||
if (!args.force && Math.abs(renewOffset) < week) {
|
|
||||||
throw new Error(
|
|
||||||
'developer error: `renewOffset` should always be at least a week, use `force` to not safety-check renewOffset'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
return renewOffset;
|
|
||||||
};
|
|
||||||
C._renewableAt = function(gnlck, mconf, args, pems) {
|
|
||||||
if (args.renewAt) {
|
|
||||||
return args.renewAt;
|
|
||||||
}
|
|
||||||
|
|
||||||
var renewOffset = C._renewOffset(gnlck, mconf, args, pems);
|
|
||||||
|
|
||||||
if (renewOffset > 0) {
|
|
||||||
return pems.issuedAt + renewOffset;
|
|
||||||
}
|
|
||||||
|
|
||||||
return pems.expiresAt + renewOffset;
|
|
||||||
};
|
|
||||||
58
errors.js
58
errors.js
@ -1,58 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var E = module.exports;
|
|
||||||
|
|
||||||
function create(code, msg) {
|
|
||||||
E[code] = function(ctx, msg2) {
|
|
||||||
var err = new Error(msg);
|
|
||||||
err.code = code;
|
|
||||||
err.context = ctx;
|
|
||||||
if (msg2) {
|
|
||||||
err.message += ': ' + msg2;
|
|
||||||
}
|
|
||||||
/*
|
|
||||||
Object.keys(extras).forEach(function(k) {
|
|
||||||
if ('message' === k) {
|
|
||||||
err.message += ': ' + extras[k];
|
|
||||||
} else {
|
|
||||||
err[k] = extras[k];
|
|
||||||
}
|
|
||||||
});
|
|
||||||
*/
|
|
||||||
return err;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
// TODO open issues and link to them as the error url
|
|
||||||
create(
|
|
||||||
'NO_MAINTAINER',
|
|
||||||
'please supply `maintainerEmail` as a contact for security and critical bug notices'
|
|
||||||
);
|
|
||||||
create(
|
|
||||||
'BAD_ORDER',
|
|
||||||
'altnames should be in deterministic order, with subject as the first altname'
|
|
||||||
);
|
|
||||||
create('NO_SUBJECT', 'no certificate subject given');
|
|
||||||
create(
|
|
||||||
'NO_SUBSCRIBER',
|
|
||||||
'please supply `subscriberEmail` as a contact for failed renewal and certificate revocation'
|
|
||||||
);
|
|
||||||
create(
|
|
||||||
'INVALID_SUBSCRIBER',
|
|
||||||
'`subscriberEmail` is not a valid address, please check for typos'
|
|
||||||
);
|
|
||||||
create(
|
|
||||||
'INVALID_HOSTNAME',
|
|
||||||
'valid hostnames must be restricted to a-z0-9_.- and contain at least one "."'
|
|
||||||
);
|
|
||||||
create(
|
|
||||||
'INVALID_DOMAIN',
|
|
||||||
'one or more domains do not exist on public DNS SOA record'
|
|
||||||
);
|
|
||||||
create(
|
|
||||||
'NOT_UNIQUE',
|
|
||||||
'found duplicate domains, or a subdomain that overlaps a wildcard'
|
|
||||||
);
|
|
||||||
|
|
||||||
// exported for testing only
|
|
||||||
E._create = create;
|
|
||||||
37
examples/README.md
Normal file
37
examples/README.md
Normal file
@ -0,0 +1,37 @@
|
|||||||
|
STOP
|
||||||
|
====
|
||||||
|
|
||||||
|
**These aren't the droids you're looking for.**
|
||||||
|
|
||||||
|
You probably don't want to use `node-letsencrypt` directly.
|
||||||
|
|
||||||
|
Instead, look here:
|
||||||
|
|
||||||
|
Webservers
|
||||||
|
----------
|
||||||
|
|
||||||
|
For any type of webserver (express, hapi, koa, connect, https, spdy, etc),
|
||||||
|
you're going to want to take a look at
|
||||||
|
[letsencrypt-express](https://github.com/Daplie/letsencrypt-express).
|
||||||
|
|
||||||
|
<https://github.com/Daplie/letsencrypt-express>
|
||||||
|
|
||||||
|
CLIs
|
||||||
|
----
|
||||||
|
|
||||||
|
For any type of CLI (like what you want to use with bash, fish, zsh, cmd.exe, PowerShell, etc),
|
||||||
|
you're going to want to take a look at
|
||||||
|
[letsencrypt-cli](https://github.com/Daplie/letsencrypt-cli).
|
||||||
|
|
||||||
|
<https://github.com/Daplie/letsencrypt-cli>
|
||||||
|
|
||||||
|
No, I wanted node-letsencrypt
|
||||||
|
=============================
|
||||||
|
|
||||||
|
Well, take a look at the API in the main README
|
||||||
|
and you can also check out the [scraps](https://github.com/Daplie/node-letsencrypt/tree/master/scraps).
|
||||||
|
|
||||||
|
Feel free to create issues for examples that don't work and pull requests if you fix one.
|
||||||
|
|
||||||
|
And please, please, do open an issue. We haven't updated the scrap examples
|
||||||
|
(hence being moved), but we do have it on the roadmap to bring back some raw API examples.
|
||||||
661
greenlock.js
661
greenlock.js
@ -1,661 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var pkg = require('./package.json');
|
|
||||||
|
|
||||||
var ACME = require('@root/acme');
|
|
||||||
var Greenlock = module.exports;
|
|
||||||
var request = require('@root/request');
|
|
||||||
var process = require('process');
|
|
||||||
|
|
||||||
var G = Greenlock;
|
|
||||||
var U = require('./utils.js');
|
|
||||||
var E = require('./errors.js');
|
|
||||||
var P = require('./plugins.js');
|
|
||||||
var A = require('./accounts.js');
|
|
||||||
var C = require('./certificates.js');
|
|
||||||
|
|
||||||
var DIR = require('./lib/directory-url.js');
|
|
||||||
var ChWrapper = require('./lib/challenges-wrapper.js');
|
|
||||||
var MngWrapper = require('./lib/manager-wrapper.js');
|
|
||||||
|
|
||||||
var UserEvents = require('./user-events.js');
|
|
||||||
var Init = require('./lib/init.js');
|
|
||||||
|
|
||||||
var caches = {};
|
|
||||||
|
|
||||||
// { maintainerEmail, directoryUrl, subscriberEmail, store, challenges }
|
|
||||||
G.create = function(gconf) {
|
|
||||||
var greenlock = {};
|
|
||||||
var gdefaults = {};
|
|
||||||
if (!gconf) {
|
|
||||||
gconf = {};
|
|
||||||
}
|
|
||||||
|
|
||||||
greenlock._create = function() {
|
|
||||||
if (!gconf._bin_mode) {
|
|
||||||
if (!gconf.maintainerEmail) {
|
|
||||||
throw E.NO_MAINTAINER('create');
|
|
||||||
}
|
|
||||||
|
|
||||||
// TODO send welcome message with benefit info
|
|
||||||
U._validMx(gconf.maintainerEmail).catch(function() {
|
|
||||||
console.error(
|
|
||||||
'invalid maintainer contact info:',
|
|
||||||
gconf.maintainerEmail
|
|
||||||
);
|
|
||||||
|
|
||||||
// maybe move this to init and don't exit the process, just in case
|
|
||||||
process.exit(1);
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('function' === typeof gconf.notify) {
|
|
||||||
gdefaults.notify = gconf.notify;
|
|
||||||
} else {
|
|
||||||
gdefaults.notify = _notify;
|
|
||||||
}
|
|
||||||
|
|
||||||
gconf = Init._init(gconf);
|
|
||||||
|
|
||||||
// OK: /path/to/blah
|
|
||||||
// OK: npm-name-blah
|
|
||||||
// NOT OK: ./rel/path/to/blah
|
|
||||||
// Error: .blah
|
|
||||||
if ('.' === (gconf.manager.module || '')[0]) {
|
|
||||||
if (!gconf.packageRoot) {
|
|
||||||
gconf.packageRoot = process.cwd();
|
|
||||||
console.warn(
|
|
||||||
'`packageRoot` not defined, trying ' + gconf.packageRoot
|
|
||||||
);
|
|
||||||
}
|
|
||||||
gconf.manager.module =
|
|
||||||
gconf.packageRoot + '/' + gconf.manager.module.slice(2);
|
|
||||||
}
|
|
||||||
|
|
||||||
// Wraps each of the following with appropriate error checking
|
|
||||||
// greenlock.manager.defaults
|
|
||||||
// greenlock.sites.add
|
|
||||||
// greenlock.sites.update
|
|
||||||
// greenlock.sites.remove
|
|
||||||
// greenlock.sites.find
|
|
||||||
// greenlock.sites.get
|
|
||||||
MngWrapper.wrap(greenlock, gconf);
|
|
||||||
// The goal here is to reduce boilerplate, such as error checking
|
|
||||||
// and duration parsing, that a manager must implement
|
|
||||||
greenlock.sites.add = greenlock.add = greenlock.manager.add;
|
|
||||||
greenlock.sites.update = greenlock.update = greenlock.manager.update;
|
|
||||||
greenlock.sites.remove = greenlock.remove = greenlock.manager.remove;
|
|
||||||
|
|
||||||
// Exports challenges.get for Greenlock Express HTTP-01,
|
|
||||||
// and whatever odd use case pops up, I suppose
|
|
||||||
// greenlock.challenges.get
|
|
||||||
ChWrapper.wrap(greenlock);
|
|
||||||
|
|
||||||
DIR._getDefaultDirectoryUrl('', gconf.staging, '');
|
|
||||||
if (gconf.directoryUrl) {
|
|
||||||
gdefaults.directoryUrl = gconf.directoryUrl;
|
|
||||||
}
|
|
||||||
|
|
||||||
greenlock._defaults = gdefaults;
|
|
||||||
greenlock._defaults.debug = gconf.debug;
|
|
||||||
|
|
||||||
if (!gconf._bin_mode && false !== gconf.renew) {
|
|
||||||
// renew every 90-ish minutes (random for staggering)
|
|
||||||
// the weak setTimeout (unref) means that when run as a CLI process this
|
|
||||||
// will still finish as expected, and not wait on the timeout
|
|
||||||
(function renew() {
|
|
||||||
setTimeout(function() {
|
|
||||||
greenlock.renew({});
|
|
||||||
renew();
|
|
||||||
}, Math.PI * 30 * 60 * 1000).unref();
|
|
||||||
})();
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
// The purpose of init is to make MCONF the source of truth
|
|
||||||
greenlock._init = function() {
|
|
||||||
var p;
|
|
||||||
greenlock._init = function() {
|
|
||||||
return p;
|
|
||||||
};
|
|
||||||
|
|
||||||
p = greenlock.manager
|
|
||||||
.init({
|
|
||||||
request: request
|
|
||||||
//punycode: require('punycode')
|
|
||||||
})
|
|
||||||
.then(async function() {
|
|
||||||
var MCONF = await greenlock.manager._defaults();
|
|
||||||
mergeDefaults(MCONF, gconf);
|
|
||||||
if (true === MCONF.agreeToTerms) {
|
|
||||||
gdefaults.agreeToTerms = function(tos) {
|
|
||||||
return Promise.resolve(tos);
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
return greenlock.manager._defaults(MCONF);
|
|
||||||
})
|
|
||||||
.catch(function(err) {
|
|
||||||
if ('load_plugin' !== err.context) {
|
|
||||||
console.error('Fatal error during greenlock init:');
|
|
||||||
console.error(err.message);
|
|
||||||
}
|
|
||||||
if (!gconf._bin_mode) {
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
return p;
|
|
||||||
};
|
|
||||||
|
|
||||||
greenlock.notify = greenlock._notify = function(ev, params) {
|
|
||||||
var mng = greenlock.manager;
|
|
||||||
|
|
||||||
if ('_' === String(ev)[0]) {
|
|
||||||
if ('_cert_issue' === ev) {
|
|
||||||
try {
|
|
||||||
mng.update({
|
|
||||||
subject: params.subject,
|
|
||||||
renewAt: params.renewAt
|
|
||||||
}).catch(function(e) {
|
|
||||||
e.context = '_cert_issue';
|
|
||||||
greenlock._notify('error', e);
|
|
||||||
});
|
|
||||||
} catch (e) {
|
|
||||||
e.context = '_cert_issue';
|
|
||||||
greenlock._notify('error', e);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
// trap internal events internally
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
try {
|
|
||||||
var p = greenlock._defaults.notify(ev, params);
|
|
||||||
if (p && p.catch) {
|
|
||||||
p.catch(function(e) {
|
|
||||||
console.error("Promise Rejection on event '" + ev + "':");
|
|
||||||
console.error(e);
|
|
||||||
});
|
|
||||||
}
|
|
||||||
} catch (e) {
|
|
||||||
console.error("Thrown Exception on event '" + ev + "':");
|
|
||||||
console.error(e);
|
|
||||||
console.error(params);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (-1 !== ['cert_issue', 'cert_renewal'].indexOf(ev)) {
|
|
||||||
// We will notify all greenlock users of mandatory and security updates
|
|
||||||
// We'll keep track of versions and os so we can make sure things work well
|
|
||||||
// { name, version, email, domains, action, communityMember, telemetry }
|
|
||||||
// TODO look at the other one
|
|
||||||
UserEvents.notify({
|
|
||||||
/*
|
|
||||||
// maintainer should be only on pre-publish, or maybe install, I think
|
|
||||||
maintainerEmail: greenlock._defaults._maintainerEmail,
|
|
||||||
name: greenlock._defaults._packageAgent,
|
|
||||||
version: greenlock._defaults._maintainerPackageVersion,
|
|
||||||
//action: params.pems._type,
|
|
||||||
domains: params.altnames,
|
|
||||||
subscriberEmail: greenlock._defaults._subscriberEmail,
|
|
||||||
// TODO enable for Greenlock Pro
|
|
||||||
//customerEmail: args.customerEmail
|
|
||||||
telemetry: greenlock._defaults.telemetry
|
|
||||||
*/
|
|
||||||
});
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
// certs.get
|
|
||||||
greenlock.get = async function(args) {
|
|
||||||
greenlock._single(args);
|
|
||||||
args._includePems = true;
|
|
||||||
var results = await greenlock.renew(args);
|
|
||||||
if (!results || !results.length) {
|
|
||||||
// TODO throw an error here?
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
// just get the first one
|
|
||||||
var result = results[0];
|
|
||||||
|
|
||||||
// (there should be only one, ideally)
|
|
||||||
if (results.length > 1) {
|
|
||||||
var err = new Error(
|
|
||||||
"a search for '" +
|
|
||||||
args.servername +
|
|
||||||
"' returned multiple certificates"
|
|
||||||
);
|
|
||||||
err.context = 'duplicate_certs';
|
|
||||||
err.servername = args.servername;
|
|
||||||
err.subjects = results.map(function(r) {
|
|
||||||
return (r.site || {}).subject || 'N/A';
|
|
||||||
});
|
|
||||||
|
|
||||||
greenlock._notify('warning', err);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (result.error) {
|
|
||||||
return Promise.reject(result.error);
|
|
||||||
}
|
|
||||||
|
|
||||||
// site for plugin options, such as http-01 challenge
|
|
||||||
// pems for the obvious reasons
|
|
||||||
return result;
|
|
||||||
};
|
|
||||||
|
|
||||||
// TODO remove async here, it doesn't matter
|
|
||||||
greenlock._single = async function(args) {
|
|
||||||
if ('string' !== typeof args.servername) {
|
|
||||||
throw new Error('no `servername` given');
|
|
||||||
}
|
|
||||||
// www.example.com => *.example.com
|
|
||||||
args.wildname =
|
|
||||||
'*.' +
|
|
||||||
args.servername
|
|
||||||
.split('.')
|
|
||||||
.slice(1)
|
|
||||||
.join('.');
|
|
||||||
if (args.wildname.split('.').length < 3) {
|
|
||||||
// No '*.com'
|
|
||||||
args.wildname = '';
|
|
||||||
}
|
|
||||||
if (
|
|
||||||
args.servernames ||
|
|
||||||
//TODO I think we need to block altnames as well, but I don't want to break anything
|
|
||||||
//args.altnames ||
|
|
||||||
args.subject ||
|
|
||||||
args.renewBefore ||
|
|
||||||
args.issueBefore ||
|
|
||||||
args.expiresBefore
|
|
||||||
) {
|
|
||||||
throw new Error(
|
|
||||||
'bad arguments, did you mean to call greenlock.renew()?'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
// duplicate, force, and others still allowed
|
|
||||||
return args;
|
|
||||||
};
|
|
||||||
|
|
||||||
greenlock._config = async function(args) {
|
|
||||||
greenlock._single(args);
|
|
||||||
var sites = await greenlock._configAll(args);
|
|
||||||
return sites[0];
|
|
||||||
};
|
|
||||||
greenlock._configAll = async function(args) {
|
|
||||||
var sites = await greenlock._find(args);
|
|
||||||
if (!sites || !sites.length) {
|
|
||||||
return [];
|
|
||||||
}
|
|
||||||
sites = JSON.parse(JSON.stringify(sites));
|
|
||||||
var mconf = await greenlock.manager._defaults();
|
|
||||||
return sites.map(function(site) {
|
|
||||||
if (site.store && site.challenges) {
|
|
||||||
return site;
|
|
||||||
}
|
|
||||||
|
|
||||||
var dconf = site;
|
|
||||||
// TODO make cli and api mode the same
|
|
||||||
if (gconf._bin_mode) {
|
|
||||||
dconf = site.defaults = {};
|
|
||||||
}
|
|
||||||
if (!site.store) {
|
|
||||||
dconf.store = mconf.store;
|
|
||||||
}
|
|
||||||
if (!site.challenges) {
|
|
||||||
dconf.challenges = mconf.challenges;
|
|
||||||
}
|
|
||||||
return site;
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
// needs to get info about the renewal, such as which store and challenge(s) to use
|
|
||||||
greenlock.renew = async function(args) {
|
|
||||||
await greenlock._init();
|
|
||||||
var mconf = await greenlock.manager._defaults();
|
|
||||||
return greenlock._renew(mconf, args);
|
|
||||||
};
|
|
||||||
greenlock._renew = async function(mconf, args) {
|
|
||||||
if (!args) {
|
|
||||||
args = {};
|
|
||||||
}
|
|
||||||
|
|
||||||
var renewedOrFailed = [];
|
|
||||||
//console.log('greenlock._renew find', args);
|
|
||||||
var sites = await greenlock._find(args);
|
|
||||||
// Note: the manager must guaranteed that these are mutable copies
|
|
||||||
//console.log('greenlock._renew found', sites);;
|
|
||||||
|
|
||||||
if (!Array.isArray(sites)) {
|
|
||||||
throw new Error(
|
|
||||||
'Developer Error: not an array of sites returned from find: ' +
|
|
||||||
JSON.stringify(sites)
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
await (async function next() {
|
|
||||||
var site = sites.shift();
|
|
||||||
if (!site) {
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
var order = { site: site };
|
|
||||||
renewedOrFailed.push(order);
|
|
||||||
// TODO merge args + result?
|
|
||||||
return greenlock
|
|
||||||
._order(mconf, site)
|
|
||||||
.then(function(pems) {
|
|
||||||
if (args._includePems) {
|
|
||||||
order.pems = pems;
|
|
||||||
}
|
|
||||||
})
|
|
||||||
.catch(function(err) {
|
|
||||||
order.error = err;
|
|
||||||
|
|
||||||
// For greenlock express serialization
|
|
||||||
err.toJSON = errorToJSON;
|
|
||||||
err.context = err.context || 'cert_order';
|
|
||||||
err.subject = site.subject;
|
|
||||||
if (args.servername) {
|
|
||||||
err.servername = args.servername;
|
|
||||||
}
|
|
||||||
// for debugging, but not to be relied on
|
|
||||||
err._site = site;
|
|
||||||
// TODO err.context = err.context || 'renew_certificate'
|
|
||||||
greenlock._notify('error', err);
|
|
||||||
})
|
|
||||||
.then(function() {
|
|
||||||
return next();
|
|
||||||
});
|
|
||||||
})();
|
|
||||||
|
|
||||||
return renewedOrFailed;
|
|
||||||
};
|
|
||||||
|
|
||||||
greenlock._acme = async function(mconf, args, dirUrl) {
|
|
||||||
var packageAgent = gconf.packageAgent || '';
|
|
||||||
// because Greenlock_Express/v3.x Greenlock/v3 is redundant
|
|
||||||
if (!/greenlock/i.test(packageAgent)) {
|
|
||||||
packageAgent = (packageAgent + ' Greenlock/' + pkg.version).trim();
|
|
||||||
}
|
|
||||||
var acme = ACME.create({
|
|
||||||
maintainerEmail: gconf.maintainerEmail,
|
|
||||||
packageAgent: packageAgent,
|
|
||||||
notify: greenlock._notify,
|
|
||||||
debug: greenlock._defaults.debug || args.debug
|
|
||||||
});
|
|
||||||
|
|
||||||
var dir = caches[dirUrl];
|
|
||||||
// don't cache more than an hour
|
|
||||||
if (dir && Date.now() - dir.ts < 1 * 60 * 60 * 1000) {
|
|
||||||
return dir.promise;
|
|
||||||
}
|
|
||||||
|
|
||||||
await acme.init(dirUrl).catch(function(err) {
|
|
||||||
// TODO this is a special kind of failure mode. What should we do?
|
|
||||||
console.error(
|
|
||||||
"[debug] Let's Encrypt may be down for maintenance or `directoryUrl` may be wrong"
|
|
||||||
);
|
|
||||||
throw err;
|
|
||||||
});
|
|
||||||
|
|
||||||
caches[dirUrl] = {
|
|
||||||
promise: Promise.resolve(acme),
|
|
||||||
ts: Date.now()
|
|
||||||
};
|
|
||||||
return acme;
|
|
||||||
};
|
|
||||||
|
|
||||||
greenlock.order = async function(siteConf) {
|
|
||||||
await greenlock._init();
|
|
||||||
var mconf = await greenlock.manager._defaults();
|
|
||||||
return greenlock._order(mconf, siteConf);
|
|
||||||
};
|
|
||||||
greenlock._order = async function(mconf, siteConf) {
|
|
||||||
// packageAgent, maintainerEmail
|
|
||||||
|
|
||||||
var dirUrl = DIR._getDirectoryUrl(
|
|
||||||
siteConf.directoryUrl || mconf.directoryUrl,
|
|
||||||
siteConf.subject
|
|
||||||
);
|
|
||||||
|
|
||||||
var acme = await greenlock._acme(mconf, siteConf, dirUrl);
|
|
||||||
var storeConf = siteConf.store || mconf.store;
|
|
||||||
storeConf = JSON.parse(JSON.stringify(storeConf));
|
|
||||||
storeConf.packageRoot = gconf.packageRoot;
|
|
||||||
|
|
||||||
if (!storeConf.basePath) {
|
|
||||||
storeConf.basePath = gconf.configDir;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('.' === (storeConf.basePath || '')[0]) {
|
|
||||||
if (!gconf.packageRoot) {
|
|
||||||
gconf.packageRoot = process.cwd();
|
|
||||||
console.warn(
|
|
||||||
'`packageRoot` not defined, trying ' + gconf.packageRoot
|
|
||||||
);
|
|
||||||
}
|
|
||||||
storeConf.basePath = require('path').resolve(
|
|
||||||
gconf.packageRoot || '',
|
|
||||||
storeConf.basePath
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
storeConf.directoryUrl = dirUrl;
|
|
||||||
var store = await P._loadStore(storeConf);
|
|
||||||
var account = await A._getOrCreate(
|
|
||||||
greenlock,
|
|
||||||
mconf,
|
|
||||||
store.accounts,
|
|
||||||
acme,
|
|
||||||
siteConf
|
|
||||||
);
|
|
||||||
var challengeConfs = siteConf.challenges || mconf.challenges;
|
|
||||||
var challenges = {};
|
|
||||||
var arr = await Promise.all(
|
|
||||||
Object.keys(challengeConfs).map(function(typ01) {
|
|
||||||
return P._loadChallenge(challengeConfs, typ01);
|
|
||||||
})
|
|
||||||
);
|
|
||||||
arr.forEach(function(el) {
|
|
||||||
challenges[el._type] = el;
|
|
||||||
});
|
|
||||||
|
|
||||||
var pems = await C._getOrOrder(
|
|
||||||
greenlock,
|
|
||||||
mconf,
|
|
||||||
store.certificates,
|
|
||||||
acme,
|
|
||||||
challenges,
|
|
||||||
account,
|
|
||||||
siteConf
|
|
||||||
);
|
|
||||||
if (!pems) {
|
|
||||||
throw new Error('no order result');
|
|
||||||
}
|
|
||||||
if (!pems.privkey) {
|
|
||||||
throw new Error('missing private key, which is kinda important');
|
|
||||||
}
|
|
||||||
|
|
||||||
return pems;
|
|
||||||
};
|
|
||||||
|
|
||||||
greenlock._create();
|
|
||||||
|
|
||||||
return greenlock;
|
|
||||||
};
|
|
||||||
|
|
||||||
G._loadChallenge = P._loadChallenge;
|
|
||||||
|
|
||||||
function errorToJSON(e) {
|
|
||||||
var error = {};
|
|
||||||
Object.getOwnPropertyNames(e).forEach(function(k) {
|
|
||||||
error[k] = e[k];
|
|
||||||
});
|
|
||||||
return error;
|
|
||||||
}
|
|
||||||
|
|
||||||
function mergeDefaults(MCONF, gconf) {
|
|
||||||
if (
|
|
||||||
gconf.agreeToTerms === true ||
|
|
||||||
MCONF.agreeToTerms === true ||
|
|
||||||
// TODO deprecate
|
|
||||||
gconf.agreeTos === true ||
|
|
||||||
MCONF.agreeTos === true
|
|
||||||
) {
|
|
||||||
MCONF.agreeToTerms = true;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!MCONF.subscriberEmail && gconf.subscriberEmail) {
|
|
||||||
MCONF.subscriberEmail = gconf.subscriberEmail;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Load the default store module
|
|
||||||
if (!MCONF.store) {
|
|
||||||
if (gconf.store) {
|
|
||||||
MCONF.store = gconf.store;
|
|
||||||
} else {
|
|
||||||
MCONF.store = {
|
|
||||||
module: 'greenlock-store-fs'
|
|
||||||
};
|
|
||||||
console.info('[default] store.module: ' + MCONF.store.module);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
if ('greenlock-store-fs' === MCONF.store.module && !MCONF.store.basePath) {
|
|
||||||
//homedir = require('os').homedir();
|
|
||||||
if (gconf.configFile) {
|
|
||||||
MCONF.store.basePath = gconf.configFile.replace(/\.json$/i, '.d');
|
|
||||||
} else {
|
|
||||||
MCONF.store.basePath = './greenlock.d';
|
|
||||||
}
|
|
||||||
}
|
|
||||||
*/
|
|
||||||
|
|
||||||
// just to test that it loads
|
|
||||||
P._loadSync(MCONF.store.module);
|
|
||||||
|
|
||||||
// Load the default challenge modules
|
|
||||||
var challenges = MCONF.challenges || gconf.challenges;
|
|
||||||
if (!challenges) {
|
|
||||||
challenges = {};
|
|
||||||
}
|
|
||||||
if (!challenges['http-01'] && !challenges['dns-01']) {
|
|
||||||
challenges['http-01'] = { module: 'acme-http-01-standalone' };
|
|
||||||
console.info(
|
|
||||||
'[default] challenges.http-01.module: ' +
|
|
||||||
challenges['http-01'].module
|
|
||||||
);
|
|
||||||
}
|
|
||||||
if (challenges['http-01']) {
|
|
||||||
if ('string' !== typeof challenges['http-01'].module) {
|
|
||||||
throw new Error(
|
|
||||||
'bad challenge http-01 module config:' +
|
|
||||||
JSON.stringify(challenges['http-01'])
|
|
||||||
);
|
|
||||||
}
|
|
||||||
P._loadSync(challenges['http-01'].module);
|
|
||||||
}
|
|
||||||
if (challenges['dns-01']) {
|
|
||||||
if ('string' !== typeof challenges['dns-01'].module) {
|
|
||||||
throw new Error(
|
|
||||||
'bad challenge dns-01 module config' +
|
|
||||||
JSON.stringify(challenges['dns-01'])
|
|
||||||
);
|
|
||||||
}
|
|
||||||
P._loadSync(challenges['dns-01'].module);
|
|
||||||
}
|
|
||||||
MCONF.challenges = challenges;
|
|
||||||
|
|
||||||
if (!MCONF.renewOffset) {
|
|
||||||
MCONF.renewOffset = gconf.renewOffset || '-45d';
|
|
||||||
console.info('[default] renewOffset: ' + MCONF.renewOffset);
|
|
||||||
}
|
|
||||||
if (!MCONF.renewStagger) {
|
|
||||||
MCONF.renewStagger = gconf.renewStagger || '3d';
|
|
||||||
console.info('[default] renewStagger: ' + MCONF.renewStagger);
|
|
||||||
}
|
|
||||||
|
|
||||||
var vers = process.versions.node.split('.');
|
|
||||||
var defaultKeyType = 'EC-P256';
|
|
||||||
if (vers[0] < 10 || (vers[0] === '10' && vers[1] < '12')) {
|
|
||||||
defaultKeyType = 'RSA-2048';
|
|
||||||
}
|
|
||||||
if (!MCONF.accountKeyType) {
|
|
||||||
MCONF.accountKeyType = gconf.accountKeyType || defaultKeyType;
|
|
||||||
console.info('[default] accountKeyType: ' + MCONF.accountKeyType);
|
|
||||||
}
|
|
||||||
if (!MCONF.serverKeyType) {
|
|
||||||
MCONF.serverKeyType = gconf.serverKeyType || 'RSA-2048';
|
|
||||||
console.info('[default] serverKeyType: ' + MCONF.serverKeyType);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!MCONF.subscriberEmail && false !== MCONF.subscriberEmail) {
|
|
||||||
MCONF.subscriberEmail =
|
|
||||||
gconf.subscriberEmail || gconf.maintainerEmail || undefined;
|
|
||||||
MCONF.agreeToTerms = gconf.agreeToTerms || undefined;
|
|
||||||
console.info('');
|
|
||||||
console.info('[default] subscriberEmail: ' + MCONF.subscriberEmail);
|
|
||||||
console.info(
|
|
||||||
'[default] agreeToTerms: ' +
|
|
||||||
(MCONF.agreeToTerms ||
|
|
||||||
gconf.agreeToTerms ||
|
|
||||||
'(show notice on use)')
|
|
||||||
);
|
|
||||||
console.info('');
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
function _notify(ev, args) {
|
|
||||||
if (!args) {
|
|
||||||
args = ev;
|
|
||||||
ev = args.event;
|
|
||||||
delete args.event;
|
|
||||||
}
|
|
||||||
|
|
||||||
// TODO define message types
|
|
||||||
if (!_notify._notice) {
|
|
||||||
console.info(
|
|
||||||
'set greenlockOptions.notify to override the default logger'
|
|
||||||
);
|
|
||||||
_notify._notice = true;
|
|
||||||
}
|
|
||||||
var prefix = 'Warning';
|
|
||||||
switch (ev) {
|
|
||||||
case 'error':
|
|
||||||
prefix = 'Error';
|
|
||||||
/* falls through */
|
|
||||||
case 'warning':
|
|
||||||
console.error(
|
|
||||||
prefix + '%s:',
|
|
||||||
(' ' + (args.context || '')).trimRight()
|
|
||||||
);
|
|
||||||
console.error(args.message);
|
|
||||||
if (args.description) {
|
|
||||||
console.error(args.description);
|
|
||||||
}
|
|
||||||
if (args.code) {
|
|
||||||
console.error('code:', args.code);
|
|
||||||
}
|
|
||||||
if (args.stack) {
|
|
||||||
console.error(args.stack);
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
if (/status/.test(ev)) {
|
|
||||||
console.info(
|
|
||||||
ev,
|
|
||||||
args.altname || args.subject || '',
|
|
||||||
args.status || ''
|
|
||||||
);
|
|
||||||
if (!args.status) {
|
|
||||||
console.info(args);
|
|
||||||
}
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
console.info(
|
|
||||||
ev,
|
|
||||||
'(more info available: ' + Object.keys(args).join(' ') + ')'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
191
greenlockrc.js
191
greenlockrc.js
@ -1,191 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
// TODO how to handle path differences when run from npx vs when required by greenlock?
|
|
||||||
|
|
||||||
var fs = require('fs');
|
|
||||||
var path = require('path');
|
|
||||||
|
|
||||||
function saveFile(rcpath, data, enc) {
|
|
||||||
// because this may have a database url or some such
|
|
||||||
fs.writeFileSync(rcpath, data, enc);
|
|
||||||
return fs.chmodSync(rcpath, parseInt('0600', 8));
|
|
||||||
}
|
|
||||||
|
|
||||||
var GRC = (module.exports = function(pkgpath, manager, rc) {
|
|
||||||
// TODO when run from package
|
|
||||||
// Run from the package root (assumed) or exit
|
|
||||||
var pkgdir = path.dirname(pkgpath);
|
|
||||||
|
|
||||||
try {
|
|
||||||
require(pkgpath);
|
|
||||||
} catch (e) {
|
|
||||||
console.error(
|
|
||||||
'npx greenlock must be run from the package root (where package.json is)'
|
|
||||||
);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
try {
|
|
||||||
return module.exports._defaults(pkgdir, manager, rc);
|
|
||||||
} catch (e) {
|
|
||||||
if ('package.json' === e.context) {
|
|
||||||
console.error(e.desc);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
console.error(e.message);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
// Figure out what to do between what's hard-coded,
|
|
||||||
// what's in the config file, and what's left unset
|
|
||||||
module.exports.resolve = function(gconf) {
|
|
||||||
var rc = GRC.read(gconf.packageRoot);
|
|
||||||
if (gconf.configFile) {
|
|
||||||
rc = { configFile: gconf.configFile };
|
|
||||||
}
|
|
||||||
|
|
||||||
var manager;
|
|
||||||
var updates;
|
|
||||||
|
|
||||||
if (rc.manager) {
|
|
||||||
if (gconf.manager && rc.manager !== gconf.manager) {
|
|
||||||
console.warn(
|
|
||||||
'warn: ignoring hard-coded ' +
|
|
||||||
gconf.manager +
|
|
||||||
' in favor of ' +
|
|
||||||
rc.manager
|
|
||||||
);
|
|
||||||
}
|
|
||||||
gconf.manager = rc.manager;
|
|
||||||
} else if (gconf.manager) {
|
|
||||||
manager = gconf.manager;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (rc.configFile) {
|
|
||||||
if (gconf.configFile && rc.configFile !== gconf.configFile) {
|
|
||||||
console.warn(
|
|
||||||
'warn: ignoring hard-coded ' +
|
|
||||||
gconf.configFile +
|
|
||||||
' in favor of ' +
|
|
||||||
rc.configFile
|
|
||||||
);
|
|
||||||
}
|
|
||||||
gconf.configFile = rc.configFile;
|
|
||||||
} else if (gconf.manager) {
|
|
||||||
updates = { configFile: gconf.configFile };
|
|
||||||
}
|
|
||||||
|
|
||||||
return GRC._defaults(gconf.packageRoot, manager, rc);
|
|
||||||
};
|
|
||||||
|
|
||||||
module.exports._defaults = function(pkgdir, manager, rc) {
|
|
||||||
var rcpath = path.join(pkgdir, '.greenlockrc');
|
|
||||||
var _rc;
|
|
||||||
var created = false;
|
|
||||||
|
|
||||||
if (manager) {
|
|
||||||
if ('.' === manager[0]) {
|
|
||||||
manager = path.resolve(pkgdir, manager);
|
|
||||||
}
|
|
||||||
try {
|
|
||||||
require(manager);
|
|
||||||
} catch (e) {
|
|
||||||
console.error('could not load ' + manager + ' from ' + pkgdir);
|
|
||||||
throw e;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
var stuff = module.exports._read(pkgdir);
|
|
||||||
_rc = stuff.rc;
|
|
||||||
created = stuff.created;
|
|
||||||
|
|
||||||
var changed;
|
|
||||||
if (manager) {
|
|
||||||
if (!_rc.manager) {
|
|
||||||
_rc.manager = manager;
|
|
||||||
}
|
|
||||||
if (_rc.manager !== manager) {
|
|
||||||
console.info('Switching manager:');
|
|
||||||
var older = _rc.manager;
|
|
||||||
var newer = manager;
|
|
||||||
if ('/' === older[0]) {
|
|
||||||
older = path.relative(pkgdir, older);
|
|
||||||
}
|
|
||||||
if ('/' === newer[0]) {
|
|
||||||
newer = path.relative(pkgdir, newer);
|
|
||||||
}
|
|
||||||
console.info('\told: ' + older);
|
|
||||||
console.info('\tnew: ' + newer);
|
|
||||||
changed = true;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (rc) {
|
|
||||||
changed = true;
|
|
||||||
Object.keys(rc).forEach(function(k) {
|
|
||||||
_rc[k] = rc[k];
|
|
||||||
});
|
|
||||||
}
|
|
||||||
|
|
||||||
if (['@greenlock/manager', 'greenlock-manager-fs'].includes(_rc.manager)) {
|
|
||||||
if (!_rc.configFile) {
|
|
||||||
changed = true;
|
|
||||||
_rc.configFile = path.join(pkgdir, 'greenlock.json');
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!changed) {
|
|
||||||
return _rc;
|
|
||||||
}
|
|
||||||
|
|
||||||
var data = JSON.stringify(_rc, null, 2);
|
|
||||||
if (created) {
|
|
||||||
console.info('Wrote ' + rcpath);
|
|
||||||
}
|
|
||||||
saveFile(rcpath, data, 'utf8');
|
|
||||||
return _rc;
|
|
||||||
};
|
|
||||||
|
|
||||||
module.exports.read = function(pkgdir) {
|
|
||||||
return module.exports._read(pkgdir).rc;
|
|
||||||
};
|
|
||||||
|
|
||||||
module.exports._read = function(pkgdir) {
|
|
||||||
var created;
|
|
||||||
var rcpath = path.join(pkgdir, '.greenlockrc');
|
|
||||||
var _data;
|
|
||||||
try {
|
|
||||||
_data = fs.readFileSync(rcpath, 'utf8');
|
|
||||||
} catch (err) {
|
|
||||||
if ('ENOENT' !== err.code) {
|
|
||||||
throw err;
|
|
||||||
}
|
|
||||||
try {
|
|
||||||
require(path.resolve(path.join(pkgdir, './package.json')));
|
|
||||||
} catch (e) {
|
|
||||||
e.context = 'package.json';
|
|
||||||
e.desc =
|
|
||||||
'run `greenlock` from the same directory as `package.json`, or specify `packageRoot` of `.greenlockrc`';
|
|
||||||
throw e;
|
|
||||||
}
|
|
||||||
console.info('Creating ' + rcpath);
|
|
||||||
created = true;
|
|
||||||
_data = '{}';
|
|
||||||
saveFile(rcpath, _data, 'utf8');
|
|
||||||
}
|
|
||||||
|
|
||||||
var rc;
|
|
||||||
try {
|
|
||||||
rc = JSON.parse(_data);
|
|
||||||
} catch (e) {
|
|
||||||
console.error("couldn't parse " + rcpath, _data);
|
|
||||||
console.error('(perhaps you should just delete it and try again?)');
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
return {
|
|
||||||
created: created,
|
|
||||||
rc: rc
|
|
||||||
};
|
|
||||||
};
|
|
||||||
328
index.js
Normal file
328
index.js
Normal file
@ -0,0 +1,328 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
// TODO handle www and no-www together somehow?
|
||||||
|
|
||||||
|
var PromiseA = require('bluebird');
|
||||||
|
var leCore = require('letiny-core');
|
||||||
|
var merge = require('./lib/common').merge;
|
||||||
|
var tplCopy = require('./lib/common').tplCopy;
|
||||||
|
|
||||||
|
var LE = module.exports;
|
||||||
|
LE.productionServerUrl = leCore.productionServerUrl;
|
||||||
|
LE.stagingServerUrl = leCore.stagingServerUrl;
|
||||||
|
LE.configDir = leCore.configDir;
|
||||||
|
LE.logsDir = leCore.logsDir;
|
||||||
|
LE.workDir = leCore.workDir;
|
||||||
|
LE.acmeChallengPrefix = leCore.acmeChallengPrefix;
|
||||||
|
LE.knownEndpoints = leCore.knownEndpoints;
|
||||||
|
|
||||||
|
LE.privkeyPath = ':config/live/:hostname/privkey.pem';
|
||||||
|
LE.fullchainPath = ':config/live/:hostname/fullchain.pem';
|
||||||
|
LE.certPath = ':config/live/:hostname/cert.pem';
|
||||||
|
LE.chainPath = ':config/live/:hostname/chain.pem';
|
||||||
|
LE.renewalPath = ':config/renewal/:hostname.conf';
|
||||||
|
LE.accountsDir = ':config/accounts/:server';
|
||||||
|
LE.defaults = {
|
||||||
|
privkeyPath: LE.privkeyPath
|
||||||
|
, fullchainPath: LE.fullchainPath
|
||||||
|
, certPath: LE.certPath
|
||||||
|
, chainPath: LE.chainPath
|
||||||
|
, renewalPath: LE.renewalPath
|
||||||
|
, accountsDir: LE.accountsDir
|
||||||
|
, server: LE.productionServerUrl
|
||||||
|
};
|
||||||
|
|
||||||
|
// backwards compat
|
||||||
|
LE.stagingServer = leCore.stagingServerUrl;
|
||||||
|
LE.liveServer = leCore.productionServerUrl;
|
||||||
|
LE.knownUrls = leCore.knownEndpoints;
|
||||||
|
|
||||||
|
LE.merge = require('./lib/common').merge;
|
||||||
|
LE.tplConfigDir = require('./lib/common').tplConfigDir;
|
||||||
|
|
||||||
|
// backend, defaults, handlers
|
||||||
|
LE.create = function (defaults, handlers, backend) {
|
||||||
|
var d, b, h;
|
||||||
|
// backwards compat for <= v1.0.2
|
||||||
|
if (defaults.registerAsync || defaults.create) {
|
||||||
|
b = defaults; d = handlers; h = backend;
|
||||||
|
defaults = d; handlers = h; backend = b;
|
||||||
|
}
|
||||||
|
if (!backend) { backend = require('./lib/core'); }
|
||||||
|
if (!handlers) { handlers = {}; }
|
||||||
|
if (!handlers.lifetime) { handlers.lifetime = 90 * 24 * 60 * 60 * 1000; }
|
||||||
|
if (!handlers.renewWithin) { handlers.renewWithin = 3 * 24 * 60 * 60 * 1000; }
|
||||||
|
if (!handlers.memorizeFor) { handlers.memorizeFor = 1 * 24 * 60 * 60 * 1000; }
|
||||||
|
if (!handlers.sniRegisterCallback) {
|
||||||
|
handlers.sniRegisterCallback = function (args, cache, cb) {
|
||||||
|
// TODO when we have ECDSA, just do this automatically
|
||||||
|
cb(null, null);
|
||||||
|
};
|
||||||
|
}
|
||||||
|
if (!handlers.getChallenge) {
|
||||||
|
if (!defaults.manual && !defaults.webrootPath) {
|
||||||
|
// GET /.well-known/acme-challenge/{{challengeKey}} should return {{tokenValue}}
|
||||||
|
throw new Error("handlers.getChallenge or defaults.webrootPath must be set");
|
||||||
|
}
|
||||||
|
handlers.getChallenge = function (hostname, key, done) {
|
||||||
|
// TODO associate by hostname?
|
||||||
|
// hmm... I don't think there's a direct way to associate this with
|
||||||
|
// the request it came from... it's kinda stateless in that way
|
||||||
|
// but realistically there only needs to be one handler and one
|
||||||
|
// "directory" for this. It's not that big of a deal.
|
||||||
|
var defaultos = LE.merge(defaults, {});
|
||||||
|
var getChallenge = require('./lib/default-handlers').getChallenge;
|
||||||
|
var copy = merge(defaults, { domains: [hostname] });
|
||||||
|
|
||||||
|
tplCopy(copy);
|
||||||
|
defaultos.domains = [hostname];
|
||||||
|
|
||||||
|
if (3 === getChallenge.length) {
|
||||||
|
getChallenge(defaultos, key, done);
|
||||||
|
}
|
||||||
|
else if (4 === getChallenge.length) {
|
||||||
|
getChallenge(defaultos, hostname, key, done);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
done(new Error("handlers.getChallenge [1] receives the wrong number of arguments"));
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
if (!handlers.setChallenge) {
|
||||||
|
if (!defaults.webrootPath) {
|
||||||
|
// GET /.well-known/acme-challenge/{{challengeKey}} should return {{tokenValue}}
|
||||||
|
throw new Error("handlers.setChallenge or defaults.webrootPath must be set");
|
||||||
|
}
|
||||||
|
handlers.setChallenge = require('./lib/default-handlers').setChallenge;
|
||||||
|
}
|
||||||
|
if (!handlers.removeChallenge) {
|
||||||
|
if (!defaults.webrootPath) {
|
||||||
|
// GET /.well-known/acme-challenge/{{challengeKey}} should return {{tokenValue}}
|
||||||
|
throw new Error("handlers.removeChallenge or defaults.webrootPath must be set");
|
||||||
|
}
|
||||||
|
handlers.removeChallenge = require('./lib/default-handlers').removeChallenge;
|
||||||
|
}
|
||||||
|
if (!handlers.agreeToTerms) {
|
||||||
|
if (defaults.agreeTos) {
|
||||||
|
console.warn("[WARN] Agreeing to terms by default is risky business...");
|
||||||
|
}
|
||||||
|
handlers.agreeToTerms = require('./lib/default-handlers').agreeToTerms;
|
||||||
|
}
|
||||||
|
if ('function' === typeof backend.create) {
|
||||||
|
backend = backend.create(defaults, handlers);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
// ignore
|
||||||
|
// this backend was created the v1.0.0 way
|
||||||
|
}
|
||||||
|
|
||||||
|
// replaces strings of workDir, certPath, etc
|
||||||
|
// if they have :config/etc/live or :conf/etc/archive
|
||||||
|
// to instead have the path of the configDir
|
||||||
|
LE.tplConfigDir(defaults.configDir, defaults);
|
||||||
|
|
||||||
|
backend = PromiseA.promisifyAll(backend);
|
||||||
|
|
||||||
|
var utils = require('./lib/common');
|
||||||
|
//var attempts = {}; // should exist in master process only
|
||||||
|
var le;
|
||||||
|
|
||||||
|
// TODO check certs on initial load
|
||||||
|
// TODO expect that certs expire every 90 days
|
||||||
|
// TODO check certs with setInterval?
|
||||||
|
//options.cacheContextsFor = options.cacheContextsFor || (1 * 60 * 60 * 1000);
|
||||||
|
|
||||||
|
le = {
|
||||||
|
backend: backend
|
||||||
|
, pyToJson: function (pyobj) {
|
||||||
|
if (!pyobj) {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
var jsobj = {};
|
||||||
|
Object.keys(pyobj).forEach(function (key) {
|
||||||
|
jsobj[key] = pyobj[key];
|
||||||
|
});
|
||||||
|
jsobj.__lines = undefined;
|
||||||
|
jsobj.__keys = undefined;
|
||||||
|
|
||||||
|
return jsobj;
|
||||||
|
}
|
||||||
|
, validate: function (hostnames, cb) {
|
||||||
|
// TODO check dns, etc
|
||||||
|
if ((!hostnames.length && hostnames.every(le.isValidDomain))) {
|
||||||
|
cb(new Error("node-letsencrypt: invalid hostnames: " + hostnames.join(',')));
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
// IMPORTANT
|
||||||
|
//
|
||||||
|
// Before attempting a dynamic registration you need to validate that
|
||||||
|
//
|
||||||
|
// * these are hostnames that you expected to exist on the system
|
||||||
|
// * their A records currently point to this ip
|
||||||
|
// * this system's ip hasn't changed
|
||||||
|
//
|
||||||
|
// If you do not check these things, then someone could attack you
|
||||||
|
// and cause you, in return, to have your ip be rate-limit blocked
|
||||||
|
//
|
||||||
|
//console.warn("\n[TODO]: node-letsencrypt: `validate(hostnames, cb)` needs to be implemented");
|
||||||
|
//console.warn("(it'll work fine without it, but for security - and convenience - it should be implemented\n");
|
||||||
|
// UPDATE:
|
||||||
|
// it's actually probably better that we don't do this here and instead
|
||||||
|
// take care of it in the approveRegistrationCallback in letsencrypt-express
|
||||||
|
cb(null, true);
|
||||||
|
}
|
||||||
|
, _registerHelper: function (args, cb) {
|
||||||
|
var copy = LE.merge(defaults, args);
|
||||||
|
var err;
|
||||||
|
|
||||||
|
if (!utils.isValidDomain(args.domains[0])) {
|
||||||
|
err = new Error("invalid domain");
|
||||||
|
err.code = "INVALID_DOMAIN";
|
||||||
|
cb(err);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
le.validate(args.domains, function (err) {
|
||||||
|
if (err) {
|
||||||
|
cb(err);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (defaults.debug || args.debug) {
|
||||||
|
console.log("[NLE]: begin registration");
|
||||||
|
}
|
||||||
|
|
||||||
|
return backend.registerAsync(copy).then(function (pems) {
|
||||||
|
if (defaults.debug || args.debug) {
|
||||||
|
console.log("[NLE]: end registration");
|
||||||
|
}
|
||||||
|
cb(null, pems);
|
||||||
|
//return le.fetch(args, cb);
|
||||||
|
}, cb);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
, _fetchHelper: function (args, cb) {
|
||||||
|
return backend.fetchAsync(args).then(function (certInfo) {
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('[LE] raw fetch certs', certInfo && Object.keys(certInfo));
|
||||||
|
}
|
||||||
|
if (!certInfo) { cb(null, null); return; }
|
||||||
|
|
||||||
|
// key, cert, issuedAt, lifetime, expiresAt
|
||||||
|
if (!certInfo.expiresAt) {
|
||||||
|
certInfo.expiresAt = certInfo.issuedAt + (certInfo.lifetime || handlers.lifetime);
|
||||||
|
}
|
||||||
|
if (!certInfo.lifetime) {
|
||||||
|
certInfo.lifetime = (certInfo.lifetime || handlers.lifetime);
|
||||||
|
}
|
||||||
|
// a pretty good hard buffer
|
||||||
|
certInfo.expiresAt -= (1 * 24 * 60 * 60 * 100);
|
||||||
|
|
||||||
|
cb(null, certInfo);
|
||||||
|
}, cb);
|
||||||
|
}
|
||||||
|
, fetch: function (args, cb) {
|
||||||
|
if (defaults.debug || args.debug) {
|
||||||
|
console.log('[LE] fetch');
|
||||||
|
}
|
||||||
|
le._fetchHelper(args, cb);
|
||||||
|
}
|
||||||
|
, renew: function (args, cb) {
|
||||||
|
if (defaults.debug || args.debug) {
|
||||||
|
console.log('[LE] renew');
|
||||||
|
}
|
||||||
|
args.duplicate = false;
|
||||||
|
le.register(args, cb);
|
||||||
|
}
|
||||||
|
, getConfig: function (args, cb) {
|
||||||
|
if (defaults.debug || args.debug) {
|
||||||
|
console.log('[LE] getConfig');
|
||||||
|
}
|
||||||
|
backend.getConfigAsync(args).then(function (pyobj) {
|
||||||
|
cb(null, le.pyToJson(pyobj));
|
||||||
|
}, function (err) {
|
||||||
|
console.error("[letsencrypt/index.js] getConfig");
|
||||||
|
console.error(err.stack);
|
||||||
|
return cb(null, []);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
, getConfigs: function (args, cb) {
|
||||||
|
if (defaults.debug || args.debug) {
|
||||||
|
console.log('[LE] getConfigs');
|
||||||
|
}
|
||||||
|
backend.getConfigsAsync(args).then(function (configs) {
|
||||||
|
cb(null, configs.map(le.pyToJson));
|
||||||
|
}, function (err) {
|
||||||
|
if ('ENOENT' === err.code) {
|
||||||
|
cb(null, []);
|
||||||
|
} else {
|
||||||
|
console.error("[letsencrypt/index.js] getConfigs");
|
||||||
|
console.error(err.stack);
|
||||||
|
cb(err);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
}
|
||||||
|
, setConfig: function (args, cb) {
|
||||||
|
if (defaults.debug || args.debug) {
|
||||||
|
console.log('[LE] setConfig');
|
||||||
|
}
|
||||||
|
backend.configureAsync(args).then(function (pyobj) {
|
||||||
|
cb(null, le.pyToJson(pyobj));
|
||||||
|
});
|
||||||
|
}
|
||||||
|
, register: function (args, cb) {
|
||||||
|
if (defaults.debug || args.debug) {
|
||||||
|
console.log('[LE] register');
|
||||||
|
}
|
||||||
|
if (!Array.isArray(args.domains)) {
|
||||||
|
cb(new Error('args.domains should be an array of domains'));
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
// this may be run in a cluster environment
|
||||||
|
// in that case it should NOT check the cache
|
||||||
|
// but ensure that it has the most fresh copy
|
||||||
|
// before attempting a renew
|
||||||
|
le._fetchHelper(args, function (err, hit) {
|
||||||
|
var now = Date.now();
|
||||||
|
|
||||||
|
if (err) {
|
||||||
|
// had a bad day
|
||||||
|
cb(err);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
else if (hit) {
|
||||||
|
if (!args.duplicate && (now - hit.issuedAt) < ((hit.lifetime || handlers.lifetime) * 0.65)) {
|
||||||
|
console.warn("\ntried to renew a certificate with over 1/3 of its lifetime left, ignoring");
|
||||||
|
console.warn("(use --duplicate or opts.duplicate to override\n");
|
||||||
|
cb(null, hit);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
le._registerHelper(args, function (err/*, pems*/) {
|
||||||
|
if (err) {
|
||||||
|
cb(err);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Sanity Check
|
||||||
|
le._fetchHelper(args, function (err, pems) {
|
||||||
|
if (pems) {
|
||||||
|
cb(null, pems);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
// still couldn't read the certs after success... that's weird
|
||||||
|
console.error("still couldn't read certs after success... that's weird");
|
||||||
|
cb(err, null);
|
||||||
|
});
|
||||||
|
});
|
||||||
|
});
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
return le;
|
||||||
|
};
|
||||||
195
lib/accounts.js
Normal file
195
lib/accounts.js
Normal file
@ -0,0 +1,195 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var PromiseA = require('bluebird');
|
||||||
|
var crypto = require('crypto');
|
||||||
|
var LeCore = require('letiny-core');
|
||||||
|
var RSA = PromiseA.promisifyAll(require('rsa-compat').RSA);
|
||||||
|
var path = require('path');
|
||||||
|
var mkdirpAsync = PromiseA.promisify(require('mkdirp'));
|
||||||
|
var fs = PromiseA.promisifyAll(require('fs'));
|
||||||
|
|
||||||
|
function createAccount(args, handlers) {
|
||||||
|
var os = require("os");
|
||||||
|
var localname = os.hostname();
|
||||||
|
|
||||||
|
// arg.rsaBitLength args.rsaExponent
|
||||||
|
return RSA.generateKeypairAsync(args.rsaKeySize || 2048, 65537, { public: true, pem: true }).then(function (keypair) {
|
||||||
|
|
||||||
|
return LeCore.registerNewAccountAsync({
|
||||||
|
email: args.email
|
||||||
|
, newRegUrl: args._acmeUrls.newReg
|
||||||
|
, agreeToTerms: function (tosUrl, agree) {
|
||||||
|
// args.email = email; // already there
|
||||||
|
args.tosUrl = tosUrl;
|
||||||
|
handlers.agreeToTerms(args, agree);
|
||||||
|
}
|
||||||
|
, accountKeypair: keypair
|
||||||
|
|
||||||
|
, debug: args.debug || handlers.debug
|
||||||
|
}).then(function (body) {
|
||||||
|
// TODO XXX use sha256 (the python client uses md5)
|
||||||
|
// TODO ssh fingerprint (noted on rsa-compat issues page, I believe)
|
||||||
|
keypair.publicKeyMd5 = crypto.createHash('md5').update(RSA.exportPublicPem(keypair)).digest('hex');
|
||||||
|
keypair.publicKeySha256 = crypto.createHash('sha256').update(RSA.exportPublicPem(keypair)).digest('hex');
|
||||||
|
var accountId = keypair.publicKeyMd5;
|
||||||
|
var accountDir = path.join(args.accountsDir, accountId);
|
||||||
|
var regr = { body: body };
|
||||||
|
|
||||||
|
args.accountId = accountId;
|
||||||
|
args.accountDir = accountDir;
|
||||||
|
|
||||||
|
return mkdirpAsync(accountDir).then(function () {
|
||||||
|
|
||||||
|
var isoDate = new Date().toISOString();
|
||||||
|
var accountMeta = {
|
||||||
|
creation_host: localname
|
||||||
|
, creation_dt: isoDate
|
||||||
|
};
|
||||||
|
|
||||||
|
// TODO abstract file writing
|
||||||
|
return PromiseA.all([
|
||||||
|
// meta.json {"creation_host": "ns1.redirect-www.org", "creation_dt": "2015-12-11T04:14:38Z"}
|
||||||
|
fs.writeFileAsync(path.join(accountDir, 'meta.json'), JSON.stringify(accountMeta), 'utf8')
|
||||||
|
// private_key.json { "e", "d", "n", "q", "p", "kty", "qi", "dp", "dq" }
|
||||||
|
, fs.writeFileAsync(path.join(accountDir, 'private_key.json'), JSON.stringify(RSA.exportPrivateJwk(keypair)), 'utf8')
|
||||||
|
// regr.json:
|
||||||
|
/*
|
||||||
|
{ body: { contact: [ 'mailto:coolaj86@gmail.com' ],
|
||||||
|
agreement: 'https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf',
|
||||||
|
key: { e: 'AQAB', kty: 'RSA', n: '...' } },
|
||||||
|
uri: 'https://acme-v01.api.letsencrypt.org/acme/reg/71272',
|
||||||
|
new_authzr_uri: 'https://acme-v01.api.letsencrypt.org/acme/new-authz',
|
||||||
|
terms_of_service: 'https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf' }
|
||||||
|
*/
|
||||||
|
, fs.writeFileAsync(path.join(accountDir, 'regr.json'), JSON.stringify(regr), 'utf8')
|
||||||
|
]).then(function () {
|
||||||
|
var pems = {};
|
||||||
|
|
||||||
|
// pems.private_key;
|
||||||
|
pems.meta = accountMeta;
|
||||||
|
pems.keypair = keypair;
|
||||||
|
pems.regr = regr;
|
||||||
|
pems.accountId = accountId;
|
||||||
|
pems.id = accountId;
|
||||||
|
return pems;
|
||||||
|
});
|
||||||
|
});
|
||||||
|
});
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function getAccount(args, handlers) {
|
||||||
|
var accountId = args.accountId;
|
||||||
|
var accountDir = path.join(args.accountsDir, accountId);
|
||||||
|
var files = {};
|
||||||
|
var configs = ['meta.json', 'private_key.json', 'regr.json'];
|
||||||
|
|
||||||
|
return PromiseA.all(configs.map(function (filename) {
|
||||||
|
var keyname = filename.slice(0, -5);
|
||||||
|
|
||||||
|
return fs.readFileAsync(path.join(accountDir, filename), 'utf8').then(function (text) {
|
||||||
|
var data;
|
||||||
|
|
||||||
|
try {
|
||||||
|
data = JSON.parse(text);
|
||||||
|
} catch(e) {
|
||||||
|
files[keyname] = { error: e };
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
files[keyname] = data;
|
||||||
|
}, function (err) {
|
||||||
|
files[keyname] = { error: err };
|
||||||
|
});
|
||||||
|
})).then(function () {
|
||||||
|
|
||||||
|
if (!Object.keys(files).every(function (key) {
|
||||||
|
return !files[key].error;
|
||||||
|
})) {
|
||||||
|
// TODO log renewal.conf
|
||||||
|
console.warn("Account '" + accountId + "' was corrupt. No big deal (I think?). Creating a new one...");
|
||||||
|
//console.log(accountId, files);
|
||||||
|
return createAccount(args, handlers);
|
||||||
|
}
|
||||||
|
|
||||||
|
var keypair = { privateKeyJwk: files.private_key };
|
||||||
|
keypair.privateKeyPem = RSA.exportPrivatePem(keypair);
|
||||||
|
keypair.publicKeyPem = RSA.exportPublicPem(keypair);
|
||||||
|
|
||||||
|
//files.private_key;
|
||||||
|
//files.regr;
|
||||||
|
//files.meta;
|
||||||
|
files.accountId = accountId; // preserve current account id
|
||||||
|
files.id = accountId;
|
||||||
|
files.keypair = keypair;
|
||||||
|
|
||||||
|
return files;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function getAccountIdByEmail(args) {
|
||||||
|
// If we read 10,000 account directories looking for
|
||||||
|
// just one email address, that could get crazy.
|
||||||
|
// We should have a folder per email and list
|
||||||
|
// each account as a file in the folder
|
||||||
|
// TODO
|
||||||
|
var email = args.email;
|
||||||
|
if ('string' !== typeof email) {
|
||||||
|
if (args.debug) {
|
||||||
|
console.log("[LE] No email given");
|
||||||
|
}
|
||||||
|
return PromiseA.resolve(null);
|
||||||
|
}
|
||||||
|
return fs.readdirAsync(args.accountsDir).then(function (nodes) {
|
||||||
|
if (args.debug) {
|
||||||
|
console.log("[LE] arg.accountsDir success");
|
||||||
|
}
|
||||||
|
|
||||||
|
return PromiseA.all(nodes.map(function (node) {
|
||||||
|
return fs.readFileAsync(path.join(args.accountsDir, node, 'regr.json'), 'utf8').then(function (text) {
|
||||||
|
var regr = JSON.parse(text);
|
||||||
|
regr.__accountId = node;
|
||||||
|
|
||||||
|
return regr;
|
||||||
|
});
|
||||||
|
})).then(function (regrs) {
|
||||||
|
var accountId;
|
||||||
|
|
||||||
|
/*
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('read many regrs');
|
||||||
|
console.log('regrs', regrs);
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
|
||||||
|
regrs.some(function (regr) {
|
||||||
|
return regr.body.contact.some(function (contact) {
|
||||||
|
var match = contact.toLowerCase() === 'mailto:' + email.toLowerCase();
|
||||||
|
if (match) {
|
||||||
|
accountId = regr.__accountId;
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
if (!accountId) {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
return accountId;
|
||||||
|
});
|
||||||
|
}).then(function (accountId) {
|
||||||
|
return accountId;
|
||||||
|
}, function (err) {
|
||||||
|
if ('ENOENT' === err.code) {
|
||||||
|
// ignore error
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
return PromiseA.reject(err);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
module.exports.getAccountIdByEmail = getAccountIdByEmail;
|
||||||
|
module.exports.getAccount = getAccount;
|
||||||
|
module.exports.createAccount = createAccount;
|
||||||
@ -1,88 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var Greenlock = require('../');
|
|
||||||
|
|
||||||
module.exports.wrap = function(greenlock) {
|
|
||||||
greenlock.challenges = {};
|
|
||||||
greenlock.challenges.get = async function(chall) {
|
|
||||||
// TODO pick one and warn on the others
|
|
||||||
// (just here due to some backwards compat issues with early v3 plugins)
|
|
||||||
var servername =
|
|
||||||
chall.servername ||
|
|
||||||
chall.altname ||
|
|
||||||
(chall.identifier && chall.identifier.value);
|
|
||||||
|
|
||||||
// TODO some sort of caching to prevent database hits?
|
|
||||||
var site = await greenlock._config({ servername: servername });
|
|
||||||
if (!site) {
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Hmm... this _should_ be impossible
|
|
||||||
if (!site.challenges || !site.challenges['http-01']) {
|
|
||||||
var copy = JSON.parse(JSON.stringify(site));
|
|
||||||
sanitizeCopiedConf(copy);
|
|
||||||
sanitizeCopiedConf(copy.store);
|
|
||||||
if (site.challenges) {
|
|
||||||
sanitizeCopiedConf(copy.challenges['http-01']);
|
|
||||||
sanitizeCopiedConf(copy.challenges['dns-01']);
|
|
||||||
sanitizeCopiedConf(copy.challenges['tls-alpn-01']);
|
|
||||||
}
|
|
||||||
console.warn('[Bug] Please report this error:');
|
|
||||||
console.warn(
|
|
||||||
'\terror: http-01 challenge requested, but not even a default http-01 config exists'
|
|
||||||
);
|
|
||||||
console.warn('\tservername:', JSON.stringify(servername));
|
|
||||||
console.warn('\tsite:', JSON.stringify(copy));
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
var plugin = await Greenlock._loadChallenge(site.challenges, 'http-01');
|
|
||||||
if (!plugin) {
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
var keyAuth;
|
|
||||||
var keyAuthDigest;
|
|
||||||
var result = await plugin.get({
|
|
||||||
challenge: {
|
|
||||||
type: chall.type,
|
|
||||||
//hostname: chall.servername,
|
|
||||||
altname: chall.servername,
|
|
||||||
identifier: { value: chall.servername },
|
|
||||||
token: chall.token
|
|
||||||
}
|
|
||||||
});
|
|
||||||
if (result) {
|
|
||||||
// backwards compat that shouldn't be dropped
|
|
||||||
// because new v3 modules had to do this to be
|
|
||||||
// backwards compatible with Greenlock v2.7 at
|
|
||||||
// the time.
|
|
||||||
if (result.challenge) {
|
|
||||||
result = result.challenge;
|
|
||||||
}
|
|
||||||
keyAuth = result.keyAuthorization;
|
|
||||||
keyAuthDigest = result.keyAuthorizationDigest;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (/dns/.test(chall.type)) {
|
|
||||||
return { keyAuthorizationDigest: keyAuthDigest };
|
|
||||||
}
|
|
||||||
|
|
||||||
return { keyAuthorization: keyAuth };
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
function sanitizeCopiedConf(copy) {
|
|
||||||
if (!copy) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
Object.keys(copy).forEach(function(k) {
|
|
||||||
if (/(api|key|token)/i.test(k) && 'string' === typeof copy[k]) {
|
|
||||||
copy[k] = '**redacted**';
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
return copy;
|
|
||||||
}
|
|
||||||
118
lib/common.js
Normal file
118
lib/common.js
Normal file
@ -0,0 +1,118 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var fs = require('fs');
|
||||||
|
var path = require('path');
|
||||||
|
var PromiseA = require('bluebird');
|
||||||
|
|
||||||
|
var homeRe = new RegExp("^~(\\/|\\\|\\" + path.sep + ")");
|
||||||
|
var re = /^[a-zA-Z0-9\.\-]+$/;
|
||||||
|
var punycode = require('punycode');
|
||||||
|
|
||||||
|
module.exports.isValidDomain = function (domain) {
|
||||||
|
if (re.test(domain)) {
|
||||||
|
return domain;
|
||||||
|
}
|
||||||
|
|
||||||
|
domain = punycode.toASCII(domain);
|
||||||
|
|
||||||
|
if (re.test(domain)) {
|
||||||
|
return domain;
|
||||||
|
}
|
||||||
|
|
||||||
|
return '';
|
||||||
|
};
|
||||||
|
|
||||||
|
module.exports.tplConfigDir = function merge(configDir, defaults) {
|
||||||
|
var homedir = require('homedir')();
|
||||||
|
Object.keys(defaults).forEach(function (key) {
|
||||||
|
if ('string' === typeof defaults[key]) {
|
||||||
|
defaults[key] = defaults[key].replace(':config', configDir).replace(':conf', configDir);
|
||||||
|
defaults[key] = defaults[key].replace(homeRe, homedir + path.sep);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
module.exports.merge = function merge(defaults, args) {
|
||||||
|
var copy = {};
|
||||||
|
|
||||||
|
Object.keys(defaults).forEach(function (key) {
|
||||||
|
copy[key] = defaults[key];
|
||||||
|
});
|
||||||
|
Object.keys(args).forEach(function (key) {
|
||||||
|
copy[key] = args[key];
|
||||||
|
});
|
||||||
|
|
||||||
|
return copy;
|
||||||
|
};
|
||||||
|
|
||||||
|
module.exports.tplCopy = function merge(copy) {
|
||||||
|
var homedir = require('homedir')();
|
||||||
|
var tpls = {
|
||||||
|
hostname: (copy.domains || [])[0]
|
||||||
|
, server: (copy.server || '').replace('https://', '').replace(/(\/)$/, '')
|
||||||
|
, conf: copy.configDir
|
||||||
|
, config: copy.configDir
|
||||||
|
};
|
||||||
|
|
||||||
|
Object.keys(copy).forEach(function (key) {
|
||||||
|
if ('string' === typeof copy[key]) {
|
||||||
|
Object.keys(tpls).sort(function (a, b) {
|
||||||
|
return b.length - a.length;
|
||||||
|
}).forEach(function (tplname) {
|
||||||
|
if (!tpls[tplname]) {
|
||||||
|
// what can't be templated now may be templatable later
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
copy[key] = copy[key].replace(':' + tplname, tpls[tplname]);
|
||||||
|
copy[key] = copy[key].replace(homeRe, homedir + path.sep);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
//return copy;
|
||||||
|
};
|
||||||
|
|
||||||
|
module.exports.fetchFromDisk = function (args) {
|
||||||
|
// TODO NO HARD-CODED DEFAULTS
|
||||||
|
if (!args.fullchainPath || !args.privkeyPath || !args.certPath || !args.chainPath) {
|
||||||
|
console.warn("missing one or more of args.privkeyPath, args.fullchainPath, args.certPath, args.chainPath");
|
||||||
|
console.warn("hard-coded conventional pathnames were for debugging and are not a stable part of the API");
|
||||||
|
}
|
||||||
|
|
||||||
|
//, fs.readFileAsync(fullchainPath, 'ascii')
|
||||||
|
// note: if this ^^ gets added back in, the arrays below must change
|
||||||
|
return PromiseA.all([
|
||||||
|
fs.readFileAsync(args.privkeyPath, 'ascii') // 0
|
||||||
|
, fs.readFileAsync(args.certPath, 'ascii') // 1
|
||||||
|
, fs.readFileAsync(args.chainPath, 'ascii') // 2
|
||||||
|
|
||||||
|
// stat the file, not the link
|
||||||
|
, fs.statAsync(args.certPath) // 3
|
||||||
|
]).then(function (arr) {
|
||||||
|
|
||||||
|
return {
|
||||||
|
key: arr[0] // privkey.pem
|
||||||
|
, privkey: arr[0] // privkey.pem
|
||||||
|
|
||||||
|
, fullchain: arr[1] + '\n' + arr[2] // fullchain.pem
|
||||||
|
, cert: arr[1] // cert.pem
|
||||||
|
|
||||||
|
, chain: arr[2] // chain.pem
|
||||||
|
, ca: arr[2] // chain.pem
|
||||||
|
|
||||||
|
, privkeyPath: args.privkeyPath
|
||||||
|
, fullchainPath: args.fullchainPath
|
||||||
|
, certPath: args.certPath
|
||||||
|
, chainPath: args.chainPath
|
||||||
|
|
||||||
|
, issuedAt: arr[3].mtime.valueOf() // ??? TODO parse to determine expiresAt and lifetime
|
||||||
|
, lifetime: args.lifetime
|
||||||
|
};
|
||||||
|
}, function (err) {
|
||||||
|
if (args.debug) {
|
||||||
|
console.error("[letsencrypt/lib/common.js] fetchFromDisk");
|
||||||
|
console.error(err.stack);
|
||||||
|
}
|
||||||
|
return null;
|
||||||
|
});
|
||||||
|
};
|
||||||
540
lib/core.js
Normal file
540
lib/core.js
Normal file
@ -0,0 +1,540 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var PromiseA = require('bluebird');
|
||||||
|
var RSA = PromiseA.promisifyAll(require('rsa-compat').RSA);
|
||||||
|
var mkdirpAsync = PromiseA.promisify(require('mkdirp'));
|
||||||
|
var path = require('path');
|
||||||
|
var fs = PromiseA.promisifyAll(require('fs'));
|
||||||
|
var sfs = require('safe-replace');
|
||||||
|
var LE = require('../');
|
||||||
|
var LeCore = PromiseA.promisifyAll(require('letiny-core'));
|
||||||
|
var Accounts = require('./accounts');
|
||||||
|
|
||||||
|
var merge = require('./common').merge;
|
||||||
|
var tplCopy = require('./common').tplCopy;
|
||||||
|
var fetchFromConfigLiveDir = require('./common').fetchFromDisk;
|
||||||
|
|
||||||
|
var ipc = {}; // in-process cache
|
||||||
|
|
||||||
|
function getAcmeUrls(args) {
|
||||||
|
var now = Date.now();
|
||||||
|
|
||||||
|
// TODO check response header on request for cache time
|
||||||
|
if ((now - ipc.acmeUrlsUpdatedAt) < 10 * 60 * 1000) {
|
||||||
|
return PromiseA.resolve(ipc.acmeUrls);
|
||||||
|
}
|
||||||
|
|
||||||
|
return LeCore.getAcmeUrlsAsync(args.server).then(function (data) {
|
||||||
|
ipc.acmeUrlsUpdatedAt = Date.now();
|
||||||
|
ipc.acmeUrls = data;
|
||||||
|
|
||||||
|
return ipc.acmeUrls;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function readRenewalConfig(args) {
|
||||||
|
var pyconf = PromiseA.promisifyAll(require('pyconf'));
|
||||||
|
|
||||||
|
return pyconf.readFileAsync(args.renewalPath).then(function (pyobj) {
|
||||||
|
return pyobj;
|
||||||
|
}, function () {
|
||||||
|
return pyconf.readFileAsync(path.join(__dirname, 'renewal.conf.tpl')).then(function (pyobj) {
|
||||||
|
return pyobj;
|
||||||
|
});
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function writeRenewalConfig(args) {
|
||||||
|
//console.log('args');
|
||||||
|
//console.log(args);
|
||||||
|
var pyobj = args.pyobj;
|
||||||
|
pyobj.checkpoints = parseInt(pyobj.checkpoints, 10) || 0;
|
||||||
|
|
||||||
|
var pyconf = PromiseA.promisifyAll(require('pyconf'));
|
||||||
|
|
||||||
|
var liveDir = args.liveDir || path.join(args.configDir, 'live', args.domains[0]);
|
||||||
|
|
||||||
|
var certPath = args.certPath || pyobj.cert || path.join(liveDir, 'cert.pem');
|
||||||
|
var fullchainPath = args.fullchainPath || pyobj.fullchain || path.join(liveDir, 'fullchain.pem');
|
||||||
|
var chainPath = args.chainPath || pyobj.chain || path.join(liveDir, 'chain.pem');
|
||||||
|
var privkeyPath = args.privkeyPath || pyobj.privkey
|
||||||
|
//|| args.domainPrivateKeyPath || args.domainKeyPath || pyobj.keyPath
|
||||||
|
|| path.join(liveDir, 'privkey.pem');
|
||||||
|
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('################ privkeyPath ################');
|
||||||
|
console.log(privkeyPath);
|
||||||
|
}
|
||||||
|
|
||||||
|
var updates = {
|
||||||
|
account: args.account.id
|
||||||
|
, configDir: args.configDir
|
||||||
|
, domains: args.domains
|
||||||
|
|
||||||
|
, email: args.email
|
||||||
|
, tos: args.agreeTos && true
|
||||||
|
// yes, it's an array. weird, right?
|
||||||
|
, webrootPath: args.webrootPath && [args.webrootPath] || []
|
||||||
|
, server: args.server || args.acmeDiscoveryUrl
|
||||||
|
|
||||||
|
, privkey: privkeyPath
|
||||||
|
, fullchain: fullchainPath
|
||||||
|
, cert: certPath
|
||||||
|
, chain: chainPath
|
||||||
|
|
||||||
|
, http01Port: args.http01Port
|
||||||
|
, keyPath: args.domainPrivateKeyPath || args.privkeyPath
|
||||||
|
, rsaKeySize: args.rsaKeySize
|
||||||
|
, checkpoints: pyobj.checkpoints
|
||||||
|
/* // TODO XXX what's the deal with these? they don't make sense
|
||||||
|
// are they just old junk? or do they have a meaning that I don't know about?
|
||||||
|
, fullchainPath: path.join(args.configDir, 'chain.pem')
|
||||||
|
, certPath: path.join(args.configDir, 'cert.pem')
|
||||||
|
, chainPath: path.join(args.configDir, 'chain.pem')
|
||||||
|
*/ // TODO XXX end
|
||||||
|
, workDir: args.workDir
|
||||||
|
, logsDir: args.logsDir
|
||||||
|
};
|
||||||
|
|
||||||
|
// final section is completely dynamic
|
||||||
|
// :hostname = :webroot_path
|
||||||
|
args.domains.forEach(function (hostname) {
|
||||||
|
updates[hostname] = args.webrootPath;
|
||||||
|
});
|
||||||
|
|
||||||
|
// must write back to the original pyobject or
|
||||||
|
// annotations will be lost
|
||||||
|
Object.keys(updates).forEach(function (key) {
|
||||||
|
pyobj[key] = updates[key];
|
||||||
|
});
|
||||||
|
|
||||||
|
return mkdirpAsync(path.dirname(args.renewalPath)).then(function () {
|
||||||
|
return pyconf.writeFileAsync(args.renewalPath, pyobj);
|
||||||
|
}).then(function () {
|
||||||
|
// NOTE
|
||||||
|
// writing twice seems to causes a bug,
|
||||||
|
// so instead we re-read the file from the disk
|
||||||
|
return pyconf.readFileAsync(args.renewalPath);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function getOrCreateRenewal(args) {
|
||||||
|
return readRenewalConfig(args).then(function (pyobj) {
|
||||||
|
var minver = pyobj.checkpoints >= 0;
|
||||||
|
|
||||||
|
args.pyobj = pyobj;
|
||||||
|
|
||||||
|
if (!minver) {
|
||||||
|
args.checkpoints = 0;
|
||||||
|
pyobj.checkpoints = 0;
|
||||||
|
return writeRenewalConfig(args);
|
||||||
|
}
|
||||||
|
|
||||||
|
// args.account.id = pyobj.account
|
||||||
|
// args.configDir = args.configDir || pyobj.configDir;
|
||||||
|
|
||||||
|
args.checkpoints = pyobj.checkpoints;
|
||||||
|
|
||||||
|
args.agreeTos = (args.agreeTos || pyobj.tos) && true;
|
||||||
|
args.email = args.email || pyobj.email;
|
||||||
|
args.domains = args.domains || pyobj.domains;
|
||||||
|
|
||||||
|
// yes, it's an array. weird, right?
|
||||||
|
args.webrootPath = args.webrootPath || pyobj.webrootPath[0];
|
||||||
|
args.server = args.server || args.acmeDiscoveryUrl || pyobj.server;
|
||||||
|
|
||||||
|
args.certPath = args.certPath || pyobj.cert;
|
||||||
|
args.privkeyPath = args.privkeyPath || pyobj.privkey;
|
||||||
|
args.chainPath = args.chainPath || pyobj.chain;
|
||||||
|
args.fullchainPath = args.fullchainPath || pyobj.fullchain;
|
||||||
|
|
||||||
|
//, workDir: args.workDir
|
||||||
|
//, logsDir: args.logsDir
|
||||||
|
args.rsaKeySize = args.rsaKeySize || pyobj.rsaKeySize;
|
||||||
|
args.http01Port = args.http01Port || pyobj.http01Port;
|
||||||
|
args.domainKeyPath = args.domainPrivateKeyPath || args.domainKeyPath || args.keyPath || pyobj.keyPath;
|
||||||
|
|
||||||
|
return writeRenewalConfig(args);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function writeCertificateAsync(args, defaults, handlers) {
|
||||||
|
if (args.debug) {
|
||||||
|
console.log("got certificate!");
|
||||||
|
}
|
||||||
|
|
||||||
|
var obj = args.pyobj;
|
||||||
|
var result = args.pems;
|
||||||
|
|
||||||
|
result.fullchain = result.cert + '\n' + (result.chain || result.ca);
|
||||||
|
obj.checkpoints = parseInt(obj.checkpoints, 10) || 0;
|
||||||
|
|
||||||
|
var liveDir = args.liveDir || path.join(args.configDir, 'live', args.domains[0]);
|
||||||
|
|
||||||
|
var certPath = args.certPath || obj.cert || path.join(liveDir, 'cert.pem');
|
||||||
|
var fullchainPath = args.fullchainPath || obj.fullchain || path.join(liveDir, 'fullchain.pem');
|
||||||
|
var chainPath = args.chainPath || obj.chain || path.join(liveDir, 'chain.pem');
|
||||||
|
var privkeyPath = args.privkeyPath || obj.privkey
|
||||||
|
//|| args.domainPrivateKeyPath || args.domainKeyPath || obj.keyPath
|
||||||
|
|| path.join(liveDir, 'privkey.pem');
|
||||||
|
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('[LE] privkeyPath', privkeyPath);
|
||||||
|
}
|
||||||
|
|
||||||
|
var archiveDir = args.archiveDir || path.join(args.configDir, 'archive', args.domains[0]);
|
||||||
|
|
||||||
|
var checkpoints = obj.checkpoints.toString();
|
||||||
|
var certArchive = path.join(archiveDir, 'cert' + checkpoints + '.pem');
|
||||||
|
var fullchainArchive = path.join(archiveDir, 'fullchain' + checkpoints + '.pem');
|
||||||
|
var chainArchive = path.join(archiveDir, 'chain'+ checkpoints + '.pem');
|
||||||
|
var privkeyArchive = path.join(archiveDir, 'privkey' + checkpoints + '.pem');
|
||||||
|
|
||||||
|
return mkdirpAsync(archiveDir).then(function () {
|
||||||
|
return PromiseA.all([
|
||||||
|
sfs.writeFileAsync(certArchive, result.cert, 'ascii')
|
||||||
|
, sfs.writeFileAsync(chainArchive, (result.chain || result.ca), 'ascii')
|
||||||
|
, sfs.writeFileAsync(fullchainArchive, result.fullchain, 'ascii')
|
||||||
|
, sfs.writeFileAsync(
|
||||||
|
privkeyArchive
|
||||||
|
// TODO nix args.key, args.domainPrivateKeyPem ??
|
||||||
|
, (result.privkey || result.key) || RSA.exportPrivatePem(args.domainKeypair)
|
||||||
|
, 'ascii'
|
||||||
|
)
|
||||||
|
]);
|
||||||
|
}).then(function () {
|
||||||
|
return mkdirpAsync(liveDir);
|
||||||
|
}).then(function () {
|
||||||
|
return PromiseA.all([
|
||||||
|
sfs.writeFileAsync(certPath, result.cert, 'ascii')
|
||||||
|
, sfs.writeFileAsync(chainPath, (result.chain || result.ca), 'ascii')
|
||||||
|
, sfs.writeFileAsync(fullchainPath, result.fullchain, 'ascii')
|
||||||
|
, sfs.writeFileAsync(
|
||||||
|
privkeyPath
|
||||||
|
// TODO nix args.key, args.domainPrivateKeyPem ??
|
||||||
|
, (result.privkey || result.key) || RSA.exportPrivatePem(args.domainKeypair)
|
||||||
|
, 'ascii'
|
||||||
|
)
|
||||||
|
]);
|
||||||
|
}).then(function () {
|
||||||
|
obj.checkpoints += 1;
|
||||||
|
args.checkpoints += 1;
|
||||||
|
|
||||||
|
return writeRenewalConfig(args);
|
||||||
|
}).then(function () {
|
||||||
|
|
||||||
|
return {
|
||||||
|
certPath: certPath
|
||||||
|
, chainPath: chainPath
|
||||||
|
, fullchainPath: fullchainPath
|
||||||
|
, privkeyPath: privkeyPath
|
||||||
|
|
||||||
|
// TODO nix keypair
|
||||||
|
, keypair: args.domainKeypair
|
||||||
|
|
||||||
|
// TODO nix args.key, args.domainPrivateKeyPem ??
|
||||||
|
// some ambiguity here...
|
||||||
|
, privkey: (result.privkey || result.key) || RSA.exportPrivatePem(args.domainKeypair)
|
||||||
|
, fullchain: result.fullchain || (result.cert + '\n' + result.chain)
|
||||||
|
, chain: (result.chain || result.ca)
|
||||||
|
// especially this one... might be cert only, might be fullchain
|
||||||
|
, cert: result.cert
|
||||||
|
|
||||||
|
, issuedAt: Date.now()
|
||||||
|
, lifetime: defaults.lifetime || handlers.lifetime
|
||||||
|
};
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function getCertificateAsync(args, defaults, handlers) {
|
||||||
|
var account = args.account;
|
||||||
|
var promise;
|
||||||
|
var keypairOpts = { public: true, pem: true };
|
||||||
|
|
||||||
|
if (!args.domainKeyPath) {
|
||||||
|
// TODO use default path ???
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('[domainKeyPath]: none');
|
||||||
|
}
|
||||||
|
promise = RSA.generateKeypairAsync(args.rsaKeySize, 65537, keypairOpts);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (args.domainKeyPath) {
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('[domainKeyPath]:', args.domainKeyPath);
|
||||||
|
}
|
||||||
|
promise = fs.readFileAsync(args.domainKeyPath, 'ascii').then(function (pem) {
|
||||||
|
return RSA.import({ privateKeyPem: pem });
|
||||||
|
}, function (/*err*/) {
|
||||||
|
return RSA.generateKeypairAsync(args.rsaKeySize, 65537, keypairOpts).then(function (keypair) {
|
||||||
|
return mkdirpAsync(path.dirname(args.domainKeyPath)).then(function () {
|
||||||
|
return fs.writeFileAsync(args.domainKeyPath, keypair.privateKeyPem, 'ascii').then(function () {
|
||||||
|
return keypair;
|
||||||
|
});
|
||||||
|
});
|
||||||
|
});
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
return promise.then(function (domainKeypair) {
|
||||||
|
if (args.debug) {
|
||||||
|
console.log("[letsencrypt/lib/core.js] get certificate");
|
||||||
|
}
|
||||||
|
|
||||||
|
args.domainKeypair = domainKeypair;
|
||||||
|
//args.registration = domainKey;
|
||||||
|
|
||||||
|
return LeCore.getCertificateAsync({
|
||||||
|
debug: args.debug
|
||||||
|
|
||||||
|
, newAuthzUrl: args._acmeUrls.newAuthz
|
||||||
|
, newCertUrl: args._acmeUrls.newCert
|
||||||
|
|
||||||
|
, accountKeypair: RSA.import(account.keypair)
|
||||||
|
, domainKeypair: domainKeypair
|
||||||
|
, domains: args.domains
|
||||||
|
|
||||||
|
//
|
||||||
|
// IMPORTANT
|
||||||
|
//
|
||||||
|
// setChallenge and removeChallenge are handed defaults
|
||||||
|
// instead of args because getChallenge does not have
|
||||||
|
// access to args
|
||||||
|
// (args is per-request, defaults is per instance)
|
||||||
|
//
|
||||||
|
, setChallenge: function (domain, key, value, done) {
|
||||||
|
var copy = merge(defaults, { domains: [domain] });
|
||||||
|
tplCopy(copy);
|
||||||
|
|
||||||
|
args.domains = [domain];
|
||||||
|
args.webrootPath = args.webrootPath;
|
||||||
|
if (4 === handlers.setChallenge.length) {
|
||||||
|
handlers.setChallenge(copy, key, value, done);
|
||||||
|
}
|
||||||
|
else if (5 === handlers.setChallenge.length) {
|
||||||
|
handlers.setChallenge(copy, domain, key, value, done);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
done(new Error("handlers.setChallenge receives the wrong number of arguments"));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
, removeChallenge: function (domain, key, done) {
|
||||||
|
var copy = merge(defaults, { domains: [domain] });
|
||||||
|
tplCopy(copy);
|
||||||
|
|
||||||
|
if (3 === handlers.removeChallenge.length) {
|
||||||
|
handlers.removeChallenge(copy, key, done);
|
||||||
|
}
|
||||||
|
else if (4 === handlers.removeChallenge.length) {
|
||||||
|
handlers.removeChallenge(copy, domain, key, done);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
done(new Error("handlers.removeChallenge receives the wrong number of arguments"));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
});
|
||||||
|
}).then(function (results) {
|
||||||
|
// { cert, chain, fullchain, privkey }
|
||||||
|
args.pems = results;
|
||||||
|
return writeCertificateAsync(args, defaults, handlers);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function getOrCreateDomainCertificate(args, defaults, handlers) {
|
||||||
|
return fetchFromConfigLiveDir(args).then(function (certs) {
|
||||||
|
// if nothing, register and save
|
||||||
|
// if something, check date (don't register unless 30+ days)
|
||||||
|
// if good, don't bother registering
|
||||||
|
// (but if we get to the point that we're actually calling
|
||||||
|
// this function, that shouldn't be the case, right?)
|
||||||
|
//console.log(certs);
|
||||||
|
if (!certs) {
|
||||||
|
// no certs, seems like a good time to get some
|
||||||
|
return getCertificateAsync(args, defaults, handlers);
|
||||||
|
}
|
||||||
|
else if ((Date.now() - certs.issuedAt) > (27 * 24 * 60 * 60 * 1000)) {
|
||||||
|
// cert is at least 27 days old we can renew that
|
||||||
|
return getCertificateAsync(args, defaults, handlers);
|
||||||
|
}
|
||||||
|
else if (args.duplicate) {
|
||||||
|
// YOLO! I be gettin' fresh certs 'erday! Yo!
|
||||||
|
return getCertificateAsync(args, defaults, handlers);
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
console.warn('[WARN] Ignoring renewal attempt for certificate less than 27 days old. Use args.duplicate to force.');
|
||||||
|
// We're happy with what we have
|
||||||
|
return certs;
|
||||||
|
}
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
// returns 'account' from lib/accounts { meta, regr, keypair, accountId (id) }
|
||||||
|
function getOrCreateAcmeAccount(args, defaults, handlers) {
|
||||||
|
var pyconf = PromiseA.promisifyAll(require('pyconf'));
|
||||||
|
|
||||||
|
return pyconf.readFileAsync(args.renewalPath).then(function (renewal) {
|
||||||
|
var accountId = renewal.account;
|
||||||
|
renewal = renewal.account;
|
||||||
|
|
||||||
|
return accountId;
|
||||||
|
}, function (err) {
|
||||||
|
if ("ENOENT" === err.code) {
|
||||||
|
if (args.debug) {
|
||||||
|
console.log("[LE] try email");
|
||||||
|
}
|
||||||
|
return Accounts.getAccountIdByEmail(args, handlers);
|
||||||
|
}
|
||||||
|
|
||||||
|
return PromiseA.reject(err);
|
||||||
|
}).then(function (accountId) {
|
||||||
|
|
||||||
|
// Note: the ACME urls are always fetched fresh on purpose
|
||||||
|
return getAcmeUrls(args).then(function (urls) {
|
||||||
|
args._acmeUrls = urls;
|
||||||
|
|
||||||
|
if (accountId) {
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('[LE] use account');
|
||||||
|
}
|
||||||
|
args.accountId = accountId;
|
||||||
|
return Accounts.getAccount(args, handlers);
|
||||||
|
} else {
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('[LE] create account');
|
||||||
|
}
|
||||||
|
return Accounts.createAccount(args, handlers);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
}).then(function (account) {
|
||||||
|
/*
|
||||||
|
if (renewal.account !== account) {
|
||||||
|
// the account has become corrupt, re-register
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('[LE] created account');
|
||||||
|
}
|
||||||
|
return account;
|
||||||
|
});
|
||||||
|
/*
|
||||||
|
return fs.readdirAsync(accountsDir, function (nodes) {
|
||||||
|
return PromiseA.all(nodes.map(function (node) {
|
||||||
|
var reMd5 = /[a-f0-9]{32}/i;
|
||||||
|
if (reMd5.test(node)) {
|
||||||
|
}
|
||||||
|
}));
|
||||||
|
});
|
||||||
|
*/
|
||||||
|
}
|
||||||
|
|
||||||
|
module.exports.create = function (defaults, handlers) {
|
||||||
|
defaults.server = defaults.server || LE.liveServer;
|
||||||
|
|
||||||
|
var wrapped = {
|
||||||
|
registerAsync: function (args) {
|
||||||
|
var copy;
|
||||||
|
// TODO move these defaults elsewhere?
|
||||||
|
//args.renewalDir = args.renewalDir || ':config/renewal/';
|
||||||
|
args.renewalPath = args.renewalPath || ':config/renewal/:hostname.conf';
|
||||||
|
// Note: the /directory is part of the server url and, as such, bleeds into the pathname
|
||||||
|
// So :config/accounts/:server/directory is *incorrect*, but the following *is* correct:
|
||||||
|
args.accountsDir = args.accountsDir || ':config/accounts/:server';
|
||||||
|
copy = merge(args, defaults);
|
||||||
|
tplCopy(copy);
|
||||||
|
|
||||||
|
if (copy.debug) {
|
||||||
|
console.log('[LE DEBUG] reg domains', args.domains);
|
||||||
|
}
|
||||||
|
|
||||||
|
var url = require('url');
|
||||||
|
var acmeLocation = url.parse(copy.server);
|
||||||
|
var acmeHostpath = path.join(acmeLocation.hostname, acmeLocation.pathname);
|
||||||
|
copy.renewalPath = copy.renewalPath || path.join(copy.configDir, 'renewal', copy.domains[0] + '.conf');
|
||||||
|
copy.accountsDir = copy.accountsDir || path.join(copy.configDir, 'accounts', acmeHostpath);
|
||||||
|
|
||||||
|
return getOrCreateAcmeAccount(copy, defaults, handlers).then(function (account) {
|
||||||
|
copy.account = account;
|
||||||
|
|
||||||
|
return getOrCreateRenewal(copy).then(function (pyobj) {
|
||||||
|
|
||||||
|
copy.pyobj = pyobj;
|
||||||
|
return getOrCreateDomainCertificate(copy, defaults, handlers);
|
||||||
|
});
|
||||||
|
}).then(function (result) {
|
||||||
|
return result;
|
||||||
|
}, function (err) {
|
||||||
|
console.error('[DEBUG le/lib/core.js] registeryAsync err');
|
||||||
|
console.error(err && err.stack || err);
|
||||||
|
return PromiseA.reject(err);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
, fetchAsync: function (args) {
|
||||||
|
var copy = merge(args, defaults);
|
||||||
|
tplCopy(copy);
|
||||||
|
|
||||||
|
if (args.debug) {
|
||||||
|
console.log('[LE DEBUG] fetch domains', copy);
|
||||||
|
}
|
||||||
|
return fetchFromConfigLiveDir(copy, defaults);
|
||||||
|
}
|
||||||
|
, configureAsync: function (hargs) {
|
||||||
|
hargs.renewalPath = hargs.renewalPath || ':config/renewal/:hostname.conf';
|
||||||
|
var copy = merge(hargs, defaults);
|
||||||
|
tplCopy(copy);
|
||||||
|
|
||||||
|
//console.log('[LE] configureAsync copy');
|
||||||
|
//console.log(hargs);
|
||||||
|
//console.log(copy);
|
||||||
|
return getOrCreateAcmeAccount(copy, defaults, handlers).then(function (account) {
|
||||||
|
copy.account = account;
|
||||||
|
return getOrCreateRenewal(copy);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
, getConfigAsync: function (hargs) {
|
||||||
|
hargs.renewalPath = hargs.renewalPath || ':config/renewal/:hostname.conf';
|
||||||
|
hargs.domains = [];
|
||||||
|
|
||||||
|
var copy = merge(hargs, defaults);
|
||||||
|
tplCopy(copy);
|
||||||
|
|
||||||
|
if (copy.debug) {
|
||||||
|
console.log('[LE DEBUG] get configs', copy);
|
||||||
|
}
|
||||||
|
|
||||||
|
return readRenewalConfig(copy).then(function (pyobj) {
|
||||||
|
var exists = pyobj.checkpoints >= 0;
|
||||||
|
if (!exists) {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
return pyobj;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
, getConfigsAsync: function (hargs) {
|
||||||
|
hargs.renewalDir = hargs.renewalDir || ':config/renewal/';
|
||||||
|
hargs.renewalPath = hargs.renewalPath || ':config/renewal/:hostname.conf';
|
||||||
|
hargs.domains = [];
|
||||||
|
|
||||||
|
var copy = merge(hargs, defaults);
|
||||||
|
tplCopy(copy);
|
||||||
|
|
||||||
|
if (copy.debug) {
|
||||||
|
console.log('[LE DEBUG] get configs', copy);
|
||||||
|
}
|
||||||
|
|
||||||
|
return fs.readdirAsync(copy.renewalDir).then(function (nodes) {
|
||||||
|
nodes = nodes.filter(function (node) {
|
||||||
|
return /^[a-z0-9]+.*\.conf$/.test(node);
|
||||||
|
});
|
||||||
|
|
||||||
|
return PromiseA.all(nodes.map(function (node) {
|
||||||
|
copy.domains = [node.replace(/\.conf$/, '')];
|
||||||
|
return wrapped.getConfigAsync(copy);
|
||||||
|
}));
|
||||||
|
});
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
|
return wrapped;
|
||||||
|
};
|
||||||
40
lib/default-handlers.js
Normal file
40
lib/default-handlers.js
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var fs = require('fs');
|
||||||
|
var path = require('path');
|
||||||
|
|
||||||
|
module.exports.agreeToTerms = function (args, agree) {
|
||||||
|
agree(null, args.agreeTos);
|
||||||
|
};
|
||||||
|
|
||||||
|
module.exports.setChallenge = function (args, challengePath, keyAuthorization, done) {
|
||||||
|
//var hostname = args.domains[0];
|
||||||
|
var mkdirp = require('mkdirp');
|
||||||
|
|
||||||
|
// TODO should be args.webrootPath
|
||||||
|
//console.log('args.webrootPath, challengePath');
|
||||||
|
//console.log(args.webrootPath, challengePath);
|
||||||
|
mkdirp(args.webrootPath, function (err) {
|
||||||
|
if (err) {
|
||||||
|
done(err);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
fs.writeFile(path.join(args.webrootPath, challengePath), keyAuthorization, 'utf8', function (err) {
|
||||||
|
done(err);
|
||||||
|
});
|
||||||
|
});
|
||||||
|
};
|
||||||
|
|
||||||
|
module.exports.getChallenge = function (args, key, done) {
|
||||||
|
//var hostname = args.domains[0];
|
||||||
|
|
||||||
|
//console.log("getting the challenge", args, key);
|
||||||
|
fs.readFile(path.join(args.webrootPath, key), 'utf8', done);
|
||||||
|
};
|
||||||
|
|
||||||
|
module.exports.removeChallenge = function (args, key, done) {
|
||||||
|
//var hostname = args.domains[0];
|
||||||
|
|
||||||
|
fs.unlink(path.join(args.webrootPath, key), done);
|
||||||
|
};
|
||||||
@ -1,46 +0,0 @@
|
|||||||
var DIR = module.exports;
|
|
||||||
|
|
||||||
// This will ALWAYS print out a notice if the URL is clearly a staging URL
|
|
||||||
DIR._getDirectoryUrl = function(dirUrl, domain) {
|
|
||||||
var liveUrl = 'https://acme-v02.api.letsencrypt.org/directory';
|
|
||||||
dirUrl = DIR._getDefaultDirectoryUrl(dirUrl, '', domain);
|
|
||||||
if (!dirUrl) {
|
|
||||||
dirUrl = liveUrl;
|
|
||||||
// This will print out a notice (just once) if no directoryUrl has been supplied
|
|
||||||
if (!DIR._shownDirectoryUrl) {
|
|
||||||
DIR._shownDirectoryUrl = true;
|
|
||||||
console.info('ACME Directory URL:', dirUrl);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return dirUrl;
|
|
||||||
};
|
|
||||||
|
|
||||||
// Handle staging URLs, pebble test server, etc
|
|
||||||
DIR._getDefaultDirectoryUrl = function(dirUrl, staging, domain) {
|
|
||||||
var stagingUrl = 'https://acme-staging-v02.api.letsencrypt.org/directory';
|
|
||||||
var stagingRe = /(^http:|staging|^127\.0\.|^::|localhost)/;
|
|
||||||
var env = '';
|
|
||||||
var args = [];
|
|
||||||
if ('undefined' !== typeof process) {
|
|
||||||
env = (process.env && process.env.ENV) || '';
|
|
||||||
args = (process.argv && process.argv.slice(1)) || [];
|
|
||||||
}
|
|
||||||
|
|
||||||
if (
|
|
||||||
staging ||
|
|
||||||
stagingRe.test(dirUrl) ||
|
|
||||||
args.includes('--staging') ||
|
|
||||||
/DEV|STAG/i.test(env)
|
|
||||||
) {
|
|
||||||
if (!stagingRe.test(dirUrl)) {
|
|
||||||
dirUrl = stagingUrl;
|
|
||||||
}
|
|
||||||
console.info('[staging] ACME Staging Directory URL:', dirUrl, env);
|
|
||||||
console.warn('FAKE CERTIFICATES (for testing) only', env, domain);
|
|
||||||
console.warn('');
|
|
||||||
}
|
|
||||||
|
|
||||||
return dirUrl;
|
|
||||||
};
|
|
||||||
|
|
||||||
DIR._shownDirectoryUrl = false;
|
|
||||||
194
lib/init.js
194
lib/init.js
@ -1,194 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var Init = module.exports;
|
|
||||||
|
|
||||||
var fs = require('fs');
|
|
||||||
var path = require('path');
|
|
||||||
//var promisify = require("util").promisify;
|
|
||||||
|
|
||||||
Init._init = function(opts) {
|
|
||||||
//var Rc = require("@root/greenlock/rc");
|
|
||||||
var Rc = require('./rc.js');
|
|
||||||
var pkgText;
|
|
||||||
var pkgErr;
|
|
||||||
var msgErr;
|
|
||||||
//var emailErr;
|
|
||||||
var realPkg;
|
|
||||||
var userPkg;
|
|
||||||
var myPkg = {};
|
|
||||||
// we want to be SUPER transparent that we're reading from package.json
|
|
||||||
// we don't want anything unexpected
|
|
||||||
var implicitConfig = [];
|
|
||||||
var rc;
|
|
||||||
|
|
||||||
if (opts.packageRoot) {
|
|
||||||
try {
|
|
||||||
pkgText = fs.readFileSync(
|
|
||||||
path.resolve(opts.packageRoot, 'package.json'),
|
|
||||||
'utf8'
|
|
||||||
);
|
|
||||||
opts._hasPackage = true;
|
|
||||||
} catch (e) {
|
|
||||||
pkgErr = e;
|
|
||||||
if (opts._mustPackage) {
|
|
||||||
console.error(
|
|
||||||
'Should be run from package root (the same directory as `package.json`)'
|
|
||||||
);
|
|
||||||
process.exit(1);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
console.warn(
|
|
||||||
'`packageRoot` should be the root of the package (probably `__dirname`)'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (pkgText) {
|
|
||||||
try {
|
|
||||||
realPkg = JSON.parse(pkgText);
|
|
||||||
} catch (e) {
|
|
||||||
pkgErr = e;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
userPkg = opts.package;
|
|
||||||
|
|
||||||
if (realPkg || userPkg) {
|
|
||||||
userPkg = userPkg || {};
|
|
||||||
realPkg = realPkg || {};
|
|
||||||
|
|
||||||
// build package agent
|
|
||||||
if (!opts.packageAgent) {
|
|
||||||
// name
|
|
||||||
myPkg.name = userPkg.name;
|
|
||||||
if (!myPkg.name) {
|
|
||||||
myPkg.name = realPkg.name;
|
|
||||||
implicitConfig.push('name');
|
|
||||||
}
|
|
||||||
|
|
||||||
// version
|
|
||||||
myPkg.version = userPkg.version;
|
|
||||||
if (!myPkg.version) {
|
|
||||||
myPkg.version = realPkg.version;
|
|
||||||
implicitConfig.push('version');
|
|
||||||
}
|
|
||||||
if (myPkg.name && myPkg.version) {
|
|
||||||
opts.packageAgent = myPkg.name + '/' + myPkg.version;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// build author
|
|
||||||
myPkg.author = opts.maintainerEmail;
|
|
||||||
if (!myPkg.author) {
|
|
||||||
myPkg.author =
|
|
||||||
(userPkg.author && userPkg.author.email) || userPkg.author;
|
|
||||||
}
|
|
||||||
if (!myPkg.author) {
|
|
||||||
implicitConfig.push('author');
|
|
||||||
myPkg.author =
|
|
||||||
(realPkg.author && realPkg.author.email) || realPkg.author;
|
|
||||||
}
|
|
||||||
if (!opts._init) {
|
|
||||||
opts.maintainerEmail = myPkg.author;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!opts.packageAgent) {
|
|
||||||
msgErr =
|
|
||||||
'missing `packageAgent` and also failed to read `name` and/or `version` from `package.json`';
|
|
||||||
if (pkgErr) {
|
|
||||||
msgErr += ': ' + pkgErr.message;
|
|
||||||
}
|
|
||||||
throw new Error(msgErr);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!opts._init) {
|
|
||||||
opts.maintainerEmail = parseMaintainer(opts.maintainerEmail);
|
|
||||||
if (!opts.maintainerEmail) {
|
|
||||||
msgErr =
|
|
||||||
'missing or malformed `maintainerEmail` (or `author` from `package.json`), which is used as the contact for support notices';
|
|
||||||
throw new Error(msgErr);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (opts.packageRoot) {
|
|
||||||
// Place the rc file in the packageroot
|
|
||||||
rc = Rc._initSync(opts.packageRoot, opts.manager, opts.configDir);
|
|
||||||
opts.configDir = rc.configDir;
|
|
||||||
opts.manager = rc.manager;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!opts.configDir && !opts.manager) {
|
|
||||||
throw new Error(
|
|
||||||
'missing `packageRoot` and `configDir`, but no `manager` was supplied'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
opts.configFile = path.join(
|
|
||||||
path.resolve(opts.packageRoot, opts.configDir),
|
|
||||||
'config.json'
|
|
||||||
);
|
|
||||||
var config;
|
|
||||||
try {
|
|
||||||
config = JSON.parse(fs.readFileSync(opts.configFile));
|
|
||||||
} catch (e) {
|
|
||||||
if ('ENOENT' !== e.code) {
|
|
||||||
throw e;
|
|
||||||
}
|
|
||||||
config = { defaults: {} };
|
|
||||||
}
|
|
||||||
|
|
||||||
opts.manager =
|
|
||||||
rc.manager ||
|
|
||||||
(config.defaults && config.defaults.manager) ||
|
|
||||||
config.manager;
|
|
||||||
if (!opts.manager) {
|
|
||||||
opts.manager = '@greenlock/manager';
|
|
||||||
}
|
|
||||||
if ('string' === typeof opts.manager) {
|
|
||||||
opts.manager = {
|
|
||||||
module: opts.manager
|
|
||||||
};
|
|
||||||
}
|
|
||||||
opts.manager = JSON.parse(JSON.stringify(opts.manager));
|
|
||||||
|
|
||||||
var confconf = ['configDir', 'configFile', 'staging', 'directoryUrl'];
|
|
||||||
Object.keys(opts).forEach(function(k) {
|
|
||||||
if (!confconf.includes(k)) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if ('undefined' !== typeof opts.manager[k]) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
opts.manager[k] = opts[k];
|
|
||||||
});
|
|
||||||
|
|
||||||
/*
|
|
||||||
var ignore = ["packageRoot", "maintainerEmail", "packageAgent", "staging", "directoryUrl", "manager"];
|
|
||||||
Object.keys(opts).forEach(function(k) {
|
|
||||||
if (ignore.includes(k)) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
opts.manager[k] = opts[k];
|
|
||||||
});
|
|
||||||
*/
|
|
||||||
|
|
||||||
// Place the rc file in the configDir itself
|
|
||||||
//Rc._initSync(opts.configDir, opts.configDir);
|
|
||||||
return opts;
|
|
||||||
};
|
|
||||||
|
|
||||||
// ex: "John Doe <john@example.com> (https://john.doe)"
|
|
||||||
// ex: "John Doe <john@example.com>"
|
|
||||||
// ex: "<john@example.com>"
|
|
||||||
// ex: "john@example.com"
|
|
||||||
var looseEmailRe = /(^|[\s<])([^'" <>:;`]+@[^'" <>:;`]+\.[^'" <>:;`]+)/;
|
|
||||||
function parseMaintainer(maintainerEmail) {
|
|
||||||
try {
|
|
||||||
maintainerEmail = maintainerEmail.match(looseEmailRe)[2];
|
|
||||||
} catch (e) {
|
|
||||||
maintainerEmail = null;
|
|
||||||
}
|
|
||||||
|
|
||||||
return maintainerEmail;
|
|
||||||
}
|
|
||||||
@ -1,645 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var U = require('../utils.js');
|
|
||||||
var E = require('../errors.js');
|
|
||||||
|
|
||||||
var warned = {};
|
|
||||||
|
|
||||||
// The purpose of this file is to try to auto-build
|
|
||||||
// partial managers so that the external API can be smaller.
|
|
||||||
|
|
||||||
module.exports.wrap = function(greenlock, gconf) {
|
|
||||||
var myFind = gconf.find;
|
|
||||||
delete gconf.find;
|
|
||||||
|
|
||||||
var mega = mergeManager(greenlock, gconf);
|
|
||||||
|
|
||||||
greenlock.manager = {};
|
|
||||||
greenlock.sites = {};
|
|
||||||
//greenlock.accounts = {};
|
|
||||||
//greenlock.certs = {};
|
|
||||||
|
|
||||||
greenlock.manager._modulename = gconf.manager.module;
|
|
||||||
if ('/' === String(gconf.manager.module)[0]) {
|
|
||||||
greenlock.manager._modulename = require('path').relative(
|
|
||||||
gconf.packageRoot,
|
|
||||||
greenlock.manager._modulename
|
|
||||||
);
|
|
||||||
if ('.' !== String(greenlock.manager._modulename)[0]) {
|
|
||||||
greenlock.manager._modulename =
|
|
||||||
'./' + greenlock.manager._modulename;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
var allowed = [
|
|
||||||
'accountKeyType', //: ["P-256", "RSA-2048"],
|
|
||||||
'serverKeyType', //: ["RSA-2048", "P-256"],
|
|
||||||
'store', // : { module, specific opts },
|
|
||||||
'challenges', // : { "http-01", "dns-01", "tls-alpn-01" },
|
|
||||||
'subscriberEmail',
|
|
||||||
'agreeToTerms',
|
|
||||||
'agreeTos',
|
|
||||||
'customerEmail',
|
|
||||||
'renewOffset',
|
|
||||||
'renewStagger',
|
|
||||||
'module', // not allowed, just ignored
|
|
||||||
'manager'
|
|
||||||
];
|
|
||||||
|
|
||||||
// get / set default site settings such as
|
|
||||||
// subscriberEmail, store, challenges, renewOffset, renewStagger
|
|
||||||
greenlock.manager.defaults = function(conf) {
|
|
||||||
return greenlock._init().then(function() {
|
|
||||||
if (!conf) {
|
|
||||||
return mega.defaults();
|
|
||||||
}
|
|
||||||
|
|
||||||
if (conf.sites) {
|
|
||||||
throw new Error('cannot set sites as global config');
|
|
||||||
}
|
|
||||||
if (conf.routes) {
|
|
||||||
throw new Error('cannot set routes as global config');
|
|
||||||
}
|
|
||||||
|
|
||||||
// disallow keys we know to be bad
|
|
||||||
[
|
|
||||||
'subject',
|
|
||||||
'deletedAt',
|
|
||||||
'altnames',
|
|
||||||
'lastAttemptAt',
|
|
||||||
'expiresAt',
|
|
||||||
'issuedAt',
|
|
||||||
'renewAt',
|
|
||||||
'sites',
|
|
||||||
'routes'
|
|
||||||
].some(function(k) {
|
|
||||||
if (k in conf) {
|
|
||||||
throw new Error(
|
|
||||||
'`' + k + '` not allowed as a default setting'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
Object.keys(conf).forEach(function(k) {
|
|
||||||
if (!allowed.includes(k) && !warned[k]) {
|
|
||||||
warned[k] = true;
|
|
||||||
console.warn(
|
|
||||||
k +
|
|
||||||
" isn't a known key. Please open an issue and let us know the use case."
|
|
||||||
);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
Object.keys(conf).forEach(function(k) {
|
|
||||||
if (-1 !== ['module', 'manager'].indexOf(k)) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('undefined' === typeof k) {
|
|
||||||
throw new Error(
|
|
||||||
"'" +
|
|
||||||
k +
|
|
||||||
"' should be set to a value, or `null`, but not left `undefined`"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
return mega.defaults(conf);
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
greenlock.manager._defaults = function(opts) {
|
|
||||||
return mega.defaults(opts);
|
|
||||||
};
|
|
||||||
|
|
||||||
greenlock.manager.add = function(args) {
|
|
||||||
if (!args || !Array.isArray(args.altnames) || !args.altnames.length) {
|
|
||||||
throw new Error(
|
|
||||||
'you must specify `altnames` when adding a new site'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
if (args.renewAt) {
|
|
||||||
throw new Error(
|
|
||||||
'you cannot specify `renewAt` when adding a new site'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
return greenlock.manager.set(args);
|
|
||||||
};
|
|
||||||
|
|
||||||
// TODO agreeToTerms should be handled somewhere... maybe?
|
|
||||||
|
|
||||||
// Add and update remains because I said I had locked the API
|
|
||||||
greenlock.manager.set = greenlock.manager.update = function(args) {
|
|
||||||
return greenlock._init().then(function() {
|
|
||||||
// The goal is to make this decently easy to manage by hand without mistakes
|
|
||||||
// but also reasonably easy to error check and correct
|
|
||||||
// and to make deterministic auto-corrections
|
|
||||||
|
|
||||||
args.subject = checkSubject(args);
|
|
||||||
|
|
||||||
//var subscriberEmail = args.subscriberEmail;
|
|
||||||
|
|
||||||
// TODO shortcut the other array checks when not necessary
|
|
||||||
if (Array.isArray(args.altnames)) {
|
|
||||||
args.altnames = checkAltnames(args.subject, args);
|
|
||||||
}
|
|
||||||
|
|
||||||
// at this point we know that subject is the first of altnames
|
|
||||||
return Promise.all(
|
|
||||||
(args.altnames || []).map(function(d) {
|
|
||||||
d = d.replace('*.', '');
|
|
||||||
return U._validDomain(d);
|
|
||||||
})
|
|
||||||
).then(function() {
|
|
||||||
if (!U._uniqueNames(args.altnames || [])) {
|
|
||||||
throw E.NOT_UNIQUE(
|
|
||||||
'add',
|
|
||||||
"'" + args.altnames.join("' '") + "'"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
// durations
|
|
||||||
if (args.renewOffset) {
|
|
||||||
args.renewOffset = U._parseDuration(args.renewOffset);
|
|
||||||
}
|
|
||||||
if (args.renewStagger) {
|
|
||||||
args.renewStagger = U._parseDuration(args.renewStagger);
|
|
||||||
}
|
|
||||||
|
|
||||||
return mega.set(args).then(function(result) {
|
|
||||||
if (!gconf._bin_mode) {
|
|
||||||
greenlock.renew({}).catch(function(err) {
|
|
||||||
if (!err.context) {
|
|
||||||
err.contxt = 'renew';
|
|
||||||
}
|
|
||||||
greenlock._notify('error', err);
|
|
||||||
});
|
|
||||||
}
|
|
||||||
return result;
|
|
||||||
});
|
|
||||||
});
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
greenlock.manager.get = greenlock.sites.get = function(args) {
|
|
||||||
return Promise.resolve().then(function() {
|
|
||||||
if (args.subject) {
|
|
||||||
throw new Error(
|
|
||||||
'get({ servername }) searches certificates by altnames, not by subject specifically'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
if (args.servernames || args.altnames || args.renewBefore) {
|
|
||||||
throw new Error(
|
|
||||||
'get({ servername }) does not take arguments that could lead to multiple results'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
return mega.get(args);
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
greenlock.manager.remove = function(args) {
|
|
||||||
return Promise.resolve().then(function() {
|
|
||||||
args.subject = checkSubject(args);
|
|
||||||
if (args.servername) {
|
|
||||||
throw new Error(
|
|
||||||
'remove() should be called with `subject` only, if you wish to remove altnames use `update()`'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
if (args.altnames) {
|
|
||||||
throw new Error(
|
|
||||||
'remove() should be called with `subject` only, not `altnames`'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
// TODO check no altnames
|
|
||||||
return mega.remove(args);
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
/*
|
|
||||||
{
|
|
||||||
subject: site.subject,
|
|
||||||
altnames: site.altnames,
|
|
||||||
//issuedAt: site.issuedAt,
|
|
||||||
//expiresAt: site.expiresAt,
|
|
||||||
renewOffset: site.renewOffset,
|
|
||||||
renewStagger: site.renewStagger,
|
|
||||||
renewAt: site.renewAt,
|
|
||||||
subscriberEmail: site.subscriberEmail,
|
|
||||||
customerEmail: site.customerEmail,
|
|
||||||
challenges: site.challenges,
|
|
||||||
store: site.store
|
|
||||||
};
|
|
||||||
*/
|
|
||||||
|
|
||||||
// no transaction promise here because it calls set
|
|
||||||
greenlock._find = async function(args) {
|
|
||||||
args = _mangleFindArgs(args);
|
|
||||||
var ours = await mega.find(args);
|
|
||||||
if (!myFind) {
|
|
||||||
return ours;
|
|
||||||
}
|
|
||||||
|
|
||||||
// if the user has an overlay find function we'll do a diff
|
|
||||||
// between the managed state and the overlay, and choose
|
|
||||||
// what was found.
|
|
||||||
var theirs = await myFind(args);
|
|
||||||
theirs = theirs.filter(function(site) {
|
|
||||||
if (!site || 'string' !== typeof site.subject) {
|
|
||||||
throw new Error('found site is missing subject');
|
|
||||||
}
|
|
||||||
if (
|
|
||||||
!Array.isArray(site.altnames) ||
|
|
||||||
!site.altnames.length ||
|
|
||||||
!site.altnames[0] ||
|
|
||||||
site.altnames[0] !== site.subject
|
|
||||||
) {
|
|
||||||
throw new Error('missing or malformed altnames');
|
|
||||||
}
|
|
||||||
['renewAt', 'issuedAt', 'expiresAt'].forEach(function(k) {
|
|
||||||
if (site[k]) {
|
|
||||||
throw new Error(
|
|
||||||
'`' +
|
|
||||||
k +
|
|
||||||
'` should be updated by `set()`, not by `find()`'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
if (!site) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if (args.subject && site.subject !== args.subject) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
var servernames = args.servernames || args.altnames;
|
|
||||||
if (
|
|
||||||
servernames &&
|
|
||||||
!site.altnames.some(function(altname) {
|
|
||||||
return servernames.includes(altname);
|
|
||||||
})
|
|
||||||
) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
return site.renewAt < (args.renewBefore || Infinity);
|
|
||||||
});
|
|
||||||
return _mergeFind(ours, theirs);
|
|
||||||
};
|
|
||||||
|
|
||||||
function _mergeFind(ours, theirs) {
|
|
||||||
var toUpdate = [];
|
|
||||||
theirs.forEach(function(_newer) {
|
|
||||||
var hasCurrent = ours.some(function(_older) {
|
|
||||||
var changed = false;
|
|
||||||
if (_newer.subject !== _older.subject) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
// BE SURE TO SET THIS UNDEFINED AFTERWARDS
|
|
||||||
_older._exists = true;
|
|
||||||
|
|
||||||
_newer.deletedAt = _newer.deletedAt || 0;
|
|
||||||
Object.keys(_newer).forEach(function(k) {
|
|
||||||
if (_older[k] !== _newer[k]) {
|
|
||||||
changed = true;
|
|
||||||
_older[k] = _newer[k];
|
|
||||||
}
|
|
||||||
});
|
|
||||||
if (changed) {
|
|
||||||
toUpdate.push(_older);
|
|
||||||
}
|
|
||||||
|
|
||||||
// handled the (only) match
|
|
||||||
return true;
|
|
||||||
});
|
|
||||||
if (!hasCurrent) {
|
|
||||||
toUpdate.push(_newer);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
// delete the things that are gone
|
|
||||||
ours.forEach(function(_older) {
|
|
||||||
if (!_older._exists) {
|
|
||||||
_older.deletedAt = Date.now();
|
|
||||||
toUpdate.push(_older);
|
|
||||||
}
|
|
||||||
_older._exists = undefined;
|
|
||||||
});
|
|
||||||
|
|
||||||
Promise.all(
|
|
||||||
toUpdate.map(function(site) {
|
|
||||||
return greenlock.sites.update(site).catch(function(err) {
|
|
||||||
console.error(
|
|
||||||
'Developer Error: cannot update sites from user-supplied `find()`:'
|
|
||||||
);
|
|
||||||
console.error(err);
|
|
||||||
});
|
|
||||||
})
|
|
||||||
);
|
|
||||||
|
|
||||||
// ours is updated from theirs
|
|
||||||
return ours;
|
|
||||||
}
|
|
||||||
|
|
||||||
greenlock.manager.init = mega.init;
|
|
||||||
};
|
|
||||||
|
|
||||||
function checkSubject(args) {
|
|
||||||
if (!args || !args.subject) {
|
|
||||||
throw new Error('you must specify `subject` when configuring a site');
|
|
||||||
}
|
|
||||||
/*
|
|
||||||
if (!args.subject) {
|
|
||||||
throw E.NO_SUBJECT('add');
|
|
||||||
}
|
|
||||||
*/
|
|
||||||
|
|
||||||
var subject = (args.subject || '').toLowerCase();
|
|
||||||
if (subject !== args.subject) {
|
|
||||||
console.warn('`subject` must be lowercase', args.subject);
|
|
||||||
}
|
|
||||||
|
|
||||||
return U._encodeName(subject);
|
|
||||||
}
|
|
||||||
|
|
||||||
function checkAltnames(subject, args) {
|
|
||||||
// the things we have to check and get right
|
|
||||||
var altnames = (args.altnames || []).map(function(name) {
|
|
||||||
return String(name || '').toLowerCase();
|
|
||||||
});
|
|
||||||
|
|
||||||
// punycode BEFORE validation
|
|
||||||
// (set, find, remove)
|
|
||||||
if (altnames.join() !== args.altnames.join()) {
|
|
||||||
console.warn(
|
|
||||||
'all domains in `altnames` must be lowercase:',
|
|
||||||
args.altnames
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
args.altnames = args.altnames.map(U._encodeName);
|
|
||||||
if (
|
|
||||||
!args.altnames.every(function(d) {
|
|
||||||
return U._validName(d);
|
|
||||||
})
|
|
||||||
) {
|
|
||||||
throw E.INVALID_HOSTNAME('add', "'" + args.altnames.join("' '") + "'");
|
|
||||||
}
|
|
||||||
|
|
||||||
if (subject && subject !== args.altnames[0]) {
|
|
||||||
throw E.BAD_ORDER(
|
|
||||||
'add',
|
|
||||||
'(' + args.subject + ") '" + args.altnames.join("' '") + "'"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
/*
|
|
||||||
if (subject && subject !== altnames[0]) {
|
|
||||||
throw new Error(
|
|
||||||
'`subject` must be the first domain in `altnames`',
|
|
||||||
args.subject,
|
|
||||||
altnames.join(' ')
|
|
||||||
);
|
|
||||||
}
|
|
||||||
*/
|
|
||||||
|
|
||||||
return altnames;
|
|
||||||
}
|
|
||||||
|
|
||||||
function loadManager(gconf) {
|
|
||||||
var m;
|
|
||||||
// 1. Get the manager
|
|
||||||
// 2. Figure out if we need to wrap it
|
|
||||||
|
|
||||||
/*
|
|
||||||
if (!gconf.manager) {
|
|
||||||
gconf.manager = '@greenlock/manager';
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('string' !== typeof gconf.manager) {
|
|
||||||
throw new Error(
|
|
||||||
'`manager` should be a string representing the npm name or file path of the module'
|
|
||||||
);
|
|
||||||
}
|
|
||||||
*/
|
|
||||||
|
|
||||||
try {
|
|
||||||
// wrap this to be safe for @greenlock/manager
|
|
||||||
m = require(gconf.manager.module).create(gconf.manager);
|
|
||||||
} catch (e) {
|
|
||||||
console.error('Error loading manager:');
|
|
||||||
console.error(e.code);
|
|
||||||
console.error(e.message);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!m) {
|
|
||||||
console.error();
|
|
||||||
console.error(
|
|
||||||
'Failed to load manager plugin ',
|
|
||||||
JSON.stringify(gconf.manager)
|
|
||||||
);
|
|
||||||
console.error();
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
return m;
|
|
||||||
}
|
|
||||||
|
|
||||||
function mergeManager(greenlock, gconf) {
|
|
||||||
var mng;
|
|
||||||
function m() {
|
|
||||||
if (mng) {
|
|
||||||
return mng;
|
|
||||||
}
|
|
||||||
mng = require('@greenlock/manager').create(gconf);
|
|
||||||
return mng;
|
|
||||||
}
|
|
||||||
|
|
||||||
var mini = loadManager(gconf);
|
|
||||||
var mega = {};
|
|
||||||
// optional
|
|
||||||
if (mini.defaults) {
|
|
||||||
mega.defaults = function(opts) {
|
|
||||||
return mini.defaults(opts);
|
|
||||||
};
|
|
||||||
} else {
|
|
||||||
mega.defaults = m().defaults;
|
|
||||||
}
|
|
||||||
|
|
||||||
// optional
|
|
||||||
if (mini.remove) {
|
|
||||||
mega.remove = function(opts) {
|
|
||||||
return mini.remove(opts);
|
|
||||||
};
|
|
||||||
} else {
|
|
||||||
mega.remove = function(opts) {
|
|
||||||
mega.get(opts).then(function(site) {
|
|
||||||
if (!site) {
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
site.deletedAt = Date.now();
|
|
||||||
return mega.set(site).then(function() {
|
|
||||||
return site;
|
|
||||||
});
|
|
||||||
});
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
if (mini.find) {
|
|
||||||
// without this there cannot be fully automatic renewal
|
|
||||||
mega.find = function(opts) {
|
|
||||||
return mini.find(opts);
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
// set and (find and/or get) should be from the same set
|
|
||||||
if (mini.set) {
|
|
||||||
mega.set = function(opts) {
|
|
||||||
if (!mini.find) {
|
|
||||||
// TODO create the list so that find can be implemented
|
|
||||||
}
|
|
||||||
return mini.set(opts);
|
|
||||||
};
|
|
||||||
} else {
|
|
||||||
mega.set = m().set;
|
|
||||||
mega.get = m().get;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (mini.get) {
|
|
||||||
mega.get = async function(opts) {
|
|
||||||
if (mini.set) {
|
|
||||||
return mini.get(opts);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!mega._get) {
|
|
||||||
mega._get = m().get;
|
|
||||||
}
|
|
||||||
|
|
||||||
var existing = await mega._get(opts);
|
|
||||||
var site = await mini.get(opts);
|
|
||||||
if (!existing) {
|
|
||||||
// Add
|
|
||||||
if (!site) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
site.renewAt = 1;
|
|
||||||
site.deletedAt = 0;
|
|
||||||
await mega.set(site);
|
|
||||||
existing = await mega._get(opts);
|
|
||||||
} else if (!site) {
|
|
||||||
// Delete
|
|
||||||
existing.deletedAt = site.deletedAt || Date.now();
|
|
||||||
await mega.set(existing);
|
|
||||||
existing = null;
|
|
||||||
} else if (
|
|
||||||
site.subject !== existing.subject ||
|
|
||||||
site.altnames.join(' ') !== existing.altnames.join(' ')
|
|
||||||
) {
|
|
||||||
// Update
|
|
||||||
site.renewAt = 1;
|
|
||||||
site.deletedAt = 0;
|
|
||||||
await mega.set(site);
|
|
||||||
existing = await mega._get(opts);
|
|
||||||
if (!existing) {
|
|
||||||
throw new Error('failed to `get` after `set`');
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return existing;
|
|
||||||
};
|
|
||||||
} else if (mini.find) {
|
|
||||||
mega.get = function(opts) {
|
|
||||||
var servername = opts.servername;
|
|
||||||
delete opts.servername;
|
|
||||||
opts.servernames = (servername && [servername]) || undefined;
|
|
||||||
return mini.find(opts).then(function(sites) {
|
|
||||||
return sites.filter(function(site) {
|
|
||||||
return site.altnames.include(servername);
|
|
||||||
})[0];
|
|
||||||
});
|
|
||||||
};
|
|
||||||
} else if (mini.set) {
|
|
||||||
throw new Error(
|
|
||||||
gconf.manager.module +
|
|
||||||
' implements `set()`, but not `get()` or `find()`'
|
|
||||||
);
|
|
||||||
} else {
|
|
||||||
mega.find = m().find;
|
|
||||||
mega.get = m().get;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!mega.find) {
|
|
||||||
mega._nofind = false;
|
|
||||||
mega.find = async function(opts) {
|
|
||||||
if (!mega._nofind) {
|
|
||||||
console.warn(
|
|
||||||
'Warning: manager `' +
|
|
||||||
greenlock.manager._modulename +
|
|
||||||
'` does not implement `find({})`\n'
|
|
||||||
);
|
|
||||||
mega._nofind = true;
|
|
||||||
}
|
|
||||||
return [];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!mega.get) {
|
|
||||||
mega.get = function(opts) {
|
|
||||||
var servername = opts.servername;
|
|
||||||
delete opts.servername;
|
|
||||||
opts.servernames = (servername && [servername]) || undefined;
|
|
||||||
return mega.find(opts).then(function(sites) {
|
|
||||||
return sites.filter(function(site) {
|
|
||||||
return site.altnames.include(servername);
|
|
||||||
})[0];
|
|
||||||
});
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
mega.init = function(deps) {
|
|
||||||
if (mini.init) {
|
|
||||||
return mini.init(deps).then(function() {
|
|
||||||
if (mng) {
|
|
||||||
return mng.init(deps);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
} else if (mng) {
|
|
||||||
return mng.init(deps);
|
|
||||||
} else {
|
|
||||||
return Promise.resolve(null);
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
return mega;
|
|
||||||
}
|
|
||||||
|
|
||||||
function _mangleFindArgs(args) {
|
|
||||||
var servernames = (args.servernames || [])
|
|
||||||
.concat(args.altnames || [])
|
|
||||||
.filter(Boolean)
|
|
||||||
.slice(0);
|
|
||||||
var modified = servernames.slice(0);
|
|
||||||
|
|
||||||
// servername, wildname, and altnames are all the same
|
|
||||||
['wildname', 'servername'].forEach(function(k) {
|
|
||||||
var altname = args[k] || '';
|
|
||||||
if (altname && !modified.includes(altname)) {
|
|
||||||
modified.push(altname);
|
|
||||||
}
|
|
||||||
});
|
|
||||||
|
|
||||||
if (modified.length) {
|
|
||||||
servernames = modified;
|
|
||||||
servernames = servernames.map(U._encodeName);
|
|
||||||
args.altnames = servernames;
|
|
||||||
args.servernames = args.altnames = checkAltnames(false, args);
|
|
||||||
}
|
|
||||||
|
|
||||||
// documented as args.servernames
|
|
||||||
// preserved as args.altnames for v3 beta backwards compat
|
|
||||||
// my only hesitancy in this choice is that a "servername"
|
|
||||||
// may NOT contain '*.', in which case `altnames` is a better choice.
|
|
||||||
// However, `altnames` is ambiguous - as if it means to find a
|
|
||||||
// certificate by that specific collection of altnames.
|
|
||||||
// ... perhaps `domains` could work?
|
|
||||||
return args;
|
|
||||||
}
|
|
||||||
77
lib/rc.js
77
lib/rc.js
@ -1,77 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var Rc = module.exports;
|
|
||||||
var fs = require('fs');
|
|
||||||
var path = require('path');
|
|
||||||
|
|
||||||
// This is only called if packageRoot is specified
|
|
||||||
// (which it should be most of the time)
|
|
||||||
Rc._initSync = function(dirname, manager, configDir) {
|
|
||||||
if (!dirname) {
|
|
||||||
return {};
|
|
||||||
}
|
|
||||||
|
|
||||||
// dirname / opts.packageRoot
|
|
||||||
var rcpath = path.resolve(dirname, '.greenlockrc');
|
|
||||||
var rc;
|
|
||||||
|
|
||||||
try {
|
|
||||||
rc = JSON.parse(fs.readFileSync(rcpath));
|
|
||||||
} catch (e) {
|
|
||||||
if ('ENOENT' !== e.code) {
|
|
||||||
throw e;
|
|
||||||
}
|
|
||||||
rc = {};
|
|
||||||
}
|
|
||||||
|
|
||||||
var changed = true;
|
|
||||||
|
|
||||||
// In the general case the manager should be specified in the
|
|
||||||
// config file, which is in the config dir, but for the specific
|
|
||||||
// case in which all custom plugins are being used and no config
|
|
||||||
// dir is needed, we allow the manager to be read from the rc.
|
|
||||||
// ex: manager: { module: 'name', xxxx: 'xxxx' }
|
|
||||||
if (manager) {
|
|
||||||
if (rc.manager) {
|
|
||||||
if (
|
|
||||||
('string' === typeof rc.manager && rc.manager !== manager) ||
|
|
||||||
('string' !== typeof rc.manager &&
|
|
||||||
rc.manager.module !== manager.module)
|
|
||||||
) {
|
|
||||||
changed = true;
|
|
||||||
console.info(
|
|
||||||
"changing `manager` from '%s' to '%s'",
|
|
||||||
rc.manager.module || rc.manager,
|
|
||||||
manager.module || manager
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
rc.manager = manager;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!configDir) {
|
|
||||||
configDir = rc.configDir;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (configDir && configDir !== rc.configDir) {
|
|
||||||
if (rc.configDir) {
|
|
||||||
console.info(
|
|
||||||
"changing `configDir` from '%s' to '%s'",
|
|
||||||
rc.configDir,
|
|
||||||
configDir
|
|
||||||
);
|
|
||||||
}
|
|
||||||
changed = true;
|
|
||||||
rc.configDir = configDir;
|
|
||||||
} else if (!rc.configDir) {
|
|
||||||
changed = true;
|
|
||||||
configDir = './greenlock.d';
|
|
||||||
rc.configDir = configDir;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (changed) {
|
|
||||||
fs.writeFileSync(rcpath, JSON.stringify(rc));
|
|
||||||
}
|
|
||||||
|
|
||||||
return rc;
|
|
||||||
};
|
|
||||||
68
lib/renewal.conf.tpl
Normal file
68
lib/renewal.conf.tpl
Normal file
@ -0,0 +1,68 @@
|
|||||||
|
#cert = :config/live/:hostname/cert.pem
|
||||||
|
cert = :cert_path
|
||||||
|
privkey = :privkey_path
|
||||||
|
chain = :chain_path
|
||||||
|
fullchain = :fullchain_path
|
||||||
|
|
||||||
|
# Options and defaults used in the renewal process
|
||||||
|
[renewalparams]
|
||||||
|
apache_enmod = a2enmod
|
||||||
|
no_verify_ssl = False
|
||||||
|
ifaces = None
|
||||||
|
apache_dismod = a2dismod
|
||||||
|
register_unsafely_without_email = False
|
||||||
|
uir = None
|
||||||
|
installer = none
|
||||||
|
config_dir = :config
|
||||||
|
text_mode = True
|
||||||
|
# junk?
|
||||||
|
# https://github.com/letsencrypt/letsencrypt/issues/1955
|
||||||
|
func = <function obtain_cert at 0x30c9500>
|
||||||
|
prepare = False
|
||||||
|
work_dir = :work_dir
|
||||||
|
tos = :agree_tos
|
||||||
|
init = False
|
||||||
|
http01_port = :http_01_port
|
||||||
|
duplicate = False
|
||||||
|
# this is for the domain
|
||||||
|
key_path = :privkey_path
|
||||||
|
nginx = False
|
||||||
|
fullchain_path = :fullchain_path
|
||||||
|
email = :email
|
||||||
|
csr = None
|
||||||
|
agree_dev_preview = None
|
||||||
|
redirect = None
|
||||||
|
verbose_count = -3
|
||||||
|
config_file = None
|
||||||
|
renew_by_default = True
|
||||||
|
hsts = False
|
||||||
|
authenticator = webroot
|
||||||
|
domains = :hostnames #comma,delimited,list
|
||||||
|
rsa_key_size = :rsa_key_size
|
||||||
|
# starts at 0 and increments at every renewal
|
||||||
|
checkpoints = -1
|
||||||
|
manual_test_mode = False
|
||||||
|
apache = False
|
||||||
|
cert_path = :cert_path
|
||||||
|
webroot_path = :webroot_paths # comma,delimited,list
|
||||||
|
strict_permissions = False
|
||||||
|
apache_server_root = /etc/apache2
|
||||||
|
# https://github.com/letsencrypt/letsencrypt/issues/1948
|
||||||
|
account = :account_id
|
||||||
|
manual_public_ip_logging_ok = False
|
||||||
|
chain_path = :chain_path
|
||||||
|
standalone = False
|
||||||
|
manual = False
|
||||||
|
server = :acme_discovery_url
|
||||||
|
standalone_supported_challenges = "http-01,tls-sni-01"
|
||||||
|
webroot = True
|
||||||
|
apache_init_script = None
|
||||||
|
user_agent = None
|
||||||
|
apache_ctl = apache2ctl
|
||||||
|
apache_le_vhost_ext = -le-ssl.conf
|
||||||
|
debug = False
|
||||||
|
tls_sni_01_port = 443
|
||||||
|
logs_dir = :logs_dir
|
||||||
|
configurator = None
|
||||||
|
[[webroot_map]]
|
||||||
|
# :hostname = :webroot_path
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 3.4 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 18 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 6.3 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 2.0 KiB |
95
order.js
95
order.js
@ -1,95 +0,0 @@
|
|||||||
var accountKeypair = await Keypairs.generate({ kty: accKty });
|
|
||||||
if (config.debug) {
|
|
||||||
console.info('Account Key Created');
|
|
||||||
console.info(JSON.stringify(accountKeypair, null, 2));
|
|
||||||
console.info();
|
|
||||||
console.info();
|
|
||||||
}
|
|
||||||
|
|
||||||
var account = await acme.accounts.create({
|
|
||||||
agreeToTerms: agree,
|
|
||||||
// TODO detect jwk/pem/der?
|
|
||||||
accountKeypair: { privateKeyJwk: accountKeypair.private },
|
|
||||||
subscriberEmail: config.email
|
|
||||||
});
|
|
||||||
|
|
||||||
// TODO top-level agree
|
|
||||||
function agree(tos) {
|
|
||||||
if (config.debug) {
|
|
||||||
console.info('Agreeing to Terms of Service:');
|
|
||||||
console.info(tos);
|
|
||||||
console.info();
|
|
||||||
console.info();
|
|
||||||
}
|
|
||||||
agreed = true;
|
|
||||||
return Promise.resolve(tos);
|
|
||||||
}
|
|
||||||
if (config.debug) {
|
|
||||||
console.info('New Subscriber Account');
|
|
||||||
console.info(JSON.stringify(account, null, 2));
|
|
||||||
console.info();
|
|
||||||
console.info();
|
|
||||||
}
|
|
||||||
if (!agreed) {
|
|
||||||
throw new Error('Failed to ask the user to agree to terms');
|
|
||||||
}
|
|
||||||
|
|
||||||
var certKeypair = await Keypairs.generate({ kty: srvKty });
|
|
||||||
var pem = await Keypairs.export({
|
|
||||||
jwk: certKeypair.private,
|
|
||||||
encoding: 'pem'
|
|
||||||
});
|
|
||||||
if (config.debug) {
|
|
||||||
console.info('Server Key Created');
|
|
||||||
console.info('privkey.jwk.json');
|
|
||||||
console.info(JSON.stringify(certKeypair, null, 2));
|
|
||||||
// This should be saved as `privkey.pem`
|
|
||||||
console.info();
|
|
||||||
console.info('privkey.' + srvKty.toLowerCase() + '.pem:');
|
|
||||||
console.info(pem);
|
|
||||||
console.info();
|
|
||||||
}
|
|
||||||
|
|
||||||
// 'subject' should be first in list
|
|
||||||
var domains = randomDomains(rnd);
|
|
||||||
if (config.debug) {
|
|
||||||
console.info('Get certificates for random domains:');
|
|
||||||
console.info(
|
|
||||||
domains
|
|
||||||
.map(function(puny) {
|
|
||||||
var uni = punycode.toUnicode(puny);
|
|
||||||
if (puny !== uni) {
|
|
||||||
return puny + ' (' + uni + ')';
|
|
||||||
}
|
|
||||||
return puny;
|
|
||||||
})
|
|
||||||
.join('\n')
|
|
||||||
);
|
|
||||||
console.info();
|
|
||||||
}
|
|
||||||
|
|
||||||
// Create CSR
|
|
||||||
var csrDer = await CSR.csr({
|
|
||||||
jwk: certKeypair.private,
|
|
||||||
domains: domains,
|
|
||||||
encoding: 'der'
|
|
||||||
});
|
|
||||||
var csr = Enc.bufToUrlBase64(csrDer);
|
|
||||||
var csrPem = PEM.packBlock({
|
|
||||||
type: 'CERTIFICATE REQUEST',
|
|
||||||
bytes: csrDer /* { jwk: jwk, domains: opts.domains } */
|
|
||||||
});
|
|
||||||
if (config.debug) {
|
|
||||||
console.info('Certificate Signing Request');
|
|
||||||
console.info(csrPem);
|
|
||||||
console.info();
|
|
||||||
}
|
|
||||||
|
|
||||||
var results = await acme.certificates.create({
|
|
||||||
account: account,
|
|
||||||
accountKeypair: { privateKeyJwk: accountKeypair.private },
|
|
||||||
csr: csr,
|
|
||||||
domains: domains,
|
|
||||||
challenges: challenges, // must be implemented
|
|
||||||
customerEmail: null
|
|
||||||
});
|
|
||||||
140
package-lock.json
generated
140
package-lock.json
generated
@ -1,140 +0,0 @@
|
|||||||
{
|
|
||||||
"name": "@root/greenlock",
|
|
||||||
"version": "4.0.5",
|
|
||||||
"lockfileVersion": 1,
|
|
||||||
"requires": true,
|
|
||||||
"dependencies": {
|
|
||||||
"@greenlock/manager": {
|
|
||||||
"version": "3.1.0",
|
|
||||||
"resolved": "https://registry.npmjs.org/@greenlock/manager/-/manager-3.1.0.tgz",
|
|
||||||
"integrity": "sha512-PBy5CMK+j4oD7sj7hF5qE+xKEOSiiuL2hHd5X5ttEbtnTSDKjNeqbrR5k2ZddwVNdjOVeBIeuqlm81IFZ+Ftew==",
|
|
||||||
"requires": {
|
|
||||||
"greenlock-manager-fs": "^3.1.0"
|
|
||||||
},
|
|
||||||
"dependencies": {
|
|
||||||
"greenlock-manager-fs": {
|
|
||||||
"version": "3.1.1",
|
|
||||||
"resolved": "https://registry.npmjs.org/greenlock-manager-fs/-/greenlock-manager-fs-3.1.1.tgz",
|
|
||||||
"integrity": "sha512-np6qdnPIOZx40PAcSQcqK1eMPWjTKxsxcgRd/OVg0ai49WC1Ds74CTrwmB84pq2n53ikbnDBQFmKEQ4AC0DK8w==",
|
|
||||||
"requires": {
|
|
||||||
"@root/mkdirp": "^1.0.0",
|
|
||||||
"safe-replace": "^1.1.0"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"@root/acme": {
|
|
||||||
"version": "3.1.0",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/acme/-/acme-3.1.0.tgz",
|
|
||||||
"integrity": "sha512-GAyaW63cpSYd2KvVp5lHLbCWeEhJPKZK9nsJvZJOKsD9Uv88KEttn4FpDZEJ+2q3Jsey0DWpuQ2I4ft0JV9p2w==",
|
|
||||||
"requires": {
|
|
||||||
"@root/csr": "^0.8.1",
|
|
||||||
"@root/encoding": "^1.0.1",
|
|
||||||
"@root/keypairs": "^0.10.0",
|
|
||||||
"@root/pem": "^1.0.4",
|
|
||||||
"@root/request": "^1.6.1",
|
|
||||||
"@root/x509": "^0.7.2"
|
|
||||||
},
|
|
||||||
"dependencies": {
|
|
||||||
"@root/request": {
|
|
||||||
"version": "1.6.1",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/request/-/request-1.6.1.tgz",
|
|
||||||
"integrity": "sha512-8wrWyeBLRp7T8J36GkT3RODJ6zYmL0/maWlAUD5LOXT28D3TDquUepyYDKYANNA3Gc8R5ZCgf+AXvSTYpJEWwQ=="
|
|
||||||
}
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"@root/asn1": {
|
|
||||||
"version": "1.0.0",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/asn1/-/asn1-1.0.0.tgz",
|
|
||||||
"integrity": "sha512-0lfZNuOULKJDJmdIkP8V9RnbV3XaK6PAHD3swnFy4tZwtlMDzLKoM/dfNad7ut8Hu3r91wy9uK0WA/9zym5mig==",
|
|
||||||
"requires": {
|
|
||||||
"@root/encoding": "^1.0.1"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"@root/csr": {
|
|
||||||
"version": "0.8.1",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/csr/-/csr-0.8.1.tgz",
|
|
||||||
"integrity": "sha512-hKl0VuE549TK6SnS2Yn9nRvKbFZXn/oAg+dZJU/tlKl/f/0yRXeuUzf8akg3JjtJq+9E592zDqeXZ7yyrg8fSQ==",
|
|
||||||
"requires": {
|
|
||||||
"@root/asn1": "^1.0.0",
|
|
||||||
"@root/pem": "^1.0.4",
|
|
||||||
"@root/x509": "^0.7.2"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"@root/encoding": {
|
|
||||||
"version": "1.0.1",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/encoding/-/encoding-1.0.1.tgz",
|
|
||||||
"integrity": "sha512-OaEub02ufoU038gy6bsNHQOjIn8nUjGiLcaRmJ40IUykneJkIW5fxDqKxQx48cszuNflYldsJLPPXCrGfHs8yQ=="
|
|
||||||
},
|
|
||||||
"@root/keypairs": {
|
|
||||||
"version": "0.10.0",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/keypairs/-/keypairs-0.10.0.tgz",
|
|
||||||
"integrity": "sha512-t8VocY46Mtb0NTsxzyLLf5tsgfw0BXLYVADAyiRdEdqHcvPFGJdjkXNtHVQuSV/FMaC65iTOHVP4E6X8iT3Ikg==",
|
|
||||||
"requires": {
|
|
||||||
"@root/encoding": "^1.0.1",
|
|
||||||
"@root/pem": "^1.0.4",
|
|
||||||
"@root/x509": "^0.7.2"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"@root/mkdirp": {
|
|
||||||
"version": "1.0.0",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/mkdirp/-/mkdirp-1.0.0.tgz",
|
|
||||||
"integrity": "sha512-hxGAYUx5029VggfG+U9naAhQkoMSXtOeXtbql97m3Hi6/sQSRL/4khKZPyOF6w11glyCOU38WCNLu9nUcSjOfA=="
|
|
||||||
},
|
|
||||||
"@root/pem": {
|
|
||||||
"version": "1.0.4",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/pem/-/pem-1.0.4.tgz",
|
|
||||||
"integrity": "sha512-rEUDiUsHtild8GfIjFE9wXtcVxeS+ehCJQBwbQQ3IVfORKHK93CFnRtkr69R75lZFjcmKYVc+AXDB+AeRFOULA=="
|
|
||||||
},
|
|
||||||
"@root/request": {
|
|
||||||
"version": "1.6.1",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/request/-/request-1.6.1.tgz",
|
|
||||||
"integrity": "sha512-8wrWyeBLRp7T8J36GkT3RODJ6zYmL0/maWlAUD5LOXT28D3TDquUepyYDKYANNA3Gc8R5ZCgf+AXvSTYpJEWwQ=="
|
|
||||||
},
|
|
||||||
"@root/x509": {
|
|
||||||
"version": "0.7.2",
|
|
||||||
"resolved": "https://registry.npmjs.org/@root/x509/-/x509-0.7.2.tgz",
|
|
||||||
"integrity": "sha512-ENq3LGYORK5NiMFHEVeNMt+fTXaC7DTS6sQXoqV+dFdfT0vmiL5cDLjaXQhaklJQq0NiwicZegzJRl1ZOTp3WQ==",
|
|
||||||
"requires": {
|
|
||||||
"@root/asn1": "^1.0.0",
|
|
||||||
"@root/encoding": "^1.0.1"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"acme-http-01-standalone": {
|
|
||||||
"version": "3.0.5",
|
|
||||||
"resolved": "https://registry.npmjs.org/acme-http-01-standalone/-/acme-http-01-standalone-3.0.5.tgz",
|
|
||||||
"integrity": "sha512-W4GfK+39GZ+u0mvxRVUcVFCG6gposfzEnSBF20T/NUwWAKG59wQT1dUbS1NixRIAsRuhpGc4Jx659cErFQH0Pg=="
|
|
||||||
},
|
|
||||||
"cert-info": {
|
|
||||||
"version": "1.5.1",
|
|
||||||
"resolved": "https://registry.npmjs.org/cert-info/-/cert-info-1.5.1.tgz",
|
|
||||||
"integrity": "sha512-eoQC/yAgW3gKTKxjzyClvi+UzuY97YCjcl+lSqbsGIy7HeGaWxCPOQFivhUYm27hgsBMhsJJFya3kGvK6PMIcQ=="
|
|
||||||
},
|
|
||||||
"dotenv": {
|
|
||||||
"version": "8.2.0",
|
|
||||||
"resolved": "https://registry.npmjs.org/dotenv/-/dotenv-8.2.0.tgz",
|
|
||||||
"integrity": "sha512-8sJ78ElpbDJBHNeBzUbUVLsqKdccaa/BXF1uPTw3GrvQTBgrQrtObr2mUrE38vzYd8cEv+m/JBfDLioYcfXoaw==",
|
|
||||||
"dev": true
|
|
||||||
},
|
|
||||||
"greenlock-store-fs": {
|
|
||||||
"version": "3.2.2",
|
|
||||||
"resolved": "https://registry.npmjs.org/greenlock-store-fs/-/greenlock-store-fs-3.2.2.tgz",
|
|
||||||
"integrity": "sha512-92ejLB4DyV4qv/2b6VLGF2nKfYQeIfg3o+e/1cIoYLjlIaUFdbBXkzLTRozFlHsQPZt2ALi5qYrpC9IwH7GK8A==",
|
|
||||||
"requires": {
|
|
||||||
"@root/mkdirp": "^1.0.0",
|
|
||||||
"safe-replace": "^1.1.0"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"punycode": {
|
|
||||||
"version": "1.4.1",
|
|
||||||
"resolved": "https://registry.npmjs.org/punycode/-/punycode-1.4.1.tgz",
|
|
||||||
"integrity": "sha1-wNWmOycYgArY4esPpSachN1BhF4=",
|
|
||||||
"dev": true
|
|
||||||
},
|
|
||||||
"safe-replace": {
|
|
||||||
"version": "1.1.0",
|
|
||||||
"resolved": "https://registry.npmjs.org/safe-replace/-/safe-replace-1.1.0.tgz",
|
|
||||||
"integrity": "sha512-9/V2E0CDsKs9DWOOwJH7jYpSl9S3N05uyevNjvsnDauBqRowBPOyot1fIvV5N2IuZAbYyvrTXrYFVG0RZInfFw=="
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
99
package.json
99
package.json
@ -1,56 +1,47 @@
|
|||||||
{
|
{
|
||||||
"name": "@root/greenlock",
|
"name": "letsencrypt",
|
||||||
"version": "4.0.5",
|
"version": "1.5.1",
|
||||||
"description": "The easiest Let's Encrypt client for Node.js and Browsers",
|
"description": "Let's Encrypt for node.js on npm",
|
||||||
"homepage": "https://rootprojects.org/greenlock/",
|
"main": "index.js",
|
||||||
"main": "greenlock.js",
|
"scripts": {
|
||||||
"browser": {},
|
"test": "echo \"Error: no test specified\" && exit 1"
|
||||||
"bin": {
|
},
|
||||||
"greenlock": "bin/greenlock.js"
|
"repository": {
|
||||||
},
|
"type": "git",
|
||||||
"files": [
|
"url": "git+https://github.com/Daplie/node-letsencrypt.git"
|
||||||
"*.js",
|
},
|
||||||
"lib",
|
"keywords": [
|
||||||
"bin",
|
"letsencrypt",
|
||||||
"dist"
|
"letsencrypt.org",
|
||||||
],
|
"le",
|
||||||
"scripts": {
|
"Let's Encrypt",
|
||||||
"build": "nodex bin/bundle.js",
|
"lejs",
|
||||||
"lint": "jshint lib bin",
|
"le.js",
|
||||||
"test": "node server.js",
|
"acme",
|
||||||
"start": "node server.js"
|
"node",
|
||||||
},
|
"nodejs",
|
||||||
"repository": {
|
"node.js",
|
||||||
"type": "git",
|
"client"
|
||||||
"url": "https://git.rootprojects.org/root/greenlock.js.git"
|
],
|
||||||
},
|
"author": "AJ ONeal <coolaj86@gmail.com> (https://coolaj86.com/)",
|
||||||
"keywords": [
|
"license": "(MIT OR Apache-2.0)",
|
||||||
"Let's Encrypt",
|
"bugs": {
|
||||||
"ACME",
|
"url": "https://github.com/Daplie/node-letsencrypt/issues"
|
||||||
"browser",
|
},
|
||||||
"EC",
|
"homepage": "https://github.com/Daplie/node-letsencrypt#readme",
|
||||||
"RSA",
|
"devDependencies": {
|
||||||
"CSR",
|
"express": "^4.13.3",
|
||||||
"greenlock",
|
"localhost.daplie.com-certificates": "^1.1.2"
|
||||||
"VanillaJS",
|
},
|
||||||
"ZeroSSL"
|
"optionalDependencies": {},
|
||||||
],
|
"dependencies": {
|
||||||
"author": "AJ ONeal <coolaj86@gmail.com> (https://coolaj86.com/)",
|
"bluebird": "^3.0.6",
|
||||||
"license": "MPL-2.0",
|
"homedir": "^0.6.0",
|
||||||
"dependencies": {
|
"letiny-core": "^2.0.1",
|
||||||
"@greenlock/manager": "^3.1.0",
|
"mkdirp": "^0.5.1",
|
||||||
"@root/acme": "^3.1.0",
|
"pyconf": "^1.1.2",
|
||||||
"@root/csr": "^0.8.1",
|
"request": "^2.67.0",
|
||||||
"@root/keypairs": "^0.10.0",
|
"rsa-compat": "^1.2.1",
|
||||||
"@root/mkdirp": "^1.0.0",
|
"safe-replace": "^1.0.2"
|
||||||
"@root/request": "^1.6.1",
|
}
|
||||||
"acme-http-01-standalone": "^3.0.5",
|
|
||||||
"cert-info": "^1.5.1",
|
|
||||||
"greenlock-store-fs": "^3.2.2",
|
|
||||||
"safe-replace": "^1.1.0"
|
|
||||||
},
|
|
||||||
"devDependencies": {
|
|
||||||
"dotenv": "^8.2.0",
|
|
||||||
"punycode": "^1.4.1"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
341
plugins.js
341
plugins.js
@ -1,341 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var P = module.exports;
|
|
||||||
|
|
||||||
var spawn = require('child_process').spawn;
|
|
||||||
var spawnSync = require('child_process').spawnSync;
|
|
||||||
var promisify = require('util').promisify;
|
|
||||||
|
|
||||||
// Exported for CLIs and such to override
|
|
||||||
P.PKG_DIR = __dirname;
|
|
||||||
|
|
||||||
P._loadStore = function(storeConf) {
|
|
||||||
return P._loadHelper(storeConf.module).then(function(plugin) {
|
|
||||||
return P._normalizeStore(storeConf.module, plugin.create(storeConf));
|
|
||||||
});
|
|
||||||
};
|
|
||||||
P._loadChallenge = function(chConfs, typ01) {
|
|
||||||
return P._loadHelper(chConfs[typ01].module).then(function(plugin) {
|
|
||||||
var ch = P._normalizeChallenge(
|
|
||||||
chConfs[typ01].module,
|
|
||||||
plugin.create(chConfs[typ01])
|
|
||||||
);
|
|
||||||
ch._type = typ01;
|
|
||||||
return ch;
|
|
||||||
});
|
|
||||||
};
|
|
||||||
P._loadHelper = function(modname) {
|
|
||||||
try {
|
|
||||||
return Promise.resolve(require(modname));
|
|
||||||
} catch (e) {
|
|
||||||
console.error("Could not load '%s'", modname);
|
|
||||||
console.error('Did you install it?');
|
|
||||||
console.error('\tnpm install --save %s', modname);
|
|
||||||
e.context = 'load_plugin';
|
|
||||||
throw e;
|
|
||||||
|
|
||||||
// Fun experiment, bad idea
|
|
||||||
/*
|
|
||||||
return P._install(modname).then(function() {
|
|
||||||
return require(modname);
|
|
||||||
});
|
|
||||||
*/
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
P._normalizeStore = function(name, store) {
|
|
||||||
var acc = store.accounts;
|
|
||||||
var crt = store.certificates;
|
|
||||||
|
|
||||||
var warned = false;
|
|
||||||
function warn() {
|
|
||||||
if (warned) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
warned = true;
|
|
||||||
console.warn(
|
|
||||||
"'" +
|
|
||||||
name +
|
|
||||||
"' may have incorrect function signatures, or contains deprecated use of callbacks"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
// accs
|
|
||||||
if (acc.check && 2 === acc.check.length) {
|
|
||||||
warn();
|
|
||||||
acc._thunk_check = acc.check;
|
|
||||||
acc.check = promisify(acc._thunk_check);
|
|
||||||
}
|
|
||||||
if (acc.set && 3 === acc.set.length) {
|
|
||||||
warn();
|
|
||||||
acc._thunk_set = acc.set;
|
|
||||||
acc.set = promisify(acc._thunk_set);
|
|
||||||
}
|
|
||||||
if (2 === acc.checkKeypair.length) {
|
|
||||||
warn();
|
|
||||||
acc._thunk_checkKeypair = acc.checkKeypair;
|
|
||||||
acc.checkKeypair = promisify(acc._thunk_checkKeypair);
|
|
||||||
}
|
|
||||||
if (3 === acc.setKeypair.length) {
|
|
||||||
warn();
|
|
||||||
acc._thunk_setKeypair = acc.setKeypair;
|
|
||||||
acc.setKeypair = promisify(acc._thunk_setKeypair);
|
|
||||||
}
|
|
||||||
|
|
||||||
// certs
|
|
||||||
if (2 === crt.check.length) {
|
|
||||||
warn();
|
|
||||||
crt._thunk_check = crt.check;
|
|
||||||
crt.check = promisify(crt._thunk_check);
|
|
||||||
}
|
|
||||||
if (3 === crt.set.length) {
|
|
||||||
warn();
|
|
||||||
crt._thunk_set = crt.set;
|
|
||||||
crt.set = promisify(crt._thunk_set);
|
|
||||||
}
|
|
||||||
if (2 === crt.checkKeypair.length) {
|
|
||||||
warn();
|
|
||||||
crt._thunk_checkKeypair = crt.checkKeypair;
|
|
||||||
crt.checkKeypair = promisify(crt._thunk_checkKeypair);
|
|
||||||
}
|
|
||||||
if (2 === crt.setKeypair.length) {
|
|
||||||
warn();
|
|
||||||
crt._thunk_setKeypair = crt.setKeypair;
|
|
||||||
crt.setKeypair = promisify(crt._thunk_setKeypair);
|
|
||||||
}
|
|
||||||
|
|
||||||
return store;
|
|
||||||
};
|
|
||||||
P._normalizeChallenge = function(name, ch) {
|
|
||||||
var gch = {};
|
|
||||||
var warned = false;
|
|
||||||
function warn() {
|
|
||||||
if (warned) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
warned = true;
|
|
||||||
console.warn(
|
|
||||||
"'" +
|
|
||||||
name +
|
|
||||||
"' may have incorrect function signatures, or contains deprecated use of callbacks"
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
var warned2 = false;
|
|
||||||
function warn2() {
|
|
||||||
if (warned2) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
warned2 = true;
|
|
||||||
console.warn(
|
|
||||||
"'" +
|
|
||||||
name +
|
|
||||||
"' did not return a Promise when called. This should be fixed by the maintainer."
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
function wrappy(fn) {
|
|
||||||
return function(_params) {
|
|
||||||
return Promise.resolve().then(function() {
|
|
||||||
var result = fn.call(ch, _params);
|
|
||||||
if (!result || !result.then) {
|
|
||||||
warn2();
|
|
||||||
}
|
|
||||||
return result;
|
|
||||||
});
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
// init, zones, set, get, remove, propagationDelay
|
|
||||||
if (ch.init) {
|
|
||||||
if (2 === ch.init.length) {
|
|
||||||
warn();
|
|
||||||
ch._thunk_init = ch.init;
|
|
||||||
ch.init = promisify(ch._thunk_init);
|
|
||||||
}
|
|
||||||
gch.init = wrappy(ch.init);
|
|
||||||
}
|
|
||||||
if (ch.zones) {
|
|
||||||
if (2 === ch.zones.length) {
|
|
||||||
warn();
|
|
||||||
ch._thunk_zones = ch.zones;
|
|
||||||
ch.zones = promisify(ch._thunk_zones);
|
|
||||||
}
|
|
||||||
gch.zones = wrappy(ch.zones);
|
|
||||||
}
|
|
||||||
if (2 === ch.set.length) {
|
|
||||||
warn();
|
|
||||||
ch._thunk_set = ch.set;
|
|
||||||
ch.set = promisify(ch._thunk_set);
|
|
||||||
}
|
|
||||||
gch.set = wrappy(ch.set);
|
|
||||||
if (2 === ch.remove.length) {
|
|
||||||
warn();
|
|
||||||
ch._thunk_remove = ch.remove;
|
|
||||||
ch.remove = promisify(ch._thunk_remove);
|
|
||||||
}
|
|
||||||
gch.remove = wrappy(ch.remove);
|
|
||||||
if (ch.get) {
|
|
||||||
if (2 === ch.get.length) {
|
|
||||||
warn();
|
|
||||||
ch._thunk_get = ch.get;
|
|
||||||
ch.get = promisify(ch._thunk_get);
|
|
||||||
}
|
|
||||||
gch.get = wrappy(ch.get);
|
|
||||||
}
|
|
||||||
if("number" === typeof ch.propagationDelay) {
|
|
||||||
gch.propagationDelay = ch.propagationDelay;
|
|
||||||
}
|
|
||||||
|
|
||||||
return gch;
|
|
||||||
};
|
|
||||||
|
|
||||||
P._loadSync = function(modname) {
|
|
||||||
try {
|
|
||||||
return require(modname);
|
|
||||||
} catch (e) {
|
|
||||||
console.error("Could not load '%s'", modname);
|
|
||||||
console.error('Did you install it?');
|
|
||||||
console.error('\tnpm install --save %s', modname);
|
|
||||||
e.context = 'load_plugin';
|
|
||||||
throw e;
|
|
||||||
}
|
|
||||||
/*
|
|
||||||
try {
|
|
||||||
mod = require(modname);
|
|
||||||
} catch (e) {
|
|
||||||
P._installSync(modname);
|
|
||||||
mod = require(modname);
|
|
||||||
}
|
|
||||||
*/
|
|
||||||
};
|
|
||||||
|
|
||||||
P._installSync = function(moduleName) {
|
|
||||||
try {
|
|
||||||
return require(moduleName);
|
|
||||||
} catch (e) {
|
|
||||||
// continue
|
|
||||||
}
|
|
||||||
var npm = 'npm';
|
|
||||||
var args = ['install', '--save', moduleName];
|
|
||||||
var out = '';
|
|
||||||
var cmd;
|
|
||||||
|
|
||||||
try {
|
|
||||||
cmd = spawnSync(npm, args, {
|
|
||||||
cwd: P.PKG_DIR,
|
|
||||||
windowsHide: true
|
|
||||||
});
|
|
||||||
} catch (e) {
|
|
||||||
console.error(
|
|
||||||
"Failed to start: '" +
|
|
||||||
npm +
|
|
||||||
' ' +
|
|
||||||
args.join(' ') +
|
|
||||||
"' in '" +
|
|
||||||
P.PKG_DIR +
|
|
||||||
"'"
|
|
||||||
);
|
|
||||||
console.error(e.message);
|
|
||||||
process.exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!cmd.status) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
out += cmd.stdout.toString('utf8');
|
|
||||||
out += cmd.stderr.toString('utf8');
|
|
||||||
|
|
||||||
if (out) {
|
|
||||||
console.error(out);
|
|
||||||
console.error();
|
|
||||||
console.error();
|
|
||||||
}
|
|
||||||
|
|
||||||
console.error(
|
|
||||||
"Failed to run: '" +
|
|
||||||
npm +
|
|
||||||
' ' +
|
|
||||||
args.join(' ') +
|
|
||||||
"' in '" +
|
|
||||||
P.PKG_DIR +
|
|
||||||
"'"
|
|
||||||
);
|
|
||||||
|
|
||||||
console.error(
|
|
||||||
'Try for yourself:\n\tcd ' + P.PKG_DIR + '\n\tnpm ' + args.join(' ')
|
|
||||||
);
|
|
||||||
|
|
||||||
process.exit(1);
|
|
||||||
};
|
|
||||||
|
|
||||||
P._install = function(moduleName) {
|
|
||||||
return new Promise(function(resolve) {
|
|
||||||
if (!moduleName) {
|
|
||||||
throw new Error('no module name given');
|
|
||||||
}
|
|
||||||
|
|
||||||
var npm = 'npm';
|
|
||||||
var args = ['install', '--save', moduleName];
|
|
||||||
var out = '';
|
|
||||||
var cmd = spawn(npm, args, {
|
|
||||||
cwd: P.PKG_DIR,
|
|
||||||
windowsHide: true
|
|
||||||
});
|
|
||||||
|
|
||||||
cmd.stdout.on('data', function(chunk) {
|
|
||||||
out += chunk.toString('utf8');
|
|
||||||
});
|
|
||||||
cmd.stdout.on('data', function(chunk) {
|
|
||||||
out += chunk.toString('utf8');
|
|
||||||
});
|
|
||||||
|
|
||||||
cmd.on('error', function(e) {
|
|
||||||
console.error(
|
|
||||||
"Failed to start: '" +
|
|
||||||
npm +
|
|
||||||
' ' +
|
|
||||||
args.join(' ') +
|
|
||||||
"' in '" +
|
|
||||||
P.PKG_DIR +
|
|
||||||
"'"
|
|
||||||
);
|
|
||||||
console.error(e.message);
|
|
||||||
process.exit(1);
|
|
||||||
});
|
|
||||||
|
|
||||||
cmd.on('exit', function(code) {
|
|
||||||
if (!code) {
|
|
||||||
resolve();
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (out) {
|
|
||||||
console.error(out);
|
|
||||||
console.error();
|
|
||||||
console.error();
|
|
||||||
}
|
|
||||||
console.error(
|
|
||||||
"Failed to run: '" +
|
|
||||||
npm +
|
|
||||||
' ' +
|
|
||||||
args.join(' ') +
|
|
||||||
"' in '" +
|
|
||||||
P.PKG_DIR +
|
|
||||||
"'"
|
|
||||||
);
|
|
||||||
console.error(
|
|
||||||
'Try for yourself:\n\tcd ' +
|
|
||||||
P.PKG_DIR +
|
|
||||||
'\n\tnpm ' +
|
|
||||||
args.join(' ')
|
|
||||||
);
|
|
||||||
process.exit(1);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
if (require.main === module) {
|
|
||||||
P._installSync(process.argv[2]);
|
|
||||||
}
|
|
||||||
202
scraps/README.md
Normal file
202
scraps/README.md
Normal file
@ -0,0 +1,202 @@
|
|||||||
|
Scraps
|
||||||
|
======
|
||||||
|
|
||||||
|
These are examples that we might come back and update (and would love help updating),
|
||||||
|
but they are more likely to cause confusion than success for the casual googled-it-and-got-here-er.
|
||||||
|
|
||||||
|
Probably Outdated Examples
|
||||||
|
========
|
||||||
|
|
||||||
|
The simplest example of setting up a webserver appropriately is probably `letsencrypt-cli` (~120 lines of code):
|
||||||
|
|
||||||
|
* [letsencrypt-cli//lib/standalone.js](https://github.com/Daplie/node-letsencrypt-cli/blob/master/lib/standalone.js)
|
||||||
|
|
||||||
|
Similary, `letsencrypt-cli`'s usage of `le.register()` is fairly simple (~75 lines of code):
|
||||||
|
|
||||||
|
* [letsencrypt-cli/bin/letsencrypt.js](https://github.com/Daplie/node-letsencrypt-cli/blob/master/bin/letsencrypt.js)
|
||||||
|
|
||||||
|
### One-Time Registration
|
||||||
|
|
||||||
|
Register a 90-day certificate manually, on a whim
|
||||||
|
|
||||||
|
**Note**: We've been running a fast development cycle and this example may be out of date.
|
||||||
|
The API *shouldn't* have changed much but, we probably need to come back and update it.
|
||||||
|
|
||||||
|
#### Snippets
|
||||||
|
|
||||||
|
[`commandline-minimal`](https://github.com/Daplie/node-letsencrypt/blob/master/examples/commandline-minimal.js):
|
||||||
|
|
||||||
|
**Part 1: the Let's Encrypt client**:
|
||||||
|
```javascript
|
||||||
|
'use strict';
|
||||||
|
|
||||||
|
var LE = require('letsencrypt');
|
||||||
|
var config = require('./config-minimal');
|
||||||
|
|
||||||
|
// Note: you should make this special dir in your product and leave it empty
|
||||||
|
config.le.webrootPath = __dirname + '/../tests/acme-challenge';
|
||||||
|
config.le.server = LE.stagingServer;
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// Manual Registration
|
||||||
|
//
|
||||||
|
var le = LE.create(config.backend, config.le);
|
||||||
|
le.register({
|
||||||
|
agreeTos: true
|
||||||
|
, domains: ['example.com'] // CHANGE TO YOUR DOMAIN
|
||||||
|
, email: 'user@email.com' // CHANGE TO YOUR EMAIL
|
||||||
|
}, function (err) {
|
||||||
|
if (err) {
|
||||||
|
console.error('[Error]: node-letsencrypt/examples/standalone');
|
||||||
|
console.error(err.stack);
|
||||||
|
} else {
|
||||||
|
console.log('success');
|
||||||
|
}
|
||||||
|
|
||||||
|
plainServer.close();
|
||||||
|
tlsServer.close();
|
||||||
|
});
|
||||||
|
```
|
||||||
|
|
||||||
|
**Part 2: Express Web Server**:
|
||||||
|
```javascript
|
||||||
|
//
|
||||||
|
// Express App
|
||||||
|
//
|
||||||
|
var app = require('express')();
|
||||||
|
app.use('/', le.middleware()); // TODO le.middleware was moved to letsencrypt-express, we need to update the docs here
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// HTTP & HTTPS servers
|
||||||
|
// (required for domain validation)
|
||||||
|
//
|
||||||
|
var plainServer = require('http').createServer(app).listen(config.plainPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
|
|
||||||
|
var tlsServer = require('https').createServer({
|
||||||
|
key: config.tlsKey
|
||||||
|
, cert: config.tlsCert
|
||||||
|
, SNICallback: le.sniCallback
|
||||||
|
}, app).listen(config.tlsPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Runnable Demo
|
||||||
|
|
||||||
|
* [commandline (standalone with "webroot")](https://github.com/Daplie/node-letsencrypt/blob/master/examples/commandline.js)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# manual standalone registration via commandline
|
||||||
|
# (runs against testing server on tls port 5001)
|
||||||
|
node examples/commandline.js example.com,www.example.com user@example.net agree
|
||||||
|
```
|
||||||
|
|
||||||
|
### Express
|
||||||
|
|
||||||
|
Fully Automatic HTTPS with ExpressJS using Free SSL certificates from Let's Encrypt
|
||||||
|
|
||||||
|
#### Snippets
|
||||||
|
|
||||||
|
* [Minimal ExpressJS Example](https://github.com/Daplie/node-letsencrypt/blob/master/examples/express-minimal.js)
|
||||||
|
|
||||||
|
```javascript
|
||||||
|
'use strict';
|
||||||
|
|
||||||
|
var LE = require('letsencrypt');
|
||||||
|
var config = require('./config-minimal');
|
||||||
|
|
||||||
|
// Note: you should make this special dir in your product and leave it empty
|
||||||
|
config.le.webrootPath = __dirname + '/../tests/acme-challenge';
|
||||||
|
config.le.server = LE.stagingServer;
|
||||||
|
|
||||||
|
//
|
||||||
|
// Automatically Register / Renew Domains
|
||||||
|
//
|
||||||
|
var le = LE.create(config.backend, config.le, {
|
||||||
|
sniRegisterCallback: function (args, expiredCert, cb) {
|
||||||
|
// Security: check that this is actually a subdomain we allow
|
||||||
|
// (otherwise an attacker can cause you to rate limit against the LE server)
|
||||||
|
|
||||||
|
var hostname = args.domains[0];
|
||||||
|
if (!/\.example\.com$/.test(hostname)) {
|
||||||
|
console.error("bad domain '" + hostname + "', not a subdomain of example.com");
|
||||||
|
cb(nul, null);
|
||||||
|
}
|
||||||
|
|
||||||
|
// agree to the LE TOS for this domain
|
||||||
|
args.agreeTos = true;
|
||||||
|
args.email = 'user@example.com';
|
||||||
|
|
||||||
|
// use the cert even though it's expired
|
||||||
|
if (expiredCert) {
|
||||||
|
cb(null, expiredCert);
|
||||||
|
cb = function () { /*ignore*/ };
|
||||||
|
}
|
||||||
|
|
||||||
|
// register / renew the certificate in the background
|
||||||
|
le.register(args, cb);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// Express App
|
||||||
|
//
|
||||||
|
var app = require('express')();
|
||||||
|
app.use('/', le.middleware());
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// HTTP & HTTPS servers
|
||||||
|
//
|
||||||
|
require('http').createServer(app).listen(config.plainPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
|
|
||||||
|
require('https').createServer({
|
||||||
|
key: config.tlsKey
|
||||||
|
, cert: config.tlsCert
|
||||||
|
, SNICallback: le.sniCallback
|
||||||
|
}, app).listen(config.tlsPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Runnable Example
|
||||||
|
|
||||||
|
* [Full ExpressJS Example](https://github.com/Daplie/node-letsencrypt/blob/master/examples/express.js)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# clear out the certificates
|
||||||
|
rm -rf tests/letsencrypt.*
|
||||||
|
|
||||||
|
# automatic registration and renewal (certs install as you visit the site for the first time)
|
||||||
|
# (runs against testing server on tls port 5001)
|
||||||
|
node examples/express.js example.com,www.example.com user@example.net agree
|
||||||
|
```
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# this will take a moment because it won't respond to the tls sni header until it gets the certs
|
||||||
|
curl https://example.com/
|
||||||
|
```
|
||||||
|
|
||||||
|
### non-root
|
||||||
|
|
||||||
|
If you want to run this as non-root, you can.
|
||||||
|
|
||||||
|
You just have to set node to be allowed to use root ports
|
||||||
|
|
||||||
|
```
|
||||||
|
# node
|
||||||
|
sudo setcap cap_net_bind_service=+ep /usr/local/bin/node
|
||||||
|
```
|
||||||
|
|
||||||
|
and then make sure to set all of of the following to a directory that your user is permitted to write to
|
||||||
|
|
||||||
|
* `webrootPath`
|
||||||
|
* `configDir`
|
||||||
|
|
||||||
53
scraps/commandline-minimal.js
Normal file
53
scraps/commandline-minimal.js
Normal file
@ -0,0 +1,53 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var LE = require('../');
|
||||||
|
var config = require('./config-minimal');
|
||||||
|
|
||||||
|
// Note: you should make this special dir in your product and leave it empty
|
||||||
|
config.le.webrootPath = __dirname + '/../tests/acme-challenge';
|
||||||
|
config.le.server = LE.stagingServer;
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// Manual Registration
|
||||||
|
//
|
||||||
|
var le = LE.create(config.le);
|
||||||
|
le.register({
|
||||||
|
agreeTos: true
|
||||||
|
, domains: [process.argv[3] || 'example.com'] // CHANGE TO YOUR DOMAIN
|
||||||
|
, email: process.argv[2] || 'user@example.com' // CHANGE TO YOUR EMAIL
|
||||||
|
}, function (err) {
|
||||||
|
if (err) {
|
||||||
|
console.error('[Error]: node-letsencrypt/examples/standalone');
|
||||||
|
console.error(err.stack);
|
||||||
|
} else {
|
||||||
|
console.log('success');
|
||||||
|
}
|
||||||
|
|
||||||
|
plainServer.close();
|
||||||
|
tlsServer.close();
|
||||||
|
});
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// Express App
|
||||||
|
//
|
||||||
|
var app = require('express')();
|
||||||
|
app.use('/', le.middleware());
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// HTTP & HTTPS servers
|
||||||
|
// (required for domain validation)
|
||||||
|
//
|
||||||
|
var plainServer = require('http').createServer(app).listen(config.plainPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
|
|
||||||
|
var tlsServer = require('https').createServer({
|
||||||
|
key: config.tlsKey
|
||||||
|
, cert: config.tlsCert
|
||||||
|
, SNICallback: le.sniCallback
|
||||||
|
}, app).listen(config.tlsPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
87
scraps/commandline.js
Normal file
87
scraps/commandline.js
Normal file
@ -0,0 +1,87 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var conf = {
|
||||||
|
domains: process.argv[2]
|
||||||
|
, email: process.argv[3]
|
||||||
|
, agree: process.argv[4]
|
||||||
|
};
|
||||||
|
var port = 80;
|
||||||
|
var tlsPort = 5001;
|
||||||
|
|
||||||
|
if (!conf.domains || !conf.email || !conf.agree) {
|
||||||
|
console.error("Usage: letsencrypt <domain1,domain2> <email> agree");
|
||||||
|
console.error("Example: letsencrypt example.com,www.example.com user@example.com agree");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
var LE = require('../');
|
||||||
|
var path = require('path');
|
||||||
|
// backend-specific defaults will be passed through
|
||||||
|
// Note: Since agreeTos is a legal agreement, I would suggest not accepting it by default
|
||||||
|
var bkDefaults = {
|
||||||
|
webrootPath: path.join(__dirname, '..', 'tests', 'acme-challenge')
|
||||||
|
, fullchainTpl: '/live/:hostname/fullchain.pem'
|
||||||
|
, privkeyTpl: '/live/:hostname/privkey.pem'
|
||||||
|
, configDir: path.join(__dirname, '..', 'tests', 'letsencrypt.config')
|
||||||
|
, server: LE.stagingServer
|
||||||
|
|
||||||
|
// backend-specific
|
||||||
|
, logsDir: path.join(__dirname, '..', 'tests', 'letsencrypt.logs')
|
||||||
|
, workDir: path.join(__dirname, '..', 'tests', 'letsencrypt.work')
|
||||||
|
};
|
||||||
|
|
||||||
|
var le = LE.create(bkDefaults, {
|
||||||
|
/*
|
||||||
|
setChallenge: function (hostnames, key, value, cb) {
|
||||||
|
// the python backend needs fs.watch implemented
|
||||||
|
// before this would work (and even then it would be difficult)
|
||||||
|
}
|
||||||
|
, getChallenge: function (hostnames, key, cb) {
|
||||||
|
//
|
||||||
|
}
|
||||||
|
, sniRegisterCallback: function (args, certInfo, cb) {
|
||||||
|
|
||||||
|
}
|
||||||
|
, registrationFailureCallback: function (args, certInfo, cb) {
|
||||||
|
what do to when a backgrounded registration fails
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
});
|
||||||
|
|
||||||
|
var localCerts = require('localhost.daplie.com-certificates');
|
||||||
|
var express = require('express');
|
||||||
|
var app = express();
|
||||||
|
|
||||||
|
app.use('/', le.middleware());
|
||||||
|
|
||||||
|
var server = require('http').createServer();
|
||||||
|
server.on('request', app);
|
||||||
|
server.listen(port, function () {
|
||||||
|
console.log('Listening http', server.address());
|
||||||
|
});
|
||||||
|
|
||||||
|
var tlsServer = require('https').createServer({
|
||||||
|
key: localCerts.key
|
||||||
|
, cert: localCerts.cert
|
||||||
|
, SNICallback: le.sniCallback
|
||||||
|
});
|
||||||
|
tlsServer.on('request', app);
|
||||||
|
tlsServer.listen(tlsPort, function () {
|
||||||
|
console.log('Listening http', tlsServer.address());
|
||||||
|
});
|
||||||
|
|
||||||
|
le.register({
|
||||||
|
agreeTos: 'agree' === conf.agree
|
||||||
|
, domains: conf.domains.split(',')
|
||||||
|
, email: conf.email
|
||||||
|
}, function (err) {
|
||||||
|
if (err) {
|
||||||
|
console.error('[Error]: node-letsencrypt/examples/standalone');
|
||||||
|
console.error(err.stack);
|
||||||
|
} else {
|
||||||
|
console.log('success');
|
||||||
|
}
|
||||||
|
|
||||||
|
server.close();
|
||||||
|
tlsServer.close();
|
||||||
|
});
|
||||||
26
scraps/config-minimal.js
Normal file
26
scraps/config-minimal.js
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var path = require('path');
|
||||||
|
|
||||||
|
var config = {
|
||||||
|
|
||||||
|
plainPort: 80
|
||||||
|
, tlsPort: 5001 // 5001 for testing, normally 443
|
||||||
|
, tlsKey: require('localhost.daplie.com-certificates').key
|
||||||
|
, tlsCert: require('localhost.daplie.com-certificates').cert
|
||||||
|
|
||||||
|
|
||||||
|
, le: {
|
||||||
|
webrootPath: path.join(__dirname, '..', 'tests', 'acme-challenge')
|
||||||
|
, fullchainTpl: '/live/:hostname/fullchain.pem'
|
||||||
|
, privkeyTpl: '/live/:hostname/privkey.pem'
|
||||||
|
, configDir: path.join(__dirname, '..', 'tests', 'letsencrypt.config')
|
||||||
|
|
||||||
|
// these are specific to the python client and won't be needed with the purejs library
|
||||||
|
, logsDir: path.join(__dirname, '..', 'tests', 'letsencrypt.logs')
|
||||||
|
, workDir: path.join(__dirname, '..', 'tests', 'letsencrypt.work')
|
||||||
|
}
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
module.exports = config;
|
||||||
57
scraps/express-minimal.js
Normal file
57
scraps/express-minimal.js
Normal file
@ -0,0 +1,57 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var LE = require('../');
|
||||||
|
var config = require('./config-minimal');
|
||||||
|
|
||||||
|
// Note: you should make this special dir in your product and leave it empty
|
||||||
|
config.le.webrootPath = __dirname + '/../tests/acme-challenge';
|
||||||
|
config.le.server = LE.stagingServer;
|
||||||
|
|
||||||
|
var le = LE.create(config.le, {
|
||||||
|
sniRegisterCallback: function (args, expiredCert, cb) {
|
||||||
|
// In theory you should never get an expired certificate because
|
||||||
|
// the certificates automatically renew in the background starting
|
||||||
|
// about a week before they expire.
|
||||||
|
// (the default behavior is to randomly stagger renewals)
|
||||||
|
// so in this case we'll just return the expired certificate
|
||||||
|
if (expiredCert) { return cb(null, expiredCert); }
|
||||||
|
|
||||||
|
// If we get here that means this domain hasn't been registered yet
|
||||||
|
// Security Warning: you should either manually register domains
|
||||||
|
// and return null here or check that the sni header isn't being
|
||||||
|
// spoofed and this is actually a domain you own before registering
|
||||||
|
//
|
||||||
|
// cb(null, null);
|
||||||
|
|
||||||
|
var hostname = args.domains[0];
|
||||||
|
console.log("[TODO] check that '" + hostname + "' is one I expect");
|
||||||
|
|
||||||
|
args.agreeTos = true;
|
||||||
|
args.email = 'user@example.com';
|
||||||
|
|
||||||
|
le.register(args, cb);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// Express App
|
||||||
|
//
|
||||||
|
var app = require('express')();
|
||||||
|
app.use('/', le.middleware());
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// HTTP & HTTPS servers
|
||||||
|
//
|
||||||
|
require('http').createServer(app).listen(config.plainPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
|
|
||||||
|
require('https').createServer({
|
||||||
|
key: config.tlsKey
|
||||||
|
, cert: config.tlsCert
|
||||||
|
, SNICallback: le.sniCallback
|
||||||
|
}, app).listen(config.tlsPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
87
scraps/express.js
Normal file
87
scraps/express.js
Normal file
@ -0,0 +1,87 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var conf = {
|
||||||
|
domains: (process.argv[2]||'').split(',')
|
||||||
|
, email: process.argv[3]
|
||||||
|
, agree: 'agree' === process.argv[4]
|
||||||
|
};
|
||||||
|
var port = 80;
|
||||||
|
var tlsPort = 5001;
|
||||||
|
|
||||||
|
if (!conf.domains || !conf.email || !conf.agree) {
|
||||||
|
console.error("Usage: node examples/express <domain1,domain2> <email> agree");
|
||||||
|
console.error("Example: node examples/express example.com,www.example.com user@example.com agree");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
var LE = require('../');
|
||||||
|
var path = require('path');
|
||||||
|
// backend-specific defaults will be passed through
|
||||||
|
// Note: Since agreeTos is a legal agreement, I would suggest not accepting it by default
|
||||||
|
var bkDefaults = {
|
||||||
|
webrootPath: path.join(__dirname, '..', 'tests', 'acme-challenge')
|
||||||
|
, fullchainTpl: '/live/:hostname/fullchain.pem'
|
||||||
|
, privkeyTpl: '/live/:hostname/privkey.pem'
|
||||||
|
, configDir: path.join(__dirname, '..', 'tests', 'letsencrypt.config')
|
||||||
|
, server: LE.stagingServer
|
||||||
|
};
|
||||||
|
|
||||||
|
var le = LE.create(LEP, bkDefaults, {
|
||||||
|
sniRegisterCallback: function (args, certInfo, cb) {
|
||||||
|
var allowedDomains = conf.domains; // require('../tests/config').allowedDomains;
|
||||||
|
|
||||||
|
// let the renewal take place in the background
|
||||||
|
if (certInfo && certInfo.context) {
|
||||||
|
cb(null, certInfo);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
// verify that these are domains we allow to register on our server
|
||||||
|
if (args.domains.length && args.domains.every(function (hostname) {
|
||||||
|
hostname = hostname.toLowerCase();
|
||||||
|
return (-1 !== allowedDomains.indexOf(hostname));
|
||||||
|
})) {
|
||||||
|
// wait for registration before responding
|
||||||
|
args.agreeTos = conf.agree;
|
||||||
|
args.email = conf.email; // you'd want to lookup which user has this email
|
||||||
|
le.register(args, cb);
|
||||||
|
} else {
|
||||||
|
// I don't know where this error goes (SNICallback)... but at least we put it somewhere
|
||||||
|
cb(new Error("SNI came in for (an) unrecognized domain(s): '" + args.domains + "'"));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
/*
|
||||||
|
, setChallenge: function (hostnames, key, value, cb) {
|
||||||
|
// the python backend needs fs.watch implemented
|
||||||
|
// before this would work (and even then it would be difficult)
|
||||||
|
}
|
||||||
|
, getChallenge: function (hostnames, key, cb) {
|
||||||
|
//
|
||||||
|
}
|
||||||
|
, registrationFailureCallback: function (args, certInfo, cb) {
|
||||||
|
what do to when a backgrounded registration fails
|
||||||
|
}
|
||||||
|
*/
|
||||||
|
});
|
||||||
|
|
||||||
|
var localCerts = require('localhost.daplie.com-certificates');
|
||||||
|
var express = require('express');
|
||||||
|
var app = express();
|
||||||
|
|
||||||
|
app.use('/', le.middleware());
|
||||||
|
|
||||||
|
var server = require('http').createServer();
|
||||||
|
server.on('request', app);
|
||||||
|
server.listen(port, function () {
|
||||||
|
console.log('Listening http', server.address());
|
||||||
|
});
|
||||||
|
|
||||||
|
var tlsServer = require('https').createServer({
|
||||||
|
key: localCerts.key
|
||||||
|
, cert: localCerts.cert
|
||||||
|
, SNICallback: le.sniCallback
|
||||||
|
});
|
||||||
|
tlsServer.on('request', app);
|
||||||
|
tlsServer.listen(tlsPort, function () {
|
||||||
|
console.log('Listening http', tlsServer.address());
|
||||||
|
});
|
||||||
80
scraps/private-key-json-to-account-id.js
Normal file
80
scraps/private-key-json-to-account-id.js
Normal file
@ -0,0 +1,80 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var fs = require('fs');
|
||||||
|
var crypto = require('crypto');
|
||||||
|
var ursa = require('ursa');
|
||||||
|
|
||||||
|
// Here are all the places you can discover the account id:
|
||||||
|
//
|
||||||
|
// letsencrypt/account.py
|
||||||
|
//
|
||||||
|
// /etc/letsencrypt/accounts/{{ server }}/directory/{{ accountId }}/private_key.json
|
||||||
|
// /etc/letsencrypt/accounts/acme-v01.api.letsencrypt.org/directory/f4c33502df3789849f617944253b35ae/private_key.json
|
||||||
|
//
|
||||||
|
// /etc/letsencrypt/renewal/{{ hostname }}.conf
|
||||||
|
// /etc/letsencrypt/renewal/example.com.conf
|
||||||
|
//
|
||||||
|
// Note: each domain has its own private key
|
||||||
|
|
||||||
|
function fromPrivateKeyUrsa(priv, cb) {
|
||||||
|
var pub = priv.toPublicPem();
|
||||||
|
var accountId = crypto.createHash('md5').update(pub).digest('hex');
|
||||||
|
|
||||||
|
cb(null, accountId);
|
||||||
|
}
|
||||||
|
|
||||||
|
function fromAccountPrivateKey(pkj, cb) {
|
||||||
|
Object.keys(pkj).forEach(function (key) {
|
||||||
|
pkj[key] = new Buffer(pkj[key], 'base64');
|
||||||
|
});
|
||||||
|
|
||||||
|
var priv = ursa.createPrivateKeyFromComponents(
|
||||||
|
pkj.n // modulus
|
||||||
|
, pkj.e // exponent
|
||||||
|
, pkj.p
|
||||||
|
, pkj.q
|
||||||
|
, pkj.dp
|
||||||
|
, pkj.dq
|
||||||
|
, pkj.qi
|
||||||
|
, pkj.d
|
||||||
|
);
|
||||||
|
|
||||||
|
fromPrivateKeyUrsa(priv, cb);
|
||||||
|
}
|
||||||
|
|
||||||
|
function fromAccountPrivateKeyFile(privateKeyPath, cb) {
|
||||||
|
// Read ACME account key
|
||||||
|
fs.readFile(privateKeyPath, 'utf8', function (err, privkeyJson) {
|
||||||
|
var pkj;
|
||||||
|
|
||||||
|
if (err) {
|
||||||
|
cb(err);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
try {
|
||||||
|
pkj = JSON.parse(privkeyJson);
|
||||||
|
} catch(e) {
|
||||||
|
cb(e);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
fromAccountPrivateKey(pkj, cb);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
function bogusAccountId(cb) {
|
||||||
|
var priv = ursa.generatePrivateKey(2048, 65537);
|
||||||
|
|
||||||
|
fromPrivateKeyUrsa(priv, cb);
|
||||||
|
}
|
||||||
|
|
||||||
|
module.exports.bogusAccountId = bogusAccountId;
|
||||||
|
module.exports.fromAccountPrivateKey = fromAccountPrivateKey;
|
||||||
|
|
||||||
|
module.exports.bogusAccountId(function (err, id) {
|
||||||
|
console.log('Random Account Id', id);
|
||||||
|
});
|
||||||
|
module.exports.fromAccountPrivateKey('/etc/letsencrypt/live/example.com/privkey.pem', function (err, id) {
|
||||||
|
console.log(id);
|
||||||
|
});
|
||||||
62
scraps/renewal-example.com.conf
Normal file
62
scraps/renewal-example.com.conf
Normal file
@ -0,0 +1,62 @@
|
|||||||
|
cert = /etc/letsencrypt/live/example.com/cert.pem
|
||||||
|
privkey = /etc/letsencrypt/live/example.com/privkey.pem
|
||||||
|
chain = /etc/letsencrypt/live/example.com/chain.pem
|
||||||
|
fullchain = /etc/letsencrypt/live/example.com/fullchain.pem
|
||||||
|
|
||||||
|
# Options and defaults used in the renewal process
|
||||||
|
[renewalparams]
|
||||||
|
apache_enmod = a2enmod
|
||||||
|
no_verify_ssl = False
|
||||||
|
ifaces = None
|
||||||
|
apache_dismod = a2dismod
|
||||||
|
register_unsafely_without_email = False
|
||||||
|
uir = None
|
||||||
|
installer = none
|
||||||
|
config_dir = /etc/letsencrypt
|
||||||
|
text_mode = False
|
||||||
|
func = <function obtain_cert at 0x30c9500>
|
||||||
|
prepare = False
|
||||||
|
work_dir = /var/lib/letsencrypt
|
||||||
|
tos = True
|
||||||
|
init = False
|
||||||
|
http01_port = 80
|
||||||
|
duplicate = False
|
||||||
|
key_path = None
|
||||||
|
nginx = False
|
||||||
|
fullchain_path = /home/user/letsencrypt/chain.pem
|
||||||
|
email = user@example.com
|
||||||
|
csr = None
|
||||||
|
agree_dev_preview = None
|
||||||
|
redirect = None
|
||||||
|
verbose_count = -3
|
||||||
|
config_file = None
|
||||||
|
renew_by_default = False
|
||||||
|
hsts = False
|
||||||
|
authenticator = webroot
|
||||||
|
domains = example.com,
|
||||||
|
rsa_key_size = 2048
|
||||||
|
checkpoints = 1
|
||||||
|
manual_test_mode = False
|
||||||
|
apache = False
|
||||||
|
cert_path = /home/user/letsencrypt/cert.pem
|
||||||
|
webroot_path = /srv/www/example.com/,
|
||||||
|
strict_permissions = False
|
||||||
|
apache_server_root = /etc/apache2
|
||||||
|
account = f4c33502df3789849f617944253b35ae
|
||||||
|
manual_public_ip_logging_ok = False
|
||||||
|
chain_path = /home/user/letsencrypt/chain.pem
|
||||||
|
standalone = False
|
||||||
|
manual = False
|
||||||
|
server = https://acme-v01.api.letsencrypt.org/directory
|
||||||
|
standalone_supported_challenges = "http-01,tls-sni-01"
|
||||||
|
webroot = True
|
||||||
|
apache_init_script = None
|
||||||
|
user_agent = None
|
||||||
|
apache_ctl = apache2ctl
|
||||||
|
apache_le_vhost_ext = -le-ssl.conf
|
||||||
|
debug = False
|
||||||
|
tls_sni_01_port = 443
|
||||||
|
logs_dir = /var/log/letsencrypt
|
||||||
|
configurator = None
|
||||||
|
[[webroot_map]]
|
||||||
|
example.com = /srv/www/example.com/
|
||||||
54
scraps/ursa.js
Normal file
54
scraps/ursa.js
Normal file
@ -0,0 +1,54 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var LE = require('../');
|
||||||
|
var config = require('./config-minimal');
|
||||||
|
|
||||||
|
// Note: you should make this special dir in your product and leave it empty
|
||||||
|
config.le.webrootPath = __dirname + '/../tests/acme-challenge';
|
||||||
|
config.le.server = LE.stagingServer;
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// Manual Registration
|
||||||
|
//
|
||||||
|
var le = LE.create(config.le);
|
||||||
|
le.backend.registerAsync({
|
||||||
|
agreeTos: true
|
||||||
|
, domains: ['example.com'] // CHANGE TO YOUR DOMAIN
|
||||||
|
, email: 'user@example.com' // CHANGE TO YOUR EMAIL
|
||||||
|
}, function (err, body) {
|
||||||
|
if (err) {
|
||||||
|
console.error('[Error]: node-letsencrypt/examples/ursa');
|
||||||
|
console.error(err.stack);
|
||||||
|
} else {
|
||||||
|
console.log('success', body);
|
||||||
|
}
|
||||||
|
|
||||||
|
plainServer.close();
|
||||||
|
tlsServer.close();
|
||||||
|
}).then(function () {}, function (err) {
|
||||||
|
console.error(err.stack);
|
||||||
|
});
|
||||||
|
|
||||||
|
//
|
||||||
|
// Express App
|
||||||
|
//
|
||||||
|
var app = require('express')();
|
||||||
|
app.use('/', le.middleware());
|
||||||
|
|
||||||
|
|
||||||
|
//
|
||||||
|
// HTTP & HTTPS servers
|
||||||
|
// (required for domain validation)
|
||||||
|
//
|
||||||
|
var plainServer = require('http').createServer(app).listen(config.plainPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
|
|
||||||
|
var tlsServer = require('https').createServer({
|
||||||
|
key: config.tlsKey
|
||||||
|
, cert: config.tlsCert
|
||||||
|
, SNICallback: le.sniCallback
|
||||||
|
}, app).listen(config.tlsPort, function () {
|
||||||
|
console.log('Listening http', this.address());
|
||||||
|
});
|
||||||
9
tests/README.md
Normal file
9
tests/README.md
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
moved the tests to the examples folder
|
||||||
|
|
||||||
|
```bash
|
||||||
|
node examples/commandline.js example.com,www.example.com user@example.com agree
|
||||||
|
```
|
||||||
|
|
||||||
|
Try it for yourself.
|
||||||
|
|
||||||
|
Go watch [Let's Encrypt in (exactly) 90 seconds](https://daplie.com/articles/lets-encrypt-in-literally-90-seconds/) and swap out the Caddy instructions with the node instructions.
|
||||||
0
tests/acme-challenge/.gitkeep
Normal file
0
tests/acme-challenge/.gitkeep
Normal file
1
tests/acme-challenge/hello
Normal file
1
tests/acme-challenge/hello
Normal file
@ -0,0 +1 @@
|
|||||||
|
hello
|
||||||
31
tests/cli.sh
31
tests/cli.sh
@ -1,31 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
# TODO notify if wildcard is selected and no dns challenge is present
|
|
||||||
node bin/greenlock.js add --subject example.com --altnames 'example.com,*.example.com'
|
|
||||||
node bin/greenlock.js update --subject example.com
|
|
||||||
node bin/greenlock.js config --subject example.com
|
|
||||||
node bin/greenlock.js config --subject *.example.com
|
|
||||||
node bin/greenlock.js defaults
|
|
||||||
node bin/greenlock.js defaults --account-key-type
|
|
||||||
node bin/greenlock.js defaults
|
|
||||||
# using --challenge-xx-xx-xxx is additive
|
|
||||||
node bin/greenlock.js defaults --challenge-dns-01 foo-http-01-bar --challenge-dns-01-token BIG_TOKEN
|
|
||||||
# using --challenge is exclusive (will delete things not mentioned)
|
|
||||||
node bin/greenlock.js defaults --challenge acme-http-01-standalone
|
|
||||||
# should delete all and add just this one anew
|
|
||||||
node bin/greenlock.js update --subject example.com --challenge bar-http-01-baz
|
|
||||||
# should add, leaving the existing
|
|
||||||
node bin/greenlock.js update --subject example.com --challenge-dns-01 baz-dns-01-qux --challenge-dns-01-token BIG_TOKEN
|
|
||||||
# should delete all and add just this one anew
|
|
||||||
node bin/greenlock.js update --subject example.com --challenge bar-http-01-baz
|
|
||||||
node bin/greenlock.js remove --subject example.com
|
|
||||||
|
|
||||||
# TODO test for failure
|
|
||||||
# node bin/greenlock.js add --subject example.com
|
|
||||||
# node bin/greenlock.js add --subject example --altnames example
|
|
||||||
# node bin/greenlock.js add --subject example.com --altnames '*.example.com'
|
|
||||||
# node bin/greenlock.js add --subject example.com --altnames '*.example.com,example.com'
|
|
||||||
# node bin/greenlock.js update --altnames example.com
|
|
||||||
# node bin/greenlock.js config foo.example.com
|
|
||||||
14
tests/config.js
Normal file
14
tests/config.js
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var path = require('path');
|
||||||
|
|
||||||
|
module.exports = {
|
||||||
|
server: "https://acme-staging.api.letsencrypt.org/directory"
|
||||||
|
, tlsSni01Port: 5001
|
||||||
|
, http01Port: 80
|
||||||
|
, webrootPath: path.join(__dirname, "acme-challenge")
|
||||||
|
, configDir: path.join(__dirname, "letsencrypt.config")
|
||||||
|
, workDir: path.join(__dirname, "letsencrypt.work")
|
||||||
|
, logsDir: path.join(__dirname, "letsencrypt.logs")
|
||||||
|
, allowedDomains: ['example.com']
|
||||||
|
};
|
||||||
@ -1,54 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
require('dotenv').config();
|
|
||||||
|
|
||||||
var Greenlock = require('../');
|
|
||||||
|
|
||||||
var subject = process.env.BASE_DOMAIN;
|
|
||||||
var altnames = [subject, '*.' + subject, 'foo.bar.' + subject];
|
|
||||||
var email = process.env.SUBSCRIBER_EMAIL;
|
|
||||||
var challenge = JSON.parse(process.env.CHALLENGE_OPTIONS);
|
|
||||||
challenge.module = process.env.CHALLENGE_PLUGIN;
|
|
||||||
|
|
||||||
var greenlock = Greenlock.create({
|
|
||||||
packageAgent: 'Greenlock_Test/v0',
|
|
||||||
maintainerEmail: email,
|
|
||||||
staging: true,
|
|
||||||
manager: require('greenlock-manager-fs').create({
|
|
||||||
//configFile: '~/.config/greenlock/certs.json',
|
|
||||||
})
|
|
||||||
});
|
|
||||||
|
|
||||||
greenlock.manager
|
|
||||||
.defaults({
|
|
||||||
agreeToTerms: true,
|
|
||||||
subscriberEmail: email,
|
|
||||||
challenges: {
|
|
||||||
'dns-01': challenge
|
|
||||||
}
|
|
||||||
//store: args.storeOpts,
|
|
||||||
//renewOffset: args.renewOffset || '30d',
|
|
||||||
//renewStagger: '1d'
|
|
||||||
})
|
|
||||||
.then(function() {
|
|
||||||
return greenlock
|
|
||||||
.add({
|
|
||||||
subject: subject,
|
|
||||||
altnames: altnames,
|
|
||||||
subscriberEmail: email
|
|
||||||
})
|
|
||||||
.then(function() {
|
|
||||||
return greenlock
|
|
||||||
.get({ servername: subject })
|
|
||||||
.then(function(pems) {
|
|
||||||
if (pems && pems.privkey && pems.cert && pems.chain) {
|
|
||||||
console.info('Success');
|
|
||||||
}
|
|
||||||
//console.log(pems);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
})
|
|
||||||
.catch(function(e) {
|
|
||||||
console.error('Big bad error:', e.code);
|
|
||||||
console.error(e);
|
|
||||||
});
|
|
||||||
0
tests/letsencrypt.config/.gitkeep
Normal file
0
tests/letsencrypt.config/.gitkeep
Normal file
0
tests/letsencrypt.logs/.gitkeep
Normal file
0
tests/letsencrypt.logs/.gitkeep
Normal file
0
tests/letsencrypt.work/.gitkeep
Normal file
0
tests/letsencrypt.work/.gitkeep
Normal file
50
tests/pyconf-write.js
Normal file
50
tests/pyconf-write.js
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
'use strict';
|
||||||
|
|
||||||
|
var PromiseA = require('bluebird');
|
||||||
|
var pyconf = PromiseA.promisifyAll(require('pyconf'));
|
||||||
|
var mkdirpAsync = PromiseA.promisify(require('mkdirp'));
|
||||||
|
var path = require('path');
|
||||||
|
|
||||||
|
pyconf.readFileAsync(path.join(__dirname, 'lib', 'renewal.conf.tpl')).then(function (obj) {
|
||||||
|
var domains = ['example.com', 'www.example.com'];
|
||||||
|
var webrootPath = '/tmp/www/example.com';
|
||||||
|
|
||||||
|
console.log(obj);
|
||||||
|
|
||||||
|
var keys = obj.__keys;
|
||||||
|
var lines = obj.__lines;
|
||||||
|
|
||||||
|
obj.__keys = null;
|
||||||
|
obj.__lines = null;
|
||||||
|
|
||||||
|
var updates = {
|
||||||
|
account: 'ACCOUNT_ID'
|
||||||
|
|
||||||
|
, cert: 'CERT_PATH'
|
||||||
|
, privkey: 'PRIVATEKEY_PATH'
|
||||||
|
, configDir: 'CONFIG_DIR'
|
||||||
|
, tos: true
|
||||||
|
, http01Port: 80
|
||||||
|
, domains: domains
|
||||||
|
};
|
||||||
|
|
||||||
|
// final section is completely dynamic
|
||||||
|
// :hostname = :webroot_path
|
||||||
|
domains.forEach(function (hostname) {
|
||||||
|
updates[hostname] = webrootPath;
|
||||||
|
});
|
||||||
|
|
||||||
|
// must write back to the original object or
|
||||||
|
// annotations will be lost
|
||||||
|
Object.keys(updates).forEach(function (key) {
|
||||||
|
obj[key] = updates[key];
|
||||||
|
});
|
||||||
|
|
||||||
|
var renewalPath = '/tmp/letsencrypt/renewal/example.com.conf';
|
||||||
|
return mkdirpAsync(path.dirname(renewalPath)).then(function () {
|
||||||
|
console.log(obj);
|
||||||
|
obj.__keys = keys;
|
||||||
|
obj.__lines = lines;
|
||||||
|
return pyconf.writeFileAsync(renewalPath, obj);
|
||||||
|
});
|
||||||
|
});
|
||||||
@ -1,7 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var UserEvents = module.exports;
|
|
||||||
|
|
||||||
UserEvents.notify = function() {
|
|
||||||
// TODO not implemented yet
|
|
||||||
};
|
|
||||||
281
utils.js
281
utils.js
@ -1,281 +0,0 @@
|
|||||||
'use strict';
|
|
||||||
|
|
||||||
var U = module.exports;
|
|
||||||
|
|
||||||
var promisify = require('util').promisify;
|
|
||||||
//var resolveSoa = promisify(require('dns').resolveSoa);
|
|
||||||
var resolveMx = promisify(require('dns').resolveMx);
|
|
||||||
var punycode = require('punycode');
|
|
||||||
var Keypairs = require('@root/keypairs');
|
|
||||||
// TODO move to @root
|
|
||||||
var certParser = require('cert-info');
|
|
||||||
|
|
||||||
U._parseDuration = function(str) {
|
|
||||||
if ('number' === typeof str) {
|
|
||||||
return str;
|
|
||||||
}
|
|
||||||
|
|
||||||
var pattern = /^(\-?\d+(\.\d+)?)([wdhms]|ms)$/;
|
|
||||||
var matches = str.match(pattern);
|
|
||||||
if (!matches || !matches[0]) {
|
|
||||||
throw new Error('invalid duration string: ' + str);
|
|
||||||
}
|
|
||||||
|
|
||||||
var n = parseInt(matches[1], 10);
|
|
||||||
var unit = matches[3];
|
|
||||||
|
|
||||||
switch (unit) {
|
|
||||||
case 'w':
|
|
||||||
n *= 7;
|
|
||||||
/*falls through*/
|
|
||||||
case 'd':
|
|
||||||
n *= 24;
|
|
||||||
/*falls through*/
|
|
||||||
case 'h':
|
|
||||||
n *= 60;
|
|
||||||
/*falls through*/
|
|
||||||
case 'm':
|
|
||||||
n *= 60;
|
|
||||||
/*falls through*/
|
|
||||||
case 's':
|
|
||||||
n *= 1000;
|
|
||||||
/*falls through*/
|
|
||||||
case 'ms':
|
|
||||||
n *= 1; // for completeness
|
|
||||||
}
|
|
||||||
|
|
||||||
return n;
|
|
||||||
};
|
|
||||||
|
|
||||||
U._encodeName = function(str) {
|
|
||||||
return punycode.toASCII(str.toLowerCase(str));
|
|
||||||
};
|
|
||||||
|
|
||||||
U._validName = function(str) {
|
|
||||||
// A quick check of the 38 and two ½ valid characters
|
|
||||||
// 253 char max full domain, including dots
|
|
||||||
// 63 char max each label segment
|
|
||||||
// Note: * is not allowed, but it's allowable here
|
|
||||||
// Note: _ (underscore) is only allowed for "domain names", not "hostnames"
|
|
||||||
// Note: - (hyphen) is not allowed as a first character (but a number is)
|
|
||||||
return (
|
|
||||||
/^(\*\.)?[a-z0-9_\.\-]+\.[a-z0-9_\.\-]+$/.test(str) &&
|
|
||||||
str.length < 254 &&
|
|
||||||
str.split('.').every(function(label) {
|
|
||||||
return label.length > 0 && label.length < 64;
|
|
||||||
})
|
|
||||||
);
|
|
||||||
};
|
|
||||||
|
|
||||||
U._validMx = function(email) {
|
|
||||||
var host = email.split('@').slice(1)[0];
|
|
||||||
// try twice, just because DNS hiccups sometimes
|
|
||||||
// Note: we don't care if the domain exists, just that it *can* exist
|
|
||||||
return resolveMx(host).catch(function() {
|
|
||||||
return U._timeout(1000).then(function() {
|
|
||||||
return resolveMx(host);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
// should be called after _validName
|
|
||||||
U._validDomain = function(str) {
|
|
||||||
// TODO use @root/dns (currently dns-suite)
|
|
||||||
// because node's dns can't read Authority records
|
|
||||||
return Promise.resolve(str);
|
|
||||||
/*
|
|
||||||
// try twice, just because DNS hiccups sometimes
|
|
||||||
// Note: we don't care if the domain exists, just that it *can* exist
|
|
||||||
return resolveSoa(str).catch(function() {
|
|
||||||
return U._timeout(1000).then(function() {
|
|
||||||
return resolveSoa(str);
|
|
||||||
});
|
|
||||||
});
|
|
||||||
*/
|
|
||||||
};
|
|
||||||
|
|
||||||
// foo.example.com and *.example.com overlap
|
|
||||||
// should be called after _validName
|
|
||||||
// (which enforces *. or no *)
|
|
||||||
U._uniqueNames = function(altnames) {
|
|
||||||
var dups = {};
|
|
||||||
var wilds = {};
|
|
||||||
if (
|
|
||||||
altnames.some(function(w) {
|
|
||||||
if ('*.' !== w.slice(0, 2)) {
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
if (wilds[w]) {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
wilds[w] = true;
|
|
||||||
})
|
|
||||||
) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
return altnames.every(function(name) {
|
|
||||||
var w;
|
|
||||||
if ('*.' !== name.slice(0, 2)) {
|
|
||||||
w =
|
|
||||||
'*.' +
|
|
||||||
name
|
|
||||||
.split('.')
|
|
||||||
.slice(1)
|
|
||||||
.join('.');
|
|
||||||
} else {
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!dups[name] && !dups[w]) {
|
|
||||||
dups[name] = true;
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
U._timeout = function(d) {
|
|
||||||
return new Promise(function(resolve) {
|
|
||||||
setTimeout(resolve, d);
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
U._genKeypair = function(keyType) {
|
|
||||||
var keyopts;
|
|
||||||
var len = parseInt(keyType.replace(/.*?(\d)/, '$1') || 0, 10);
|
|
||||||
if (/RSA/.test(keyType)) {
|
|
||||||
keyopts = {
|
|
||||||
kty: 'RSA',
|
|
||||||
modulusLength: len || 2048
|
|
||||||
};
|
|
||||||
} else if (/^(EC|P\-?\d)/i.test(keyType)) {
|
|
||||||
keyopts = {
|
|
||||||
kty: 'EC',
|
|
||||||
namedCurve: 'P-' + (len || 256)
|
|
||||||
};
|
|
||||||
} else {
|
|
||||||
// TODO put in ./errors.js
|
|
||||||
throw new Error('invalid key type: ' + keyType);
|
|
||||||
}
|
|
||||||
|
|
||||||
return Keypairs.generate(keyopts).then(function(pair) {
|
|
||||||
return U._jwkToSet(pair.private);
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
// TODO use ACME._importKeypair ??
|
|
||||||
U._importKeypair = function(keypair) {
|
|
||||||
// this should import all formats equally well:
|
|
||||||
// 'object' (JWK), 'string' (private key pem), kp.privateKeyPem, kp.privateKeyJwk
|
|
||||||
if (keypair.private || keypair.d) {
|
|
||||||
return U._jwkToSet(keypair.private || keypair);
|
|
||||||
}
|
|
||||||
if (keypair.privateKeyJwk) {
|
|
||||||
return U._jwkToSet(keypair.privateKeyJwk);
|
|
||||||
}
|
|
||||||
|
|
||||||
if ('string' !== typeof keypair && !keypair.privateKeyPem) {
|
|
||||||
// TODO put in errors
|
|
||||||
throw new Error('missing private key');
|
|
||||||
}
|
|
||||||
|
|
||||||
return Keypairs.import({ pem: keypair.privateKeyPem || keypair }).then(
|
|
||||||
function(priv) {
|
|
||||||
if (!priv.d) {
|
|
||||||
throw new Error('missing private key');
|
|
||||||
}
|
|
||||||
return U._jwkToSet(priv);
|
|
||||||
}
|
|
||||||
);
|
|
||||||
};
|
|
||||||
|
|
||||||
U._jwkToSet = function(jwk) {
|
|
||||||
var keypair = {
|
|
||||||
privateKeyJwk: jwk
|
|
||||||
};
|
|
||||||
return Promise.all([
|
|
||||||
Keypairs.export({
|
|
||||||
jwk: jwk,
|
|
||||||
encoding: 'pem'
|
|
||||||
}).then(function(pem) {
|
|
||||||
keypair.privateKeyPem = pem;
|
|
||||||
}),
|
|
||||||
Keypairs.export({
|
|
||||||
jwk: jwk,
|
|
||||||
encoding: 'pem',
|
|
||||||
public: true
|
|
||||||
}).then(function(pem) {
|
|
||||||
keypair.publicKeyPem = pem;
|
|
||||||
}),
|
|
||||||
Keypairs.publish({
|
|
||||||
jwk: jwk
|
|
||||||
}).then(function(pub) {
|
|
||||||
keypair.publicKeyJwk = pub;
|
|
||||||
})
|
|
||||||
]).then(function() {
|
|
||||||
return keypair;
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
U._attachCertInfo = function(results) {
|
|
||||||
var certInfo = certParser.info(results.cert);
|
|
||||||
|
|
||||||
// subject, altnames, issuedAt, expiresAt
|
|
||||||
Object.keys(certInfo).forEach(function(key) {
|
|
||||||
results[key] = certInfo[key];
|
|
||||||
});
|
|
||||||
|
|
||||||
return results;
|
|
||||||
};
|
|
||||||
|
|
||||||
U._certHasDomain = function(certInfo, _domain) {
|
|
||||||
var names = (certInfo.altnames || []).slice(0);
|
|
||||||
return names.some(function(name) {
|
|
||||||
var domain = _domain.toLowerCase();
|
|
||||||
name = name.toLowerCase();
|
|
||||||
if ('*.' === name.substr(0, 2)) {
|
|
||||||
name = name.substr(2);
|
|
||||||
domain = domain
|
|
||||||
.split('.')
|
|
||||||
.slice(1)
|
|
||||||
.join('.');
|
|
||||||
}
|
|
||||||
return name === domain;
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
// a bit heavy to be labeled 'utils'... perhaps 'common' would be better?
|
|
||||||
U._getOrCreateKeypair = function(db, subject, query, keyType, mustExist) {
|
|
||||||
var exists = false;
|
|
||||||
return db
|
|
||||||
.checkKeypair(query)
|
|
||||||
.then(function(kp) {
|
|
||||||
if (kp) {
|
|
||||||
exists = true;
|
|
||||||
return U._importKeypair(kp);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (mustExist) {
|
|
||||||
// TODO put in errors
|
|
||||||
throw new Error(
|
|
||||||
'required keypair not found: ' +
|
|
||||||
(subject || '') +
|
|
||||||
' ' +
|
|
||||||
JSON.stringify(query)
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
return U._genKeypair(keyType);
|
|
||||||
})
|
|
||||||
.then(function(keypair) {
|
|
||||||
return { exists: exists, keypair: keypair };
|
|
||||||
});
|
|
||||||
};
|
|
||||||
|
|
||||||
U._getKeypair = function(db, subject, query) {
|
|
||||||
return U._getOrCreateKeypair(db, subject, query, '', true).then(function(
|
|
||||||
result
|
|
||||||
) {
|
|
||||||
return result.keypair;
|
|
||||||
});
|
|
||||||
};
|
|
||||||
Loading…
x
Reference in New Issue
Block a user