137 lines
3.7 KiB
Bash
Executable File
137 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# letsencrypt-tools
|
|
# https://git.stack-source.com/msb/letsencrypt-tools
|
|
# Copyright (c) 2022 Matthew Saunders Brown <matthewsaundersbrown@gmail.com>
|
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
|
#
|
|
# must be root
|
|
if [ "$USER" != "root" ]; then
|
|
exec sudo -u root $0 $@
|
|
fi
|
|
|
|
help()
|
|
{
|
|
thisfilename=$(basename -- "$0")
|
|
echo "$thisfilename"
|
|
echo "Create a Let's Encrypt certificate."
|
|
echo ""
|
|
echo "Usage: $thisfilename domain -d <domain> [-t] [-n] [-h]"
|
|
echo ""
|
|
echo " -h Print this help."
|
|
echo " -d <domain> Domain (hostname) to create certificate for."
|
|
echo " -t Obtain certificates using a DNS TXT record (if you are using PowerDNS for DNS.)"
|
|
echo " -n Dry Run - don't create cert, just echo command to run."
|
|
exit
|
|
}
|
|
|
|
# set options
|
|
while getopts "hd:tn" opt; do
|
|
case "${opt}" in
|
|
h )
|
|
help
|
|
exit;;
|
|
d ) # domain name (hostname) to create cert for
|
|
domain=${OPTARG,,}
|
|
# basic but good enough domain name regex validation
|
|
if [[ ! $domain =~ ^(([a-zA-Z](-?[a-zA-Z0-9])*)\.)+[a-zA-Z]{2,}$ ]] ; then
|
|
echo "ERROR: Invalid domain name: $1"
|
|
exit 1
|
|
fi
|
|
;;
|
|
t )
|
|
dnstxt=true
|
|
;;
|
|
n )
|
|
dryrun=true
|
|
;;
|
|
\? )
|
|
echo "Invalid option: $OPTARG" 1>&2
|
|
exit;;
|
|
: )
|
|
echo "Invalid option: $OPTARG requires an argument" 1>&2
|
|
exit;;
|
|
esac
|
|
done
|
|
|
|
# check for domain (hostname)
|
|
if [[ -z $domain ]]; then
|
|
echo "domain (hostname) is required"
|
|
exit 1
|
|
fi
|
|
|
|
# check for existing pem file
|
|
if [[ -f /etc/ssl/letsencrypt/$domain.pem ]]; then
|
|
echo "pem file for $domain already exists"
|
|
exit 1
|
|
fi
|
|
|
|
# set vars
|
|
command="certbot certonly"
|
|
if [[ -n $dnstxt ]]; then
|
|
if [[ -f /usr/local/etc/pdns-certbot-credentials.ini ]]; then
|
|
command="$command --authenticator dns-powerdns --dns-powerdns-credentials /usr/local/etc/pdns-certbot-credentials.ini --dns-powerdns-propagation-seconds 3"
|
|
else
|
|
echo "ERROR: /usr/local/etc/pdns-certbot-credentials.ini config file does not exist, can't use -t (DNS TXT authenticator)."
|
|
exit 1
|
|
fi
|
|
else
|
|
command="$command --standalone"
|
|
fi
|
|
|
|
dnscheck=false
|
|
ips=(`ip -4 -o addr show | awk '{ print $4 }' | cut -d / -f 1`)
|
|
|
|
# check dns for domain
|
|
dns=`host -t A $domain|grep 'has address'|awk '{ print $4 }'`
|
|
if [[ " ${ips[@]} " =~ " ${dns} " ]]; then
|
|
command="$command -d $domain"
|
|
dnscheck=true
|
|
fi
|
|
|
|
# check dns for www subdomain
|
|
dns=`host -t A www.$domain|grep 'has address'|awk '{ print $4 }'`
|
|
if [[ " ${ips[@]} " =~ " ${dns} " ]]; then
|
|
command="$command -d www.$domain"
|
|
dnscheck=true
|
|
fi
|
|
|
|
# copy above www subdomain section and modify as desired to
|
|
# automatically check for and add additional subdomains to cert
|
|
|
|
# check common additional mail subdomains
|
|
if [[ $domain = mail.* ]]; then
|
|
# check for imap subdomain
|
|
dns=`host -t A ${domain/mail./imap.}|grep 'has address'|awk '{ print $4 }'`
|
|
if [[ " ${ips[@]} " =~ " ${dns} " ]]; then
|
|
command="$command -d ${domain/mail./imap.}"
|
|
dnscheck=true
|
|
fi
|
|
# check for smtp subdomain
|
|
dns=`host -t A ${domain/mail./smtp.}|grep 'has address'|awk '{ print $4 }'`
|
|
if [[ " ${ips[@]} " =~ " ${dns} " ]]; then
|
|
command="$command -d ${domain/mail./smtp.}"
|
|
dnscheck=true
|
|
fi
|
|
# check for pop subdomain
|
|
dns=`host -t A ${domain/mail./pop.}|grep 'has address'|awk '{ print $4 }'`
|
|
if [[ " ${ips[@]} " =~ " ${dns} " ]]; then
|
|
command="$command -d ${domain/mail./pop.}"
|
|
dnscheck=true
|
|
fi
|
|
fi
|
|
|
|
# check if any of the dns lookups passed
|
|
if [[ "$dnscheck" = "false" ]]; then
|
|
echo "All dns checks failed, can't create cert."
|
|
exit 1
|
|
fi
|
|
|
|
# run (or display) command
|
|
if [[ "$dryrun" = "true" ]]; then
|
|
echo "Run this command to create cert:"
|
|
echo "$command"
|
|
else
|
|
$command
|
|
fi
|