issue-cert.sh

#!/bin/bash

echo -e ""
echo -e " ###############################################################" 
echo -e " ##      THIS WILL ISSUE A FREE 90 DAY SSL CERTIFICATE        ##"
echo -e " ##                     FROM LETS ENCRYPT                     ##"
echo -e " ###############################################################" 
echo ""
            
            # In Testing mode use only testing accounts
            if [[ "${TESTING}" == 1 ]]; then DF_TMP_ACCD=${DF_ACCOUNT_DIR_T}; else DF_TMP_ACCD=${DF_ACCOUNT_DIR}; fi
            
            # Check if there is a default email account configured
            if [ ! -f "${DF_TMP_ACCD}/${DF_ACCOUNT_D}" ]; then
                echo -e " ${RED}WARNING:${NC} No default email account configured"
                echo "  - please use the account menu to set one up"
                exit 1;
            fi
            
            # Load the Account 
            . "${DF_TMP_ACCD}/${DF_ACCOUNT_D}"      
    
    # Run   
    
    echo -e "${GREEN}Do you want to ISSUE a SSL certificate (y/n)?${NC}"
    echo " > existing certificates are renewed if older than 14 days"
    read DFRUN
    echo ""
    if [ "${DFRUN}" == "y" ]; then 
    
            echo -e "Which domain(s) do you wish to issue a certificate for?"
            echo " > eg; mydomain.com"
            echo " > For more than one SSL cert per IP,"
            echo "   please use spaces in between for any SNI domains"
            echo " > eg; mydomain.com myseconddomain.com someothergreatdomain.com"
            echo ""
            echo "   NOTE: www.mydomain and mydomain are not the same and need to be"
            echo "         added seperatly using SNI"
            echo ""
            read DFRUNCERT
            echo ""
            
            if [ "${DFRUNCERT}" == "" ]; then echo -e "${RED}ERROR:${NC} Please enter a domain"; exit 1; fi
            # Check if we already have an existing domain
            dftmpstring="$( cut -d ' ' -f 1 <<< "${DFRUNCERT}" )";
            if [ -d "${BASEDIR}/certs/${dftmpstring}" ]; then 
                echo -e "${RED}WARNING:${NC} Primary domain already exists!"
                echo ""
                echo -n "Do you wish to continue? (y/n) "
                read DF_TMP_INPUT2
                echo ""
                if [ ! "${DF_TMP_INPUT2}" == "y" ]; then echo " - Nothing issued!"; exit 1; fi
            fi
            
            # create tmp file for the domains
            echo -e "${DFRUNCERT}" > "${BASEDIR}/tmp-domains.txt";
        
        # Check if Challenge directory exists
        if [ ! -d "$AUTODF" ]; then
            echo -e " + Creating global auto challenge directory";
            mkdir -p "$AUTODF";
        else
            echo -e " - global auto challange directory exists";
            # Create a test file (so we can check if the file is readable from the public internet using http)
        fi
        
        # Add well-known alias to all vhosts on the server
        SEVHOST="${DF_CL_NGINX}/"
        # Do we need to restart the NGINX Service?
        DFSERVICER=0;
        
        # Search through the vhosts.d directory for all folders
        for Dir in $(find ${SEVHOST}* -maxdepth 0 -type d ); 
        do
            # Check if the DIR is found (prevents config errors)
            FolderName=$(basename $Dir);
            if [[ ! -d "${DF_CL_NGINX}/${FolderName}" ]]; then 
                echo -e "${RED}ERROR:${NC} Vhost directory NOT found for (${FolderName})"; 
                echo " - (${DF_CL_NGINX}/${FolderName})"; 
                exit 1; 
            fi
            
            
            # Check if we have an existing file? Check if it is correct
            # if wrong delete it so we can re-create again
            if [[ -f "${DF_CL_NGINX}/${FolderName}/acme.conf" ]]; then
                 DF_TMP_RE=1;
                 if grep -q "${AUTODF}" "${DF_CL_NGINX}/${FolderName}/acme.conf"; then DF_TMP_RE=0; fi
                 
                 if [[ ${DF_TMP_RE} == 1 ]]; then
                    echo " - Found incorrect ACME Challenge Alias for (${FolderName})"; 
                    sudo rm -f -- "${DF_CL_NGINX}/${FolderName}/acme.conf"
                fi
            fi
            
            # Check if the ACME Conf already exists
            if [[ ! -f "${DF_CL_NGINX}/${FolderName}/acme.conf" ]]; then
                echo " + Adding ACME Challenge Alias to (${FolderName})";
                DFSERVICER=1;
                # LETS ADD THE CUSTOM WEBROOT ALIAS
                echo -e "
# ADDS THE CHALLENGE DIR TO THE VHOST SERVER BLOCK  
# DO NOT EDIT (generated by sh files)
location /.well-known/acme-challenge/ {
       alias ${AUTODF}/;
}" | sudo tee "${DF_CL_NGINX}/${FolderName}/acme.conf" > /dev/null
                
            fi
        done
        
        # reset the cd back to script dir
        cd ${BASEDIR};
        
        if [ $DFSERVICER == 1 ]; then
            # Restart Nginx
            echo " + Challenge files updated, restarting NGINX..."
            sudo service nginx-sp restart
        else
            echo " + No changes needed in Vhosts"
        fi
        # Create the tmp config (for acme.sh) - doing it the lazy way -> tmp.df

        echo -e "WELLKNOWN='${AUTODF}'" > ${CFDFT}
        echo -e "CONTACT_EMAIL='${CONTACT_EMAIL}'" >> ${CFDFT}
        echo -e "DOMAINS_TXT='${BASEDIR}/tmp-domains.txt'" >> ${CFDFT}
        echo -e "PRIVATE_KEY='${PRIVATE_KEY}'" >> ${CFDFT}
        if [[ "${TESTING}" == 1 ]]; then
            echo -e 'CA="https://acme-staging.api.letsencrypt.org/directory"' >> ${CFDFT}
        else
            echo -e 'CA="https://acme-v01.api.letsencrypt.org/directory"' >> ${CFDFT}
        fi
   
        bash "${BASEDIR}/acme.sh" -c --config ${CFDFT}
        
        # Remove tmp config file
        rm -- ${CFDFT}
        rm -- "${BASEDIR}/tmp-domains.txt"
    else
        echo "Nothing issued/renewed!"
	    exit;
    fi