renew-cert.sh

#!/bin/bash

echo -e ""
echo -e " ###############################################################" 
echo -e " ##      THIS WILL RENEW A FREE 90 DAY SSL CERTIFICATE        ##"
echo -e " ##                     FROM LETS ENCRYPT                     ##"
echo -e " ###############################################################" 
echo ""
            
            # In Testing mode use only testing accounts
            if [[ "${TESTING}" == 1 ]]; then DF_TMP_ACCD=${DF_ACCOUNT_DIR_T}; else DF_TMP_ACCD=${DF_ACCOUNT_DIR}; fi
            
            # Check if there is a default email account configured
            if [ ! -f "${DF_TMP_ACCD}/${DF_ACCOUNT_D}" ]; then
                echo -e " ${RED}WARNING:${NC} No email default email account configured"
                echo "  - please use the account menu to set one up"
                exit 1;
            fi
            
            # Load the Account 
            . "${DF_TMP_ACCD}/${DF_ACCOUNT_D}"      
    
    # Run   
    
    echo -e "${GREEN}Do you want to manually renew a SSL certificate (y/n)?${NC}"
    echo " > existing certificates are renewed if older than 14 days"
    read DFRUN
    if [ "${DFRUN}" == "y" ]; then 
    
        # Find all the PRIMARY DOMAINS 
        SEVHOST="${BASEDIR}/certs";
        DFC=0; DF_TMP_TXT=""; DFCO=
        for Domain in $(find ${SEVHOST}/* -maxdepth 0 -type d ); 
        do
            FolderName=$(basename $Domain);
            if [ -d "${SEVHOST}/${FolderName}" ]; then
                    DF_TMP_TXT="${DF_TMP_TXT} > ${FolderName}\n";
                    DFC=$((DFC + 1))
                    DFCO=${FolderName}              
            fi
        done
        
        if [[ ${DFC} == 0 ]]; then
            echo " - No Domains found"
            exit 1;
        fi
        
        echo ""

        if [[ ${DFC} == 1 ]]; then
            # Only one certificate which can be renewed
            echo " + Domain (${DFCO}) added"
            DFRUNCERT=${DFCO};
        else
            # More then 1 make the user choose
            echo -e "Which domain do you wish to renew?"
            echo -e "${DF_TMP_TXT}"
            echo ""
            read DFRUNCERT
            echo ""
        fi
        
        # Get current list of domains 
        if [ ! -f "${BASEDIR}/certs/${DFRUNCERT}/${DF_ACCOUNT_DOMAIN}" ]; then
            echo -e "${RED}ERROR:${NC} Cannot find domain list";
            exit 1;
        else
            echo " + Domain list added"
            
        fi
    
        # Check if Challange directory exists
        if [ ! -d "$AUTODF" ]; then
            echo -e " + Creating global auto challenge directory";
            mkdir -p "$AUTODF";
        else
            echo -e " - global auto challange directory exists"
            # Create a test file (so we can check if the file is readable from the public internet using http)
            if [ ! -e "${AUTODF}/df" ]; then
            "df" > ${AUTODF}/df
            fi
        fi
        
        # Add well-known alias to all vhosts on the server
        SEVHOST=${DF_CL_NGINX};
        # Do we need to restart the NGINX Service?
        DFSERVICER=0;
        
        for Dir in $(find ${SEVHOST}* -maxdepth 0 -type d ); 
        do
            FolderName=$(basename $Dir);
            cd /etc/nginx-sp/vhosts.d/
            if [ ! -f "${FolderName}/acme.conf" ]; then
               echo " + Adding ACME Challange Alias to (${FolderName})";
                DFSERVICER=1;
                sudo touch $FolderName.custom.conf
                # LETS ADD THE CUSTOM WEBROOT ALIAS
                echo -e "
# ADDS THE CHALLENGE DIR TO THE VHOST SERVER BLOCK  
# DO NOT EDIT (generated by sh files)
location /.well-known/acme-challenge/ {
       alias ${AUTODF}/;
}" | sudo tee "${FolderName}/acme.conf" > /dev/null
                

            fi
        done
        
        # reset the cd back to script dir
        cd ${BASEDIR};
        
        if [ $DFSERVICER == 1 ]; then
            # Restart Nginx
            echo " + Challange files updated, restarting NGINX..."
            sudo service nginx-sp restart
        else
            echo " - No changes needed in Vhosts"
        fi
        
    
        # Create the tmp config (for acme.sh) - doing it the lazy way
        echo -e "WELLKNOWN='${AUTODF}'" > ${CFDFT}
        echo -e "CONTACT_EMAIL='${CONTACT_EMAIL}'" >> ${CFDFT}
        echo -e "DOMAINS_TXT='${BASEDIR}/certs/${DFRUNCERT}/${DF_ACCOUNT_DOMAIN}'" >> ${CFDFT}
        echo -e "PRIVATE_KEY='${PRIVATE_KEY}'" >> ${CFDFT}
        if [[ "${TESTING}" == 1 ]]; then
            echo -e 'CA="https://acme-staging.api.letsencrypt.org/directory"' >> ${CFDFT}
        else
            echo -e 'CA="https://acme-v01.api.letsencrypt.org/directory"' >> ${CFDFT}
        fi
   
        bash "${BASEDIR}/acme.sh" -c --config ${CFDFT}
        
        # Remove tmp config file
        rm -- ${CFDFT}
    else
        echo "Nothing issued/renewed!"
	    exit;
    fi