The cleanup command skips filetypes for which the symlink is broken or
doesn't exist. However, if dehydrated fails, we may end up in exactly
the situation that the symlink doesn't exist (yet). If dehydrated fails
repeatedly, we may end up with a lot of old cert.csr, cert.pem and
privkey.pem files, so we really want to be able to clean them up.
Remove all files if the symlink is broken/missing, instead of skipping
those files.
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
libressl did not pick up the implicit host header patches
of OpenSSL 1.1 even in version 3 and thus exhibits the same
behavior as OpenSSL 1.0.
Patch by Chen, Chih-Chia <pigfoot@gmail.com>
Fixes#778
before applying heuristics, use PRETTY_NAME from os-release(3),
which reliably exists on all common linux distributions.
keep the /etc/issue parsing as fallback.
We store the account URL on account creation in the account_id.json file.
When reading the file, if the attribute is missing, we retrieve the account URL
from the CA ( https://tools.ietf.org/html/rfc8555#section-7.3.1 ) and edit the
file.
Per https://tools.ietf.org/html/rfc8555#section-7.3
> The server returns this account object in a 201 (Created) response, with the
> account URL in a Location header field. The account URL is used as the "kid"
> value in the JWS authenticating subsequent requests by this account (see
> Section 6.2). The account URL is also used for requests for management
> actions on this account, as described below.
Per https://tools.ietf.org/html/rfc8555#section-7.1.3
> status (required, string): The status of this order. Possible values are
> "pending", "ready", "processing", "valid", and "invalid". See Section 7.1.6.
Per https://tools.ietf.org/html/rfc8555#section-7.5.1
> The client indicates to the server that it is ready for the challenge
> validation by sending an empty JSON body ("{}") carried in a POST
> request to the challenge URL (not the authorization URL).
Quick note: dehydrated moved, the license will NOT change, and I will still take care of the project.
See https://lukas.im/2020/01/30/selling-dehydrated/index.html for more details.
Dehydrated is a client for signing certificates with an ACME-server (e.g. Let's Encrypt) implemented as a relatively simple (zsh-compatible) bash-script.
--env (-e) Output configuration variables for use in other scripts
@@ -64,6 +70,7 @@ Parameters:
--ipv4 (-4) Resolve names to IPv4 addresses only
--ipv6 (-6) Resolve names to IPv6 addresses only
--domain (-d) domain.tld Use specified domain name(s) instead of domains.txt entry (one certificate!)
--ca url/preset Use specified CA URL or preset
--alias certalias Use specified name for certificate directory (and per-certificate config) instead of the primary domain (only used if --domain is specified)
--keep-going (-g) Keep going after encountering an error while creating/renewing multiple certificates in cron mode
--force (-x) Force renew of certificate even if it is longer valid than value in RENEW_DAYS
@@ -71,8 +78,10 @@ Parameters:
--lock-suffix example.com Suffix lockfile name with a string (useful for with -d)
--ocsp Sets option in CSR indicating OCSP stapling to be mandatory
--privkey (-p) path/to/key.pem Use specified private key instead of account key (useful for revocation)
--domains-txt path/to/domains.txt Use specified domains.txt instead of default/configured one
--config (-f) path/to/config Use specified config file
--hook (-k) path/to/hook.sh Use specified script for hooks
--preferred-chain issuer-cn Use alternative certificate chain identified by issuer CN
--out (-o) certs/directory Output certificates into the specified directory
--alpn alpn-certs/directory Output alpn verification certificates into the specified directory
--challenge (-t) http-01|dns-01 Which challenge should be used? Currently http-01 and dns-01 are supported
If you want to import existing keys from the official letsencrypt client have a look at [Import from official letsencrypt client](https://github.com/lukas2511/dehydrated/wiki/Import-from-official-letsencrypt-client).
@@ -15,18 +15,16 @@ Your config should look something like this:
```nginx
stream{
server{
map$ssl_preread_alpn_protocols$tls_port{
~\bacme-tls/1\b10443;
default443;
}
map$ssl_preread_alpn_protocols$tls_port{
~\bacme-tls/1\b10443;
default443;
}
server{
listen443;
listen[::]:443;
proxy_pass10.13.37.42:$tls_port;
ssl_prereadon;
}
server{
listen443;
listen[::]:443;
proxy_pass10.13.37.42:$tls_port;
ssl_prereadon;
}
}
```
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
