Skip to content

Commit 9195bf0

Browse files
Choose encryption algoritm based on cert name
In [this][1] article the author presents a way to have Nginx work with both RSA and ECC keys at the same time. This is achieved by just including two `ssl_certificate[_key]` lines which points to different files. By then ordering the `ssl_ciphers` in your preferred way you can have Nginx automatically use the correct RSA or ECDSA key/certificate. In the article the author add ".ecc" to the files using ECDSA (ECC is underlying technology), and ".rsa" to those using RSA. So to handle this in our script we have a regex that checks if it can match once of these alternatives. All of these may appear anywhere in the `cert-name`: -rsa .rsa -ecc .ecc -ecdsa .ecdsa All of these are also case insensitive. Having these somewhere in the name will override the `USE_ECDSA` environment variable, so special cases like this can be made. If the "rsa" string is matched an RSA key is created, while the others will be of the ECDSA type. [1]: https://medium.com/hackernoon/rsa-and-ecdsa-hybrid-nginx-setup-with-letsencrypt-certificates-ee422695d7d3
1 parent a870e67 commit 9195bf0

File tree

1 file changed

+12
-2
lines changed

1 file changed

+12
-2
lines changed

src/scripts/run_certbot.sh

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,18 @@ get_certificate() {
7070
for conf_file in /etc/nginx/conf.d/*.conf*; do
7171
for cert_name in $(parse_cert_names "${conf_file}"); do
7272
# Determine which type of key algorithm to use for this certificate
73-
# request.
74-
if [ "${USE_ECDSA}" == "1" ]; then
73+
# request. Having the algorithm specified in the certificate name will
74+
# take precedence over the environmental variable.
75+
if [[ "${cert_name,,}" =~ ^.*(-|\.)ecdsa.*$ ]]; then
76+
debug "Found variant of 'ECDSA' in name '${cert_name}"
77+
key_type="ecdsa"
78+
elif [[ "${cert_name,,}" =~ ^.*(-|\.)ecc.*$ ]]; then
79+
debug "Found variant of 'ECC' in name '${cert_name}"
80+
key_type="ecdsa"
81+
elif [[ "${cert_name,,}" =~ ^.*(-|\.)rsa.*$ ]]; then
82+
debug "Found variant of 'RSA' in name '${cert_name}"
83+
key_type="rsa"
84+
elif [ "${USE_ECDSA}" == "1" ]; then
7585
key_type="ecdsa"
7686
else
7787
key_type="rsa"

0 commit comments

Comments
 (0)