Skip to content

Commit 1d7eed3

Browse files
JrCsJrCs
authored
Merge pull request #140 from mickaelperrin/multidomains
[FEATURE] Create SAN certificates only for common domains
2 parents 8ce9cc5 + d25099e commit 1d7eed3

File tree

2 files changed

+76
-51
lines changed

2 files changed

+76
-51
lines changed

‎app/letsencrypt_service

Lines changed: 75 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -62,59 +62,83 @@ update_certs() {
6262
# First domain will be our base domain
6363
base_domain="${hosts_array_expanded[0]}"
6464

65-
if [[ "$create_test_certificate" == true ]]; then
66-
# Use staging acme end point
67-
acme_ca_uri="https://acme-staging.api.letsencrypt.org/directory"
68-
if [[ ! -f /etc/nginx/certs/.${base_domain}.test ]]; then
69-
# Remove old certificates
70-
rm -rf /etc/nginx/certs/${base_domain}
71-
for domain in "${!hosts_array}"; do
72-
rm -f /etc/nginx/certs/$domain.{crt,key,dhparam.pem}
73-
done
74-
touch /etc/nginx/certs/.${base_domain}.test
75-
fi
76-
else
77-
acme_ca_uri="$ACME_CA_URI"
78-
if [[ -f /etc/nginx/certs/.${base_domain}.test ]]; then
79-
# Remove old test certificates
80-
rm -rf /etc/nginx/certs/${base_domain}
81-
for domain in "${!hosts_array}"; do
82-
rm -f /etc/nginx/certs/$domain.{crt,key,dhparam.pem}
83-
done
84-
rm -f /etc/nginx/certs/.${base_domain}.test
85-
fi
86-
fi
87-
88-
# Create directory for the first domain
89-
mkdir -p /etc/nginx/certs/$base_domain
90-
cd /etc/nginx/certs/$base_domain
91-
92-
for domain in "${!hosts_array}"; do
93-
# Add all the domains to certificate
94-
params_d_str+=" -d $domain"
95-
# Add location configuration for the domain
96-
add_location_configuration "$domain" || reload_nginx
65+
# Identify base_domains
66+
declare -a base_domains
67+
base_domains+=("$base_domain")
68+
69+
for domain in "${!hosts_array:1}"; do
70+
if [[ $domain == *"$base_domain"* ]]; then
71+
echo "$domain contains $base_domain, skipping."
72+
else
73+
echo "$domain not found in $base_domain. Adding $domain to base_domains."
74+
base_domain=$domain
75+
base_domains+=("$base_domain")
76+
fi
9777
done
9878

99-
echo "Creating/renewal $base_domain certificates... (${hosts_array_expanded[*]})"
100-
/usr/bin/simp_le \
101-
-f account_key.json -f key.pem -f fullchain.pem -f cert.pem \
102-
--tos_sha256 6373439b9f29d67a5cd4d18cbc7f264809342dbf21cb2ba2fc7588df987a6221 \
103-
$params_d_str \
104-
--email "${!email_varname}" \
105-
--server=$acme_ca_uri \
106-
--default_root /usr/share/nginx/html/
107-
108-
simp_le_return=$?
109-
110-
for altnames in ${hosts_array_expanded[@]:1}; do
111-
# Remove old CN domain that now are altnames
112-
rm -rf /etc/nginx/certs/$altnames
113-
done
114-
115-
for domain in "${!hosts_array}"; do
116-
create_links $base_domain $domain && reload_nginx='true'
117-
[[ $simp_le_return -eq 0 ]] && reload_nginx='true'
79+
for base_domain in "${base_domains[@]}"; do
80+
echo "Base domain is now $base_domain"
81+
if [[ "$create_test_certificate" == true ]]; then
82+
# Use staging acme end point
83+
acme_ca_uri="https://acme-staging.api.letsencrypt.org/directory"
84+
if [[ ! -f /etc/nginx/certs/.${base_domain}.test ]]; then
85+
# Remove old certificates
86+
rm -rf /etc/nginx/certs/${base_domain}
87+
for domain in "${!hosts_array}"; do
88+
rm -f /etc/nginx/certs/$domain.{crt,key,dhparam.pem}
89+
done
90+
touch /etc/nginx/certs/.${base_domain}.test
91+
fi
92+
else
93+
acme_ca_uri="$ACME_CA_URI"
94+
if [[ -f /etc/nginx/certs/.${base_domain}.test ]]; then
95+
# Remove old test certificates
96+
rm -rf /etc/nginx/certs/${base_domain}
97+
for domain in "${!hosts_array}"; do
98+
rm -f /etc/nginx/certs/$domain.{crt,key,dhparam.pem}
99+
done
100+
rm -f /etc/nginx/certs/.${base_domain}.test
101+
fi
102+
fi
103+
104+
# Create directory for the first domain
105+
mkdir -p /etc/nginx/certs/$base_domain
106+
cd /etc/nginx/certs/$base_domain
107+
related_domains=()
108+
params_d_str=''
109+
110+
for domain in "${!hosts_array}"; do
111+
if [[ $domain == *"$base_domain"* ]]; then
112+
# Add all the domains to certificate
113+
params_d_str+=" -d $domain"
114+
related_domains+=($domain)
115+
# Add location configuration for the domain
116+
add_location_configuration "$domain" || reload_nginx
117+
fi
118+
done
119+
120+
echo "Creating/renewal $base_domain certificates... (${related_domains[*]})"
121+
/usr/bin/simp_le \
122+
-f account_key.json -f key.pem -f fullchain.pem -f cert.pem \
123+
--tos_sha256 6373439b9f29d67a5cd4d18cbc7f264809342dbf21cb2ba2fc7588df987a6221 \
124+
$params_d_str \
125+
--email "${!email_varname}" \
126+
--server=$acme_ca_uri \
127+
--default_root /usr/share/nginx/html/
128+
129+
simp_le_return=$?
130+
131+
for altnames in ${related_domains[@]:1}; do
132+
echo "Removing old CN domain for $altnames"
133+
# Remove old CN domain that now are altnames
134+
rm -rf /etc/nginx/certs/$altnames
135+
done
136+
137+
for domain in "${related_domains[@]}"; do
138+
echo "Creating links for $domain related to $base_domain"
139+
create_links $base_domain $domain && reload_nginx='true'
140+
[[ $simp_le_return -eq 0 ]] && reload_nginx='true'
141+
done
118142
done
119143
done
120144

‎install_simp_le.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ git -C /src clone https://github.com/kuba/simp_le.git
1111

1212
# Install simp_le in /usr/bin
1313
cd /src/simp_le
14+
git checkout acme-0.8
1415
python ./setup.py install
1516

1617
# Make house cleaning

0 commit comments

Comments
 (0)