-
Notifications
You must be signed in to change notification settings - Fork 47
/
acme.sh
394 lines (335 loc) · 16 KB
/
acme.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
#!/bin/bash
RED="\033[31m"
GREEN="\033[32m"
YELLOW="\033[33m"
PLAIN='\033[0m'
red(){
echo -e "\033[31m\033[01m$1\033[0m"
}
green(){
echo -e "\033[32m\033[01m$1\033[0m"
}
yellow(){
echo -e "\033[33m\033[01m$1\033[0m"
}
REGEX=("debian" "ubuntu" "centos|red hat|kernel|oracle linux|alma|rocky" "'amazon linux'" "fedora")
RELEASE=("Debian" "Ubuntu" "CentOS" "CentOS" "Fedora")
PACKAGE_UPDATE=("apt-get update" "apt-get update" "yum -y update" "yum -y update" "yum -y update")
PACKAGE_INSTALL=("apt -y install" "apt -y install" "yum -y install" "yum -y install" "yum -y install")
PACKAGE_REMOVE=("apt -y remove" "apt -y remove" "yum -y remove" "yum -y remove" "yum -y remove")
PACKAGE_UNINSTALL=("apt -y autoremove" "apt -y autoremove" "yum -y autoremove" "yum -y autoremove" "yum -y autoremove")
[[ $EUID -ne 0 ]] && red "注意：请在root用户下运行脚本" && exit 1
CMD=("$(grep -i pretty_name /etc/os-release 2>/dev/null | cut -d \" -f2)" "$(hostnamectl 2>/dev/null | grep -i system | cut -d : -f2)" "$(lsb_release -sd 2>/dev/null)" "$(grep -i description /etc/lsb-release 2>/dev/null | cut -d \" -f2)" "$(grep . /etc/redhat-release 2>/dev/null)" "$(grep . /etc/issue 2>/dev/null | cut -d \\ -f1 | sed '/^[ ]*$/d')")
for i in "${CMD[@]}"; do
SYS="$i"
if [[ -n $SYS ]]; then
break
fi
done
for ((int = 0; int < ${#REGEX[@]}; int++)); do
if [[ $(echo "$SYS" | tr '[:upper:]' '[:lower:]') =~ ${REGEX[int]} ]]; then
SYSTEM="${RELEASE[int]}" && [[ -n $SYSTEM ]] && break
fi
done
[[ -z $SYSTEM ]] && red "不支持当前VPS系统, 请使用主流的操作系统" && exit 1
check_ip(){
ipv4=$(curl -s4m8 ip.sb -k | sed -n 1p)
ipv6=$(curl -s6m8 ip.sb -k | sed -n 1p)
}
inst_acme(){
if [[ ! $SYSTEM == "CentOS" ]]; then
${PACKAGE_UPDATE[int]}
fi
${PACKAGE_INSTALL[int]} curl wget sudo socat openssl dnsutils
if [[ $SYSTEM == "CentOS" ]]; then
${PACKAGE_INSTALL[int]} cronie
systemctl start crond
systemctl enable crond
else
${PACKAGE_INSTALL[int]} cron
systemctl start cron
systemctl enable cron
fi
read -rp "请输入注册邮箱 (例: [email protected], 或留空自动生成一个gmail邮箱): " email
if [[ -z $email ]]; then
automail=$(date +%s%N | md5sum | cut -c 1-16)
yellow "已取消设置邮箱, 使用自动生成的gmail邮箱: $email"
fi
curl https://get.acme.sh | sh -s email=$email
source ~/.bashrc
bash ~/.acme.sh/acme.sh --upgrade --auto-upgrade
switch_provider
if [[ -n $(~/.acme.sh/acme.sh -v 2>/dev/null) ]]; then
green "Acme.sh 证书一键申请脚本安装成功!"
else
red "抱歉, Acme.sh 证书一键申请脚本安装失败"
green "建议如下："
yellow "1. 检查 VPS 的网络环境"
yellow "2. 脚本可能跟不上时代, 建议截图发布到 GitHub Issues 询问"
fi
}
unst_acme() {
[[ -z $(~/.acme.sh/acme.sh -v 2>/dev/null) ]] && yellow "未安装Acme.sh, 卸载程序无法执行!" && exit 1
~/.acme.sh/acme.sh --uninstall
sed -i '/--cron/d' /etc/crontab >/dev/null 2>&1
rm -rf ~/.acme.sh
green "Acme.sh 证书一键申请脚本已彻底卸载!"
}
check_80(){
# 感谢Wulabing前辈提供的检查80端口思路
# Source: https://github.com/wulabing/Xray_onekey
if [[ -z $(type -P lsof) ]]; then
if [[ ! $SYSTEM == "CentOS" ]]; then
${PACKAGE_UPDATE[int]}
fi
${PACKAGE_INSTALL[int]} lsof
fi
yellow "正在检测 80 端口是否占用..."
sleep 1
if [[ $(lsof -i:"80" | grep -i -c "listen") -eq 0 ]]; then
green "检测到目前 80 端口未被占用"
sleep 1
else
red "检测到目前 80 端口被其他程序被占用，以下为占用程序信息"
lsof -i:"80"
read -rp "如需结束占用进程请按Y，按其他键则退出 [Y/N]: " yn
if [[ $yn =~ "Y"|"y" ]]; then
lsof -i:"80" | awk '{print $2}' | grep -v "PID" | xargs kill -9
sleep 1
else
exit 1
fi
fi
}
checktls() {
if [[ -f /root/cert.crt && -f /root/private.key ]]; then
if [[ -s /root/cert.crt && -s /root/private.key ]]; then
if [[ -n $(type -P wg-quick) && -n $(type -P wgcf) ]]; then
wg-quick up wgcf >/dev/null 2>&1
fi
if [[ -a "/opt/warp-go/warp-go" ]]; then
systemctl start warp-go
fi
echo $domain > /root/ca.log
sed -i '/--cron/d' /etc/crontab >/dev/null 2>&1
echo "0 0 * * * root bash /root/.acme.sh/acme.sh --cron -f >/dev/null 2>&1" >> /etc/crontab
green "证书申请成功! 脚本申请到的证书 (cert.crt) 和私钥 (private.key) 文件已保存到 /root 文件夹下"
yellow "证书 crt 文件路径如下: /root/cert.crt"
yellow "私钥 key 文件路径如下: /root/private.key"
else
if [[ -n $(type -P wg-quick) && -n $(type -P wgcf) ]]; then
wg-quick up wgcf >/dev/null 2>&1
fi
if [[ -a "/opt/warp-go/warp-go" ]]; then
systemctl start warp-go
fi
red "抱歉，证书申请失败"
green "建议如下: "
yellow "1. 自行检测防火墙是否打开, 如使用 80 端口申请模式时, 请关闭防火墙或放行 80 端口"
yellow "2. 同一域名多次申请可能会触发 Let's Encrypt 官方风控, 请尝试使用脚本菜单的 9 选项更换证书颁发机构, 再重试申请证书, 或更换域名、或等待 7 天后再尝试执行脚本"
yellow "3. 脚本可能跟不上时代, 建议截图发布到 GitHub Issues、GitLab Issues、论坛或 TG 群询问"
fi
fi
}
acme_standalone(){
[[ -z $(~/.acme.sh/acme.sh -v 2>/dev/null) ]] && inst_acme
check_80
WARPv4Status=$(curl -s4m8 https://www.cloudflare.com/cdn-cgi/trace -k | grep warp | cut -d= -f2)
WARPv6Status=$(curl -s6m8 https://www.cloudflare.com/cdn-cgi/trace -k | grep warp | cut -d= -f2)
if [[ $WARPv4Status =~ on|plus ]] || [[ $WARPv6Status =~ on|plus ]]; then
wg-quick down wgcf >/dev/null 2>&1
systemctl stop warp-go >/dev/null 2>&1
fi
check_ip
echo ""
yellow "在使用 80 端口申请模式时, 请先将您的域名解析至你的 VPS 的真实 IP 地址, 否则会导致证书申请失败"
echo ""
if [[ -n $ipv4 && -n $ipv6 ]]; then
echo -e "VPS 的真实 IPv4 地址为: ${GREEN}$ipv4${PLAIN}"
echo -e "VPS 的真实 IPv6 地址为: ${GREEN}$ipv6${PLAIN}"
elif [[ -n $ipv4 && -z $ipv6 ]]; then
echo -e "VPS 的真实 IPv4 地址为: ${GREEN}$ipv4${PLAIN}"
elif [[ -z $ipv4 && -n $ipv6 ]]; then
echo -e "VPS 的真实 IPv6 地址为: ${GREEN}$ipv6${PLAIN}"
fi
echo ""
read -rp "请输入解析完成的域名: " domain
[[ -z $domain ]] && red "未输入域名，无法执行操作！" && exit 1
green "已输入的域名：$domain" && sleep 1
domainIP=$(dig @8.8.8.8 +time=2 +short "$domain" 2>/dev/null | sed -n 1p)
if echo $domainIP | grep -q "network unreachable\|timed out" || [[ -z $domainIP ]]; then
domainIP=$(dig @2001:4860:4860::8888 +time=2 aaaa +short "$domain" 2>/dev/null | sed -n 1p)
fi
if echo $domainIP | grep -q "network unreachable\|timed out" || [[ -z $domainIP ]] ; then
red "未解析出 IP，请检查域名是否输入有误"
yellow "是否尝试强行匹配？"
green "1. 是，将使用强行匹配"
green "2. 否，退出脚本"
read -p "请输入选项 [1-2]：" ipChoice
if [[ $ipChoice == 1 ]]; then
yellow "将尝试强行匹配以申请域名证书"
else
red "将退出脚本"
exit 1
fi
fi
if [[ $domainIP == $ipv6 ]]; then
bash ~/.acme.sh/acme.sh --issue -d ${domain} --standalone -k ec-256 --listen-v6 --insecure
fi
if [[ $domainIP == $ipv4 ]]; then
bash ~/.acme.sh/acme.sh --issue -d ${domain} --standalone -k ec-256 --insecure
fi
if [[ -n $(echo $domainIP | grep nginx) ]]; then
if [[ -n $(type -P wg-quick) && -n $(type -P wgcf) ]]; then
wg-quick up wgcf >/dev/null 2>&1
fi
if [[ -a "/opt/warp-go/warp-go" ]]; then
systemctl start warp-go
fi
yellow "域名解析失败, 请检查域名是否正确填写或等待解析完成再执行脚本"
exit 1
elif [[ -n $(echo $domainIP | grep ":") || -n $(echo $domainIP | grep ".") ]]; then
if [[ $domainIP != $ipv4 ]] && [[ $domainIP != $ipv6 ]]; then
if [[ -n $(type -P wg-quick) && -n $(type -P wgcf) ]]; then
wg-quick up wgcf >/dev/null 2>&1
fi
if [[ -a "/opt/warp-go/warp-go" ]]; then
systemctl start warp-go
fi
green "域名 ${domain} 目前解析的IP: ($domainIP)"
red "当前域名解析的 IP 与当前 VPS 使用的真实IP不匹配"
green "建议如下："
yellow "1. 请确保 CloudFlare 小云朵为关闭状态 (仅限DNS), 其他域名解析或 CDN 网站设置同理"
yellow "2. 请检查 DNS 解析设置的 IP 是否为 VPS 的真实 IP"
yellow "3. 脚本可能跟不上时代, 建议截图发布到 GitHub Issues、GitLab Issues、论坛或 TG 群询问"
exit 1
fi
fi
bash ~/.acme.sh/acme.sh --install-cert -d ${domain} --key-file /root/private.key --fullchain-file /root/cert.crt --ecc
checktls
}
acme_cfapiTLD(){
[[ -z $(~/.acme.sh/acme.sh -v 2>/dev/null) ]] && inst_acme
check_ip
read -rp "请输入需要申请证书的域名: " domain
if [[ $(echo ${domain:0-2}) =~ cf|ga|gq|ml|tk ]]; then
red "检测为 Freenom 免费域名, 由于 CloudFlare API 不支持, 故无法使用本模式申请!"
exit
fi
read -rp "请输入 CloudFlare Global API Key: " cfgak
[[ -z $cfgak ]] && red "未输入 CloudFlare Global API Key, 无法执行操作!" && exit 1
export CF_Key="$cfgak"
read -rp "请输入 CloudFlare 的登录邮箱: " cfemail
[[ -z $domain ]] && red "未输入 CloudFlare 的登录邮箱, 无法执行操作!" && exit 1
export CF_Email="$cfemail"
if [[ -z $ipv4 ]]; then
bash ~/.acme.sh/acme.sh --issue --dns dns_cf -d "${domain}" -k ec-256 --listen-v6 --insecure
else
bash ~/.acme.sh/acme.sh --issue --dns dns_cf -d "${domain}" -k ec-256 --insecure
fi
bash ~/.acme.sh/acme.sh --install-cert -d "${domain}" --key-file /root/private.key --fullchain-file /root/cert.crt --ecc
checktls
}
acme_cfapiNTLD(){
[[ -z $(~/.acme.sh/acme.sh -v 2>/dev/null) ]] && inst_acme
check_ip
read -rp "请输入需要申请证书的泛域名 (输入格式：example.com): " domain
[[ -z $domain ]] && red "未输入域名，无法执行操作！" && exit 1
if [[ $(echo ${domain:0-2}) =~ cf|ga|gq|ml|tk ]]; then
red "检测为 Freenom 免费域名, 由于 CloudFlare API 不支持, 故无法使用本模式申请!"
back2menu
fi
read -rp "请输入 CloudFlare Global API Key: " cfgak
[[ -z $cfgak ]] && red "未输入 CloudFlare Global API Key, 无法执行操作！" && exit 1
export CF_Key="$cfgak"
read -rp "请输入 CloudFlare 的登录邮箱: " cfemail
[[ -z $domain ]] && red "未输入 CloudFlare 的登录邮箱, 无法执行操作!" && exit 1
export CF_Email="$cfemail"
if [[ -z $ipv4 ]]; then
bash ~/.acme.sh/acme.sh --issue --dns dns_cf -d "*.${domain}" -d "${domain}" -k ec-256 --listen-v6 --insecure
else
bash ~/.acme.sh/acme.sh --issue --dns dns_cf -d "*.${domain}" -d "${domain}" -k ec-256 --insecure
fi
bash ~/.acme.sh/acme.sh --install-cert -d "*.${domain}" --key-file /root/private.key --fullchain-file /root/cert.crt --ecc
checktls
}
view_cert(){
[[ -z $(~/.acme.sh/acme.sh -v 2>/dev/null) ]] && inst_acme
bash ~/.acme.sh/acme.sh --list
}
revoke_cert() {
[[ -z $(~/.acme.sh/acme.sh -v 2>/dev/null) ]] && inst_acme
bash ~/.acme.sh/acme.sh --list
read -rp "请输入要撤销的域名证书 (复制 Main_Domain 下显示的域名): " domain
[[ -z $domain ]] && red "未输入域名，无法执行操作!" && exit 1
if [[ -n $(bash ~/.acme.sh/acme.sh --list | grep $domain) ]]; then
bash ~/.acme.sh/acme.sh --revoke -d ${domain} --ecc
bash ~/.acme.sh/acme.sh --remove -d ${domain} --ecc
rm -rf ~/.acme.sh/${domain}_ecc
rm -f /root/cert.crt /root/private.key
green "撤销 ${domain} 的域名证书成功"
else
red "未找到 ${domain} 的域名证书, 请检查后重新运行!"
fi
}
renew_cert() {
[[ -z $(~/.acme.sh/acme.sh -v 2>/dev/null) ]] && yellow "未安装acme.sh, 无法执行操作!" && exit 1
bash ~/.acme.sh/acme.sh --cron -f
}
switch_provider(){
[[ -z $(~/.acme.sh/acme.sh -v 2>/dev/null) ]] && inst_acme
yellow "请选择证书提供商, 默认通过 Letsencrypt.org 来申请证书 "
yellow "如果证书申请失败, 例如一天内通过 Letsencrypt.org 申请次数过多, 可选 BuyPass.com 或 ZeroSSL.com 来申请."
echo -e " ${GREEN}1.${PLAIN} Letsencrypt.org ${YELLOW}(默认)${PLAIN}"
echo -e " ${GREEN}2.${PLAIN} BuyPass.com"
echo -e " ${GREEN}3.${PLAIN} ZeroSSL.com"
read -rp "请选择证书提供商 [1-3]: " provider
case $provider in
2) bash ~/.acme.sh/acme.sh --set-default-ca --server buypass && green "切换证书提供商为 BuyPass.com 成功！" ;;
3) bash ~/.acme.sh/acme.sh --set-default-ca --server zerossl && green "切换证书提供商为 ZeroSSL.com 成功！" ;;
*) bash ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt && green "切换证书提供商为 Letsencrypt.org 成功！" ;;
esac
}
menu() {
clear
echo "#############################################################"
echo -e "# ${RED}Acme 证书一键申请脚本${PLAIN} #"
echo -e "# ${GREEN}作者${PLAIN}: MisakaNo の 小破站 #"
echo -e "# ${GREEN}博客${PLAIN}: https://blog.misaka.rest #"
echo -e "# ${GREEN}GitHub 项目${PLAIN}: https://github.com/Misaka-blog #"
echo -e "# ${GREEN}GitLab 项目${PLAIN}: https://gitlab.com/Misaka-blog #"
echo -e "# ${GREEN}Telegram 频道${PLAIN}: https://t.me/misakanocchannel #"
echo -e "# ${GREEN}Telegram 群组${PLAIN}: https://t.me/misakanoc #"
echo -e "# ${GREEN}YouTube 频道${PLAIN}: https://www.youtube.com/@misaka-blog #"
echo "#############################################################"
echo ""
echo -e " ${GREEN}1.${PLAIN} 安装 Acme.sh 域名证书申请脚本"
echo -e " ${GREEN}2.${PLAIN} ${RED}卸载 Acme.sh 域名证书申请脚本${PLAIN}"
echo " -------------"
echo -e " ${GREEN}3.${PLAIN} 申请单域名证书 ${YELLOW}(80端口申请)${PLAIN}"
echo -e " ${GREEN}4.${PLAIN} 申请单域名证书 ${YELLOW}(CF API申请)${PLAIN} ${GREEN}(无需解析)${PLAIN} ${RED}(不支持freenom域名)${PLAIN}"
echo -e " ${GREEN}5.${PLAIN} 申请泛域名证书 ${YELLOW}(CF API申请)${PLAIN} ${GREEN}(无需解析)${PLAIN} ${RED}(不支持freenom域名)${PLAIN}"
echo " -------------"
echo -e " ${GREEN}6.${PLAIN} 查看已申请的证书"
echo -e " ${GREEN}7.${PLAIN} 撤销并删除已申请的证书"
echo -e " ${GREEN}8.${PLAIN} 手动续期已申请的证书"
echo -e " ${GREEN}9.${PLAIN} 切换证书颁发机构"
echo " -------------"
echo -e " ${GREEN}0.${PLAIN} 退出脚本"
echo ""
read -rp "请输入选项 [0-9]: " menuInput
case "$menuInput" in
1 ) inst_acme ;;
2 ) unst_acme ;;
3 ) acme_standalone ;;
4 ) acme_cfapiTLD ;;
5 ) acme_cfapiNTLD ;;
6 ) view_cert ;;
7 ) revoke_cert ;;
8 ) renew_cert ;;
9 ) switch_provider ;;
* ) exit 1 ;;
esac
}
menu