letsencrypt
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
letsencrypt [2022/06/01 12:39] admin |
letsencrypt [2026/08/01 23:41] (current) admin |
||
|---|---|---|---|
| Line 17: | Line 17: | ||
| --post-hook "/etc/init.d/nginx reload"</code> | --post-hook "/etc/init.d/nginx reload"</code> | ||
| - | == /usr/local/sbin/push_to_confiared.sh == | + | == /usr/local/sbin/push_to_confiared.sh to push for IPv4 reverse proxy == |
| <code> | <code> | ||
| #!/bin/bash | #!/bin/bash | ||
| #RENEWED_LINEAGE=/etc/letsencrypt/live/site.com | #RENEWED_LINEAGE=/etc/letsencrypt/live/site.com | ||
| - | if [ ! -f ${RENEWED_LINEAGE}/cert.pem ] | + | # Pushes a renewed certificate to the Confiared reverse-proxy, so the edges that terminate |
| + | # IPv4 stop serving the previous one. Called by certbot as renew_hook/deploy_hook. | ||
| + | # --insecure is deliberate: this can run while the certificate of api.confiared.com itself | ||
| + | # is the one being repaired. | ||
| + | |||
| + | if [ ! -f "${RENEWED_LINEAGE}/cert.pem" ] | ||
| then | then | ||
| echo "${RENEWED_LINEAGE}/cert.pem was not found, abort" > /var/log/last_letsencrypt_confiared_api.log | echo "${RENEWED_LINEAGE}/cert.pem was not found, abort" > /var/log/last_letsencrypt_confiared_api.log | ||
| Line 27: | Line 32: | ||
| exit 255 | exit 255 | ||
| fi | fi | ||
| - | /usr/bin/curl --silent --data-urlencode "certificate=`cat ${RENEWED_LINEAGE}/cert.pem`" --data-urlencode "chain=`cat ${RENEWED_LINEAGE}/chain.pem`" --data-urlencode "privatekey=`cat ${RENEWED_LINEAGE}/privkey.pem`" https://api.confiared.com/reverse-proxy/upload-certificate -o /var/log/last_letsencrypt_confiared_api.log | + | |
| - | if [ $? -ne 0 ] | + | # The api answers 400 + a json explaining why when it refuses a certificate. curl exits 0 on |
| + | # a 400, so testing $? alone reports success for a certificate that was in fact rejected: that | ||
| + | # is how a stale certificate stayed on the edges until it expired. Test the http code instead. | ||
| + | # Not -f: -f would throw away the json body, which is the only place the reason is written. | ||
| + | push() | ||
| + | { | ||
| + | local code | ||
| + | code=$(/usr/bin/curl --insecure --silent --max-time 120 -w '%{http_code}' \ | ||
| + | --data-urlencode "certificate=$(cat ${RENEWED_LINEAGE}/cert.pem)" \ | ||
| + | --data-urlencode "chain=$(cat ${RENEWED_LINEAGE}/chain.pem)" \ | ||
| + | --data-urlencode "privatekey=$(cat ${RENEWED_LINEAGE}/privkey.pem)" \ | ||
| + | https://api.confiared.com/reverse-proxy/upload-certificate \ | ||
| + | -o /var/log/last_letsencrypt_confiared_api.log) | ||
| + | [ "$code" = "200" ] | ||
| + | } | ||
| + | |||
| + | if push | ||
| then | then | ||
| - | # try 99 times | + | exit 0 |
| - | for i in {1..99} | + | |
| - | do | + | |
| - | sleep 600 | + | |
| - | /usr/bin/curl --silent --data-urlencode "certificate=`cat ${RENEWED_LINEAGE}/cert.pem`" --data-urlencode "chain=`cat ${RENEWED_LINEAGE}/chain.pem`" --data-urlencode "privatekey=`cat ${RENEWED_LINEAGE}/privkey.pem`" https://api.confiared.com/reverse-proxy/upload-certificate -o /var/log/last_letsencrypt_confiared_api.log | + | |
| - | if [ $? -ne 0 ] | + | |
| - | then | + | |
| - | exit 0 | + | |
| - | fi | + | |
| - | done | + | |
| fi | fi | ||
| + | # Refused or unreachable. Retry for ~16h: the api can be down, or the refusal can be transient. | ||
| + | for i in {1..99} | ||
| + | do | ||
| + | sleep 600 | ||
| + | if push | ||
| + | then | ||
| + | exit 0 | ||
| + | fi | ||
| + | done | ||
| + | |||
| + | echo "`date -Is` push refused after 99 tries, see /var/log/last_letsencrypt_confiared_api.log" >> /var/log/last_letsencrypt_confiared_api.err | ||
| + | exit 1 | ||
| </code> | </code> | ||
letsencrypt.1654087174.txt.gz · Last modified: 2022/06/01 12:39 by admin
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
