forked from QROkes/webinoly
-
Notifications
You must be signed in to change notification settings - Fork 0
/
site-ssl
201 lines (167 loc) · 9.55 KB
/
site-ssl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
#!/bin/bash
# This is a library for Site Manager Plugin
# Functions for SSL On/Off
source /opt/webinoly/lib/general
ssl_nginx() {
sudo sed -i '/listen 80/c \ listen 443 ssl http2;' /etc/nginx/sites-available/$domain
sudo sed -i '/listen \[::\]:80/c \ listen [::]:443 ssl http2;' /etc/nginx/sites-available/$domain
sudo sed -i '/headers-http.conf/a \ include common/headers-https.conf;' /etc/nginx/sites-available/$domain
sudo sed -i '/server_name /r /opt/webinoly/templates/template-site-ssl' /etc/nginx/sites-available/$domain
[[ -n $add_to_wildcard ]] && cert=$add_to_wildcard || cert=$domain
sudo sed -i "/WebinolySSLstart/,/WebinolySSLend/{s/domain.com/$cert/}" /etc/nginx/sites-available/$domain
# Custom SSL files
if [[ -n $ssl_crt && -n $ssl_key ]]; then
sudo sed -i '/WebinolySSLstart/a \ # WebinolySSLCustomCert' /etc/nginx/sites-available/$domain
sudo sed -i "/fullchain.pem/c \ ssl_certificate $ssl_crt;" /etc/nginx/sites-available/$domain
sudo sed -i "/privkey.pem/c \ ssl_certificate_key $ssl_key;" /etc/nginx/sites-available/$domain
sudo chmod 777 $ssl_crt
sudo chmod 777 $ssl_key
sudo chmod 755 $(dirname -- $ssl_crt)
sudo chmod 755 $(dirname -- $ssl_key)
sudo chown -R root:root $(dirname -- $ssl_crt)
if [[ -n $ssl_ocsp && -f $ssl_ocsp ]]; then
sudo sed -i "/ssl_trusted_certificate/c \ ssl_trusted_certificate $ssl_ocsp;" /etc/nginx/sites-available/$domain
sudo chmod 777 $ssl_ocsp
sudo chmod 755 $(dirname -- $ssl_ocsp)
else
sudo sed -i '/WebinolySSLstart/,/WebinolySSLend/{/ssl_stapling/d}' /etc/nginx/sites-available/$domain
sudo sed -i '/WebinolySSLstart/,/WebinolySSLend/{/ssl_trusted_certificate/d}' /etc/nginx/sites-available/$domain
fi
fi
# HTTP to HTTPS Redirection
[[ $subdomflag == 1 ]] && local sername="server_name $domain;" || local sername="server_name $domain www.$domain;"
[[ -n $wildcard ]] && sername="server_name $domain *.$domain;"
sudo sed -i '1r /opt/webinoly/templates/template-site-sslredirect' /etc/nginx/sites-available/$domain
sudo sed -i "/#server_name;/c \ $sername" /etc/nginx/sites-available/$domain
# In case this domain is used as tools-site or default-site
[[ $(conf_read tools-site) == $domain ]] && sudo webinoly -tools-site=$domain
[[ $(conf_read default-site) == $domain ]] && sudo webinoly -default-site=$domain
}
site_ssl_on() {
local cermail=$(conf_read mail)
local path=$domain
# Some validations to prevent errors when creating certs.
check_for_nginx_tool
if [[ -n $root && -f /etc/nginx/sites-available/$root ]]; then
path=$root
elif [[ -n $root && ! -f /etc/nginx/sites-available/$root ]]; then
echo "${red}[ERROR] Root path domain is not a valid domain or is not found/hosted in this server!${end}"
exit 1
fi
if [[ ! -d /var/www/$path/htdocs && -z $root_path ]]; then
echo "${red}[ERROR] Seems like you are trying to request an SSL Certificate for a Parked/Mapped Domain."
echo "Please, use the '-root=domain.com' parameter to specify the main domain."
echo ""
echo "If your site is using the Reverse Proxy configuration, please use the '-root-path=/opt/app' option.${end}"
exit 1
elif [[ -n $root_path && ! -d $root_path ]]; then
echo "${red}[ERROR] Invalid root path!${end}"
exit 1
fi
if [[ ! -f /etc/letsencrypt/live/$domain/fullchain.pem && $ssl == "force-renewal" ]]; then
echo "${red}[ERROR] Cert you're trying to renew not found!${end}"
exit 1
fi
echo "${gre}"
echo "*************************************************************************************************"
echo "** Please, be careful with the number of intents or certificates you try to get. **"
echo "** Let’s Encrypt provides rate limits to ensure fair usage by as many people as possible. **"
echo "** **"
echo "** If you are getting errors or having issues when trying to get a new certificate **"
echo "** read about the Let's Encrypt rate limit - https://letsencrypt.org/docs/rate-limits/ **"
echo "*************************************************************************************************"
echo "${end}"
[[ $subdomflag == 0 ]] && echo "${blu}Please, be sure that${end} $domain ${blu}and${end} www.$domain ${blu}are both currently pointing (DNS) to this server. ${end}"
[[ $subdomflag == 1 ]] && echo "${blu}Please, be sure that the${end} $domain ${blu}subdomain is currently pointing (DNS) to this server. ${end}"
# We need an email to notify each renew intent (cron)
while [[ -z $cermail ]]
do
echo "${blu}"
read -p "Please, enter an email to register your new certificate: ${end}" cermail
if [[ "$cermail" =~ ^[a-z0-9_\+-]+(\.[a-z0-9_\+-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)*\.([a-z]{2,4})$ ]]; then
conf_write mail $cermail
echo "${gre}Email address has been successfuly validated and saved! ${end}"
else
cermail=""
echo "${red}Please enter a valid email address!"
fi
echo "${end}"
done
# Create new certificate
local param="--email $cermail --no-eff-email --agree-tos --staple-ocsp --must-staple"
[[ $(conf_read debug) == "true" ]] && param="$param --test-cert"
[[ $ssl == "force-renewal" ]] && param="$param --force-renewal"
[[ $subdomflag == 1 ]] && local domset="-d $domain" || local domset="-d $domain -d www.$domain"
# Wildcard
if [[ ( ! -f /etc/letsencrypt/live/$domain/fullchain.pem || $ssl == "force-renewal" ) && -n $wildcard ]]; then
sudo certbot certonly --manual --preferred-challenges=dns --manual-public-ip-logging-ok -d $domain -d *.$domain $param
# Manual mode for Reverse Proxy sites
elif [[ ( ! -f /etc/letsencrypt/live/$domain/fullchain.pem || $ssl == "force-renewal" ) && -n $root_path ]]; then
conf_write temp-path $root_path
sudo certbot certonly --manual --preferred-challenges=http --manual-auth-hook /opt/webinoly/lib/ex-ssl-authentication --manual-cleanup-hook /opt/webinoly/lib/ex-ssl-cleanup --manual-public-ip-logging-ok $domset $param
conf_delete temp-path
# Single cert
elif [[ ! -f /etc/letsencrypt/live/$domain/fullchain.pem || $ssl == "force-renewal" ]]; then
sudo certbot certonly --webroot -w /var/www/$path/htdocs/ $domset $param
elif [[ -f /etc/letsencrypt/live/$domain/fullchain.pem ]]; then
echo "${blu}Certificate for${end} $domain ${blu}already exist and found, wait while we configure your server to use it!${end}"
fi
# SSL Nginx Conf
if [[ -f /etc/letsencrypt/live/$domain/fullchain.pem && $ssl != "force-renewal" ]]; then
ssl_nginx
# Auto-Renew Certificate
if [[ ! -f /var/spool/cron/crontabs/root ]]; then
sudo touch /var/spool/cron/crontabs/root
sudo chmod 600 /var/spool/cron/crontabs/root
sudo chown root:crontab /var/spool/cron/crontabs/root
fi
cronmail=$( sudo grep -F "MAILTO=" /var/spool/cron/crontabs/root )
cronrene=$( sudo grep -F "certbot renew" /var/spool/cron/crontabs/root )
[[ -z $cronmail && -n $cermail && -z $cronrene ]] && echo "MAILTO=${cermail}" | sudo tee -a /var/spool/cron/crontabs/root > /dev/null
[[ -z $cronrene ]] && echo '15 3 * * 7 certbot renew --post-hook "service nginx restart"' | sudo tee -a /var/spool/cron/crontabs/root > /dev/null
[[ $(is_wp $domain) == "true" ]] && edit_wp_db_url $domain "https://${domain}"
echo "${gre}SSL have been successfully enabled for your site -${blu} $domain${end}"
elif [[ -f /etc/letsencrypt/live/$domain/fullchain.pem && $ssl == "force-renewal" ]]; then
echo "${gre}SSL Cert ${blu}- $domain$ - ${gre}has been Forced to Renew!${end}"
elif [[ ! -f /etc/letsencrypt/live/$domain/fullchain.pem ]]; then
echo "${red}"
echo "[ERROR] Unable to create the new certificate!"
echo "${end}"
exit 1
fi
[[ $(conf_read debug) == "true" ]] && echo "${red}Debug Mode is enabled, this SSL Cert is just for testing purpose and should not be used in production enviroments.${end}"
}
ssl_revoke() {
[[ $(conf_read debug) == "true" ]] && local param="--test-cert" || local param=""
sudo certbot revoke --cert-path /etc/letsencrypt/live/$domain/cert.pem --delete-after-revoke $param
echo "${gre}"
echo "SSL Cert for your site${blu} $domain ${gre}has been completely removed and revoked!${end}"
}
site_ssl_off() {
# Don't ask if SSL is Custom
[[ -n $(sed -n -e '/WebinolyNginxServerStart/,$p' /etc/nginx/sites-available/$domain | grep -F "WebinolySSLCustomCert") ]] && revoke="off"
sudo sed -i '/listen 443/c \ listen 80;' /etc/nginx/sites-available/$domain
sudo sed -i '/listen \[::\]:443/c \ listen [::]:80;' /etc/nginx/sites-available/$domain
sudo sed -i '/headers-https.conf/d' /etc/nginx/sites-available/$domain
sudo sed -i '/WebinolySSLstart/,/WebinolySSLend/{/.*/d}' /etc/nginx/sites-available/$domain
sudo sed -i '/WebinolySSLredirectStart/,/WebinolySSLredirectEnd/{/.*/d}' /etc/nginx/sites-available/$domain
# In case this domain is used as tools-site or default-site
[[ $(conf_read tools-site) == $domain ]] && sudo webinoly -tools-site=$domain
[[ $(conf_read default-site) == $domain ]] && sudo webinoly -default-site=$domain
[[ $(is_wp $domain) == "true" ]] && edit_wp_db_url $domain "http://${domain}"
if [[ -n $revoke && $revoke =~ ^(on|off)$ ]]; then
[[ $revoke == "on" ]] && answer="Y" || answer="N"
else
echo "${blu}Select 'Y' to revoke and delete all the certificate files."
echo "Select 'N' if you only want to deactivate this certificate momentary and you will activate it later again."
echo "${gre}"
echo "Do you want to delete and revoke this certificate [y/N]? "
while read -r -n 1 -s answer; do
answer=${answer:-n}
[[ $answer = [YyNn] ]] && break
done
echo "${end}"
fi
[[ $answer == [Yy] ]] && ssl_revoke
echo "${gre}SSL has been successfully disabled for your site -${blu} $domain${end}"
}