diff options
| author | Paul Buetow <paul@buetow.org> | 2026-08-03 13:13:05 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-08-03 13:13:05 +0300 |
| commit | 5147db7a3e2902392206970513ffa95009b100ae (patch) | |
| tree | 8304d4b89c89a203dc99411a9a99819ac46a43bd /frontends/scripts | |
| parent | a7d859681f5508a829115376d9dd993f3f137321 (diff) | |
frontends: restore standalone standby certificates
Amp-Thread-ID: https://ampcode.com/threads/T-019fc408-6e41-73fe-826d-d47b0408981b
Co-authored-by: Amp <amp@ampcode.com>
Diffstat (limited to 'frontends/scripts')
| -rw-r--r-- | frontends/scripts/acme.sh.tpl | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/frontends/scripts/acme.sh.tpl b/frontends/scripts/acme.sh.tpl index dd613fc..c7b4d9e 100644 --- a/frontends/scripts/acme.sh.tpl +++ b/frontends/scripts/acme.sh.tpl @@ -16,13 +16,17 @@ ensure_placeholder_cert () { fi } -alias_cert () { - source=$1 - alias=$2 +prepare_standby_cert () { + host=$1 - ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.crt" - ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.fullchain.pem" - ln -sf "/etc/ssl/private/$source.key" "/etc/ssl/private/$alias.key" + # Migrate aliases created by the short-lived shared-SAN configuration. + # acme-client must never write a standalone certificate through a symlink + # to the primary keypair. + if [ -L "/etc/ssl/$host.fullchain.pem" ] \ + || [ -L "/etc/ssl/private/$host.key" ]; then + rm -f "/etc/ssl/$host.crt" "/etc/ssl/$host.fullchain.pem" \ + "/etc/ssl/private/$host.key" + fi } handle_cert () { @@ -57,13 +61,9 @@ handle_cert <%= $host %> if [ $? -eq 0 ]; then has_update=yes fi -<% if (grep { $_ eq $host } @$f3s_hosts) { -%> -# f3s standby names are SANs on the primary certificate. relayd selects a -# keypair by SNI name, so provide filename aliases for that shared certificate. -alias_cert <%= $host %> standby.<%= $host %> -<% } -%> <% unless ($host eq 'blowfish.buetow.org' or $host eq 'fishfinger.buetow.org' - or grep { $_ eq $host } @$f3s_hosts) { -%> + or $host =~ /^(ipv4|ipv6)\./) { -%> +prepare_standby_cert standby.<%= $host %> handle_cert standby.<%= $host %> if [ $? -eq 0 ]; then has_update=yes |