diff options
Diffstat (limited to 'frontends/scripts')
| -rw-r--r-- | frontends/scripts/acme.sh.tpl | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/frontends/scripts/acme.sh.tpl b/frontends/scripts/acme.sh.tpl index dd613fc..c7b4d9e 100644 --- a/frontends/scripts/acme.sh.tpl +++ b/frontends/scripts/acme.sh.tpl @@ -16,13 +16,17 @@ ensure_placeholder_cert () { fi } -alias_cert () { - source=$1 - alias=$2 +prepare_standby_cert () { + host=$1 - ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.crt" - ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.fullchain.pem" - ln -sf "/etc/ssl/private/$source.key" "/etc/ssl/private/$alias.key" + # Migrate aliases created by the short-lived shared-SAN configuration. + # acme-client must never write a standalone certificate through a symlink + # to the primary keypair. + if [ -L "/etc/ssl/$host.fullchain.pem" ] \ + || [ -L "/etc/ssl/private/$host.key" ]; then + rm -f "/etc/ssl/$host.crt" "/etc/ssl/$host.fullchain.pem" \ + "/etc/ssl/private/$host.key" + fi } handle_cert () { @@ -57,13 +61,9 @@ handle_cert <%= $host %> if [ $? -eq 0 ]; then has_update=yes fi -<% if (grep { $_ eq $host } @$f3s_hosts) { -%> -# f3s standby names are SANs on the primary certificate. relayd selects a -# keypair by SNI name, so provide filename aliases for that shared certificate. -alias_cert <%= $host %> standby.<%= $host %> -<% } -%> <% unless ($host eq 'blowfish.buetow.org' or $host eq 'fishfinger.buetow.org' - or grep { $_ eq $host } @$f3s_hosts) { -%> + or $host =~ /^(ipv4|ipv6)\./) { -%> +prepare_standby_cert standby.<%= $host %> handle_cert standby.<%= $host %> if [ $? -eq 0 ]; then has_update=yes |