aboutsummaryrefslogtreecommitdiff
path: root/net/acme/files
Commit message (Collapse)AuthorAge
* ACME: Remove dependency on luci-lib-ipkgToke Høiland-Jørgensen2019-05-23
| | | | | | | | | Instead, use @jow-'s suggestion of just checking for the presence of the executables to find the installed web servers. Fixes #8529. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
* ACME: Fix missing quotes in variable comparisonsToke Høiland-Jørgensen2019-03-22
| | | | | | | The variables can be empty if not set in the UCI config. Reported-by: Petr Novák <petrn@me.com> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
* acme: Fix loading credentialsAdrien DAURIAT2019-02-08
| | | | | | | | Move loading credential function before cert renewal call as credentials might be needed for some renewal operations ( ex: DNS ) Signed-off-by: Adrien DAURIAT <16813527+dauriata@users.noreply.github.com> [toke@toke.dk: Port to master branch] Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* net/acme: commit uhttpd configuration if update_httpd setAlexey I. Froloff2019-02-07
| | | | | | uhttpd configuration should be commited when update_uhttpd set. Signed-off-by: Alexey I. Froloff <raorn@raorn.name>
* net/acme: issue_cert should always call post_checks on exitAlexey I. Froloff2019-02-07
| | | | | | | | | | issue_cert fuction may return without calling post_checks, which leaves port 80 open and uhttpd configuration is not restored is listen_http was set. Always call post_checks when returning from issue_cert. Signed-off-by: Alexey I. Froloff <raorn@raorn.name>
* acme: Remove 8192 bits certificate optionToke Høiland-Jørgensen2019-01-08
| | | | | | | This is not supported by letsencrypt, so issuing the certificate will fail. Instead, add 3072 bits as an intermediate option. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
* acme: Support selecting ECC certificates from LuciToke Høiland-Jørgensen2019-01-08
| | | | | | | | | | | As pointed out by @andersk, acme.sh already supports ECC certificates, and they can be set manually in the uci file, just not in Luci. Fix this by changing the key size selector into a listbox, and adding ECC certs as options. Fixes #7825. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
* acme: Fix arithmetic syntaxToke Høiland-Jørgensen2018-09-19
| | | | | | Thanks to @jow- for pointing out the mistake. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Fix whitespace and long lines, bump package revToke Høiland-Jørgensen2018-09-19
| | | | Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: add support for nginx webserverAnsuel Smith2018-09-19
| | | | | | This adds a metapakcge for acme luci ap without uhttpd dependency and adds entities and check to stop handle nginx server and modify the certificate set automatically. Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
* acme: Fix bugs from upstream's change to socatToke Høiland-Jørgensen2018-08-22
| | | | | | | | | | The upstream acme.sh package changed to using socat instead of netcat; update the dependencies to reflect this, and pass --listen-v6 when running in standalone mode (since socat only listens on IPv4 by default). Also add a missing cleanup call when certificate issuance fails. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Not all fields should be mandatory in LuciToke Høiland-Jørgensen2018-06-27
| | | | | | Fixes #6370. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Change boot init script logic to invoke startToke Høiland-Jørgensen2018-05-07
| | | | | | | | | | | The new procd config dependency tracking requires the start method to be called even on boot. So add a state file that is checked by the run script to condition the special-case boot run instead of the previous independent call to the run script. Ref: https://github.com/openwrt/luci/pull/1769 Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Support DNS modeZhong Jianxin2018-04-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tested with dynu.com ddns. Install acme-dnsapi: # opkg install acme-dnsapi Example `/etc/config/acme`: config acme option state_dir '/etc/acme' option account_email email@example.org' option debug '0' config cert 'foo' option enabled '1' option use_staging '1' option keylength '2048' option update_uhttpd '0' option dns 'dns_dynu' list domains 'foo.dynu.com' list domains '*.foo.dynu.com' list credentials 'Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"' list credentials 'Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy"' Run: # /etc/init.d/acme start Signed-off-by: Zhong Jianxin <azuwis@gmail.com>
* Fix acme-challenge ./well-known check / webroot detection (#4339)Aleksei Nosachev2017-05-10
| | | | | | | | fixes webroot to be defined as _currentRoot='/www' instead of being interpreted as _currentRoot='"/www"' Signed-off-by: Aleksei Nosachev <nos1609@hotmail.com>
* acme: Support running in webroot mode, detect other daemons on port 80Toke Høiland-Jørgensen2017-04-26
| | | | | | | | | | | For configurations where another web server is running on port 80, running acme.sh in standalone mode fails. Try to detect this and refuse to run; and allow the user to configure a webroot directory to use the running webserver for certificate verification. This also updates acme.sh to the latest version. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Fix for curl linked against mbed TLS. (#4254)Daniel H2017-04-12
| | | | | | | Use newest acme.sh release (2.6.8). Remove dependency on ca-certificates and add dependency on ca-bundle. Update environment variable. Signed-off-by: Daniel Halmschlager <da@halms.at>
* acme: Update to v1.4.Toke Høiland-Jørgensen2016-11-28
| | | | | | | | This updates to the latest git version of acme.sh and drops the patch to disable timestamps from the output (since that is now supported upstream). Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Update to v1.3.Toke Høiland-Jørgensen2016-11-25
| | | | | | | | This version handles transitioning from a previous certificate that was issues using the staging server, adds more debug logging, and handles state directories better if issuing fails. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: New version 1.2.Toke Høiland-Jørgensen2016-11-04
| | | | | | | | | | | This version will use the standalone (netcat) mode of acme.sh during verification instead of exposing uhttpd to the internet for the duration of the verification. It will also add an ip6tables rule to also support verification over IPv6. Also contains an updated version of acme.sh. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Add Luci appToke Høiland-Jørgensen2016-08-05
| | | | | | This adds a Luci configuration app for the ACME certificate package. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
* acme: Add package.Toke Høiland-Jørgensen2016-08-05
This adds a package wrapping the acme.sh script from https://github.com/Neilpang/acme.sh in Uci config and hooks to interact correctly with uhttpd. Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Powered by cgit, Themed by Ted Yin.