aboutsummaryrefslogtreecommitdiff
path: root/net/uacme
Commit message (Collapse)AuthorAge
* uacme: Add support custom CAs and TLS-ALPN-01 challengePeter Putzer2024-03-09
| | | | Signed-off-by: Peter Putzer <openwrt@mundschenk.at>
* uacme: update to 1.7.4Lucian Cristian2023-02-25
| | | | Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
* uacme: Remove deprecated $(AUTORELEASE)Antti Seppälä2022-12-22
| | | | Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
* uacme: Use UCI to configure firewall instead of iptablesAntti Seppälä2022-12-22
| | | | | | | | | Use UCI to add temporary incoming firewall rule to accept http traffic for challenge verification. This should make uacme compatible with OpenWrt's fw3/4 implementation. Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
* uacme: update to 1.7.3Lucian Cristian2022-10-21
| | | | Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
* uacme: add libev dependency to uacme-ualpnEneas U de Queiroz2022-04-09
| | | | | | | | | | The dependency has a PACKAGE_uacme-ualpn condition so that libev won't be unnecessarily built if uacme-ualpn is not selected. Remove PKG_USE_MIPS16:=0, as it is not necessary when not using the libev that is bundled with uacme. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* uacme: always include ualpnLucian Cristian2022-03-28
| | | | | | with mbetls update we can have ualpn on any variant Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
* uacme: proper ualpn integrationLucian Cristian2022-02-17
| | | | | | ualpn works only with openssl and gnutls, so default build will not have this included Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
* uacme: pack ualpn.shLucian Cristian2022-02-16
| | | | Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
* uacme: update to 1.7.1Rosen Penev2021-07-21
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* uacme: add use_auto_stagingLeonardo Mörlein2021-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | Staging certificates have the advantage that their retry limits are loose. Therefore they can be obtained quickly when automatic retries are used. Unfortunately they can not be used for deployments because their CA is not accepted by clients. Production certificates do not have this limitation, but their retry limits are strict. For production certificates, automatic retries can only be performed a few times per hour. This makes automatic obtainment of certificates tenacious. With use_auto_staging=1, the advantages of the two certificate types are combined. Uacme will first obtain a staging certificate. When the staging certificate is successfully obtained, uacme will switch and obtain a production certificate. Since the staging certificate has already been successfully obtained, we can ensure that the production certificate is successfully obtained in the first attempt. This means that "retries" are performed on the staging certificate and the production certificate is obtained in the first attempt. In summary, this feature enables fast obtaining of production certificates when automatic retries are used. By default, this feature is set to use_auto_staging=0, which means that uacme will behave as before by default. Signed-off-by: Leonardo Mörlein <git@irrelefant.net>
* uacme: do not override production state dir variableLeonardo Mörlein2021-04-24
| | | | | | | | | | | | | | | With this commit, issue_cert() can be called multiple times alternating between staging and production certificates within a script. Before this commit, the production state dir was stored in $STATE_DIR. But in the case of $use_staging=1, this variable was overwritten in issue_cert() with $STAGING_STATE_DIR. This made it impossible to call issue_cert() with $use_staging=0 afterwards. Now the production state dir is stored in $PRODUCTION_STATE_DIR. This way it is not overridden anymore and issue_cert() can be called multiple times alternating with production and staging. Signed-off-by: Leonardo Mörlein <git@irrelefant.net>
* uacme: add retriesLeonardo Mörlein2021-04-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this commit, the acme service attempted to obtain certificates once and then terminated, regardless of whether the certificate could be obtained or not. This commit introduces a new uci option "retries" to the "certificate" section. If this option is set to N, the acme service will attempt to obtain the certificate up to N times before terminating. There is a waiting pause between the retries to comply with the rate limits of Let'sEncrypt. The waiting pause is: - 2 minutes for staging certificates - 24 minutes for production certificates The current "Failed Validation" rate limits of Let'sEncrypt are: - staging: 60 per hour -> 1 failure every 1 minute in avg. - production: 5 per hour -> 1 failure every 12 minutes in avg. This means that we are within rate limits by a factor of two. By default the option "retries" is set to "1", which means that acme behaves as before by default. If the variable is set to "0", infinite retries are performed. This feature is helpful, when you already want to initiate the certificate request, but you are still waiting for your dns server to be configured, your network to appear or other conditions. Signed-off-by: Leonardo Mörlein <git@irrelefant.net>
* uacme: propagate rc of uacme in issue_cert()Leonardo Mörlein2021-04-04
| | | | | | | | | Before this commit, issue_cert always returned 1 no matter if uacme returned 1, 2, 3, ... With this commit, the return code of the uacme binary is propagated. Therefore the caller of issue_cert can differentiate between "no renew necessary" and "an error occurred". Signed-off-by: Leonardo Mörlein <me@irrelefant.net>
* uacme: allow including run-uacmeLeonardo Mörlein2021-04-04
| | | | | | | With this commit, the run-acme script can be included into other scripts by setting INLCUDE_ONLY=1. Signed-off-by: Leonardo Mörlein <me@irrelefant.net>
* uacme: update to 1.7Rosen Penev2021-02-28
| | | | | | Switched to AUTORELEASE for simplicity. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* uacme: adopt to new behavior of nginxPeter Stadler2021-02-08
| | | | Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>
* uacme: Update to 1.6Antti Seppälä2020-12-20
| | | | Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
* uacme: remove cron entry on package removalWren Turkal2020-05-28
| | | | | | | Previously, the cron config was not removed on uninstall. This change fixes that. Signed-off-by: Wren Turkal <wt@penguintechs.org>
* uacme: add support for user-provided setup and cleanup scriptsAntti Seppälä2020-04-30
| | | | | | | | | | | Add possibility for user to provide setup and cleanup scripts for additional flexibility. Setup-script takes precedence over the built-in behavior of uacme. This helps users with more complex use-cases to utilize uacme to update certificates without adding complexity to the provided run.sh script. Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
* uacme: update to 1.2.1Antti Seppälä2020-04-18
| | | | | | | | Update to latest release. Do not compile optional ualpn binary. Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
* uacme: update to 1.0.22Rosen Penev2020-02-13
| | | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* uacme: add packageLucian Cristian2019-10-10
lightweight client for the RFC8555 ACMEv2 protocol, written in plain C code with minimal dependencies (libcurl and one of GnuTLS, OpenSSL or mbedTLS). Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>
Powered by cgit, Themed by Ted Yin.