mirror of
https://github.com/certd/certd.git
synced 2026-04-14 12:30:54 +08:00
feat: 【破坏性更新】插件改为metadata加载模式，plugin-cert、plugin-lib包部分代码转移到certd-server中，影响自定义插件，需要修改相关import引用
ssh、aliyun、tencent、qiniu、oss等 access和client需要转移import
This commit is contained in:
xiaojunnuo
@@ -21,13 +21,8 @@
|
||||
"@certd/basic": "^1.37.17",
|
||||
"@certd/pipeline": "^1.37.17",
|
||||
"@certd/plugin-lib": "^1.37.17",
|
||||
"@google-cloud/publicca": "^1.3.0",
|
||||
"dayjs": "^1.11.7",
|
||||
"jszip": "^3.10.1",
|
||||
"lodash-es": "^4.17.21",
|
||||
"psl": "^1.9.0",
|
||||
"punycode.js": "^2.3.1",
|
||||
"rimraf": "^5.0.5"
|
||||
"psl": "^1.9.0"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/chai": "^4.3.3",
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
import { IsAccess, AccessInput, BaseAccess } from "@certd/pipeline";
|
||||
|
||||
@IsAccess({
|
||||
name: "eab",
|
||||
title: "EAB授权",
|
||||
desc: "ZeroSSL证书申请需要EAB授权",
|
||||
icon: "ic:outline-lock",
|
||||
})
|
||||
export class EabAccess extends BaseAccess {
|
||||
@AccessInput({
|
||||
title: "KID",
|
||||
component: {
|
||||
placeholder: "kid / keyId",
|
||||
},
|
||||
helper: "EAB KID， google的叫 keyId，ssl.com的叫Account/ACME Key",
|
||||
required: true,
|
||||
encrypt: true,
|
||||
})
|
||||
kid = "";
|
||||
@AccessInput({
|
||||
title: "HMACKey",
|
||||
component: {
|
||||
placeholder: "HMAC Key / b64MacKey",
|
||||
},
|
||||
helper: "EAB HMAC Key ，google的叫b64MacKey",
|
||||
required: true,
|
||||
encrypt: true,
|
||||
})
|
||||
hmacKey = "";
|
||||
|
||||
@AccessInput({
|
||||
title: "email",
|
||||
component: {
|
||||
placeholder: "绑定一个邮箱",
|
||||
},
|
||||
rules: [{ type: "email", message: "请输入正确的邮箱" }],
|
||||
helper: "Google的EAB申请证书，更换邮箱会导致EAB失效，可以在此处绑定一个邮箱避免此问题",
|
||||
required: true,
|
||||
})
|
||||
email = "";
|
||||
}
|
||||
|
||||
new EabAccess();
|
||||
@@ -1,98 +0,0 @@
|
||||
import { IsAccess, AccessInput, BaseAccess } from "@certd/pipeline";
|
||||
|
||||
@IsAccess({
|
||||
name: "google",
|
||||
title: "google cloud",
|
||||
desc: "谷歌云授权",
|
||||
icon: "flat-color-icons:google",
|
||||
})
|
||||
export class GoogleAccess extends BaseAccess {
|
||||
@AccessInput({
|
||||
title: "密钥类型",
|
||||
value: "serviceAccount",
|
||||
component: {
|
||||
placeholder: "密钥类型",
|
||||
name: "a-select",
|
||||
vModel: "value",
|
||||
options: [
|
||||
{ value: "serviceAccount", label: "服务账号密钥" },
|
||||
{ value: "apiKey", label: "ApiKey，暂不可用", disabled: true },
|
||||
],
|
||||
},
|
||||
helper: "密钥类型",
|
||||
required: true,
|
||||
encrypt: false,
|
||||
})
|
||||
type = "";
|
||||
|
||||
@AccessInput({
|
||||
title: "项目ID",
|
||||
component: {
|
||||
placeholder: "ProjectId",
|
||||
},
|
||||
helper: "ProjectId",
|
||||
required: true,
|
||||
encrypt: false,
|
||||
mergeScript: `
|
||||
return {
|
||||
show:ctx.compute(({form})=>{
|
||||
return form.access.type === 'apiKey'
|
||||
})
|
||||
}
|
||||
`,
|
||||
})
|
||||
projectId = "";
|
||||
|
||||
@AccessInput({
|
||||
title: "ApiKey",
|
||||
component: {
|
||||
placeholder: "ApiKey",
|
||||
},
|
||||
helper: "不要选，目前没有用",
|
||||
required: true,
|
||||
encrypt: true,
|
||||
mergeScript: `
|
||||
return {
|
||||
show:ctx.compute(({form})=>{
|
||||
return form.access.type === 'apiKey'
|
||||
})
|
||||
}
|
||||
`,
|
||||
})
|
||||
apiKey = "";
|
||||
|
||||
@AccessInput({
|
||||
title: "服务账号密钥",
|
||||
component: {
|
||||
placeholder: "serviceAccountSecret",
|
||||
name: "a-textarea",
|
||||
vModel: "value",
|
||||
rows: 4,
|
||||
},
|
||||
helper:
|
||||
"[如何创建服务账号](https://cloud.google.com/iam/docs/service-accounts-create?hl=zh-CN) \n[获取密钥](https://console.cloud.google.com/iam-admin/serviceaccounts?hl=zh-cn)，点击详情，点击创建密钥，将下载json文件，把内容填在此处",
|
||||
required: true,
|
||||
encrypt: true,
|
||||
mergeScript: `
|
||||
return {
|
||||
show:ctx.compute(({form})=>{
|
||||
return form.access.type === 'serviceAccount'
|
||||
})
|
||||
}
|
||||
`,
|
||||
})
|
||||
serviceAccountSecret = "";
|
||||
|
||||
@AccessInput({
|
||||
title: "https代理",
|
||||
component: {
|
||||
placeholder: "http://127.0.0.1:10811",
|
||||
},
|
||||
helper: "Google的请求需要走代理，如果不配置，则会使用环境变量中的全局HTTPS_PROXY配置\n或者服务器本身在海外，则不需要配置",
|
||||
required: false,
|
||||
encrypt: false,
|
||||
})
|
||||
httpsProxy = "";
|
||||
}
|
||||
|
||||
new GoogleAccess();
|
||||
@@ -1,2 +0,0 @@
|
||||
export * from "./eab-access.js";
|
||||
export * from "./google-access.js";
|
||||
@@ -1,97 +0,0 @@
|
||||
import { HttpClient, ILogger, utils } from "@certd/basic";
|
||||
import { IAccess, IServiceGetter, Registrable } from "@certd/pipeline";
|
||||
|
||||
export type DnsProviderDefine = Registrable & {
|
||||
accessType: string;
|
||||
icon?: string;
|
||||
};
|
||||
|
||||
export type CreateRecordOptions = {
|
||||
domain: string;
|
||||
fullRecord: string;
|
||||
hostRecord: string;
|
||||
type: string;
|
||||
value: any;
|
||||
};
|
||||
export type RemoveRecordOptions<T> = {
|
||||
recordReq: CreateRecordOptions;
|
||||
// 本次创建的dns解析记录，实际上就是createRecord接口的返回值
|
||||
recordRes: T;
|
||||
};
|
||||
|
||||
export type DnsProviderContext = {
|
||||
access: IAccess;
|
||||
logger: ILogger;
|
||||
http: HttpClient;
|
||||
utils: typeof utils;
|
||||
domainParser: IDomainParser;
|
||||
serviceGetter: IServiceGetter;
|
||||
};
|
||||
|
||||
export interface IDnsProvider<T = any> {
|
||||
onInstance(): Promise<void>;
|
||||
|
||||
/**
|
||||
* 中文转英文
|
||||
* @param domain
|
||||
*/
|
||||
punyCodeEncode(domain: string): string;
|
||||
|
||||
/**
|
||||
* 转中文域名
|
||||
* @param domain
|
||||
*/
|
||||
punyCodeDecode(domain: string): string;
|
||||
|
||||
createRecord(options: CreateRecordOptions): Promise<T>;
|
||||
|
||||
removeRecord(options: RemoveRecordOptions<T>): Promise<void>;
|
||||
|
||||
setCtx(ctx: DnsProviderContext): void;
|
||||
|
||||
//中文域名是否需要punycode转码，如果返回True，则使用punycode来添加解析记录，否则使用中文域名添加解析记录
|
||||
usePunyCode(): boolean;
|
||||
}
|
||||
|
||||
export interface ISubDomainsGetter {
|
||||
getSubDomains(): Promise<string[]>;
|
||||
}
|
||||
|
||||
export interface IDomainParser {
|
||||
parse(fullDomain: string): Promise<string>;
|
||||
}
|
||||
|
||||
export type DnsVerifier = {
|
||||
// dns直接校验
|
||||
dnsProviderType?: string;
|
||||
dnsProviderAccessId?: number;
|
||||
};
|
||||
|
||||
export type CnameVerifier = {
|
||||
hostRecord: string;
|
||||
domain: string;
|
||||
recordValue: string;
|
||||
};
|
||||
|
||||
export type HttpVerifier = {
|
||||
// http校验
|
||||
httpUploaderType: string;
|
||||
httpUploaderAccess: number;
|
||||
httpUploadRootDir: string;
|
||||
};
|
||||
export type DomainVerifier = {
|
||||
domain: string;
|
||||
mainDomain: string;
|
||||
type: string;
|
||||
dns?: DnsVerifier;
|
||||
cname?: CnameVerifier;
|
||||
http?: HttpVerifier;
|
||||
};
|
||||
|
||||
export type DomainVerifiers = {
|
||||
[key: string]: DomainVerifier;
|
||||
};
|
||||
|
||||
export interface IDomainVerifierGetter {
|
||||
getVerifiers(domains: string[]): Promise<DomainVerifiers>;
|
||||
}
|
||||
@@ -1,62 +0,0 @@
|
||||
import { CreateRecordOptions, DnsProviderContext, DnsProviderDefine, IDnsProvider, RemoveRecordOptions } from "./api.js";
|
||||
import { dnsProviderRegistry } from "./registry.js";
|
||||
import { HttpClient, ILogger } from "@certd/basic";
|
||||
import punycode from "punycode.js";
|
||||
export abstract class AbstractDnsProvider<T = any> implements IDnsProvider<T> {
|
||||
ctx!: DnsProviderContext;
|
||||
http!: HttpClient;
|
||||
logger!: ILogger;
|
||||
|
||||
usePunyCode(): boolean {
|
||||
//是否使用punycode来添加解析记录
|
||||
//默认都使用原始中文域名来添加
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* 中文转英文
|
||||
* @param domain
|
||||
*/
|
||||
punyCodeEncode(domain: string) {
|
||||
return punycode.toASCII(domain);
|
||||
}
|
||||
|
||||
/**
|
||||
* 转中文域名
|
||||
* @param domain
|
||||
*/
|
||||
punyCodeDecode(domain: string) {
|
||||
return punycode.toUnicode(domain);
|
||||
}
|
||||
|
||||
setCtx(ctx: DnsProviderContext) {
|
||||
this.ctx = ctx;
|
||||
this.logger = ctx.logger;
|
||||
this.http = ctx.http;
|
||||
}
|
||||
|
||||
async parseDomain(fullDomain: string) {
|
||||
return await this.ctx.domainParser.parse(fullDomain);
|
||||
}
|
||||
|
||||
abstract createRecord(options: CreateRecordOptions): Promise<T>;
|
||||
|
||||
abstract onInstance(): Promise<void>;
|
||||
|
||||
abstract removeRecord(options: RemoveRecordOptions<T>): Promise<void>;
|
||||
}
|
||||
|
||||
export async function createDnsProvider(opts: { dnsProviderType: string; context: DnsProviderContext }): Promise<IDnsProvider> {
|
||||
const { dnsProviderType, context } = opts;
|
||||
const dnsProviderPlugin = dnsProviderRegistry.get(dnsProviderType);
|
||||
const DnsProviderClass = await dnsProviderPlugin.target();
|
||||
const dnsProviderDefine = dnsProviderPlugin.define as DnsProviderDefine;
|
||||
if (dnsProviderDefine.deprecated) {
|
||||
context.logger.warn(dnsProviderDefine.deprecated);
|
||||
}
|
||||
// @ts-ignore
|
||||
const dnsProvider: IDnsProvider = new DnsProviderClass();
|
||||
dnsProvider.setCtx(context);
|
||||
await dnsProvider.onInstance();
|
||||
return dnsProvider;
|
||||
}
|
||||
@@ -1,23 +0,0 @@
|
||||
import { dnsProviderRegistry } from "./registry.js";
|
||||
import { DnsProviderDefine } from "./api.js";
|
||||
import { Decorator } from "@certd/pipeline";
|
||||
import * as _ from "lodash-es";
|
||||
|
||||
// 提供一个唯一 key
|
||||
export const DNS_PROVIDER_CLASS_KEY = "pipeline:dns-provider";
|
||||
|
||||
export function IsDnsProvider(define: DnsProviderDefine): ClassDecorator {
|
||||
return (target: any) => {
|
||||
target = Decorator.target(target);
|
||||
|
||||
Reflect.defineMetadata(DNS_PROVIDER_CLASS_KEY, define, target);
|
||||
|
||||
target.define = define;
|
||||
dnsProviderRegistry.register(define.name, {
|
||||
define,
|
||||
target: async () => {
|
||||
return target;
|
||||
},
|
||||
});
|
||||
};
|
||||
}
|
||||
@@ -1,71 +0,0 @@
|
||||
import { IDomainParser, ISubDomainsGetter } from "./api";
|
||||
//@ts-ignore
|
||||
import psl from "psl";
|
||||
import { ILogger, utils, logger as globalLogger } from "@certd/basic";
|
||||
import { resolveDomainBySoaRecord } from "@certd/acme-client";
|
||||
|
||||
export class DomainParser implements IDomainParser {
|
||||
subDomainsGetter: ISubDomainsGetter;
|
||||
logger: ILogger;
|
||||
constructor(subDomainsGetter: ISubDomainsGetter, logger?: ILogger) {
|
||||
this.subDomainsGetter = subDomainsGetter;
|
||||
this.logger = logger || globalLogger;
|
||||
}
|
||||
|
||||
parseDomainByPsl(fullDomain: string) {
|
||||
const parsed = psl.parse(fullDomain) as psl.ParsedDomain;
|
||||
if (parsed.error) {
|
||||
throw new Error(`解析${fullDomain}域名失败:` + JSON.stringify(parsed.error));
|
||||
}
|
||||
return parsed.domain as string;
|
||||
}
|
||||
|
||||
async parse(fullDomain: string) {
|
||||
//如果是ip
|
||||
if (utils.domain.isIp(fullDomain)) {
|
||||
return fullDomain;
|
||||
}
|
||||
|
||||
this.logger.info(`查找主域名:${fullDomain}`);
|
||||
const cacheKey = `domain_parse:${fullDomain}`;
|
||||
const value = utils.cache.get(cacheKey);
|
||||
if (value) {
|
||||
this.logger.info(`从缓存获取到主域名:${fullDomain}->${value}`);
|
||||
return value;
|
||||
}
|
||||
|
||||
const subDomains = await this.subDomainsGetter.getSubDomains();
|
||||
if (subDomains && subDomains.length > 0) {
|
||||
const fullDomainDot = "." + fullDomain;
|
||||
for (const subDomain of subDomains) {
|
||||
if (fullDomainDot.endsWith("." + subDomain)) {
|
||||
//找到子域名托管
|
||||
utils.cache.set(cacheKey, subDomain, {
|
||||
ttl: 60 * 1000,
|
||||
});
|
||||
this.logger.info(`获取到子域名托管域名:${fullDomain}->${subDomain}`);
|
||||
return subDomain;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const res = this.parseDomainByPsl(fullDomain);
|
||||
this.logger.info(`从psl获取主域名:${fullDomain}->${res}`);
|
||||
|
||||
let soaManDomain = null;
|
||||
try {
|
||||
const mainDomain = await resolveDomainBySoaRecord(fullDomain);
|
||||
if (mainDomain) {
|
||||
this.logger.info(`从SOA获取到主域名:${fullDomain}->${mainDomain}`);
|
||||
soaManDomain = mainDomain;
|
||||
}
|
||||
} catch (e) {
|
||||
this.logger.error("从SOA获取主域名失败", e.message);
|
||||
}
|
||||
if (soaManDomain && soaManDomain !== res) {
|
||||
this.logger.warn(`SOA获取的主域名（${soaManDomain}）和psl获取的主域名(${res})不一致，请确认是否有设置子域名托管`);
|
||||
}
|
||||
|
||||
return res;
|
||||
}
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
export * from "./api.js";
|
||||
export * from "./registry.js";
|
||||
export * from "./decorator.js";
|
||||
export * from "./base.js";
|
||||
export * from "./domain-parser.js";
|
||||
@@ -1,3 +0,0 @@
|
||||
import { createRegistry } from "@certd/pipeline";
|
||||
|
||||
export const dnsProviderRegistry = createRegistry("dnsProvider");
|
||||
@@ -1,3 +1 @@
|
||||
export * from "./access/index.js";
|
||||
export * from "./plugin/index.js";
|
||||
export * from "./dns-provider/index.js";
|
||||
export * from "@certd/plugin-lib";
|
||||
@@ -1,62 +0,0 @@
|
||||
import { EabAccess, GoogleAccess } from "../access/index.js";
|
||||
import { ILogger } from "@certd/basic";
|
||||
|
||||
export class GoogleClient {
|
||||
access: GoogleAccess;
|
||||
logger: ILogger;
|
||||
constructor(opts: { logger: ILogger; access: GoogleAccess }) {
|
||||
this.access = opts.access;
|
||||
this.logger = opts.logger;
|
||||
}
|
||||
async getEab() {
|
||||
// https://cloud.google.com/docs/authentication/api-keys-use#using-with-client-libs
|
||||
const { v1 } = await import("@google-cloud/publicca");
|
||||
// process.env.HTTPS_PROXY = "http://127.0.0.1:10811";
|
||||
const access = this.access;
|
||||
if (!access.serviceAccountSecret) {
|
||||
throw new Error("服务账号密钥 不能为空");
|
||||
}
|
||||
const credentials = JSON.parse(access.serviceAccountSecret);
|
||||
|
||||
const client = new v1.PublicCertificateAuthorityServiceClient({ credentials });
|
||||
const parent = `projects/${credentials.project_id}/locations/global`;
|
||||
const externalAccountKey = {};
|
||||
const request = {
|
||||
parent,
|
||||
externalAccountKey,
|
||||
};
|
||||
|
||||
let envHttpsProxy = "";
|
||||
try {
|
||||
if (this.access.httpsProxy) {
|
||||
//设置临时使用代理
|
||||
envHttpsProxy = process.env.HTTPS_PROXY;
|
||||
process.env.HTTPS_PROXY = this.access.httpsProxy;
|
||||
}
|
||||
this.logger.info("开始获取google eab授权");
|
||||
const response = await client.createExternalAccountKey(request);
|
||||
const { keyId, b64MacKey } = response[0];
|
||||
const eabAccess = new EabAccess();
|
||||
eabAccess.kid = keyId;
|
||||
eabAccess.hmacKey = b64MacKey.toString();
|
||||
this.logger.info(`google eab授权获取成功，kid: ${eabAccess.kid}`);
|
||||
return eabAccess;
|
||||
} finally {
|
||||
if (envHttpsProxy) {
|
||||
process.env.HTTPS_PROXY = envHttpsProxy;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// const access = new GoogleAccess();
|
||||
// access.projectId = "hip-light-432411-d4";
|
||||
// access.serviceAccountSecret = `
|
||||
//
|
||||
//
|
||||
// `;
|
||||
// // process.env.HTTPS_PROXY = "http://127.0.0.1:10811";
|
||||
// const client = new GoogleClient(access);
|
||||
// client.getEab().catch((e) => {
|
||||
// console.error(e);
|
||||
// });
|
||||
@@ -1,462 +0,0 @@
|
||||
// @ts-ignore
|
||||
import * as acme from "@certd/acme-client";
|
||||
import { ClientExternalAccountBindingOptions, UrlMapping } from "@certd/acme-client";
|
||||
import * as _ from "lodash-es";
|
||||
import { Challenge } from "@certd/acme-client/types/rfc8555";
|
||||
import { IContext } from "@certd/pipeline";
|
||||
import { ILogger, utils } from "@certd/basic";
|
||||
import { IDnsProvider, IDomainParser } from "../../dns-provider/index.js";
|
||||
import punycode from "punycode.js";
|
||||
import { IOssClient } from "@certd/plugin-lib";
|
||||
export type CnameVerifyPlan = {
|
||||
type?: string;
|
||||
domain: string;
|
||||
fullRecord: string;
|
||||
dnsProvider: IDnsProvider;
|
||||
};
|
||||
|
||||
export type HttpVerifyPlan = {
|
||||
type: string;
|
||||
domain: string;
|
||||
httpUploader: IOssClient;
|
||||
};
|
||||
|
||||
export type DomainVerifyPlan = {
|
||||
domain: string;
|
||||
mainDomain: string;
|
||||
type: "cname" | "dns" | "http";
|
||||
dnsProvider?: IDnsProvider;
|
||||
cnameVerifyPlan?: CnameVerifyPlan;
|
||||
httpVerifyPlan?: HttpVerifyPlan;
|
||||
};
|
||||
export type DomainsVerifyPlan = {
|
||||
[key: string]: DomainVerifyPlan;
|
||||
};
|
||||
|
||||
export type Providers = {
|
||||
dnsProvider?: IDnsProvider;
|
||||
domainsVerifyPlan?: DomainsVerifyPlan;
|
||||
};
|
||||
|
||||
export type CertInfo = {
|
||||
crt: string; //fullchain证书
|
||||
key: string; //私钥
|
||||
csr: string; //csr
|
||||
oc?: string; //仅证书，非fullchain证书
|
||||
ic?: string; //中间证书
|
||||
pfx?: string;
|
||||
der?: string;
|
||||
jks?: string;
|
||||
one?: string;
|
||||
p7b?: string;
|
||||
};
|
||||
export type SSLProvider = "letsencrypt" | "google" | "zerossl" | "sslcom" | "letsencrypt_staging";
|
||||
export type PrivateKeyType = "rsa_1024" | "rsa_2048" | "rsa_3072" | "rsa_4096" | "ec_256" | "ec_384" | "ec_521";
|
||||
type AcmeServiceOptions = {
|
||||
userContext: IContext;
|
||||
logger: ILogger;
|
||||
sslProvider: SSLProvider;
|
||||
eab?: ClientExternalAccountBindingOptions;
|
||||
skipLocalVerify?: boolean;
|
||||
useMappingProxy?: boolean;
|
||||
reverseProxy?: string;
|
||||
privateKeyType?: PrivateKeyType;
|
||||
signal?: AbortSignal;
|
||||
maxCheckRetryCount?: number;
|
||||
userId: number;
|
||||
domainParser: IDomainParser;
|
||||
waitDnsDiffuseTime?: number;
|
||||
};
|
||||
|
||||
export class AcmeService {
|
||||
options: AcmeServiceOptions;
|
||||
userContext: IContext;
|
||||
logger: ILogger;
|
||||
sslProvider: SSLProvider;
|
||||
skipLocalVerify = true;
|
||||
eab?: ClientExternalAccountBindingOptions;
|
||||
constructor(options: AcmeServiceOptions) {
|
||||
this.options = options;
|
||||
this.userContext = options.userContext;
|
||||
this.logger = options.logger;
|
||||
this.sslProvider = options.sslProvider || "letsencrypt";
|
||||
this.eab = options.eab;
|
||||
this.skipLocalVerify = options.skipLocalVerify ?? false;
|
||||
// acme.setLogger((message: any, ...args: any[]) => {
|
||||
// this.logger.info(message, ...args);
|
||||
// });
|
||||
}
|
||||
|
||||
async getAccountConfig(email: string, urlMapping: UrlMapping): Promise<any> {
|
||||
const conf = (await this.userContext.getObj(this.buildAccountKey(email))) || {};
|
||||
if (urlMapping && urlMapping.mappings) {
|
||||
for (const key in urlMapping.mappings) {
|
||||
if (Object.prototype.hasOwnProperty.call(urlMapping.mappings, key)) {
|
||||
const element = urlMapping.mappings[key];
|
||||
if (conf.accountUrl?.indexOf(element) > -1) {
|
||||
//如果用了代理url，要替换回去
|
||||
conf.accountUrl = conf.accountUrl.replace(element, key);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return conf;
|
||||
}
|
||||
|
||||
buildAccountKey(email: string) {
|
||||
return `acme.config.${this.sslProvider}.${email}`;
|
||||
}
|
||||
|
||||
async saveAccountConfig(email: string, conf: any) {
|
||||
await this.userContext.setObj(this.buildAccountKey(email), conf);
|
||||
}
|
||||
|
||||
async getAcmeClient(email: string): Promise<acme.Client> {
|
||||
const mappings = {};
|
||||
if (this.sslProvider === "letsencrypt") {
|
||||
mappings["acme-v02.api.letsencrypt.org"] = this.options.reverseProxy || "le.px.certd.handfree.work";
|
||||
} else if (this.sslProvider === "google") {
|
||||
mappings["dv.acme-v02.api.pki.goog"] = this.options.reverseProxy || "gg.px.certd.handfree.work";
|
||||
}
|
||||
const urlMapping: UrlMapping = {
|
||||
enabled: false,
|
||||
mappings,
|
||||
};
|
||||
const conf = await this.getAccountConfig(email, urlMapping);
|
||||
if (conf.key == null) {
|
||||
conf.key = await this.createNewKey();
|
||||
await this.saveAccountConfig(email, conf);
|
||||
this.logger.info(`创建新的Accountkey:${email}`);
|
||||
}
|
||||
const directoryUrl = acme.getDirectoryUrl({ sslProvider: this.sslProvider, pkType: this.options.privateKeyType });
|
||||
if (this.options.useMappingProxy) {
|
||||
urlMapping.enabled = true;
|
||||
} else {
|
||||
//测试directory是否可以访问
|
||||
const isOk = await this.testDirectory(directoryUrl);
|
||||
if (!isOk) {
|
||||
this.logger.info("测试访问失败，自动使用代理");
|
||||
urlMapping.enabled = true;
|
||||
}
|
||||
}
|
||||
const client = new acme.Client({
|
||||
sslProvider: this.sslProvider,
|
||||
directoryUrl: directoryUrl,
|
||||
accountKey: conf.key,
|
||||
accountUrl: conf.accountUrl,
|
||||
externalAccountBinding: this.eab,
|
||||
backoffAttempts: this.options.maxCheckRetryCount || 20,
|
||||
backoffMin: 5000,
|
||||
backoffMax: 10000,
|
||||
urlMapping,
|
||||
signal: this.options.signal,
|
||||
logger: this.logger,
|
||||
});
|
||||
|
||||
if (conf.accountUrl == null) {
|
||||
const accountPayload = {
|
||||
termsOfServiceAgreed: true,
|
||||
contact: [`mailto:${email}`],
|
||||
externalAccountBinding: this.eab,
|
||||
};
|
||||
await client.createAccount(accountPayload);
|
||||
conf.accountUrl = client.getAccountUrl();
|
||||
await this.saveAccountConfig(email, conf);
|
||||
}
|
||||
return client;
|
||||
}
|
||||
|
||||
async createNewKey() {
|
||||
const key = await acme.crypto.createPrivateKey(2048);
|
||||
return key.toString();
|
||||
}
|
||||
|
||||
async challengeCreateFn(authz: any, keyAuthorizationGetter: (challenge: Challenge) => Promise<string>, providers: Providers) {
|
||||
this.logger.info("Triggered challengeCreateFn()");
|
||||
|
||||
const fullDomain = authz.identifier.value;
|
||||
let domain = await this.options.domainParser.parse(fullDomain);
|
||||
this.logger.info("主域名为：" + domain);
|
||||
|
||||
const getChallenge = (type: string) => {
|
||||
return authz.challenges.find((c: any) => c.type === type);
|
||||
};
|
||||
|
||||
const doHttpVerify = async (challenge: any, httpUploader: IOssClient) => {
|
||||
const keyAuthorization = await keyAuthorizationGetter(challenge);
|
||||
this.logger.info("http校验");
|
||||
const filePath = `.well-known/acme-challenge/${challenge.token}`;
|
||||
const fileContents = keyAuthorization;
|
||||
this.logger.info(`校验 ${fullDomain} ，准备上传文件：${filePath}`);
|
||||
await httpUploader.upload(filePath, Buffer.from(fileContents));
|
||||
this.logger.info(`上传文件【${filePath}】成功`);
|
||||
return {
|
||||
challenge,
|
||||
keyAuthorization,
|
||||
httpUploader,
|
||||
};
|
||||
};
|
||||
|
||||
const doDnsVerify = async (challenge: any, fullRecord: string, dnsProvider: IDnsProvider) => {
|
||||
this.logger.info("dns校验");
|
||||
const keyAuthorization = await keyAuthorizationGetter(challenge);
|
||||
|
||||
const mainDomain = dnsProvider.usePunyCode() ? domain : punycode.toUnicode(domain);
|
||||
fullRecord = dnsProvider.usePunyCode() ? fullRecord : punycode.toUnicode(fullRecord);
|
||||
const recordValue = keyAuthorization;
|
||||
let hostRecord = fullRecord.replace(`${mainDomain}`, "");
|
||||
if (hostRecord.endsWith(".")) {
|
||||
hostRecord = hostRecord.substring(0, hostRecord.length - 1);
|
||||
}
|
||||
|
||||
const recordReq = {
|
||||
domain: mainDomain,
|
||||
fullRecord,
|
||||
hostRecord,
|
||||
type: "TXT",
|
||||
value: recordValue,
|
||||
};
|
||||
this.logger.info("添加 TXT 解析记录", JSON.stringify(recordReq));
|
||||
const recordRes = await dnsProvider.createRecord(recordReq);
|
||||
this.logger.info("添加 TXT 解析记录成功", JSON.stringify(recordRes));
|
||||
return {
|
||||
recordReq,
|
||||
recordRes,
|
||||
dnsProvider,
|
||||
challenge,
|
||||
keyAuthorization,
|
||||
};
|
||||
};
|
||||
|
||||
let dnsProvider = providers.dnsProvider;
|
||||
let fullRecord = `_acme-challenge.${fullDomain}`;
|
||||
|
||||
// const origDomain = punycode.toUnicode(domain);
|
||||
const origFullDomain = punycode.toUnicode(fullDomain);
|
||||
|
||||
const isIp = utils.domain.isIp(origFullDomain);
|
||||
function checkIpChallenge(type: string) {
|
||||
if (isIp) {
|
||||
throw new Error(`IP证书不支持${type}校验方式，请选择HTTP方式校验`);
|
||||
}
|
||||
}
|
||||
if (providers.domainsVerifyPlan) {
|
||||
//按照计划执行
|
||||
const domainVerifyPlan = providers.domainsVerifyPlan[origFullDomain];
|
||||
if (domainVerifyPlan) {
|
||||
if (domainVerifyPlan.type === "dns") {
|
||||
checkIpChallenge("dns");
|
||||
dnsProvider = domainVerifyPlan.dnsProvider;
|
||||
} else if (domainVerifyPlan.type === "cname") {
|
||||
checkIpChallenge("cname");
|
||||
const cname: CnameVerifyPlan = domainVerifyPlan.cnameVerifyPlan;
|
||||
if (cname) {
|
||||
dnsProvider = cname.dnsProvider;
|
||||
domain = await this.options.domainParser.parse(cname.domain);
|
||||
fullRecord = cname.fullRecord;
|
||||
} else {
|
||||
this.logger.error(`未找到域名${fullDomain}的CNAME校验计划，请修改证书申请配置`);
|
||||
}
|
||||
if (dnsProvider == null) {
|
||||
throw new Error(`未找到域名${fullDomain}CNAME校验计划的DnsProvider，请修改证书申请配置`);
|
||||
}
|
||||
} else if (domainVerifyPlan.type === "http") {
|
||||
const plan: HttpVerifyPlan = domainVerifyPlan.httpVerifyPlan;
|
||||
if (plan) {
|
||||
const httpChallenge = getChallenge("http-01");
|
||||
if (httpChallenge == null) {
|
||||
throw new Error("该域名不支持http-01方式校验");
|
||||
}
|
||||
return await doHttpVerify(httpChallenge, plan.httpUploader);
|
||||
} else {
|
||||
throw new Error("未找到域名【" + fullDomain + "】的http校验配置");
|
||||
}
|
||||
} else {
|
||||
throw new Error("不支持的校验类型", domainVerifyPlan.type);
|
||||
}
|
||||
} else {
|
||||
this.logger.warn(`未找到域名${fullDomain}的校验计划，使用默认的dnsProvider`);
|
||||
}
|
||||
}
|
||||
if (!dnsProvider) {
|
||||
throw new Error(`域名${fullDomain}没有匹配到任何校验方式，证书申请失败`);
|
||||
}
|
||||
|
||||
const dnsChallenge = getChallenge("dns-01");
|
||||
checkIpChallenge("dns");
|
||||
return await doDnsVerify(dnsChallenge, fullRecord, dnsProvider);
|
||||
}
|
||||
|
||||
/**
|
||||
* Function used to remove an ACME challenge response
|
||||
*
|
||||
* @param {object} authz Authorization object
|
||||
* @param {object} challenge Selected challenge
|
||||
* @param {string} keyAuthorization Authorization key
|
||||
* @param recordReq
|
||||
* @param recordRes
|
||||
* @param dnsProvider dnsProvider
|
||||
* @param httpUploader
|
||||
* @returns {Promise}
|
||||
*/
|
||||
|
||||
async challengeRemoveFn(authz: any, challenge: any, keyAuthorization: string, recordReq: any, recordRes: any, dnsProvider?: IDnsProvider, httpUploader?: IOssClient) {
|
||||
this.logger.info("执行清理");
|
||||
|
||||
/* http-01 */
|
||||
const fullDomain = authz.identifier.value;
|
||||
if (challenge.type === "http-01") {
|
||||
const filePath = `.well-known/acme-challenge/${challenge.token}`;
|
||||
this.logger.info(`Removing challenge response for ${fullDomain} at file: ${filePath}`);
|
||||
await httpUploader.remove(filePath);
|
||||
this.logger.info(`删除文件【${filePath}】成功`);
|
||||
} else if (challenge.type === "dns-01") {
|
||||
this.logger.info(`删除 TXT 解析记录:${JSON.stringify(recordReq)} ,recordRes = ${JSON.stringify(recordRes)}`);
|
||||
try {
|
||||
await dnsProvider.removeRecord({
|
||||
recordReq,
|
||||
recordRes,
|
||||
});
|
||||
this.logger.info("删除解析记录成功");
|
||||
} catch (e) {
|
||||
this.logger.error("删除解析记录出错：", e);
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async order(options: {
|
||||
email: string;
|
||||
domains: string | string[];
|
||||
dnsProvider?: any;
|
||||
domainsVerifyPlan?: DomainsVerifyPlan;
|
||||
httpUploader?: any;
|
||||
csrInfo: any;
|
||||
privateKeyType?: string;
|
||||
profile?: string;
|
||||
preferredChain?: string;
|
||||
}): Promise<CertInfo> {
|
||||
const { email, csrInfo, dnsProvider, domainsVerifyPlan, profile, preferredChain } = options;
|
||||
const client: acme.Client = await this.getAcmeClient(email);
|
||||
|
||||
let domains = options.domains;
|
||||
const encodingDomains = [];
|
||||
for (const domain of domains) {
|
||||
encodingDomains.push(punycode.toASCII(domain));
|
||||
}
|
||||
domains = encodingDomains;
|
||||
|
||||
/* Create CSR */
|
||||
const { altNames } = this.buildCommonNameByDomains(domains);
|
||||
let privateKey = null;
|
||||
const privateKeyType = options.privateKeyType || "rsa_2048";
|
||||
const privateKeyArr = privateKeyType.split("_");
|
||||
const type = privateKeyArr[0];
|
||||
let size = 2048;
|
||||
if (privateKeyArr.length > 1) {
|
||||
size = parseInt(privateKeyArr[1]);
|
||||
}
|
||||
|
||||
let encodingType = "pkcs8";
|
||||
if (privateKeyArr.length > 2) {
|
||||
encodingType = privateKeyArr[2];
|
||||
}
|
||||
|
||||
if (type == "ec") {
|
||||
const name: any = "P-" + size;
|
||||
privateKey = await acme.crypto.createPrivateEcdsaKey(name, encodingType);
|
||||
} else {
|
||||
privateKey = await acme.crypto.createPrivateRsaKey(size, encodingType);
|
||||
}
|
||||
|
||||
let createCsr: any = acme.crypto.createCsr;
|
||||
if (encodingType === "pkcs1") {
|
||||
//兼容老版本
|
||||
createCsr = acme.forge.createCsr;
|
||||
}
|
||||
const csrData: any = {
|
||||
// commonName,
|
||||
...csrInfo,
|
||||
altNames,
|
||||
// emailAddress: email,
|
||||
};
|
||||
const [key, csr] = await createCsr(csrData, privateKey);
|
||||
|
||||
if (dnsProvider == null && domainsVerifyPlan == null) {
|
||||
throw new Error("dnsProvider 、 domainsVerifyPlan不能都为空");
|
||||
}
|
||||
|
||||
const providers: Providers = {
|
||||
dnsProvider,
|
||||
domainsVerifyPlan,
|
||||
};
|
||||
/* 自动申请证书 */
|
||||
const crt = await client.auto({
|
||||
csr,
|
||||
email: email,
|
||||
termsOfServiceAgreed: true,
|
||||
skipChallengeVerification: this.skipLocalVerify,
|
||||
challengePriority: ["dns-01", "http-01"],
|
||||
challengeCreateFn: async (
|
||||
authz: acme.Authorization,
|
||||
keyAuthorizationGetter: (challenge: Challenge) => Promise<string>
|
||||
): Promise<{ recordReq?: any; recordRes?: any; dnsProvider?: any; challenge: Challenge; keyAuthorization: string }> => {
|
||||
return await this.challengeCreateFn(authz, keyAuthorizationGetter, providers);
|
||||
},
|
||||
challengeRemoveFn: async (authz: acme.Authorization, challenge: Challenge, keyAuthorization: string, recordReq: any, recordRes: any, dnsProvider: IDnsProvider, httpUploader: IOssClient): Promise<any> => {
|
||||
return await this.challengeRemoveFn(authz, challenge, keyAuthorization, recordReq, recordRes, dnsProvider, httpUploader);
|
||||
},
|
||||
signal: this.options.signal,
|
||||
profile,
|
||||
preferredChain,
|
||||
});
|
||||
|
||||
const crtString = crt.toString();
|
||||
const cert: CertInfo = {
|
||||
crt: crtString,
|
||||
key: key.toString(),
|
||||
csr: csr.toString(),
|
||||
};
|
||||
/* Done */
|
||||
this.logger.debug(`CSR:\n${cert.csr}`);
|
||||
this.logger.debug(`Certificate:\n${cert.crt}`);
|
||||
this.logger.info("证书申请成功");
|
||||
return cert;
|
||||
}
|
||||
|
||||
buildCommonNameByDomains(domains: string | string[]): {
|
||||
commonName?: string;
|
||||
altNames: string[] | undefined;
|
||||
} {
|
||||
if (typeof domains === "string") {
|
||||
domains = domains.split(",");
|
||||
}
|
||||
if (domains.length === 0) {
|
||||
throw new Error("domain can not be empty");
|
||||
}
|
||||
// const commonName = domains[0];
|
||||
// let altNames: undefined | string[] = undefined;
|
||||
// if (domains.length > 1) {
|
||||
// altNames = _.slice(domains, 1);
|
||||
// }
|
||||
return {
|
||||
// commonName,
|
||||
altNames: domains,
|
||||
};
|
||||
}
|
||||
|
||||
private async testDirectory(directoryUrl: string) {
|
||||
try {
|
||||
await utils.http.request({
|
||||
url: directoryUrl,
|
||||
method: "GET",
|
||||
timeout: 10000,
|
||||
});
|
||||
} catch (e) {
|
||||
this.logger.error(`${directoryUrl}，测试访问失败`, e.message);
|
||||
return false;
|
||||
}
|
||||
this.logger.info(`${directoryUrl}，测试访问成功`);
|
||||
return true;
|
||||
}
|
||||
}
|
||||
@@ -1,212 +0,0 @@
|
||||
import { AbstractTaskPlugin, FileItem, IContext, Step, TaskInput, TaskOutput } from "@certd/pipeline";
|
||||
import dayjs from "dayjs";
|
||||
import type { CertInfo } from "./acme.js";
|
||||
import { CertReader } from "./cert-reader.js";
|
||||
import JSZip from "jszip";
|
||||
import { CertConverter } from "./convert.js";
|
||||
export const EVENT_CERT_APPLY_SUCCESS = "CertApply.success";
|
||||
|
||||
export abstract class CertApplyBaseConvertPlugin extends AbstractTaskPlugin {
|
||||
@TaskInput({
|
||||
title: "证书域名",
|
||||
component: {
|
||||
name: "a-select",
|
||||
vModel: "value",
|
||||
mode: "tags",
|
||||
open: false,
|
||||
placeholder: "foo.com / *.foo.com / *.bar.com",
|
||||
tokenSeparators: [",", " ", "，", "、", "|"],
|
||||
},
|
||||
rules: [{ type: "domains" }],
|
||||
required: true,
|
||||
col: {
|
||||
span: 24,
|
||||
},
|
||||
order: -999,
|
||||
helper:
|
||||
"1、支持多个域名打到一个证书上，例如： foo.com，*.foo.com，*.bar.com\n" +
|
||||
"2、子域名被通配符包含的不要填写，例如：www.foo.com已经被*.foo.com包含，不要填写www.foo.com\n" +
|
||||
"3、泛域名只能通配*号那一级（*.foo.com的证书不能用于xxx.yyy.foo.com、不能用于foo.com）\n" +
|
||||
"4、输入一个，空格之后，再输入下一个 \n" +
|
||||
"5、如果设置了子域托管解析（比如免费的二级域名托管在CF或者阿里云），请先[设置托管子域名](#/certd/pipeline/subDomain)",
|
||||
})
|
||||
domains!: string[];
|
||||
|
||||
@TaskInput({
|
||||
title: "证书加密密码",
|
||||
component: {
|
||||
name: "input-password",
|
||||
vModel: "value",
|
||||
},
|
||||
required: false,
|
||||
order: 100,
|
||||
helper: "转换成PFX、jks格式证书是否需要加密\njks必须设置密码，不传则默认123456\npfx不传则为空密码",
|
||||
})
|
||||
pfxPassword!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: "PFX证书转换参数",
|
||||
value: "-macalg SHA1 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES",
|
||||
component: {
|
||||
name: "a-auto-complete",
|
||||
vModel: "value",
|
||||
options: [
|
||||
{ value: "", label: "兼容 Windows Server 最新" },
|
||||
{ value: "-macalg SHA1 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES", label: "兼容 Windows Server 2016" },
|
||||
{ value: "-nomac -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES", label: "兼容 Windows Server 2008" },
|
||||
],
|
||||
},
|
||||
required: false,
|
||||
order: 100,
|
||||
helper: "兼容Windows Server各个版本",
|
||||
})
|
||||
pfxArgs = "-macalg SHA1 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES";
|
||||
|
||||
userContext!: IContext;
|
||||
lastStatus!: Step;
|
||||
|
||||
@TaskOutput({
|
||||
title: "域名证书",
|
||||
type: "cert",
|
||||
})
|
||||
cert?: CertInfo;
|
||||
|
||||
@TaskOutput({
|
||||
title: "域名证书压缩文件",
|
||||
type: "certZip",
|
||||
})
|
||||
certZip?: FileItem;
|
||||
|
||||
async onInstance() {
|
||||
this.userContext = this.ctx.userContext;
|
||||
this.lastStatus = this.ctx.lastStatus as Step;
|
||||
await this.onInit();
|
||||
}
|
||||
|
||||
abstract onInit(): Promise<void>;
|
||||
|
||||
//必须output之后执行
|
||||
async emitCertApplySuccess() {
|
||||
const emitter = this.ctx.emitter;
|
||||
const value = {
|
||||
cert: this.cert,
|
||||
file: this._result.files[0].path,
|
||||
};
|
||||
await emitter.emit(EVENT_CERT_APPLY_SUCCESS, value);
|
||||
}
|
||||
|
||||
async output(certReader: CertReader, isNew: boolean) {
|
||||
const cert: CertInfo = certReader.toCertInfo();
|
||||
this.cert = cert;
|
||||
|
||||
this._result.pipelineVars.certEffectiveTime = dayjs(certReader.detail.notBefore).valueOf();
|
||||
this._result.pipelineVars.certExpiresTime = dayjs(certReader.detail.notAfter).valueOf();
|
||||
if (!this._result.pipelinePrivateVars) {
|
||||
this._result.pipelinePrivateVars = {};
|
||||
}
|
||||
this._result.pipelinePrivateVars.cert = cert;
|
||||
|
||||
if (isNew) {
|
||||
try {
|
||||
const converter = new CertConverter({ logger: this.logger });
|
||||
const res = await converter.convert({
|
||||
cert,
|
||||
pfxPassword: this.pfxPassword,
|
||||
pfxArgs: this.pfxArgs,
|
||||
});
|
||||
if (cert.pfx == null && res.pfx) {
|
||||
cert.pfx = res.pfx;
|
||||
}
|
||||
|
||||
if (cert.der == null && res.der) {
|
||||
cert.der = res.der;
|
||||
}
|
||||
|
||||
if (cert.jks == null && res.jks) {
|
||||
cert.jks = res.jks;
|
||||
}
|
||||
|
||||
if (cert.p7b == null && res.p7b) {
|
||||
cert.p7b = res.p7b;
|
||||
}
|
||||
|
||||
this.logger.info("转换证书格式成功");
|
||||
} catch (e) {
|
||||
this.logger.error("转换证书格式失败", e);
|
||||
}
|
||||
}
|
||||
|
||||
if (isNew) {
|
||||
const zipFileName = certReader.buildCertFileName("zip", certReader.detail.notBefore);
|
||||
await this.zipCert(cert, zipFileName);
|
||||
} else {
|
||||
this.extendsFiles();
|
||||
}
|
||||
this.certZip = this._result.files[0];
|
||||
}
|
||||
|
||||
async zipCert(cert: CertInfo, filename: string) {
|
||||
const zip = new JSZip();
|
||||
zip.file("证书.pem", cert.crt);
|
||||
zip.file("私钥.pem", cert.key);
|
||||
zip.file("中间证书.pem", cert.ic);
|
||||
zip.file("cert.crt", cert.crt);
|
||||
zip.file("cert.key", cert.key);
|
||||
zip.file("intermediate.crt", cert.ic);
|
||||
zip.file("origin.crt", cert.oc);
|
||||
zip.file("one.pem", cert.one);
|
||||
zip.file("cert.p7b", cert.p7b);
|
||||
if (cert.pfx) {
|
||||
zip.file("cert.pfx", Buffer.from(cert.pfx, "base64"));
|
||||
}
|
||||
if (cert.der) {
|
||||
zip.file("cert.der", Buffer.from(cert.der, "base64"));
|
||||
}
|
||||
if (cert.jks) {
|
||||
zip.file("cert.jks", Buffer.from(cert.jks, "base64"));
|
||||
}
|
||||
|
||||
zip.file(
|
||||
"说明.txt",
|
||||
`证书文件说明
|
||||
cert.crt：证书文件，包含证书链，pem格式
|
||||
cert.key：私钥文件，pem格式
|
||||
intermediate.crt：中间证书文件，pem格式
|
||||
origin.crt：原始证书文件，不含证书链，pem格式
|
||||
one.pem： 证书和私钥简单合并成一个文件，pem格式，crt正文+key正文
|
||||
cert.pfx：pfx格式证书文件，iis服务器使用
|
||||
cert.der：der格式证书文件
|
||||
cert.jks：jks格式证书文件，java服务器使用
|
||||
`
|
||||
);
|
||||
|
||||
const content = await zip.generateAsync({ type: "nodebuffer" });
|
||||
this.saveFile(filename, content);
|
||||
this.logger.info(`已保存文件:${filename}`);
|
||||
}
|
||||
|
||||
formatCert(pem: string) {
|
||||
pem = pem.replace(/\r/g, "");
|
||||
pem = pem.replace(/\n\n/g, "\n");
|
||||
pem = pem.replace(/\n$/g, "");
|
||||
return pem;
|
||||
}
|
||||
|
||||
formatCerts(cert: { crt: string; key: string; csr: string }) {
|
||||
const newCert: CertInfo = {
|
||||
crt: this.formatCert(cert.crt),
|
||||
key: this.formatCert(cert.key),
|
||||
csr: this.formatCert(cert.csr),
|
||||
};
|
||||
return newCert;
|
||||
}
|
||||
|
||||
async readLastCert(): Promise<CertReader | undefined> {
|
||||
const cert = this.lastStatus?.status?.output?.cert;
|
||||
if (cert == null) {
|
||||
this.logger.info("没有找到上次的证书");
|
||||
return undefined;
|
||||
}
|
||||
return new CertReader(cert);
|
||||
}
|
||||
}
|
||||
@@ -1,171 +0,0 @@
|
||||
import { NotificationBody, Step, TaskInput } from "@certd/pipeline";
|
||||
import dayjs from "dayjs";
|
||||
import { CertReader } from "./cert-reader.js";
|
||||
import { pick } from "lodash-es";
|
||||
import { CertApplyBaseConvertPlugin } from "./base-convert.js";
|
||||
|
||||
export abstract class CertApplyBasePlugin extends CertApplyBaseConvertPlugin {
|
||||
@TaskInput({
|
||||
title: "邮箱",
|
||||
component: {
|
||||
name: "email-selector",
|
||||
vModel: "value",
|
||||
},
|
||||
rules: [{ type: "email", message: "请输入正确的邮箱" }],
|
||||
required: true,
|
||||
order: -1,
|
||||
helper: "请输入邮箱",
|
||||
})
|
||||
email!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: "更新天数",
|
||||
value: 18,
|
||||
component: {
|
||||
name: "a-input-number",
|
||||
vModel: "value",
|
||||
},
|
||||
required: true,
|
||||
order: 100,
|
||||
helper: "到期前多少天后更新证书，注意：流水线默认不会自动运行，请设置定时器，每天定时运行本流水线",
|
||||
})
|
||||
renewDays!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "证书申请成功通知",
|
||||
value: false,
|
||||
component: {
|
||||
name: "a-switch",
|
||||
vModel: "checked",
|
||||
},
|
||||
order: 100,
|
||||
helper: "证书申请成功后是否发送通知，优先使用默认通知渠道",
|
||||
})
|
||||
successNotify = false;
|
||||
|
||||
// @TaskInput({
|
||||
// title: "CsrInfo",
|
||||
// helper: "暂时没有用",
|
||||
// })
|
||||
csrInfo!: string;
|
||||
|
||||
async onInstance() {
|
||||
this.userContext = this.ctx.userContext;
|
||||
this.lastStatus = this.ctx.lastStatus as Step;
|
||||
await this.onInit();
|
||||
}
|
||||
|
||||
abstract onInit(): Promise<void>;
|
||||
|
||||
abstract doCertApply(): Promise<CertReader>;
|
||||
|
||||
async execute(): Promise<string | void> {
|
||||
const oldCert = await this.condition();
|
||||
if (oldCert != null) {
|
||||
await this.output(oldCert, false);
|
||||
return "skip";
|
||||
}
|
||||
const cert = await this.doCertApply();
|
||||
if (cert != null) {
|
||||
await this.output(cert, true);
|
||||
|
||||
await this.emitCertApplySuccess();
|
||||
//清空后续任务的状态，让后续任务能够重新执行
|
||||
this.clearLastStatus();
|
||||
|
||||
if (this.successNotify) {
|
||||
await this.sendSuccessNotify();
|
||||
}
|
||||
} else {
|
||||
throw new Error("申请证书失败");
|
||||
}
|
||||
}
|
||||
|
||||
getCheckChangeInputKeys() {
|
||||
//插件哪些字段参与校验是否需要更新
|
||||
return ["domains", "sslProvider", "privateKeyType", "dnsProviderType", "pfxPassword"];
|
||||
}
|
||||
/**
|
||||
* 是否更新证书
|
||||
*/
|
||||
async condition() {
|
||||
// if (this.forceUpdate) {
|
||||
// this.logger.info("强制更新证书选项已勾选，准备申请新证书");
|
||||
// this.logger.warn("申请完之后，切记取消强制更新，避免申请过多证书。");
|
||||
// return null;
|
||||
// }
|
||||
|
||||
const checkInputChanges = this.getCheckChangeInputKeys();
|
||||
const oldInput = JSON.stringify(pick(this.lastStatus?.input, checkInputChanges));
|
||||
const thisInput = JSON.stringify(pick(this, checkInputChanges));
|
||||
const inputChanged = oldInput !== thisInput;
|
||||
|
||||
this.logger.info(`旧参数：${oldInput}`);
|
||||
this.logger.info(`新参数：${thisInput}`);
|
||||
if (inputChanged) {
|
||||
this.logger.info("输入参数变更，准备申请新证书");
|
||||
return null;
|
||||
} else {
|
||||
this.logger.info("输入参数未变更，检查证书是否过期");
|
||||
}
|
||||
|
||||
let oldCert: CertReader | undefined = undefined;
|
||||
try {
|
||||
this.logger.info("读取上次证书");
|
||||
oldCert = await this.readLastCert();
|
||||
} catch (e) {
|
||||
this.logger.warn("读取cert失败：", e);
|
||||
}
|
||||
if (oldCert == null) {
|
||||
this.logger.info("还未申请过，准备申请新证书");
|
||||
return null;
|
||||
}
|
||||
|
||||
const ret = this.isWillExpire(oldCert.expires, this.renewDays);
|
||||
if (!ret.isWillExpire) {
|
||||
this.logger.info(`证书还未过期：过期时间${dayjs(oldCert.expires).format("YYYY-MM-DD HH:mm:ss")},剩余${ret.leftDays}天`);
|
||||
return oldCert;
|
||||
}
|
||||
this.logger.info("即将过期，开始更新证书");
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* 检查是否过期，默认提前35天
|
||||
* @param expires
|
||||
* @param maxDays
|
||||
*/
|
||||
isWillExpire(expires: number, maxDays = 20) {
|
||||
if (expires == null) {
|
||||
throw new Error("过期时间不能为空");
|
||||
}
|
||||
// 检查有效期
|
||||
const leftDays = Math.floor((expires - dayjs().valueOf()) / (1000 * 60 * 60 * 24));
|
||||
this.logger.info(`证书剩余天数：${leftDays}`);
|
||||
return {
|
||||
isWillExpire: leftDays <= maxDays,
|
||||
leftDays,
|
||||
};
|
||||
}
|
||||
async sendSuccessNotify() {
|
||||
this.logger.info("发送证书申请成功通知");
|
||||
const url = await this.ctx.urlService.getPipelineDetailUrl(this.pipeline.id, this.ctx.runtime.id);
|
||||
const body: NotificationBody = {
|
||||
title: `证书申请成功【${this.pipeline.title}】`,
|
||||
content: `域名：${this.domains.join(",")}`,
|
||||
url: url,
|
||||
notificationType: "certApplySuccess",
|
||||
};
|
||||
try {
|
||||
await this.ctx.notificationService.send({
|
||||
useDefault: true,
|
||||
useEmail: true,
|
||||
emailAddress: this.email,
|
||||
logger: this.logger,
|
||||
body,
|
||||
});
|
||||
} catch (e) {
|
||||
this.logger.error("证书申请成功通知发送失败", e);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,244 +0,0 @@
|
||||
import { CertInfo } from "./acme.js";
|
||||
import fs from "fs";
|
||||
import os from "os";
|
||||
import path from "path";
|
||||
import { CertificateInfo, crypto } from "@certd/acme-client";
|
||||
import { ILogger } from "@certd/basic";
|
||||
import dayjs from "dayjs";
|
||||
import { uniq } from "lodash-es";
|
||||
|
||||
export type CertReaderHandleContext = {
|
||||
reader: CertReader;
|
||||
tmpCrtPath: string;
|
||||
tmpKeyPath: string;
|
||||
tmpOcPath?: string;
|
||||
tmpPfxPath?: string;
|
||||
tmpDerPath?: string;
|
||||
tmpIcPath?: string;
|
||||
tmpJksPath?: string;
|
||||
tmpOnePath?: string;
|
||||
tmpP7bPath?: string;
|
||||
};
|
||||
export type CertReaderHandle = (ctx: CertReaderHandleContext) => Promise<void>;
|
||||
export type HandleOpts = { logger: ILogger; handle: CertReaderHandle };
|
||||
|
||||
const formats = {
|
||||
pem: ["crt", "key", "ic"],
|
||||
one: ["one"],
|
||||
pfx: ["pfx"],
|
||||
der: ["der"],
|
||||
jks: ["jks"],
|
||||
p7b: ["p7b", "key"],
|
||||
};
|
||||
export class CertReader {
|
||||
cert: CertInfo;
|
||||
|
||||
detail: CertificateInfo;
|
||||
//毫秒时间戳
|
||||
effective: number;
|
||||
//毫秒时间戳
|
||||
expires: number;
|
||||
constructor(certInfo: CertInfo) {
|
||||
this.cert = certInfo;
|
||||
|
||||
if (!certInfo.ic) {
|
||||
this.cert.ic = this.getIc();
|
||||
}
|
||||
|
||||
if (!certInfo.oc) {
|
||||
this.cert.oc = this.getOc();
|
||||
}
|
||||
|
||||
if (!certInfo.one) {
|
||||
this.cert.one = this.cert.crt + "\n" + this.cert.key;
|
||||
}
|
||||
|
||||
try {
|
||||
const { detail, effective, expires } = this.getCrtDetail(this.cert.crt);
|
||||
this.detail = detail;
|
||||
this.effective = effective.getTime();
|
||||
this.expires = expires.getTime();
|
||||
} catch (e) {
|
||||
throw new Error("证书解析失败:" + e.message);
|
||||
}
|
||||
}
|
||||
|
||||
getIc() {
|
||||
//中间证书ic， 就是crt的第一个 -----END CERTIFICATE----- 之后的内容
|
||||
const endStr = "-----END CERTIFICATE-----";
|
||||
const firstBlockEndIndex = this.cert.crt.indexOf(endStr);
|
||||
|
||||
const start = firstBlockEndIndex + endStr.length + 1;
|
||||
if (this.cert.crt.length <= start) {
|
||||
return "";
|
||||
}
|
||||
const ic = this.cert.crt.substring(start);
|
||||
if (ic == null) {
|
||||
return "";
|
||||
}
|
||||
return ic?.trim();
|
||||
}
|
||||
|
||||
getOc() {
|
||||
//原始证书 就是crt的第一个 -----END CERTIFICATE----- 之前的内容
|
||||
const endStr = "-----END CERTIFICATE-----";
|
||||
const arr = this.cert.crt.split(endStr);
|
||||
return arr[0] + endStr;
|
||||
}
|
||||
|
||||
toCertInfo(format?: string): CertInfo {
|
||||
if (!format) {
|
||||
return this.cert;
|
||||
}
|
||||
|
||||
const formatArr = formats[format];
|
||||
const res: any = {};
|
||||
formatArr.forEach((key: string) => {
|
||||
res[key] = this.cert[key];
|
||||
});
|
||||
return res;
|
||||
}
|
||||
|
||||
getCrtDetail(crt: string = this.cert.crt) {
|
||||
return CertReader.readCertDetail(crt);
|
||||
}
|
||||
|
||||
static readCertDetail(crt: string) {
|
||||
const detail = crypto.readCertificateInfo(crt.toString());
|
||||
const effective = detail.notBefore;
|
||||
const expires = detail.notAfter;
|
||||
return { detail, effective, expires };
|
||||
}
|
||||
|
||||
getAllDomains() {
|
||||
const { detail } = this.getCrtDetail();
|
||||
const domains = [];
|
||||
if (detail.domains?.commonName) {
|
||||
domains.push(detail.domains.commonName);
|
||||
}
|
||||
domains.push(...detail.domains.altNames);
|
||||
//去重
|
||||
return uniq(domains);
|
||||
}
|
||||
|
||||
getAltNames() {
|
||||
const { detail } = this.getCrtDetail();
|
||||
return detail.domains.altNames;
|
||||
}
|
||||
|
||||
static getMainDomain(crt: string) {
|
||||
const { detail } = CertReader.readCertDetail(crt);
|
||||
return CertReader.getMainDomainFromDetail(detail);
|
||||
}
|
||||
|
||||
getMainDomain() {
|
||||
const { detail } = this.getCrtDetail();
|
||||
return CertReader.getMainDomainFromDetail(detail);
|
||||
}
|
||||
|
||||
static getMainDomainFromDetail(detail: CertificateInfo) {
|
||||
let domain = detail?.domains?.commonName;
|
||||
if (domain == null) {
|
||||
domain = detail?.domains?.altNames?.[0];
|
||||
}
|
||||
if (domain == null) {
|
||||
domain = "unknown";
|
||||
}
|
||||
return domain;
|
||||
}
|
||||
|
||||
saveToFile(type: "crt" | "key" | "pfx" | "der" | "oc" | "one" | "ic" | "jks" | "p7b", filepath?: string) {
|
||||
if (!this.cert[type]) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (filepath == null) {
|
||||
//写入临时目录
|
||||
filepath = path.join(os.tmpdir(), "/certd/tmp/", Math.floor(Math.random() * 1000000) + `_cert.${type}`);
|
||||
}
|
||||
|
||||
const dir = path.dirname(filepath);
|
||||
if (!fs.existsSync(dir)) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
if (type === "crt" || type === "key" || type === "ic" || type === "oc" || type === "one" || type === "p7b") {
|
||||
fs.writeFileSync(filepath, this.cert[type]);
|
||||
} else {
|
||||
fs.writeFileSync(filepath, Buffer.from(this.cert[type], "base64"));
|
||||
}
|
||||
return filepath;
|
||||
}
|
||||
|
||||
async readCertFile(opts: HandleOpts) {
|
||||
const logger = opts.logger;
|
||||
logger.info("将证书写入本地缓存文件");
|
||||
const tmpCrtPath = this.saveToFile("crt");
|
||||
const tmpKeyPath = this.saveToFile("key");
|
||||
const tmpPfxPath = this.saveToFile("pfx");
|
||||
const tmpIcPath = this.saveToFile("ic");
|
||||
const tmpOcPath = this.saveToFile("oc");
|
||||
const tmpDerPath = this.saveToFile("der");
|
||||
const tmpJksPath = this.saveToFile("jks");
|
||||
const tmpOnePath = this.saveToFile("one");
|
||||
const tmpP7bPath = this.saveToFile("p7b");
|
||||
logger.info("本地文件写入成功");
|
||||
try {
|
||||
return await opts.handle({
|
||||
reader: this,
|
||||
tmpCrtPath,
|
||||
tmpKeyPath,
|
||||
tmpPfxPath,
|
||||
tmpDerPath,
|
||||
tmpIcPath,
|
||||
tmpJksPath,
|
||||
tmpOcPath,
|
||||
tmpP7bPath,
|
||||
tmpOnePath,
|
||||
});
|
||||
} catch (err) {
|
||||
logger.error("处理失败", err);
|
||||
throw err;
|
||||
} finally {
|
||||
//删除临时文件
|
||||
logger.info("清理临时文件");
|
||||
function removeFile(filepath?: string) {
|
||||
if (filepath) {
|
||||
fs.unlinkSync(filepath);
|
||||
}
|
||||
}
|
||||
removeFile(tmpCrtPath);
|
||||
removeFile(tmpKeyPath);
|
||||
removeFile(tmpPfxPath);
|
||||
removeFile(tmpOcPath);
|
||||
removeFile(tmpDerPath);
|
||||
removeFile(tmpIcPath);
|
||||
removeFile(tmpJksPath);
|
||||
removeFile(tmpOnePath);
|
||||
removeFile(tmpP7bPath);
|
||||
}
|
||||
}
|
||||
|
||||
buildCertFileName(suffix: string, applyTime: any, prefix = "cert") {
|
||||
let domain = this.getMainDomain();
|
||||
domain = domain.replaceAll(".", "_").replaceAll("*", "_");
|
||||
const timeStr = dayjs(applyTime).format("YYYYMMDDHHmmss");
|
||||
return `${prefix}_${domain}_${timeStr}.${suffix}`;
|
||||
}
|
||||
|
||||
buildCertName(prefix: string = "") {
|
||||
let domain = this.getMainDomain();
|
||||
domain = domain.replaceAll(".", "_").replaceAll("*", "_");
|
||||
return `${prefix}_${domain}_${dayjs().format("YYYYMMDDHHmmssSSS")}`;
|
||||
}
|
||||
|
||||
static appendTimeSuffix(name?: string) {
|
||||
if (name == null) {
|
||||
name = "certd";
|
||||
}
|
||||
return name + "_" + dayjs().format("YYYYMMDDHHmmssSSS");
|
||||
}
|
||||
|
||||
static buildCertName(cert: any) {
|
||||
return new CertReader(cert).buildCertName();
|
||||
}
|
||||
}
|
||||
@@ -1,150 +0,0 @@
|
||||
import { ILogger, sp } from "@certd/basic";
|
||||
import type { CertInfo } from "../cert-plugin/acme.js";
|
||||
import { CertReader, CertReaderHandleContext } from "../cert-plugin/cert-reader.js";
|
||||
import path from "path";
|
||||
import os from "os";
|
||||
import fs from "fs";
|
||||
|
||||
export { CertReader };
|
||||
export type { CertInfo };
|
||||
|
||||
export class CertConverter {
|
||||
logger: ILogger;
|
||||
|
||||
constructor(opts: { logger: ILogger }) {
|
||||
this.logger = opts.logger;
|
||||
}
|
||||
async convert(opts: { cert: CertInfo; pfxPassword: string; pfxArgs: string }): Promise<{
|
||||
pfx: string;
|
||||
der: string;
|
||||
jks: string;
|
||||
p7b: string;
|
||||
}> {
|
||||
const certReader = new CertReader(opts.cert);
|
||||
let pfx: string;
|
||||
let der: string;
|
||||
let jks: string;
|
||||
let p7b: string;
|
||||
const handle = async (ctx: CertReaderHandleContext) => {
|
||||
// 调用openssl 转pfx
|
||||
pfx = await this.convertPfx(ctx, opts.pfxPassword, opts.pfxArgs);
|
||||
|
||||
// 转der
|
||||
der = await this.convertDer(ctx);
|
||||
|
||||
jks = await this.convertJks(ctx, opts.pfxPassword);
|
||||
|
||||
p7b = await this.convertP7b(ctx);
|
||||
};
|
||||
|
||||
await certReader.readCertFile({ logger: this.logger, handle });
|
||||
|
||||
return {
|
||||
pfx,
|
||||
der,
|
||||
jks,
|
||||
p7b,
|
||||
};
|
||||
}
|
||||
|
||||
async exec(cmd: string) {
|
||||
process.env.LANG = "zh_CN.GBK";
|
||||
await sp.spawn({
|
||||
cmd: cmd,
|
||||
logger: this.logger,
|
||||
});
|
||||
}
|
||||
|
||||
private async convertPfx(opts: CertReaderHandleContext, pfxPassword: string, pfxArgs: string) {
|
||||
const { tmpCrtPath, tmpKeyPath } = opts;
|
||||
|
||||
const pfxPath = path.join(os.tmpdir(), "/certd/tmp/", Math.floor(Math.random() * 1000000) + "_cert.pfx");
|
||||
|
||||
const dir = path.dirname(pfxPath);
|
||||
if (!fs.existsSync(dir)) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
|
||||
let passwordArg = "-passout pass:";
|
||||
if (pfxPassword) {
|
||||
passwordArg = `-password pass:${pfxPassword}`;
|
||||
}
|
||||
// 兼容server 2016，旧版本不能用sha256
|
||||
const oldPfxCmd = `openssl pkcs12 ${pfxArgs} -export -out ${pfxPath} -inkey ${tmpKeyPath} -in ${tmpCrtPath} ${passwordArg}`;
|
||||
// const newPfx = `openssl pkcs12 -export -out ${pfxPath} -inkey ${tmpKeyPath} -in ${tmpCrtPath} ${passwordArg}`;
|
||||
await this.exec(oldPfxCmd);
|
||||
const fileBuffer = fs.readFileSync(pfxPath);
|
||||
const pfxCert = fileBuffer.toString("base64");
|
||||
fs.unlinkSync(pfxPath);
|
||||
return pfxCert;
|
||||
|
||||
//
|
||||
// const applyTime = new Date().getTime();
|
||||
// const filename = reader.buildCertFileName("pfx", applyTime);
|
||||
// this.saveFile(filename, fileBuffer);
|
||||
}
|
||||
|
||||
private async convertDer(opts: CertReaderHandleContext) {
|
||||
const { tmpCrtPath } = opts;
|
||||
const derPath = path.join(os.tmpdir(), "/certd/tmp/", Math.floor(Math.random() * 1000000) + `_cert.der`);
|
||||
|
||||
const dir = path.dirname(derPath);
|
||||
if (!fs.existsSync(dir)) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
|
||||
await this.exec(`openssl x509 -outform der -in ${tmpCrtPath} -out ${derPath}`);
|
||||
const fileBuffer = fs.readFileSync(derPath);
|
||||
const derCert = fileBuffer.toString("base64");
|
||||
fs.unlinkSync(derPath);
|
||||
return derCert;
|
||||
}
|
||||
|
||||
async convertP7b(opts: CertReaderHandleContext) {
|
||||
const { tmpCrtPath } = opts;
|
||||
const p7bPath = path.join(os.tmpdir(), "/certd/tmp/", Math.floor(Math.random() * 1000000) + `_cert.p7b`);
|
||||
const dir = path.dirname(p7bPath);
|
||||
if (!fs.existsSync(dir)) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
//openssl crl2pkcs7 -nocrl \
|
||||
// -certfile your_domain.crt \
|
||||
// -certfile intermediate.crt \
|
||||
// -out chain.p7b
|
||||
await this.exec(`openssl crl2pkcs7 -nocrl -certfile ${tmpCrtPath} -out ${p7bPath}`);
|
||||
const fileBuffer = fs.readFileSync(p7bPath);
|
||||
const p7bCert = fileBuffer.toString();
|
||||
fs.unlinkSync(p7bPath);
|
||||
return p7bCert;
|
||||
}
|
||||
async convertJks(opts: CertReaderHandleContext, pfxPassword = "") {
|
||||
const jksPassword = pfxPassword || "123456";
|
||||
try {
|
||||
const randomStr = Math.floor(Math.random() * 1000000) + "";
|
||||
|
||||
const p12Path = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_cert.p12`);
|
||||
const { tmpCrtPath, tmpKeyPath } = opts;
|
||||
let passwordArg = "-passout pass:";
|
||||
if (jksPassword) {
|
||||
passwordArg = `-password pass:${jksPassword}`;
|
||||
}
|
||||
await this.exec(`openssl pkcs12 -export -in ${tmpCrtPath} -inkey ${tmpKeyPath} -out ${p12Path} -name certd ${passwordArg}`);
|
||||
|
||||
const jksPath = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_cert.jks`);
|
||||
const dir = path.dirname(jksPath);
|
||||
if (!fs.existsSync(dir)) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
await this.exec(`keytool -importkeystore -srckeystore ${p12Path} -srcstoretype PKCS12 -srcstorepass "${jksPassword}" -destkeystore ${jksPath} -deststoretype PKCS12 -deststorepass "${jksPassword}" `);
|
||||
fs.unlinkSync(p12Path);
|
||||
|
||||
const fileBuffer = fs.readFileSync(jksPath);
|
||||
const certBase64 = fileBuffer.toString("base64");
|
||||
fs.unlinkSync(jksPath);
|
||||
return certBase64;
|
||||
} catch (e) {
|
||||
this.logger.error("转换jks失败", e);
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,193 +0,0 @@
|
||||
import { IsTaskPlugin, pluginGroups, RunStrategy, Step, TaskInput, TaskOutput } from "@certd/pipeline";
|
||||
import type { CertInfo } from "../acme.js";
|
||||
import { CertReader } from "../cert-reader.js";
|
||||
import { CertApplyBaseConvertPlugin } from "../base-convert.js";
|
||||
import dayjs from "dayjs";
|
||||
|
||||
export { CertReader };
|
||||
export type { CertInfo };
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: "CertApplyUpload",
|
||||
icon: "ph:certificate",
|
||||
title: "商用证书托管",
|
||||
group: pluginGroups.cert.key,
|
||||
desc: "手动上传自定义证书后，自动部署（每次证书有更新，都需要手动上传一次）",
|
||||
default: {
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.AlwaysRun,
|
||||
},
|
||||
},
|
||||
shortcut: {
|
||||
certUpdate: {
|
||||
title: "更新证书",
|
||||
icon: "ion:upload",
|
||||
action: "onCertUpdate",
|
||||
form: {
|
||||
columns: {
|
||||
crt: {
|
||||
title: "证书",
|
||||
type: "text",
|
||||
form: {
|
||||
component: {
|
||||
name: "pem-input",
|
||||
vModel: "modelValue",
|
||||
textarea: {
|
||||
rows: 4,
|
||||
placeholder: "-----BEGIN CERTIFICATE-----\n...\n...\n-----END CERTIFICATE-----",
|
||||
},
|
||||
},
|
||||
rules: [{ required: true, message: "此项必填" }],
|
||||
col: { span: 24 },
|
||||
},
|
||||
},
|
||||
key: {
|
||||
title: "私钥",
|
||||
type: "text",
|
||||
form: {
|
||||
component: {
|
||||
name: "pem-input",
|
||||
vModel: "modelValue",
|
||||
textarea: {
|
||||
rows: 4,
|
||||
placeholder: "-----BEGIN PRIVATE KEY-----\n...\n...\n-----END PRIVATE KEY----- ",
|
||||
},
|
||||
},
|
||||
rules: [{ required: true, message: "此项必填" }],
|
||||
col: { span: 24 },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
export class CertApplyUploadPlugin extends CertApplyBaseConvertPlugin {
|
||||
@TaskInput({
|
||||
title: "过期前提醒",
|
||||
value: 10,
|
||||
component: {
|
||||
name: "a-input-number",
|
||||
vModel: "value",
|
||||
},
|
||||
required: true,
|
||||
order: 100,
|
||||
helper: "到期前多少天提醒",
|
||||
})
|
||||
renewDays!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "手动上传证书",
|
||||
component: {
|
||||
name: "cert-info-updater",
|
||||
vModel: "modelValue",
|
||||
},
|
||||
helper: "手动上传证书",
|
||||
order: -9999,
|
||||
required: true,
|
||||
mergeScript: `
|
||||
return {
|
||||
component:{
|
||||
on:{
|
||||
updated(scope){
|
||||
scope.form.input.domains = scope.$event?.domains
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
`,
|
||||
})
|
||||
uploadCert!: CertInfo;
|
||||
|
||||
@TaskOutput({
|
||||
title: "证书MD5",
|
||||
type: "certMd5",
|
||||
})
|
||||
certMd5?: string;
|
||||
|
||||
async onInstance() {
|
||||
this.accessService = this.ctx.accessService;
|
||||
this.logger = this.ctx.logger;
|
||||
this.userContext = this.ctx.userContext;
|
||||
this.lastStatus = this.ctx.lastStatus as Step;
|
||||
}
|
||||
|
||||
async onInit(): Promise<void> {}
|
||||
|
||||
async getCertFromStore() {
|
||||
let certReader = null;
|
||||
try {
|
||||
this.logger.info("读取上次证书");
|
||||
certReader = await this.readLastCert();
|
||||
} catch (e) {
|
||||
this.logger.warn("读取cert失败：", e);
|
||||
}
|
||||
return certReader;
|
||||
}
|
||||
|
||||
private checkExpires(certReader: CertReader) {
|
||||
const renewDays = (this.renewDays ?? 10) * 24 * 60 * 60 * 1000;
|
||||
if (certReader.expires) {
|
||||
if (certReader.expires < new Date().getTime()) {
|
||||
throw new Error("证书已过期，停止部署，请尽快上传新证书");
|
||||
}
|
||||
if (certReader.expires < new Date().getTime() + renewDays) {
|
||||
throw new Error("证书即将已过期，停止部署，请尽快上传新证书");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async execute(): Promise<string | void> {
|
||||
const oldCertReader = await this.getCertFromStore();
|
||||
if (oldCertReader) {
|
||||
const leftDays = dayjs(oldCertReader.expires).diff(dayjs(), "day");
|
||||
this.logger.info(`证书过期时间${dayjs(oldCertReader.expires).format("YYYY-MM-DD HH:mm:ss")},剩余${leftDays}天`);
|
||||
this.checkExpires(oldCertReader);
|
||||
if (!this.ctx.inputChanged) {
|
||||
this.logger.info("输入参数无变化");
|
||||
const lastCrtMd5 = this.lastStatus?.status?.output?.certMd5;
|
||||
const newCrtMd5 = this.ctx.utils.hash.md5(this.uploadCert.crt);
|
||||
this.logger.info("证书MD5", newCrtMd5);
|
||||
this.logger.info("上次证书MD5", lastCrtMd5);
|
||||
if (lastCrtMd5 === newCrtMd5) {
|
||||
this.logger.info("证书无变化，跳过");
|
||||
//输出证书MD5
|
||||
this.certMd5 = newCrtMd5;
|
||||
await this.output(oldCertReader, false);
|
||||
return "skip";
|
||||
}
|
||||
this.logger.info("证书有变化，重新部署");
|
||||
} else {
|
||||
this.logger.info("输入参数有变化，重新部署");
|
||||
}
|
||||
}
|
||||
|
||||
const newCertReader = new CertReader(this.uploadCert);
|
||||
this.clearLastStatus();
|
||||
//输出证书MD5
|
||||
this.certMd5 = this.ctx.utils.hash.md5(newCertReader.cert.crt);
|
||||
const newLeftDays = dayjs(newCertReader.expires).diff(dayjs(), "day");
|
||||
this.logger.info(`新证书过期时间${dayjs(newCertReader.expires).format("YYYY-MM-DD HH:mm:ss")},剩余${newLeftDays}天`);
|
||||
this.checkExpires(newCertReader);
|
||||
await this.output(newCertReader, true);
|
||||
|
||||
//必须output之后执行
|
||||
await this.emitCertApplySuccess();
|
||||
return;
|
||||
}
|
||||
|
||||
async onCertUpdate(data: any) {
|
||||
const certReader = new CertReader(data);
|
||||
return {
|
||||
input: {
|
||||
uploadCert: {
|
||||
crt: data.crt,
|
||||
key: data.key,
|
||||
},
|
||||
domains: certReader.getAllDomains(),
|
||||
},
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
new CertApplyUploadPlugin();
|
||||
@@ -1,165 +0,0 @@
|
||||
import { IsTaskPlugin, PageSearch, pluginGroups, RunStrategy, TaskInput } from "@certd/pipeline";
|
||||
import { AliyunAccess, createRemoteSelectInputDefine } from "@certd/plugin-lib";
|
||||
import type { CertInfo } from "../acme.js";
|
||||
import { CertApplyBasePlugin } from "../base.js";
|
||||
import { CertReader } from "../cert-reader.js";
|
||||
import dayjs from "dayjs";
|
||||
|
||||
export { CertReader };
|
||||
export type { CertInfo };
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: "CertApplyGetFormAliyun",
|
||||
icon: "ph:certificate",
|
||||
title: "获取阿里云订阅证书",
|
||||
group: pluginGroups.cert.key,
|
||||
desc: "从阿里云拉取订阅模式的商用证书",
|
||||
default: {
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.AlwaysRun,
|
||||
},
|
||||
},
|
||||
})
|
||||
export class CertApplyGetFormAliyunPlugin extends CertApplyBasePlugin {
|
||||
@TaskInput({
|
||||
title: "Access授权",
|
||||
helper: "阿里云授权AccessKeyId、AccessKeySecret",
|
||||
component: {
|
||||
name: "access-selector",
|
||||
type: "aliyun",
|
||||
},
|
||||
required: true,
|
||||
})
|
||||
accessId!: string;
|
||||
|
||||
@TaskInput(
|
||||
createRemoteSelectInputDefine({
|
||||
title: "证书订单ID",
|
||||
helper: "订阅模式的证书订单Id",
|
||||
typeName: "CertApplyGetFormAliyun",
|
||||
component: {
|
||||
name: "RemoteAutoComplete",
|
||||
vModel: "value",
|
||||
},
|
||||
action: CertApplyGetFormAliyunPlugin.prototype.onGetOrderList.name,
|
||||
})
|
||||
)
|
||||
orderId!: string;
|
||||
|
||||
async onInit(): Promise<void> {}
|
||||
|
||||
async doCertApply(): Promise<CertReader> {
|
||||
const access = await this.getAccess<AliyunAccess>(this.accessId);
|
||||
const client = await access.getClient("cas.aliyuncs.com");
|
||||
this.logger.info(`开始获取证书,orderId:${this.orderId}`);
|
||||
let orderId: any = this.orderId;
|
||||
if (!orderId) {
|
||||
throw new Error("请先输入证书订单ID");
|
||||
}
|
||||
if (typeof orderId !== "string") {
|
||||
orderId = parseInt(orderId);
|
||||
}
|
||||
const certState = await this.getCertificateState(client, orderId);
|
||||
this.logger.info(`获取到证书Id:${JSON.stringify(certState.CertId)}`);
|
||||
const certDetail = await this.getCertDetail(client, certState.CertId);
|
||||
this.logger.info(`获取到证书:${certDetail.getAllDomains()}, 过期时间：${dayjs(certDetail.expires).format("YYYY-MM-DD HH:mm:ss")}`);
|
||||
return certDetail;
|
||||
}
|
||||
|
||||
async getCertDetail(client: any, certId: any) {
|
||||
const res = await client.doRequest({
|
||||
// 接口名称
|
||||
// 接口名称
|
||||
action: "GetUserCertificateDetail",
|
||||
// 接口版本
|
||||
version: "2020-04-07",
|
||||
// 接口协议
|
||||
protocol: "HTTPS",
|
||||
// 接口 HTTP 方法
|
||||
method: "POST",
|
||||
authType: "AK",
|
||||
style: "RPC",
|
||||
// 接口 PATH
|
||||
pathname: `/`,
|
||||
data: {
|
||||
query: {
|
||||
CertId: certId,
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
const crt = res.Cert;
|
||||
const key = res.Key;
|
||||
|
||||
return new CertReader({
|
||||
crt,
|
||||
key,
|
||||
csr: "",
|
||||
});
|
||||
}
|
||||
|
||||
async getCertificateState(client: any, orderId: any): Promise<{ CertId: string; Type: string; Domain: string }> {
|
||||
const res = await client.doRequest({
|
||||
// 接口名称
|
||||
action: "DescribeCertificateState",
|
||||
// 接口版本
|
||||
version: "2020-04-07",
|
||||
// 接口协议
|
||||
protocol: "HTTPS",
|
||||
// 接口 HTTP 方法
|
||||
method: "POST",
|
||||
authType: "AK",
|
||||
style: "RPC",
|
||||
// 接口 PATH
|
||||
pathname: `/`,
|
||||
data: {
|
||||
query: {
|
||||
OrderId: orderId,
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
return res;
|
||||
}
|
||||
|
||||
async onGetOrderList(req: PageSearch) {
|
||||
if (!this.accessId) {
|
||||
throw new Error("请先选择Access授权");
|
||||
}
|
||||
const access = await this.getAccess<AliyunAccess>(this.accessId);
|
||||
|
||||
const client = await access.getClient("cas.aliyuncs.com");
|
||||
|
||||
const res = await client.doRequest({
|
||||
// 接口名称
|
||||
action: "ListUserCertificateOrder",
|
||||
// 接口版本
|
||||
version: "2020-04-07",
|
||||
method: "POST",
|
||||
authType: "AK",
|
||||
style: "RPC",
|
||||
// 接口 PATH
|
||||
pathname: `/`,
|
||||
data: {
|
||||
query: {
|
||||
Status: "ISSUED",
|
||||
},
|
||||
},
|
||||
});
|
||||
const list = res?.CertificateOrderList || [];
|
||||
if (!list || list.length === 0) {
|
||||
throw new Error("没有找到已签发的证书订单");
|
||||
}
|
||||
|
||||
return list.map((item: any) => {
|
||||
const label = `${item.Domain}<${item.OrderId}>`;
|
||||
return {
|
||||
label: label,
|
||||
value: item.OrderId,
|
||||
Domain: item.Domain,
|
||||
};
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
new CertApplyGetFormAliyunPlugin();
|
||||
@@ -1,670 +0,0 @@
|
||||
import { CancelError, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput } from "@certd/pipeline";
|
||||
import { utils } from "@certd/basic";
|
||||
|
||||
import { AcmeService, CertInfo, DomainsVerifyPlan, DomainVerifyPlan, PrivateKeyType, SSLProvider } from "./acme.js";
|
||||
import * as _ from "lodash-es";
|
||||
import { createDnsProvider, DnsProviderContext, DnsVerifier, DomainVerifiers, HttpVerifier, IDnsProvider, IDomainVerifierGetter, ISubDomainsGetter } from "../../dns-provider/index.js";
|
||||
import { CertReader } from "./cert-reader.js";
|
||||
import { CertApplyBasePlugin } from "./base.js";
|
||||
import { GoogleClient } from "../../libs/google.js";
|
||||
import { EabAccess } from "../../access";
|
||||
import { DomainParser } from "../../dns-provider/domain-parser.js";
|
||||
import { ossClientFactory } from "@certd/plugin-lib";
|
||||
|
||||
export * from "./base.js";
|
||||
export type { CertInfo };
|
||||
export * from "./cert-reader.js";
|
||||
export type CnameRecordInput = {
|
||||
id: number;
|
||||
status: string;
|
||||
};
|
||||
|
||||
export type HttpRecordInput = {
|
||||
domain: string;
|
||||
httpUploaderType: string;
|
||||
httpUploaderAccess: number;
|
||||
httpUploadRootDir: string;
|
||||
};
|
||||
export type DomainVerifyPlanInput = {
|
||||
domain: string;
|
||||
type: "cname" | "dns" | "http";
|
||||
dnsProviderType?: string;
|
||||
dnsProviderAccessType?: string;
|
||||
dnsProviderAccessId?: number;
|
||||
cnameVerifyPlan?: Record<string, CnameRecordInput>;
|
||||
httpVerifyPlan?: Record<string, HttpRecordInput>;
|
||||
};
|
||||
export type DomainsVerifyPlanInput = {
|
||||
[key: string]: DomainVerifyPlanInput;
|
||||
};
|
||||
|
||||
const preferredChainConfigs = {
|
||||
letsencrypt: {
|
||||
helper: "如无特殊需求保持默认即可",
|
||||
options: [
|
||||
{ value: "ISRG Root X1", label: "ISRG Root X1" },
|
||||
{ value: "ISRG Root X2", label: "ISRG Root X2" },
|
||||
],
|
||||
},
|
||||
google: {
|
||||
helper: "GlobalSign 提供对老旧设备更好的兼容性，但证书链会变长",
|
||||
options: [
|
||||
{ value: "GTS Root R1", label: "GTS Root R1" },
|
||||
{ value: "GlobalSign", label: "GlobalSign" },
|
||||
],
|
||||
},
|
||||
} as const;
|
||||
|
||||
const preferredChainSupportedProviders = Object.keys(preferredChainConfigs);
|
||||
|
||||
const preferredChainMergeScript = (() => {
|
||||
const configs = JSON.stringify(preferredChainConfigs);
|
||||
const supportedProviders = JSON.stringify(preferredChainSupportedProviders);
|
||||
const defaultProvider = JSON.stringify(preferredChainSupportedProviders[0]);
|
||||
return `
|
||||
const chainConfigs = ${configs};
|
||||
const supportedProviders = ${supportedProviders};
|
||||
const defaultProvider = ${defaultProvider};
|
||||
const getConfig = (provider)=> chainConfigs[provider] || chainConfigs[defaultProvider];
|
||||
return {
|
||||
show: ctx.compute(({form})=> supportedProviders.includes(form.sslProvider)),
|
||||
component: {
|
||||
options: ctx.compute(({form})=> getConfig(form.sslProvider).options)
|
||||
},
|
||||
helper: ctx.compute(({form})=> getConfig(form.sslProvider).helper),
|
||||
value: ctx.compute(({form})=>{
|
||||
const { options } = getConfig(form.sslProvider);
|
||||
const allowed = options.map(item=>item.value);
|
||||
const current = form.preferredChain;
|
||||
if(allowed.includes(current)){
|
||||
return current;
|
||||
}
|
||||
return allowed[0];
|
||||
})
|
||||
};
|
||||
`;
|
||||
})();
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: "CertApply",
|
||||
title: "证书申请（JS版）",
|
||||
icon: "ph:certificate",
|
||||
group: pluginGroups.cert.key,
|
||||
desc: "免费通配符域名证书申请，支持多个域名打到同一个证书上",
|
||||
default: {
|
||||
input: {
|
||||
renewDays: 18,
|
||||
forceUpdate: false,
|
||||
},
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.AlwaysRun,
|
||||
},
|
||||
},
|
||||
})
|
||||
export class CertApplyPlugin extends CertApplyBasePlugin {
|
||||
@TaskInput({
|
||||
title: "域名验证方式",
|
||||
value: "dns",
|
||||
component: {
|
||||
name: "a-select",
|
||||
vModel: "value",
|
||||
options: [
|
||||
{ value: "dns", label: "DNS直接验证" },
|
||||
{ value: "cname", label: "CNAME代理验证" },
|
||||
{ value: "http", label: "HTTP文件验证（IP证书只能选它）" },
|
||||
{ value: "dnses", label: "多DNS提供商" },
|
||||
{ value: "auto", label: "自动匹配" },
|
||||
],
|
||||
},
|
||||
required: true,
|
||||
helper: `1. <b>DNS直接验证</b>：当域名dns解析已被本系统支持时（即下方DNS解析服务商选项中可选），推荐选择此方式
|
||||
2. <b>CNAME代理验证</b>：支持任何注册商的域名，第一次需要手动添加[CNAME记录](#/certd/cname/record)（如果经常申请失败，建议将DNS服务器修改为阿里云/腾讯云的，然后使用DNS直接验证）
|
||||
3. <b>HTTP文件验证</b>：不支持泛域名，需要配置网站文件上传（IP证书必须选它）
|
||||
4. <b>多DNS提供商</b>：每个域名可以选择独立的DNS提供商
|
||||
5. <b>自动匹配</b>：此处无需选择校验方式，需要在[域名管理](#/certd/cert/domain)中提前配置好校验方式
|
||||
`,
|
||||
})
|
||||
challengeType!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: "证书颁发机构",
|
||||
value: "letsencrypt",
|
||||
component: {
|
||||
name: "icon-select",
|
||||
vModel: "value",
|
||||
options: [
|
||||
{ value: "letsencrypt", label: "Let's Encrypt（免费，新手推荐，支持IP证书）", icon: "simple-icons:letsencrypt" },
|
||||
{ value: "google", label: "Google（免费）", icon: "flat-color-icons:google" },
|
||||
{ value: "zerossl", label: "ZeroSSL（免费）", icon: "emojione:digit-zero" },
|
||||
{ value: "litessl", label: "litessl（免费）", icon: "roentgen:free" },
|
||||
{ value: "sslcom", label: "SSL.com（仅主域名和www免费）", icon: "la:expeditedssl" },
|
||||
{ value: "letsencrypt_staging", label: "Let's Encrypt测试环境（仅供测试）", icon: "simple-icons:letsencrypt" },
|
||||
],
|
||||
},
|
||||
helper: "Let's Encrypt：申请最简单\nGoogle：大厂光环，兼容性好，仅首次需要翻墙获取EAB授权\nZeroSSL：需要EAB授权，无需翻墙\nSSL.com：仅主域名和www免费,必须设置CAA记录",
|
||||
required: true,
|
||||
})
|
||||
sslProvider!: SSLProvider;
|
||||
|
||||
@TaskInput({
|
||||
title: "DNS解析服务商",
|
||||
component: {
|
||||
name: "dns-provider-selector",
|
||||
},
|
||||
mergeScript: `
|
||||
return {
|
||||
show: ctx.compute(({form})=>{
|
||||
return form.challengeType === 'dns'
|
||||
}),
|
||||
component:{
|
||||
onSelectedChange: ctx.compute(({form})=>{
|
||||
return ($event)=>{
|
||||
form.dnsProviderAccessType = $event.accessType
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
`,
|
||||
required: true,
|
||||
helper: "您的域名注册商，或者域名的dns服务器属于哪个平台\n如果这里没有，请选择CNAME代理验证校验方式",
|
||||
})
|
||||
dnsProviderType!: string;
|
||||
|
||||
// dns解析授权类型,勿删
|
||||
dnsProviderAccessType!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: "DNS解析授权",
|
||||
component: {
|
||||
name: "access-selector",
|
||||
},
|
||||
required: true,
|
||||
helper: "请选择dns解析服务商授权",
|
||||
mergeScript: `return {
|
||||
component:{
|
||||
type: ctx.compute(({form})=>{
|
||||
return form.dnsProviderAccessType || form.dnsProviderType
|
||||
})
|
||||
},
|
||||
show: ctx.compute(({form})=>{
|
||||
return form.challengeType === 'dns'
|
||||
})
|
||||
}
|
||||
`,
|
||||
})
|
||||
dnsProviderAccess!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "域名验证配置",
|
||||
component: {
|
||||
name: "domains-verify-plan-editor",
|
||||
},
|
||||
rules: [{ type: "checkDomainVerifyPlan" }],
|
||||
required: true,
|
||||
col: {
|
||||
span: 24,
|
||||
},
|
||||
mergeScript: `return {
|
||||
component:{
|
||||
domains: ctx.compute(({form})=>{
|
||||
return form.domains
|
||||
}),
|
||||
defaultType: ctx.compute(({form})=>{
|
||||
return form.challengeType || 'cname'
|
||||
})
|
||||
},
|
||||
show: ctx.compute(({form})=>{
|
||||
return form.challengeType === 'cname' || form.challengeType === 'http' || form.challengeType === 'dnses'
|
||||
}),
|
||||
helper: ctx.compute(({form})=>{
|
||||
if(form.challengeType === 'cname' ){
|
||||
return '请按照上面的提示，给要申请证书的域名添加CNAME记录，添加后，点击验证，验证成功后不要删除记录，申请和续期证书会一直用它'
|
||||
}else if (form.challengeType === 'http'){
|
||||
return '请按照上面的提示，给每个域名设置文件上传配置，证书申请过程中会上传校验文件到网站根目录的.well-known/acme-challenge/目录下'
|
||||
}else if (form.challengeType === 'http'){
|
||||
return '给每个域名单独配置dns提供商'
|
||||
}
|
||||
})
|
||||
}
|
||||
`,
|
||||
})
|
||||
domainsVerifyPlan!: DomainsVerifyPlanInput;
|
||||
|
||||
@TaskInput({
|
||||
title: "Google公共EAB授权",
|
||||
isSys: true,
|
||||
show: false,
|
||||
})
|
||||
googleCommonEabAccessId!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "ZeroSSL公共EAB授权",
|
||||
isSys: true,
|
||||
show: false,
|
||||
})
|
||||
zerosslCommonEabAccessId!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "SSL.com公共EAB授权",
|
||||
isSys: true,
|
||||
show: false,
|
||||
})
|
||||
sslcomCommonEabAccessId!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "litessl公共EAB授权",
|
||||
isSys: true,
|
||||
show: false,
|
||||
})
|
||||
litesslCommonEabAccessId!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "EAB授权",
|
||||
component: {
|
||||
name: "access-selector",
|
||||
type: "eab",
|
||||
},
|
||||
maybeNeed: true,
|
||||
required: false,
|
||||
helper:
|
||||
"需要提供EAB授权" +
|
||||
"\nZeroSSL：请前往[zerossl开发者中心](https://app.zerossl.com/developer),生成 'EAB Credentials'" +
|
||||
"\nGoogle:请查看[google获取eab帮助文档](https://certd.docmirror.cn/guide/use/google/)，用过一次后会绑定邮箱，后续复用EAB要用同一个邮箱" +
|
||||
"\nSSL.com:[SSL.com账号页面](https://secure.ssl.com/account),然后点击api credentials链接，然后点击编辑按钮，查看Secret key和HMAC key" +
|
||||
"\nlitessl:[litesslEAB页面](https://freessl.cn/automation/eab-manager),然后点击新增EAB",
|
||||
mergeScript: `
|
||||
return {
|
||||
show: ctx.compute(({form})=>{
|
||||
return (form.sslProvider === 'zerossl' && !form.zerosslCommonEabAccessId)
|
||||
|| (form.sslProvider === 'google' && !form.googleCommonEabAccessId)
|
||||
|| (form.sslProvider === 'sslcom' && !form.sslcomCommonEabAccessId)
|
||||
|| (form.sslProvider === 'litessl' && !form.litesslCommonEabAccessId)
|
||||
})
|
||||
}
|
||||
`,
|
||||
})
|
||||
eabAccessId!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "服务账号授权",
|
||||
component: {
|
||||
name: "access-selector",
|
||||
type: "google",
|
||||
},
|
||||
maybeNeed: true,
|
||||
required: false,
|
||||
helper: "google服务账号授权与EAB授权选填其中一个，[服务账号授权获取方法](https://certd.docmirror.cn/guide/use/google/)\n服务账号授权需要配置代理或者服务器本身在海外",
|
||||
mergeScript: `
|
||||
return {
|
||||
show: ctx.compute(({form})=>{
|
||||
return form.sslProvider === 'google' && !form.googleCommonEabAccessId
|
||||
})
|
||||
}
|
||||
`,
|
||||
})
|
||||
googleAccessId!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "加密算法",
|
||||
value: "rsa_2048",
|
||||
component: {
|
||||
name: "a-select",
|
||||
vModel: "value",
|
||||
options: [
|
||||
{ value: "rsa_1024", label: "RSA 1024" },
|
||||
{ value: "rsa_2048", label: "RSA 2048" },
|
||||
{ value: "rsa_3072", label: "RSA 3072" },
|
||||
{ value: "rsa_4096", label: "RSA 4096" },
|
||||
{ value: "rsa_2048_pkcs1", label: "RSA 2048 pkcs1 (旧版)" },
|
||||
{ value: "ec_256", label: "EC 256" },
|
||||
{ value: "ec_384", label: "EC 384" },
|
||||
// { value: "ec_521", label: "EC 521" },
|
||||
],
|
||||
},
|
||||
helper: "如无特殊需求，默认即可\n选择RSA 2048 pkcs1可以获得旧版RSA证书",
|
||||
required: true,
|
||||
})
|
||||
privateKeyType!: PrivateKeyType;
|
||||
|
||||
@TaskInput({
|
||||
title: "证书配置",
|
||||
value: "classic",
|
||||
component: {
|
||||
name: "a-select",
|
||||
vModel: "value",
|
||||
options: [
|
||||
{ value: "classic", label: "经典（classic）" },
|
||||
{ value: "tlsserver", label: "TLS服务器（tlsserver）" },
|
||||
{ value: "shortlived", label: "短暂的（shortlived）" },
|
||||
],
|
||||
},
|
||||
helper: "如无特殊需求，默认即可",
|
||||
required: false,
|
||||
mergeScript: `
|
||||
return {
|
||||
show: ctx.compute(({form})=>{
|
||||
return form.sslProvider === 'letsencrypt'
|
||||
})
|
||||
}
|
||||
`,
|
||||
})
|
||||
certProfile!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: "首选链",
|
||||
component: {
|
||||
name: "a-select",
|
||||
vModel: "value",
|
||||
options: preferredChainConfigs.letsencrypt.options,
|
||||
},
|
||||
helper: preferredChainConfigs.letsencrypt.helper,
|
||||
required: false,
|
||||
mergeScript: preferredChainMergeScript,
|
||||
})
|
||||
preferredChain!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: "使用代理",
|
||||
value: false,
|
||||
component: {
|
||||
name: "a-switch",
|
||||
vModel: "checked",
|
||||
},
|
||||
helper: "如果acme-v02.api.letsencrypt.org或dv.acme-v02.api.pki.goog被墙无法访问，请尝试开启此选项\n默认情况会进行测试，如果无法访问，将会自动使用代理",
|
||||
})
|
||||
useProxy = false;
|
||||
|
||||
@TaskInput({
|
||||
title: "自定义反代地址",
|
||||
component: {
|
||||
placeholder: "google.yourproxy.com",
|
||||
},
|
||||
helper: "填写你的自定义反代地址，不要带http://\nletsencrypt反代目标：acme-v02.api.letsencrypt.org\ngoogle反代目标：dv.acme-v02.api.pki.goog",
|
||||
})
|
||||
reverseProxy = "";
|
||||
|
||||
@TaskInput({
|
||||
title: "跳过本地校验DNS",
|
||||
value: false,
|
||||
component: {
|
||||
name: "a-switch",
|
||||
vModel: "checked",
|
||||
},
|
||||
helper: "跳过本地校验可以加快申请速度，同时也会增加失败概率。",
|
||||
})
|
||||
skipLocalVerify = false;
|
||||
|
||||
@TaskInput({
|
||||
title: "检查解析重试次数",
|
||||
value: 20,
|
||||
component: {
|
||||
name: "a-input-number",
|
||||
vModel: "value",
|
||||
},
|
||||
helper: "检查域名验证解析记录重试次数，如果你的域名服务商解析生效速度慢，可以适当增加此值",
|
||||
})
|
||||
maxCheckRetryCount = 20;
|
||||
|
||||
@TaskInput({
|
||||
title: "等待解析生效时长",
|
||||
value: 30,
|
||||
component: {
|
||||
name: "a-input-number",
|
||||
vModel: "value",
|
||||
},
|
||||
helper: "等待解析生效时长（秒），如果使用CNAME方式校验，本地验证失败，可以尝试延长此时间（比如5-10分钟）",
|
||||
})
|
||||
waitDnsDiffuseTime = 30;
|
||||
|
||||
acme!: AcmeService;
|
||||
|
||||
eab!: EabAccess;
|
||||
|
||||
async onInit() {
|
||||
let eab: EabAccess = null;
|
||||
|
||||
if (this.sslProvider && !this.sslProvider.startsWith("letsencrypt")) {
|
||||
if (this.sslProvider === "google" && this.googleAccessId) {
|
||||
this.logger.info("当前正在使用 google服务账号授权获取EAB");
|
||||
const googleAccess = await this.getAccess(this.googleAccessId);
|
||||
const googleClient = new GoogleClient({
|
||||
access: googleAccess,
|
||||
logger: this.logger,
|
||||
});
|
||||
eab = await googleClient.getEab();
|
||||
} else {
|
||||
const getEab = async (type: string) => {
|
||||
if (this.eabAccessId) {
|
||||
this.logger.info(`当前正在使用 ${type} EAB授权`);
|
||||
eab = await this.getAccess(this.eabAccessId);
|
||||
} else if (this[`${type}CommonEabAccessId`]) {
|
||||
this.logger.info(`当前正在使用 ${type} 公共EAB授权`);
|
||||
eab = await this.getAccess(this[`${type}CommonEabAccessId`], true);
|
||||
} else {
|
||||
throw new Error(`${type}需要配置EAB授权`);
|
||||
}
|
||||
};
|
||||
await getEab(this.sslProvider);
|
||||
}
|
||||
}
|
||||
this.eab = eab;
|
||||
const subDomainsGetter = await this.ctx.serviceGetter.get<ISubDomainsGetter>("subDomainsGetter");
|
||||
const domainParser = new DomainParser(subDomainsGetter, this.logger);
|
||||
this.acme = new AcmeService({
|
||||
userId: this.ctx.user.id,
|
||||
userContext: this.userContext,
|
||||
logger: this.logger,
|
||||
sslProvider: this.sslProvider,
|
||||
eab,
|
||||
skipLocalVerify: this.skipLocalVerify,
|
||||
useMappingProxy: this.useProxy,
|
||||
reverseProxy: this.reverseProxy,
|
||||
privateKeyType: this.privateKeyType,
|
||||
signal: this.ctx.signal,
|
||||
maxCheckRetryCount: this.maxCheckRetryCount,
|
||||
domainParser,
|
||||
waitDnsDiffuseTime: this.waitDnsDiffuseTime,
|
||||
});
|
||||
}
|
||||
|
||||
async doCertApply() {
|
||||
let email = this.email;
|
||||
if (this.eab && this.eab.email) {
|
||||
email = this.eab.email;
|
||||
}
|
||||
const domains = this["domains"];
|
||||
|
||||
const csrInfo = _.merge(
|
||||
{
|
||||
// country: "CN",
|
||||
// state: "GuangDong",
|
||||
// locality: "ShengZhen",
|
||||
// organization: "CertD Org.",
|
||||
// organizationUnit: "IT Department",
|
||||
// emailAddress: email,
|
||||
},
|
||||
this.csrInfo ? JSON.parse(this.csrInfo) : {}
|
||||
);
|
||||
this.logger.info("开始申请证书,", email, domains);
|
||||
|
||||
let dnsProvider: IDnsProvider = null;
|
||||
let domainsVerifyPlan: DomainsVerifyPlan = null;
|
||||
if (this.challengeType === "cname" || this.challengeType === "http" || this.challengeType === "dnses") {
|
||||
domainsVerifyPlan = await this.createDomainsVerifyPlan(domains, this.domainsVerifyPlan);
|
||||
} else if (this.challengeType === "auto") {
|
||||
domainsVerifyPlan = await this.createDomainsVerifyPlanByAuto(domains);
|
||||
} else {
|
||||
const dnsProviderType = this.dnsProviderType;
|
||||
const access = await this.getAccess(this.dnsProviderAccess);
|
||||
dnsProvider = await this.createDnsProvider(dnsProviderType, access);
|
||||
}
|
||||
|
||||
try {
|
||||
const cert = await this.acme.order({
|
||||
email,
|
||||
domains,
|
||||
dnsProvider,
|
||||
domainsVerifyPlan,
|
||||
csrInfo,
|
||||
privateKeyType: this.privateKeyType,
|
||||
profile: this.certProfile,
|
||||
preferredChain: this.preferredChain,
|
||||
});
|
||||
|
||||
const certInfo = this.formatCerts(cert);
|
||||
return new CertReader(certInfo);
|
||||
} catch (e: any) {
|
||||
const message: string = e?.message;
|
||||
if (message != null && message.indexOf("redundant with a wildcard domain in the same request") >= 0) {
|
||||
this.logger.error(e);
|
||||
throw new Error(`通配符域名已经包含了普通域名，请删除其中一个（${message}）`);
|
||||
}
|
||||
if (e.name === "CancelError") {
|
||||
throw new CancelError(e.message);
|
||||
}
|
||||
throw e;
|
||||
}
|
||||
}
|
||||
|
||||
async createDnsProvider(dnsProviderType: string, dnsProviderAccess: any): Promise<IDnsProvider> {
|
||||
const domainParser = this.acme.options.domainParser;
|
||||
const context: DnsProviderContext = {
|
||||
access: dnsProviderAccess,
|
||||
logger: this.logger,
|
||||
http: this.ctx.http,
|
||||
utils,
|
||||
domainParser,
|
||||
serviceGetter: this.ctx.serviceGetter,
|
||||
};
|
||||
return await createDnsProvider({
|
||||
dnsProviderType,
|
||||
context,
|
||||
});
|
||||
}
|
||||
|
||||
async createDomainsVerifyPlan(domains: string[], verifyPlanSetting: DomainsVerifyPlanInput): Promise<DomainsVerifyPlan> {
|
||||
const plan: DomainsVerifyPlan = {};
|
||||
|
||||
const domainParser = this.acme.options.domainParser;
|
||||
for (const fullDomain of domains) {
|
||||
const domain = fullDomain.replaceAll("*.", "");
|
||||
const mainDomain = await domainParser.parse(domain);
|
||||
const planSetting: DomainVerifyPlanInput = verifyPlanSetting[mainDomain];
|
||||
if (planSetting == null) {
|
||||
throw new Error(`没有找到域名（${domain}）的校验计划（如果您在流水线创建之后设置了子域名托管，需要重新编辑证书申请任务和重新校验cname记录的校验状态）`);
|
||||
}
|
||||
if (planSetting.type === "dns") {
|
||||
plan[domain] = await this.createDnsDomainVerifyPlan(planSetting, domain, mainDomain);
|
||||
} else if (planSetting.type === "cname") {
|
||||
plan[domain] = await this.createCnameDomainVerifyPlan(domain, mainDomain);
|
||||
} else if (planSetting.type === "http") {
|
||||
plan[domain] = await this.createHttpDomainVerifyPlan(planSetting.httpVerifyPlan[domain], domain, mainDomain);
|
||||
}
|
||||
}
|
||||
return plan;
|
||||
}
|
||||
|
||||
private async createDomainsVerifyPlanByAuto(domains: string[]) {
|
||||
//从数据库里面自动选择校验方式
|
||||
// domain list
|
||||
const domainList = new Set<string>();
|
||||
//整理域名
|
||||
for (let domain of domains) {
|
||||
domain = domain.replaceAll("*.", "");
|
||||
domainList.add(domain);
|
||||
}
|
||||
const domainVerifierGetter: IDomainVerifierGetter = await this.ctx.serviceGetter.get("domainVerifierGetter");
|
||||
|
||||
const verifiers: DomainVerifiers = await domainVerifierGetter.getVerifiers([...domainList]);
|
||||
|
||||
const plan: DomainsVerifyPlan = {};
|
||||
|
||||
for (const domain in verifiers) {
|
||||
const verifier = verifiers[domain];
|
||||
if (verifier == null) {
|
||||
throw new Error(`没有找到与该域名（${domain}）匹配的校验方式，请先到‘域名管理’页面添加校验方式`);
|
||||
}
|
||||
if (verifier.type === "dns") {
|
||||
plan[domain] = await this.createDnsDomainVerifyPlan(verifier.dns, domain, verifier.mainDomain);
|
||||
} else if (verifier.type === "cname") {
|
||||
plan[domain] = await this.createCnameDomainVerifyPlan(domain, verifier.mainDomain);
|
||||
} else if (verifier.type === "http") {
|
||||
plan[domain] = await this.createHttpDomainVerifyPlan(verifier.http, domain, verifier.mainDomain);
|
||||
}
|
||||
}
|
||||
return plan;
|
||||
}
|
||||
|
||||
private async createDnsDomainVerifyPlan(planSetting: DnsVerifier, domain: string, mainDomain: string): Promise<DomainVerifyPlan> {
|
||||
const access = await this.getAccess(planSetting.dnsProviderAccessId);
|
||||
return {
|
||||
type: "dns",
|
||||
mainDomain,
|
||||
domain,
|
||||
dnsProvider: await this.createDnsProvider(planSetting.dnsProviderType, access),
|
||||
};
|
||||
}
|
||||
|
||||
private async createHttpDomainVerifyPlan(httpSetting: HttpVerifier, domain: string, mainDomain: string): Promise<DomainVerifyPlan> {
|
||||
const httpUploaderContext = {
|
||||
accessService: this.ctx.accessService,
|
||||
logger: this.logger,
|
||||
utils,
|
||||
};
|
||||
|
||||
const access = await this.getAccess(httpSetting.httpUploaderAccess);
|
||||
let rootDir = httpSetting.httpUploadRootDir;
|
||||
if (!rootDir.endsWith("/") && !rootDir.endsWith("\\")) {
|
||||
rootDir = rootDir + "/";
|
||||
}
|
||||
this.logger.info("上传方式", httpSetting.httpUploaderType);
|
||||
const httpUploader = await ossClientFactory.createOssClientByType(httpSetting.httpUploaderType, {
|
||||
access,
|
||||
rootDir: rootDir,
|
||||
ctx: httpUploaderContext,
|
||||
});
|
||||
return {
|
||||
type: "http",
|
||||
domain,
|
||||
mainDomain,
|
||||
httpVerifyPlan: {
|
||||
type: "http",
|
||||
domain,
|
||||
httpUploader,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
private async createCnameDomainVerifyPlan(domain: string, mainDomain: string): Promise<DomainVerifyPlan> {
|
||||
const cnameRecord = await this.ctx.cnameProxyService.getByDomain(domain);
|
||||
if (cnameRecord == null) {
|
||||
throw new Error(`请先配置${domain}的CNAME记录，并通过校验`);
|
||||
}
|
||||
if (cnameRecord.status !== "valid") {
|
||||
throw new Error(`CNAME记录${domain}的校验状态为${cnameRecord.status}，请等待校验通过`);
|
||||
}
|
||||
|
||||
// 主域名异常
|
||||
if (cnameRecord.mainDomain && mainDomain && cnameRecord.mainDomain !== mainDomain) {
|
||||
throw new Error(`CNAME记录${domain}的域名与配置的主域名不一致（${cnameRecord.mainDomain}≠${mainDomain}），请确认是否在流水线创建之后修改了子域名托管，您需要重新校验CNAME记录的校验状态`);
|
||||
}
|
||||
|
||||
let dnsProvider = cnameRecord.commonDnsProvider;
|
||||
if (cnameRecord.cnameProvider.id > 0) {
|
||||
dnsProvider = await this.createDnsProvider(cnameRecord.cnameProvider.dnsProviderType, cnameRecord.cnameProvider.access);
|
||||
}
|
||||
|
||||
return {
|
||||
type: "cname",
|
||||
domain,
|
||||
mainDomain,
|
||||
cnameVerifyPlan: {
|
||||
domain: cnameRecord.cnameProvider.domain,
|
||||
fullRecord: cnameRecord.recordValue,
|
||||
dnsProvider,
|
||||
},
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
new CertApplyPlugin();
|
||||
@@ -1 +0,0 @@
|
||||
export const dnsList = [];
|
||||
@@ -1,250 +0,0 @@
|
||||
import { IsTaskPlugin, pluginGroups, RunStrategy, Step, TaskInput } from "@certd/pipeline";
|
||||
import type { CertInfo } from "../acme.js";
|
||||
import { CertReader } from "../cert-reader.js";
|
||||
import { CertApplyBasePlugin } from "../base.js";
|
||||
import fs from "fs";
|
||||
import { EabAccess } from "../../../access/index.js";
|
||||
import path from "path";
|
||||
import JSZip from "jszip";
|
||||
|
||||
export { CertReader };
|
||||
export type { CertInfo };
|
||||
export type PrivateKeyType = "rsa2048" | "rsa3072" | "rsa4096" | "rsa8192" | "ec256" | "ec384";
|
||||
|
||||
@IsTaskPlugin({
|
||||
name: "CertApplyLego",
|
||||
icon: "ph:certificate",
|
||||
title: "证书申请（Lego）",
|
||||
group: pluginGroups.cert.key,
|
||||
desc: "支持海量DNS解析提供商，推荐使用，一样的免费通配符域名证书申请，支持多个域名打到同一个证书上",
|
||||
default: {
|
||||
input: {
|
||||
renewDays: 35,
|
||||
forceUpdate: false,
|
||||
},
|
||||
strategy: {
|
||||
runStrategy: RunStrategy.AlwaysRun,
|
||||
},
|
||||
},
|
||||
})
|
||||
export class CertApplyLegoPlugin extends CertApplyBasePlugin {
|
||||
// @TaskInput({
|
||||
// title: "ACME服务端点",
|
||||
// default: "https://acme-v02.api.letsencrypt.org/directory",
|
||||
// component: {
|
||||
// name: "a-select",
|
||||
// vModel: "value",
|
||||
// options: [
|
||||
// { value: "https://acme-v02.api.letsencrypt.org/directory", label: "Let's Encrypt" },
|
||||
// { value: "https://letsencrypt.proxy.handsfree.work/directory", label: "Let's Encrypt代理，letsencrypt.org无法访问时使用" },
|
||||
// ],
|
||||
// },
|
||||
// required: true,
|
||||
// })
|
||||
acmeServer!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: "DNS类型",
|
||||
component: {
|
||||
name: "a-input",
|
||||
vModel: "value",
|
||||
placeholder: "alidns",
|
||||
},
|
||||
helper: "你的域名是通过哪家提供商进行解析的，具体应该配置什么请参考lego文档：https://go-acme.github.io/lego/dns/",
|
||||
required: true,
|
||||
})
|
||||
dnsType!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: "环境变量",
|
||||
component: {
|
||||
name: "a-textarea",
|
||||
vModel: "value",
|
||||
rows: 4,
|
||||
placeholder: "ALICLOUD_ACCESS_KEY=abcdefghijklmnopqrstuvwx\nALICLOUD_SECRET_KEY=your-secret-key",
|
||||
},
|
||||
required: true,
|
||||
helper: "一行一条，例如 appKeyId=xxxxx，具体配置请参考lego文档：https://go-acme.github.io/lego/dns/",
|
||||
})
|
||||
environment!: string;
|
||||
|
||||
@TaskInput({
|
||||
title: "EAB授权",
|
||||
component: {
|
||||
name: "access-selector",
|
||||
type: "eab",
|
||||
},
|
||||
maybeNeed: true,
|
||||
helper: "如果需要提供EAB授权",
|
||||
})
|
||||
legoEabAccessId!: number;
|
||||
|
||||
@TaskInput({
|
||||
title: "自定义LEGO全局参数",
|
||||
component: {
|
||||
name: "a-input",
|
||||
vModel: "value",
|
||||
placeholder: "--dns-timeout 30",
|
||||
},
|
||||
helper: "额外的lego全局命令行参数，参考文档：https://go-acme.github.io/lego/usage/cli/options/",
|
||||
maybeNeed: true,
|
||||
})
|
||||
customArgs = "";
|
||||
|
||||
@TaskInput({
|
||||
title: "自定义LEGO签名参数",
|
||||
component: {
|
||||
name: "a-input",
|
||||
vModel: "value",
|
||||
placeholder: "--no-bundle",
|
||||
},
|
||||
helper: "额外的lego签名命令行参数，参考文档：https://go-acme.github.io/lego/usage/cli/options/",
|
||||
maybeNeed: true,
|
||||
})
|
||||
customCommandOptions = "";
|
||||
|
||||
@TaskInput({
|
||||
title: "加密算法",
|
||||
value: "ec256",
|
||||
component: {
|
||||
name: "a-select",
|
||||
vModel: "value",
|
||||
options: [
|
||||
{ value: "rsa2048", label: "RSA 2048" },
|
||||
{ value: "rsa3072", label: "RSA 3072" },
|
||||
{ value: "rsa4096", label: "RSA 4096" },
|
||||
{ value: "rsa8192", label: "RSA 8192" },
|
||||
{ value: "ec256", label: "EC 256" },
|
||||
{ value: "ec384", label: "EC 384" },
|
||||
// { value: "ec_521", label: "EC 521" },
|
||||
],
|
||||
},
|
||||
helper: "如无特殊需求，默认即可",
|
||||
required: true,
|
||||
})
|
||||
privateKeyType!: PrivateKeyType;
|
||||
|
||||
eab?: EabAccess;
|
||||
|
||||
getCheckChangeInputKeys() {
|
||||
return ["domains", "privateKeyType", "dnsType"];
|
||||
}
|
||||
|
||||
async onInstance() {
|
||||
this.accessService = this.ctx.accessService;
|
||||
this.logger = this.ctx.logger;
|
||||
this.userContext = this.ctx.userContext;
|
||||
this.lastStatus = this.ctx.lastStatus as Step;
|
||||
if (this.legoEabAccessId) {
|
||||
this.eab = await this.accessService.getById(this.legoEabAccessId);
|
||||
}
|
||||
}
|
||||
async onInit(): Promise<void> {}
|
||||
|
||||
async doCertApply() {
|
||||
const env: any = {};
|
||||
const env_lines = this.environment.split("\n");
|
||||
for (const line of env_lines) {
|
||||
const [key, value] = line.trim().split("=");
|
||||
env[key] = value.trim();
|
||||
}
|
||||
|
||||
let domainArgs = "";
|
||||
for (const domain of this.domains) {
|
||||
domainArgs += ` -d "${domain}"`;
|
||||
}
|
||||
this.logger.info(`环境变量:${JSON.stringify(env)}`);
|
||||
let eabArgs = "";
|
||||
if (this.eab) {
|
||||
eabArgs = ` --eab --kid "${this.eab.kid}" --hmac "${this.eab.hmacKey}"`;
|
||||
}
|
||||
const keyType = `-k ${this.privateKeyType?.replaceAll("_", "")}`;
|
||||
|
||||
const saveDir = `./data/.lego/pipeline_${this.pipeline.id}/`;
|
||||
const savePathArgs = `--path "${saveDir}"`;
|
||||
const os_type = process.platform === "win32" ? "windows" : "linux";
|
||||
const legoDir = "./tools/lego";
|
||||
const legoPath = path.resolve(legoDir, os_type === "windows" ? "lego.exe" : "lego");
|
||||
if (!fs.existsSync(legoPath)) {
|
||||
//解压缩
|
||||
const arch = process.arch;
|
||||
let platform = "amd64";
|
||||
if (arch === "arm64" || arch === "arm") {
|
||||
platform = "arm64";
|
||||
}
|
||||
const LEGO_VERSION = process.env.LEGO_VERSION;
|
||||
let legoZipFileName = `lego_v${LEGO_VERSION}_windows_${platform}.zip`;
|
||||
if (os_type === "linux") {
|
||||
legoZipFileName = `lego_v${LEGO_VERSION}_linux_${platform}.tar.gz`;
|
||||
}
|
||||
const legoZipFilePath = `${legoDir}/${legoZipFileName}`;
|
||||
if (!fs.existsSync(legoZipFilePath)) {
|
||||
this.logger.info(`lego文件不存在:${legoZipFilePath},准备下载`);
|
||||
const downloadUrl = `https://github.com/go-acme/lego/releases/download/v${LEGO_VERSION}/${legoZipFileName}`;
|
||||
await this.ctx.download(
|
||||
{
|
||||
url: downloadUrl,
|
||||
method: "GET",
|
||||
logRes: false,
|
||||
},
|
||||
legoZipFilePath
|
||||
);
|
||||
this.logger.info("下载lego成功");
|
||||
}
|
||||
|
||||
if (os_type === "linux") {
|
||||
//tar是否存在
|
||||
await this.ctx.utils.sp.spawn({
|
||||
cmd: `tar -zxvf ${legoZipFilePath} -C ${legoDir}/`,
|
||||
});
|
||||
await this.ctx.utils.sp.spawn({
|
||||
cmd: `chmod +x ${legoDir}/*`,
|
||||
});
|
||||
this.logger.info("解压lego成功");
|
||||
} else {
|
||||
const zip = new JSZip();
|
||||
const data = fs.readFileSync(legoZipFilePath);
|
||||
const zipData = await zip.loadAsync(data);
|
||||
const files = Object.keys(zipData.files);
|
||||
for (const file of files) {
|
||||
const content = await zipData.files[file].async("nodebuffer");
|
||||
fs.writeFileSync(`${legoDir}/${file}`, content);
|
||||
}
|
||||
this.logger.info("解压lego成功");
|
||||
}
|
||||
}
|
||||
let serverArgs = "";
|
||||
if (this.acmeServer) {
|
||||
serverArgs = ` --server ${this.acmeServer}`;
|
||||
}
|
||||
const cmds = [`${legoPath} -a --email "${this.email}" --dns ${this.dnsType} ${keyType} ${domainArgs} ${serverArgs} ${eabArgs} ${savePathArgs} ${this.customArgs || ""} run ${this.customCommandOptions || ""}`];
|
||||
|
||||
await this.ctx.utils.sp.spawn({
|
||||
cmd: cmds,
|
||||
logger: this.logger,
|
||||
env,
|
||||
});
|
||||
|
||||
//读取证书文件
|
||||
// example.com.crt
|
||||
// example.com.issuer.crt
|
||||
// example.com.json
|
||||
// example.com.key
|
||||
|
||||
let domain1 = this.domains[0];
|
||||
domain1 = domain1.replaceAll("*", "_");
|
||||
const crtPath = path.resolve(saveDir, "certificates", `${domain1}.crt`);
|
||||
if (fs.existsSync(crtPath) === false) {
|
||||
throw new Error(`证书文件不存在,证书申请失败:${crtPath}`);
|
||||
}
|
||||
const crt = fs.readFileSync(crtPath, "utf8");
|
||||
const keyPath = path.resolve(saveDir, "certificates", `${domain1}.key`);
|
||||
const key = fs.readFileSync(keyPath, "utf8");
|
||||
const csr = "";
|
||||
const cert = { crt, key, csr };
|
||||
const certInfo = this.formatCerts(cert);
|
||||
return new CertReader(certInfo);
|
||||
}
|
||||
}
|
||||
|
||||
new CertApplyLegoPlugin();
|
||||
@@ -1,7 +0,0 @@
|
||||
export { EVENT_CERT_APPLY_SUCCESS } from "./cert-plugin/base-convert.js";
|
||||
|
||||
export * from "./cert-plugin/index.js";
|
||||
export * from "./cert-plugin/lego/index.js";
|
||||
export * from "./cert-plugin/custom/index.js";
|
||||
export * from "./cert-plugin/getter/aliyun.js";
|
||||
export const CertApplyPluginNames = [":cert:"];
|
||||
Reference in New Issue
Block a user