Skip to content
This repository has been archived by the owner on Oct 8, 2019. It is now read-only.

Latest commit

 

History

History
95 lines (71 loc) · 2.53 KB

README.adoc

File metadata and controls

95 lines (71 loc) · 2.53 KB
Raw

acme-client-plus

This project provides a ready-to-go script for periodic renewal of TLS certificates using the BSD’s acme-client.

Requirements

  • acme-client

  • POSIX-sh compatible shell (e.g. Busybox ash, dash, ZSH, bash, …); script acme-renew-certs needs a shell with support for set -e pipefail

  • common userland with awk, find, sed (e.g. from Busybox, GNU coreutils, …)

  • openssl command (if you want to generate RSA keys with different size than 4096 bits)

Installation

git clone https://github.com/jirutka/acme-client-plus.git
cd jirutka/acme-client-plus
make install

Examples

acme-client-plus.conf:
# Size of RSA keys for domains (in bits).
rsa_key_size="3072"

# Additional options to pass into acme-client.
# -O - Request OCSP stapling for the given domains.
acme_client_opts="-O"

# This function is executed after any certificate(s) have been renewed;
# use it to reload affected services.
# $@: domain names
after_renew() {
    # Note: This example is for the OpenRC init system.
    /etc/init.d/nginx --ifstarted --quiet reload
}
Issue a certificate for domain foo.example.org with alternative name bar.example.org:
acme-client-plus issue foo.example.org bar.example.org
Renew all certificates that are close to their expiration:
acme-client-plus renew
Renew certificate for domain foo.example.org even if it’s too soon:
acme-client-plus renew -F foo.example.org

Files

Default directory structure:
/
|-- etc
|   |-- logrotate.d
|   |   `-- acme-client-plus (750)
|   |-- periodic/weekly
|   |   `-- acme-renew-certs (750)
|   |-- ssl/acme (755) [certs_dir, keys_dir]
|   |   |-- <domain> (755)
|   |   |   |-- cert.pem (444)
|   |   |   |-- chain.pem (444)
|   |   |   |-- fullchain.pem (444)
|   |   |   `-- privkey.pem (400)
|   |   :-- ...
|   |   `-- account-key.pem (400) [account_key]
|   `-- acme-client-plus.conf (644)
|-- usr/bin
|   `-- acme-client-plus (750)
`-- var
    |-- log
    |   `-- acme-renew.log (644)
    `-- www/acme (755) [challenge_dir]
        :-- ...
        `-- xyz (444)

License

This project is licensed under ISC License. For the full text of the license, see the LICENSE file.

See Also