bitdeals
36e1865e37
Build docker image and push to registry.bitdeals.org / main-build-job (push) Successful in 30s
certbot's own -d already takes a comma-separated list and puts every name
in the certificate's Subject Alternative Names, so `-d "$CERTBOT_DOMAIN"`
needed no change at all. What assumed a single domain was everything that
treated the variable as a *file name*: --cert-name, and the two scripts
that address the lineage under /etc/letsencrypt/live. Certbot names a
lineage after the first domain of the list, so all three now take
${CERTBOT_DOMAIN%%,*} instead of the whole string -- otherwise a two-domain
value asks for a lineage literally called "a.org,b.org" and the renewal
pass looks for a directory nobody made.
One certificate with several names rather than several lineages: HAProxy
binds a single site.pem, and a second lineage would have nowhere to go.
Adding a domain to CERTBOT_DOMAIN on a machine that already holds a
certificate still needs one manual issuance -- `certbot renew` reads the
names off the certificate it has and never looks at the variable. The
README says so, and gives the command.
20 lines
453 B
Bash
20 lines
453 B
Bash
#!/bin/sh
|
|
|
|
# Certificates exist
|
|
if [ -n "$CERTBOT_DOMAIN" -a -d /etc/letsencrypt/live/"${CERTBOT_DOMAIN%%,*}" ]; then
|
|
# Check certificates and renew them
|
|
certbot renew --http-01-port=380
|
|
|
|
# Concatenate certificates
|
|
. $(dirname $0)/2-concatenate-cert.sh
|
|
|
|
# Update certificates in HAProxy
|
|
. $(dirname $0)/3-update-haproxy-cert.sh
|
|
|
|
# Certificates don't exist
|
|
else
|
|
# Execute certificate creation script
|
|
. $(dirname $0)/0-create-cert.sh
|
|
fi
|
|
|