bitdeals
36e1865e37
Build docker image and push to registry.bitdeals.org / main-build-job (push) Successful in 30s
certbot's own -d already takes a comma-separated list and puts every name
in the certificate's Subject Alternative Names, so `-d "$CERTBOT_DOMAIN"`
needed no change at all. What assumed a single domain was everything that
treated the variable as a *file name*: --cert-name, and the two scripts
that address the lineage under /etc/letsencrypt/live. Certbot names a
lineage after the first domain of the list, so all three now take
${CERTBOT_DOMAIN%%,*} instead of the whole string -- otherwise a two-domain
value asks for a lineage literally called "a.org,b.org" and the renewal
pass looks for a directory nobody made.
One certificate with several names rather than several lineages: HAProxy
binds a single site.pem, and a second lineage would have nowhere to go.
Adding a domain to CERTBOT_DOMAIN on a machine that already holds a
certificate still needs one manual issuance -- `certbot renew` reads the
names off the certificate it has and never looks at the variable. The
README says so, and gives the command.
21 lines
844 B
Bash
21 lines
844 B
Bash
#!/bin/sh
|
|
|
|
# Join the issued certificate and its key into the single site.pem HAProxy
|
|
# expects.
|
|
#
|
|
# Absolute paths rather than a cd: this script is sourced, so a cd would move
|
|
# the caller's working directory as well, and an unchecked one that failed left
|
|
# the tests below looking for fullchain.pem in whatever directory the caller
|
|
# happened to be in.
|
|
|
|
live="/etc/letsencrypt/live/${CERTBOT_DOMAIN%%,*}"
|
|
|
|
if [ -f "$live/fullchain.pem" ] && [ -f "$live/privkey.pem" ]; then
|
|
# Through a temporary file, then an atomic rename: HAProxy reads site.pem at
|
|
# start-up and must never find it half-written.
|
|
cat "$live/fullchain.pem" "$live/privkey.pem" > /etc/certificates/site.pem.tmp
|
|
mv /etc/certificates/site.pem.tmp /etc/certificates/site.pem
|
|
else
|
|
echo "2-concatenate-cert.sh: no certificate under $live, site.pem left as it is" >&2
|
|
fi
|