12 def read_config( path = 'config.yaml' )
13 p "Reading config from #{path}"
15 config = YAML.load_file( path )
16 rescue Psych::SyntaxError
17 $stderr.puts "Parsing configfile failed: " + $!.to_s
20 $stderr.puts "IO failed: " + $!.to_s
25 def read_account_key( path = 'pkey.pem' )
26 p "Reading account key from #{path}"
27 if File.readable?( path )
28 p "File #{path} is readable, trying to parse"
29 privatekey_string = File.read( path )
30 private_key = OpenSSL::PKey::EC.new( privatekey_string )
32 if File.exists?( path )
33 raise( "The file #{path} exists but is not readable. Make it readable or specify different path" )
35 p "File #{path} does not exist, trying to create"
36 private_key = OpenSSL::PKey::EC.generate( "prime256v1" )
37 File.write( path, private_key.private_to_pem )
43 def deploy_dns01_challenge_token( domain, token, nameserver, config )
44 p "Creating DNS UPDATE packet"
45 update = Dnsruby::Update.new( domain )
46 # TODO: delete challenge token record after validation
47 update.delete( "_acme-challenge." + domain , 'TXT' )
48 update.add( "_acme-challenge." + domain, 'TXT', 10, token )
50 p "Creating object for contacting nameserver"
51 res = Dnsruby::Resolver.new( nameserver )
54 p "Looking up TSIG parameters"
55 tsig_name = config['domains'][domain]['tsig_key']
56 tsig_key = config['tsig_keys'][tsig_name]['key']
57 tsig_alg = config['tsig_keys'][tsig_name]['algorithm']
58 p "Creating TSIG object"
59 tsig = Dnsruby::RR.create({
63 :algorithm => tsig_alg,
66 p "Signing DNS UPDATE packet with TSIG object"
69 p "Sending UPDATE to nameserver"
70 response = res.send_message(update)
73 def wait_for_challenge_propagation( domain, challenge )
74 p "Creating recursor object for checking challenge propagation"
75 rec = Dnsruby::Recursor.new
76 p "Getting NS records for #{domain}"
77 domain_auth_ns = rec.query_no_validation_or_recursion( domain, "NS" )
79 p "Checking challenge status on all NS"
80 domain_auth_ns.answer.each do |ns|
81 nameserver = ns.rdata.to_s
82 p "Creating resolver object for checking propagation on #{nameserver}"
83 res = Dnsruby::Resolver.new( nameserver )
85 res.do_caching = false
87 p "Querying ACME challenge record"
88 result = res.query_no_validation_or_recursion( "_acme-challenge." + domain, "TXT" )
90 propagated = result.answer.any? do |answer|
94 p "against challenge string"
95 p challenge.record_content
96 answer.rdata[0] == challenge.record_content
99 p "Sleeping before checking again"
106 def wait_for_challenge_validation( challenge )
107 p "Requesting validation of challenge"
108 challenge.request_validation
110 while challenge.status == 'pending'
111 p "Sleeping because challenge validation is pending"
118 def get_cert_key( domain )
119 path = "./domains/#{domain}/"
120 key_file = path + "current.key"
121 p "Reading cert key from #{key_file}"
122 if File.readable?( key_file )
123 p "Cert key is readable, trying to read"
124 pkey_file = File.new( key_file )
125 privatekey_string = pkey_file.read
126 domain_key = OpenSSL::PKey::EC.new( privatekey_string )
128 p "Cert key is not readable, trying to create one"
129 pkey_file = File.new( path + Time.now.to_i.to_s + ".key", 'w' )
130 domain_key = OpenSSL::PKey::EC.generate( "prime256v1" )
131 pkey_pem = domain_key.private_to_pem
132 pkey_file.write( pkey_pem )
133 File.symlink( File.basename( pkey_file ), File.dirname( pkey_file ) + "/current.key" )
138 def get_cert( order, domains, domain_key )
139 path = "./domains/#{domains[0]}/"
140 crt_file = path + "cert.pem"
141 p "Creating CSR object"
142 csr = Acme::Client::CertificateRequest.new(private_key: domain_key, names: domains, subject: { common_name: "#{domains[0]}" })
143 p "Finalize cert order"
144 order.finalize(csr: csr)
145 while order.status == 'processing'
146 p "Sleep while order is processing"
148 p "Rechecking order status"
151 cert = order.certificate
154 cert_file = File.new( path + Time.now.to_i.to_s + ".crt", 'w' )
155 cert_file.write( cert )
156 if File.symlink?( File.dirname( cert_file ) + "/current.crt" ) then
157 File.unlink( File.dirname( cert_file ) + "/current.crt" )
158 File.symlink( File.basename( cert_file ), File.dirname( cert_file ) + "/current.crt" )
168 # iterate over configured certs
169 # TODO: make this one thread per cert
170 config['certs'].each_pair do |cert_name, cert_opts|
171 p "Finding CA to use for cert #{cert_name}"
172 acme_directory_url = config['CAs'][cert_opts['ca']['name']]['directory_url']
174 p "Finding account to use for cert #{cert_name} from CA #{cert_opts['ca']['name']}"
175 account = config['ca_accounts'][cert_opts['ca']['account']]
176 email = account['email']
178 private_key = read_account_key( account['keyfile'] )
180 p "Creating client object for communication with CA"
181 client = Acme::Client.new( private_key: private_key, directory: acme_directory_url )
183 client.new_account(contact: "mailto:#{email}", terms_of_service_agreed: true)
185 p "Creating order object for cert #{cert_name}"
186 order = client.new_order(identifiers: cert_opts['domain_names'] )
187 if order.status != "ready" then
188 p "Order is not ready, we need to authorize first"
190 p "Iterating over required authorizations"
191 order.authorizations.each do |auth|
192 p "Processing authorization for #{auth.domain}"
193 p "Finding challenge type for #{auth.domain}"
194 p config['domains'][auth.domain]['challenge']
195 challenge = auth.dns01
196 deploy_dns01_challenge_token( auth.domain, challenge.record_content, config['domains'][auth.domain]['primary_ns'], config )
197 wait_for_challenge_propagation( auth.domain, challenge )
198 wait_for_challenge_validation( challenge )
201 # deploy_dns01_challenge_token( cert_opts['domain_names'][0], challenge.record_content, cert_opts['challenge']['primary_ns'], config )
204 p "Order is ready, we don’t need to authorize"
206 domain_key = get_cert_key( cert_opts['domain_names'][0] )
208 get_cert( order, cert_opts['domain_names'], domain_key )