renew-cert-auto.sh

#!/bin/bash

############################################################### 
##      THIS WILL RENEW A FREE 90 DAY SSL CERTIFICATE        ##
##                 FROM LETS ENCRYPT AUTO                    ##
##                                                           ##
##             to be used with a cron job ideally            ##
############################################################### 

# Make sure a value is passed from the paramater
if [[ "${DF_CRON_DOMAIN}" == "" ]]; then echo "ERROR: No Domain specified" >> $DF_LOG 2>&1; exit 1; fi

# Lets check the domain has a ssl certs
if [[ ! -d "${BASEDIR}/certs/${DF_CRON_DOMAIN}" ]]; then echo "ERROR: Domain does not have a SSL Cert on this server" >> $DF_LOG 2>&1; exit 1; fi

# Lets load the cron config from the domain config file
if [[ ! -f "${BASEDIR}/certs/${DF_CRON_DOMAIN}/${DF_ACCOUNT_DOMAIN_CRON}" ]]; then echo "ERROR: No Cron config file found in the domain" >> $DF_LOG 2>&1; exit 1; else . "${BASEDIR}/certs/${DF_CRON_DOMAIN}/${DF_ACCOUNT_DOMAIN_CRON}"; fi

# In Testing mode use only testing accounts
if [[ "${TESTING}" == 1 ]]; then DF_TMP_ACCD=${DF_ACCOUNT_DIR_T}; echo " + Running in TESTING MODE (STAGING SERVERS)" >> $DF_LOG 2>&1; else DF_TMP_ACCD=${DF_ACCOUNT_DIR}; fi

# Check if there is an email paramater present, otherwise use the default one
if [[ ! "${DF_CRON_EMAIL}" == "" ]]; then
    # Check if there is a default email account configured
    if [ -f "${DF_TMP_ACCD}/${DF_ACCOUNT_D}" ]; then
        . "${DF_TMP_ACCD}/${DF_ACCOUNT_D}"
        echo " + Loaded default email account (${CONTACT_EMAIL})" >> $DF_LOG 2>&1
    else
        echo "ERROR: No email account found" >> $DF_LOG 2>&1; exit 1;
    fi
else
    CONTACT_EMAIL=${DF_CRON_EMAIL}
    if [[ ! -f "${DF_TMP_ACCD}/${CONTACT_EMAIL}.pem" ]]; then echo "ERROR: No email account found as per paramater" >> $DF_LOG 2>&1; exit 1; fi
    PRIVATE_KEY="${DF_TMP_ACCD}/${CONTACT_EMAIL}.pem"
    echo " + Loaded set email account (${CONTACT_EMAIL})" >> $DF_LOG 2>&1
fi
        
# Get current list of domains 
if [ ! -f "${BASEDIR}/certs/${DF_CRON_DOMAIN}/${DF_ACCOUNT_DOMAIN}" ]; then
    echo "ERROR: Cannot find domain list" >> $DF_LOG 2>&1; exit 1;
else
    echo " + Domain list added" >> $DF_LOG 2>&1
fi
    
# Check if Challange directory exists
if [ ! -d "$AUTODF" ]; then
    echo -e " + Creating global auto challenge directory";
    mkdir -p "$AUTODF";
fi
        
#

        # Add well-known alias to all vhosts on the server
        SEVHOST="${DF_CL_NGINX}/"
        # Do we need to restart the NGINX Service?
        DFSERVICER=0;
        
        # Search through the vhosts.d directory for all folders
        for Dir in $(find ${SEVHOST}* -maxdepth 0 -type d ); 
        do
            # Check if the DIR is found (prevents config errors)
            FolderName=$(basename $Dir);
            if [[ ! -d "${DF_CL_NGINX}/${FolderName}" ]]; then 
                echo "ERROR: Vhost directory NOT found for (${FolderName})" >> $DF_LOG 2>&1; exit 1;
            fi
            
            # Check if we have an existing file? Check if it is correct
            # if wrong delete it so we can re-create again
            if [[ -f "${DF_CL_NGINX}/${FolderName}/acme.conf" ]]; then
                 DF_TMP_RE=1;
                 if grep -q "${AUTODF}" "${DF_CL_NGINX}/${FolderName}/acme.conf"; then DF_TMP_RE=0; fi
                 
                 if [[ ${DF_TMP_RE} == 1 ]]; then
                    echo " - Found incorrect ACME Challenge Alias for (${FolderName})" >> $DF_LOG 2>&1
                    sudo rm -f -- "${DF_CL_NGINX}/${FolderName}/acme.conf"
                fi
            fi
            
            # Check if the ACME Conf already exists
            if [[ ! -f "${DF_CL_NGINX}/${FolderName}/acme.conf" ]]; then
                echo " + Adding ACME Challenge Alias to (${FolderName})" >> $DF_LOG 2>&1
                DFSERVICER=1;
                # LETS ADD THE CUSTOM WEBROOT ALIAS
                echo -e "
# ADDS THE CHALLENGE DIR TO THE VHOST SERVER BLOCK  
# DO NOT EDIT (generated by sh files)
location /.well-known/acme-challenge/ {
       alias ${AUTODF}/;
}" | sudo tee "${DF_CL_NGINX}/${FolderName}/acme.conf" > /dev/null
                
            fi
        done

#
        
        # reset the cd back to script dir
        cd ${BASEDIR};
        
        if [ $DFSERVICER == 1 ]; then
            # Restart Nginx
            echo " + Challenge files updated, restarting NGINX..." >> $DF_LOG 2>&1
            sudo service nginx-sp restart >> $DF_LOG 2>&1
        else
            echo " - No changes needed in Vhosts" >> $DF_LOG 2>&1
        fi
        
    
        # Create the tmp config (for acme.sh) - doing it the lazy way
        echo -e "WELLKNOWN='${AUTODF}'" > ${CFDFT}
        echo -e "CONTACT_EMAIL='${CONTACT_EMAIL}'" >> ${CFDFT}
        echo -e "DOMAINS_TXT='${BASEDIR}/certs/${DF_CRON_DOMAIN}/${DF_ACCOUNT_DOMAIN}'" >> ${CFDFT}
        echo -e "PRIVATE_KEY='${PRIVATE_KEY}'" >> ${CFDFT}
        if [[ "${TESTING}" == 1 ]]; then
            echo -e 'CA="https://acme-staging.api.letsencrypt.org/directory"' >> ${CFDFT}
        else
            echo -e 'CA="https://acme-v01.api.letsencrypt.org/directory"' >> ${CFDFT}
        fi
   
        bash "${BASEDIR}/acme.sh" -c --config ${CFDFT} >> $DF_LOG 2>&1
        
        # Remove tmp config file
        rm -- ${CFDFT}
        exit;