Prefer ISRG root x1. Upgrade the chain.
This commit is contained in:
parent
8f19c8f944
commit
324c050814
|
@ -55,6 +55,7 @@ letsencrypt_acme_sh_use_ecc: False
|
|||
letsencrypt_acme_sh_ecc_key_lenght: ec-384
|
||||
letsencrypt_acme_sh_rsa_key_lenght: 4096
|
||||
letsencrypt_acme_sh_ocsp_must_staple: False
|
||||
letsencrypt_acme_sh_specific_root_ca: '--preferred-chain "ISRG Root X1"'
|
||||
letsencrypt_acme_email: sysadmin@example.com
|
||||
letsencrypt_acme_sh_email: '{{ letsencrypt_acme_email }}'
|
||||
letsencrypt_acme_standalone_port: 4402
|
||||
|
|
|
@ -1,17 +1,20 @@
|
|||
#!/bin/bash
|
||||
|
||||
if [ -f "/etc/default/acme_sh_request_env" ] ; then
|
||||
# shellcheck disable=SC1091
|
||||
. "/etc/default/acme_sh_request_env"
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -f "$ACME_SH_ENV_FILE" ] ; then
|
||||
# shellcheck source=/dev/null
|
||||
. "$ACME_SH_ENV_FILE"
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
$ACME_SH_BIN --upgrade -b chain
|
||||
$ACME_SH_BIN --cron --home "$ACME_SH_BINDIR" --config-home "$ACME_SH_CONFIG_HOME" > "$ACME_SH_CRON_LOG_FILE" 2>&1
|
||||
|
||||
exit $?
|
||||
|
|
|
@ -5,12 +5,14 @@ if [ $# -ne 1 ] ; then
|
|||
fi
|
||||
|
||||
if [ -f "/etc/default/acme_sh_request_env" ] ; then
|
||||
# shellcheck disable=SC1091
|
||||
. "/etc/default/acme_sh_request_env"
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -n "$ACME_SH_ENV_FILE" ] && [ -f "$ACME_SH_ENV_FILE" ] ; then
|
||||
# shellcheck source=/dev/null
|
||||
. "$ACME_SH_ENV_FILE"
|
||||
else
|
||||
exit 1
|
||||
|
@ -40,6 +42,7 @@ if [ ! -f "$ACME_SH_CONFIG_HOME/ok_certificate_issued" ] && [ "$ACME_SH_USE_DNS_
|
|||
service httpd start >/dev/null 2>&1
|
||||
fi
|
||||
else
|
||||
$ACME_SH_BIN --upgrade -b chain
|
||||
$ACME_SH_BIN $ACME_SH_ISSUE_CERT_REQUEST > "$ACME_SH_ISSUE_LOG_FILE" 2>&1
|
||||
RETVAL=$?
|
||||
fi
|
||||
|
|
|
@ -29,7 +29,7 @@ ACME_SH_INSTALL_OPTS="$ACME_SH_INSTALL_OPTS --home {{ letsencrypt_acme_sh_user_h
|
|||
#
|
||||
# Certificate issue options
|
||||
#
|
||||
ACME_SH_ISSUE_CERT_REQUEST_OPTIONS="--issue --server {{ letsencrypt_acme_sh_default_ca }} -k {% if letsencrypt_acme_sh_use_ecc %}{{ letsencrypt_acme_sh_ecc_key_lenght }}{% else %}{{ letsencrypt_acme_sh_rsa_key_lenght }}{% endif %} --log {{ letsencrypt_acme_sh_base_data_dir }}/logs/acme.sh.log"
|
||||
ACME_SH_ISSUE_CERT_REQUEST_OPTIONS="--issue --server {{ letsencrypt_acme_sh_default_ca }} {{ letsencrypt_acme_sh_specific_root_ca }} -k {% if letsencrypt_acme_sh_use_ecc %}{{ letsencrypt_acme_sh_ecc_key_lenght }}{% else %}{{ letsencrypt_acme_sh_rsa_key_lenght }}{% endif %} --log {{ letsencrypt_acme_sh_base_data_dir }}/logs/acme.sh.log"
|
||||
{% if letsencrypt_acme_sh_ocsp_must_staple %}
|
||||
ACME_SH_ISSUE_CERT_REQUEST="$ACME_SH_ISSUE_CERT_REQUEST_OPTIONS --ocsp"
|
||||
{% endif %}
|
||||
|
|
Loading…
Reference in New Issue