#!/bin/bash
set -euo pipefail
domain="${ACME_DOMAIN:?ACME_DOMAIN is required}"
home=/root/.acme.sh
cert_dir=/etc/trojan/certs
source_cert="$home/${domain}_ecc/fullchain.cer"
source_key="$home/${domain}_ecc/${domain}.key"
before=""
[[ -f "$cert_dir/fullchain.pem" ]] && before=$(openssl x509 -in "$cert_dir/fullchain.pem" -noout -fingerprint -sha256)
"$home/acme.sh" --cron --home "$home"
test -r "$source_cert" -a -r "$source_key"
openssl x509 -in "$source_cert" -noout -checkend 0
mkdir -p "$cert_dir"
install -m 0644 "$source_cert" "$cert_dir/fullchain.pem"
install -m 0600 "$source_key" "$cert_dir/private.key"
openssl x509 -noout -modulus -in "$cert_dir/fullchain.pem" | openssl sha256 > /tmp/trojan-cert.modulus
openssl rsa -noout -modulus -in "$cert_dir/private.key" | openssl sha256 >> /tmp/trojan-cert.modulus
[[ $(cut -d' ' -f2 /tmp/trojan-cert.modulus | sort -u | wc -l) -eq 1 ]]
after=$(openssl x509 -in "$cert_dir/fullchain.pem" -noout -fingerprint -sha256)
if [[ "$before" != "$after" ]]; then systemctl restart trojan; fi