21 lines
1.0 KiB
Bash
21 lines
1.0 KiB
Bash
#!/bin/bash
|
|
set -euo pipefail
|
|
domain="${ACME_DOMAIN:?ACME_DOMAIN is required}"
|
|
home=/root/.acme.sh
|
|
cert_dir=/etc/trojan/certs
|
|
source_cert="$home/${domain}_ecc/fullchain.cer"
|
|
source_key="$home/${domain}_ecc/${domain}.key"
|
|
before=""
|
|
[[ -f "$cert_dir/fullchain.pem" ]] && before=$(openssl x509 -in "$cert_dir/fullchain.pem" -noout -fingerprint -sha256)
|
|
"$home/acme.sh" --cron --home "$home"
|
|
test -r "$source_cert" -a -r "$source_key"
|
|
openssl x509 -in "$source_cert" -noout -checkend 0
|
|
mkdir -p "$cert_dir"
|
|
install -m 0644 "$source_cert" "$cert_dir/fullchain.pem"
|
|
install -m 0600 "$source_key" "$cert_dir/private.key"
|
|
openssl x509 -noout -modulus -in "$cert_dir/fullchain.pem" | openssl sha256 > /tmp/trojan-cert.modulus
|
|
openssl rsa -noout -modulus -in "$cert_dir/private.key" | openssl sha256 >> /tmp/trojan-cert.modulus
|
|
[[ $(cut -d' ' -f2 /tmp/trojan-cert.modulus | sort -u | wc -l) -eq 1 ]]
|
|
after=$(openssl x509 -in "$cert_dir/fullchain.pem" -noout -fingerprint -sha256)
|
|
if [[ "$before" != "$after" ]]; then systemctl restart trojan; fi
|