letsencrypt-certs

#!/usr/bin/perl

use esmith::ConfigDB;
use esmith::HostsDB;
use File::stat;
use Getopt::Std;
use File::Temp;

my $cdb = esmith::ConfigDB->open();
my $ddb = esmith::HostsDB->open_ro();

my $crtdir = "/etc/letsencrypt/";
my $crtdir_backup = "/etc/letsencrypt.autobackup/";
my $lebin = "/usr/bin/certbot";
my $config = "";
my $verbose = 0;
my $testing = 0;
my $force = 0;
our $mail = '';
our $modified = 0;
# Certificate for FQDN
our @domains = ();
my $challenge = $cdb->get_prop('pki', 'LetsEncryptChallenge') || 'http';
my $tmp;

$SIG{INT}  = \&restore;
$SIG{TERM} = \&restore;

sub restore {
    if ( -d $crtdir_backup) {
        # restore backup cert dir
        if ($verbose) {
            print "Restoring $crtdir ...\n";
        }
        system("rm -rf $crtdir");
        system("mv $crtdir_backup $crtdir");
    }
}

sub renew {
    my $domains = shift;
    my $challenge = shift;
    my $config = shift || '';

    my $opts = " certonly --text --non-interactive --agree-tos ";
    if (!$mail) {
        $opts .= " --register-unsafely-without-email "
    } else {
        $opts .= " --email $mail "
    }

    if ($challenge eq 'http') {
        $opts .= " --preferred-challenges http --webroot --webroot-path /var/www/html/ ";
    } else {
        $opts .= " --preferred-challenges dns --$challenge --$challenge-credentials $config --$challenge-propagation-seconds 15";
    }

    my $cmd = "$lebin $opts";

    foreach (@$domains) {
        $cmd .= " -d $_ ";
    }

    if ($force) {
        $cmd .= " --force-renewal ";
    }

    if ($testing) {
        $cmd .= " --test-cert ";
    }

    if (!$verbose) {
        $cmd .= " --quiet >/dev/null";
    } else {
        $cmd .= " -v ";
        print $cmd."\n";
    }
    my $ret = system($cmd);

    if ($testing) {
        restore();
        exit $ret>>8;
    }

}

sub help {
    print "Usage: $0 [-h] [-f] [-d <domain1,domain2,..>] [-v] [-t] [-e <mail_address>]\n";
    print "\nOptions:\n";
    print "  -h : show this help\n";
    print "  -f : force certificate renew\n";
    print "  -d : comma-separated list of domains,\n";
    print "       if not set read from config db pki[LetsEncryptDomains]\n";
    print "  -v : verbose\n";
    print "  -t : testing, enable staging CA\n";
    print "  -e : use given mail for registration\n";
}

my %options=();
getopts("hvtfd:e:", \%options);

# make sure certificate dir exists
if ( ! -d $crtdir) {
    mkdir($crtdir);
}

if (defined $options{h}) {
    help();
    exit 0;
}

if (defined $options{v}) {
    $verbose = 1;
}

if (defined $options{f}) {
    $force = 1;
}

if (defined $options{t}) {
    $testing = 1;

    # copy existing cert dir into a temporary one
    system("mv $crtdir $crtdir_backup");
}

if (defined $options{d}) {
    foreach (split(',',$options{d})) {
        push(@domains, $_);
    }
}

if (defined $options{e}) {
    $mail = $options{e};
} else {
    $mail = $cdb->get_prop('pki','LetsEncryptMail') || '';
}

# read domains from pki prop
if (!@domains) {
    my $le_domains =  $cdb->get_prop('pki','LetsEncryptDomains') || '';
    if ($le_domains) {
        foreach (split(',',$le_domains)) {
            push(@domains, $_);
        }
    }
}

if (!@domains) {
    exit 0;
}

if ($challenge =~ m/^dns/) {
    $tmp = File::Temp->new( UNLINK => 0, SUFFIX => '.ini' );
    my %props = $cdb->get('pki')->props();
    foreach $p (keys %props) {
        if($p =~ m/LetsEncrypt_(.*)$/) {
            print $tmp "$1=$props{$p}\n";
        }
    }
}

# Renew certificate for all domains
renew(\@domains, $challenge, $tmp ? $tmp->filename : undef);

exit 0;