mirror of
https://github.com/netbirdio/plugins.git
synced 2026-05-22 18:44:07 -07:00
security/acme-client: rename to "ACME Client", refs #2361
This commit is contained in:
Frank Wall
@@ -1,6 +1,6 @@
|
||||
PLUGIN_NAME= acme-client
|
||||
PLUGIN_VERSION= 2.6
|
||||
PLUGIN_COMMENT= Let's Encrypt client
|
||||
PLUGIN_COMMENT= ACME Client
|
||||
PLUGIN_MAINTAINER= opnsense@moov.de
|
||||
PLUGIN_DEPENDS= acme.sh py${PLUGIN_PYTHON}-dns-lexicon
|
||||
|
||||
|
||||
@@ -14,6 +14,7 @@ Added:
|
||||
* add support for new ACME CA's: buypass, buypass_test, sslcom, zerossl (#2361)
|
||||
|
||||
Changed:
|
||||
* rename plugin from "Let's Encrypt client" to "ACME Client" (#2361)
|
||||
* rename "Let's Encrypt Environment" to "ACME CA" (#2361)
|
||||
* preserve old LE accounts/certs by adding a compatibility layer (#2361)
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Copyright (C) 2017 Frank Wall
|
||||
* Copyright (C) 2017-2021 Frank Wall
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
@@ -58,7 +58,7 @@ function acmeclient_services()
|
||||
}
|
||||
|
||||
$services[] = array(
|
||||
'description' => gettext('Let\'s Encrypt client'),
|
||||
'description' => gettext('ACME client'),
|
||||
'pidfile' => '/var/run/lighttpd-acme-challenge.pid',
|
||||
'configd' => array(
|
||||
'restart' => array('acme-http-challenge restart'),
|
||||
|
||||
+5
-5
@@ -1,7 +1,7 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Copyright (C) 2017 Frank Wall
|
||||
* Copyright (C) 2017-2021 Frank Wall
|
||||
* Copyright (C) 2015 Deciso B.V.
|
||||
*
|
||||
* All rights reserved.
|
||||
@@ -263,7 +263,7 @@ class SettingsController extends ApiMutableModelControllerBase
|
||||
// Add a new HAProxy ACL
|
||||
$acl_uuid = $mdlHAProxy->newAcl(
|
||||
"find_acme_challenge",
|
||||
"Added by Let's Encrypt plugin",
|
||||
"Added by ACME Client plugin",
|
||||
"path_beg",
|
||||
"0",
|
||||
array("path_beg" => "/.well-known/acme-challenge/")
|
||||
@@ -273,7 +273,7 @@ class SettingsController extends ApiMutableModelControllerBase
|
||||
$backend_uuid = $mdlHAProxy->newBackend(
|
||||
"1",
|
||||
"acme_challenge_backend",
|
||||
"Added by Let's Encrypt plugin",
|
||||
"Added by ACME Client plugin",
|
||||
"http",
|
||||
"source",
|
||||
"",
|
||||
@@ -283,7 +283,7 @@ class SettingsController extends ApiMutableModelControllerBase
|
||||
// Add a new HAProxy action
|
||||
$action_uuid = $mdlHAProxy->newAction(
|
||||
"redirect_acme_challenges",
|
||||
"Added by Let's Encrypt plugin",
|
||||
"Added by ACME Client plugin",
|
||||
"if",
|
||||
"",
|
||||
"and",
|
||||
@@ -298,7 +298,7 @@ class SettingsController extends ApiMutableModelControllerBase
|
||||
// Add a new HAProxy server
|
||||
$server_uuid = $mdlHAProxy->newServer(
|
||||
"acme_challenge_host",
|
||||
"Added by Let's Encrypt plugin",
|
||||
"Added by ACME Client plugin",
|
||||
"127.0.0.1",
|
||||
$acme_port,
|
||||
"active",
|
||||
|
||||
+4
-4
@@ -27,24 +27,24 @@
|
||||
<type>select_multiple</type>
|
||||
<style>tokenize</style>
|
||||
<allownew>true</allownew>
|
||||
<help><![CDATA[Configure additional names that should be part of the certificate, i.e. www.example.com or mail.example.com. Use TAB key to complete typing a FQDN.<br/><div class="text-info"><b>NOTE:</b>You need to forcefully re-issue the certificate if you change "Alt Names" after the certificate was signed by the Let's Encrypt Authority! Use the "issue" button in the Commands column in this case.</div>]]></help>
|
||||
<help><![CDATA[Configure additional names that should be part of the certificate, i.e. www.example.com or mail.example.com. Use TAB key to complete typing a FQDN.<br/><div class="text-info"><b>NOTE:</b>You need to forcefully re-issue the certificate if you change "Alt Names" after the certificate was signed by the ACME CA! Use the "issue" button in the Commands column in this case.</div>]]></help>
|
||||
<hint>Enter FQDN here. Finish with TAB.</hint>
|
||||
</field>
|
||||
<field>
|
||||
<label>Let's Encrypt Settings</label>
|
||||
<label>ACME CA Settings</label>
|
||||
<type>header</type>
|
||||
</field>
|
||||
<field>
|
||||
<id>certificate.account</id>
|
||||
<label>LE Account</label>
|
||||
<type>dropdown</type>
|
||||
<help><![CDATA[Set the Let's Encrypt account to use for this certificate.]]></help>
|
||||
<help><![CDATA[Set the ACME CA account to use for this certificate.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<id>certificate.validationMethod</id>
|
||||
<label>Challenge Type</label>
|
||||
<type>dropdown</type>
|
||||
<help><![CDATA[Set the Let's Encrypt challenge type for this certificate.]]></help>
|
||||
<help><![CDATA[Set the ACME challenge type for this certificate.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<id>certificate.autoRenewal</id>
|
||||
|
||||
+3
-3
@@ -21,7 +21,7 @@
|
||||
<id>validation.method</id>
|
||||
<label>Challenge Type</label>
|
||||
<type>dropdown</type>
|
||||
<help>Set the Let's Encrypt challenge type. You'll have to add configuration for the selected challenge type below.</help>
|
||||
<help>Set the ACME challenge type. You'll have to add configuration for the selected challenge type below.</help>
|
||||
</field>
|
||||
<field>
|
||||
<label>HTTP-01</label>
|
||||
@@ -48,7 +48,7 @@
|
||||
<id>validation.http_opn_interface</id>
|
||||
<label>Interface</label>
|
||||
<type>dropdown</type>
|
||||
<help><![CDATA[The FQDN's used in your certificate must currently point to an official IP address. Choose the interface where this IP address is currently configured. OPNsense will automatically create a temporary port forward to allow the Let's Encrypt validation to succeed. This will lead to a short downtime of the service that is normally used with this IP address.<br/><div class="text-info"><b>NOTE:</b>This will ONLY work if the official IP addresses are LOCALLY configured on your OPNsense firewall.</div>]]></help>
|
||||
<help><![CDATA[The FQDN's used in your certificate must currently point to an official IP address. Choose the interface where this IP address is currently configured. OPNsense will automatically create a temporary port forward to allow the ACME validation to succeed. This will lead to a short downtime of the service that is normally used with this IP address.<br/><div class="text-info"><b>NOTE:</b>This will ONLY work if the official IP addresses are LOCALLY configured on your OPNsense firewall.</div>]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<id>validation.http_opn_ipaddresses</id>
|
||||
@@ -56,7 +56,7 @@
|
||||
<type>select_multiple</type>
|
||||
<style>tokenize</style>
|
||||
<allownew>true</allownew>
|
||||
<help><![CDATA[The FQDN's used in your certificate must currently point to one or more official IP addresses. Enter the all of these IP addresses here. OPNsense will automatically create a temporary port forward to allow the Let's Encrypt validation to succeed. This will lead to a short downtime of the service that is normally used with these IP addresses.<br/><div class="text-info"><b>NOTE:</b>This will ONLY work if the official IP addresses are LOCALLY configured on your OPNsense firewall.</div>]]></help>
|
||||
<help><![CDATA[The FQDN's used in your certificate must currently point to one or more official IP addresses. Enter the all of these IP addresses here. OPNsense will automatically create a temporary port forward to allow the ACME validation to succeed. This will lead to a short downtime of the service that is normally used with these IP addresses.<br/><div class="text-info"><b>NOTE:</b>This will ONLY work if the official IP addresses are LOCALLY configured on your OPNsense firewall.</div>]]></help>
|
||||
<hint>Enter IP addresses here. Finish each with TAB.</hint>
|
||||
</field>
|
||||
<field>
|
||||
|
||||
+2
-2
@@ -3,7 +3,7 @@
|
||||
<id>acmeclient.settings.enabled</id>
|
||||
<label>Enable Plugin</label>
|
||||
<type>checkbox</type>
|
||||
<help><![CDATA[Enable Let's Encrypt plugin.]]></help>
|
||||
<help><![CDATA[Enable ACME client plugin.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<id>acmeclient.settings.autoRenewal</id>
|
||||
@@ -33,7 +33,7 @@
|
||||
<id>acmeclient.settings.challengePort</id>
|
||||
<label>Local HTTP Port</label>
|
||||
<type>text</type>
|
||||
<help><![CDATA[When using HTTP-01 as challenge type, a local webserver is used to provide acme challenge data to the Let's Encrypt servers. The local webserver is NOT directly exposed to the outside and should NOT use port 80 or any other well-known port. This setting allows you to change the local port of this webserver in case it interferes with another local service. Defaults to port 43580.]]></help>
|
||||
<help><![CDATA[When using HTTP-01 as challenge type, a local webserver is used to provide acme challenge data to the ACME CA. The local webserver is NOT directly exposed to the outside and should NOT use port 80 or any other well-known port. This setting allows you to change the local port of this webserver in case it interferes with another local service. Defaults to port 43580.]]></help>
|
||||
<advanced>true</advanced>
|
||||
</field>
|
||||
<field>
|
||||
|
||||
@@ -31,7 +31,7 @@ namespace OPNsense\AcmeClient;
|
||||
use OPNsense\Core\Config;
|
||||
|
||||
/**
|
||||
* Manage Let's Encrypt accounts with acme.sh
|
||||
* Manage ACME CA accounts with acme.sh
|
||||
* @package OPNsense\AcmeClient
|
||||
*/
|
||||
class LeAccount extends LeCommon
|
||||
@@ -192,7 +192,7 @@ class LeAccount extends LeCommon
|
||||
}
|
||||
|
||||
/**
|
||||
* register account with Let's Encrypt
|
||||
* register account with configured ACME CA
|
||||
* @return bool
|
||||
*/
|
||||
public function register()
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
<?php
|
||||
|
||||
/*
|
||||
* Copyright (C) 2020 Frank Wall
|
||||
* Copyright (C) 2020-2021 Frank Wall
|
||||
* Copyright (C) 2018 Deciso B.V.
|
||||
* All rights reserved.
|
||||
*
|
||||
@@ -30,7 +30,7 @@
|
||||
namespace OPNsense\AcmeClient;
|
||||
|
||||
/**
|
||||
* Interface for Let's Encrypt automations
|
||||
* Interface for ACME Client automations
|
||||
* @package OPNsense\AcmeClient
|
||||
*/
|
||||
interface LeAutomationInterface
|
||||
|
||||
+6
-6
@@ -37,7 +37,7 @@ use OPNsense\AcmeClient\LeAutomationFactory;
|
||||
use OPNsense\AcmeClient\LeValidationFactory;
|
||||
|
||||
/**
|
||||
* Manage Let's Encrypt certificates with acme.sh
|
||||
* Manage ACME certificates with acme.sh
|
||||
* @package OPNsense\AcmeClient
|
||||
*/
|
||||
class LeCertificate extends LeCommon
|
||||
@@ -169,7 +169,7 @@ class LeCertificate extends LeCommon
|
||||
|
||||
// Collect required CA information
|
||||
$ca_cn = LeUtils::local_cert_get_cn($ca_content, false);
|
||||
$ca['descr'] = (string)$ca_cn . ' (Let\'s Encrypt)';
|
||||
$ca['descr'] = (string)$ca_cn . ' (ACME Client)';
|
||||
|
||||
// Prepare CA for import
|
||||
LeUtils::local_ca_import($ca, $ca_content);
|
||||
@@ -186,7 +186,7 @@ class LeCertificate extends LeCommon
|
||||
}
|
||||
} else {
|
||||
// Create new CA
|
||||
LeUtils::log("importing Let's Encrypt CA: ${ca_cn}");
|
||||
LeUtils::log("importing ACME CA: ${ca_cn}");
|
||||
$newca = Config::getInstance()->object()->addChild('ca');
|
||||
foreach (array_keys($ca) as $cacfg) {
|
||||
$newca->addChild($cacfg, (string)$ca[$cacfg]);
|
||||
@@ -251,7 +251,7 @@ class LeCertificate extends LeCommon
|
||||
|
||||
// Collect required cert information
|
||||
$cert_cn = LeUtils::local_cert_get_cn($cert_content, false);
|
||||
$cert['descr'] = (string)$cert_cn . ' (Let\'s Encrypt)';
|
||||
$cert['descr'] = (string)$cert_cn . ' (ACME Client)';
|
||||
$cert['refid'] = $cert_refid;
|
||||
|
||||
// Prepare certificate for import
|
||||
@@ -277,7 +277,7 @@ class LeCertificate extends LeCommon
|
||||
$newcert->addChild($certcfg, (string)$cert[$certcfg]);
|
||||
}
|
||||
}
|
||||
LeUtils::log("${import_log_message} Let's Encrypt X.509 certificate: ${cert_cn}");
|
||||
LeUtils::log("${import_log_message} ACME X.509 certificate: ${cert_cn}");
|
||||
|
||||
/**
|
||||
* Step 3: update configuration
|
||||
@@ -300,7 +300,7 @@ class LeCertificate extends LeCommon
|
||||
}
|
||||
|
||||
/**
|
||||
* check if certificate is already issued by Let's Encrypt
|
||||
* check if certificate is already issued by ACME CA
|
||||
* @return bool
|
||||
*/
|
||||
public function isIssued()
|
||||
|
||||
@@ -32,7 +32,7 @@ use OPNsense\Core\Config;
|
||||
use OPNsense\AcmeClient\LeUtils;
|
||||
|
||||
/**
|
||||
* Common constants and functions for all Let's Encrypt classes
|
||||
* Common constants and functions for all ACME classes
|
||||
* @package OPNsense\AcmeClient
|
||||
*/
|
||||
abstract class LeCommon
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
<?php
|
||||
|
||||
/*
|
||||
* Copyright (C) 2020 Frank Wall
|
||||
* Copyright (C) 2020-2021 Frank Wall
|
||||
* Copyright (C) 2018 Deciso B.V.
|
||||
* All rights reserved.
|
||||
*
|
||||
@@ -30,7 +30,7 @@
|
||||
namespace OPNsense\AcmeClient;
|
||||
|
||||
/**
|
||||
* Interface for Let's Encrypt validation methods
|
||||
* Interface for ACME validation methods
|
||||
* @package OPNsense\Backup
|
||||
*/
|
||||
interface LeValidationInterface
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
<acl>
|
||||
<page-services-letsencrypt>
|
||||
<name>Services: Let's Encrypt</name>
|
||||
<page-services-acmeclient>
|
||||
<name>Services: ACME Client</name>
|
||||
<patterns>
|
||||
<pattern>ui/acmeclient/*</pattern>
|
||||
<pattern>api/acmeclient/*</pattern>
|
||||
</patterns>
|
||||
</page-services-letsencrypt>
|
||||
</page-services-acmeclient>
|
||||
</acl>
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
<model>
|
||||
<mount>//OPNsense/AcmeClient</mount>
|
||||
<version>3.0.0</version>
|
||||
<description>A secure Let's Encrypt plugin</description>
|
||||
<description>A secure ACME Client plugin</description>
|
||||
<items>
|
||||
<settings>
|
||||
<enabled type="BooleanField">
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
<menu>
|
||||
<Services>
|
||||
<!-- using LE prefix for proper sorting -->
|
||||
<LEAcmeClient VisibleName="Let's Encrypt" cssClass="fa fa-certificate fa-fw">
|
||||
<AcmeClient VisibleName="ACME Client" cssClass="fa fa-certificate fa-fw">
|
||||
<Settings order="10" url="/ui/acmeclient">
|
||||
<General url="/ui/acmeclient#general-settings"/>
|
||||
</Settings>
|
||||
@@ -13,6 +12,6 @@
|
||||
<SystemLog VisibleName="System Log" order="10" url="/ui/acmeclient/logs"/>
|
||||
<AcmeLog VisibleName="Acme Log" order="20" url="/ui/diagnostics/log/core/acmeclient"/>
|
||||
</Logs>
|
||||
</LEAcmeClient>
|
||||
</AcmeClient>
|
||||
</Services>
|
||||
</menu>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{#
|
||||
|
||||
Copyright (C) 2017 Frank Wall
|
||||
Copyright (C) 2017-2021 Frank Wall
|
||||
OPNsense® is Copyright © 2014-2015 by Deciso B.V.
|
||||
All rights reserved.
|
||||
|
||||
@@ -300,7 +300,7 @@ POSSIBILITY OF SUCH DAMAGE.
|
||||
if (gridParams['register'] != undefined) {
|
||||
var uuid=$(this).data("row-id");
|
||||
stdDialogConfirm('{{ lang._('Confirmation Required') }}',
|
||||
'{{ lang._('Register the selected account with Lets Encrypt?') }}',
|
||||
'{{ lang._('Register the selected account with the configured ACME CA?') }}',
|
||||
'{{ lang._('Yes') }}', '{{ lang._('Cancel') }}', function() {
|
||||
ajaxCall(url=gridParams['register'] + uuid,sendData={},callback=function(data,status){
|
||||
// reload grid afterwards
|
||||
|
||||
@@ -41,7 +41,7 @@ use OPNsense\AcmeClient\LeCertificate;
|
||||
const ABOUT = <<<TXT
|
||||
|
||||
This script acts as a bridge between the OPNsense WebGUI/API and the
|
||||
acme.sh Let's Encrypt client.
|
||||
acme.sh ACME client.
|
||||
|
||||
TXT;
|
||||
|
||||
@@ -66,7 +66,7 @@ const MODES = [
|
||||
'description' => 'run automations for the specified certificate',
|
||||
],
|
||||
'register' => [
|
||||
'description' => 'register the specified account with Lets Encrypt',
|
||||
'description' => 'register the specified account with ACME CA',
|
||||
],
|
||||
];
|
||||
|
||||
@@ -76,7 +76,7 @@ const STATIC_OPTIONS = <<<TXT
|
||||
--mode Specify the mode of operation
|
||||
--cert The certificate UUID when working with a single certificate
|
||||
--all Work with ALL enabled certificates
|
||||
--account The account UUID when working with an Lets Encrypt account
|
||||
--account The account UUID when working with an ACME CA account
|
||||
--force Force certain operations (i.e. renew)
|
||||
--cron Special mode when running from cron (i.e. consider auto renew settings)
|
||||
TXT;
|
||||
@@ -98,7 +98,7 @@ const EXAMPLES = <<<TXT
|
||||
- Completely remove a certificate (keeping the copy in Trust Store untouched)
|
||||
lecert.php --mode remove --cert 00000000-0000-0000-0000-000000000000
|
||||
|
||||
- When registering a new account with Lets Encrypt
|
||||
- When registering a new account with ACME CA
|
||||
lecert.php --mode register --account 00000000-0000-0000-0000-000000000000
|
||||
TXT;
|
||||
|
||||
|
||||
@@ -82,7 +82,7 @@ command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/setup.sh; /usr/sbin/daem
|
||||
parameters:
|
||||
type:script
|
||||
message:cronjob running to sign or renew certificates
|
||||
description:Renew Let's Encrypt certificates
|
||||
description:Renew ACME certificates
|
||||
|
||||
[register-account]
|
||||
command:/usr/local/opnsense/scripts/OPNsense/AcmeClient/lecert.php --mode register --account
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ server.max-keep-alive-idle = 30
|
||||
# server.virtual-* options
|
||||
server.document-root = "/var/empty"
|
||||
|
||||
# Let's Encrypt acme challenges
|
||||
# ACME challenges
|
||||
alias.url += ( "/.well-known/acme-challenge/" => "/var/etc/acme-client/challenges/.well-known/acme-challenge/" )
|
||||
|
||||
# Maximum idle time with nothing being written
|
||||
|
||||
Reference in New Issue
Block a user