Last active
December 21, 2015 13:21
-
-
Save Sambego/e91acc0c2b5d92fbd9ce to your computer and use it in GitHub Desktop.
Check if a Let's Encrypt certificate needs renewal, and renew if possible. This script is an adapted version of the one made by Erika Heidi for Digital Ocean. The only difference is this works on nginx.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/bin/bash | |
| #================================================================ | |
| # Let's Encrypt renewal script for Nginx on Ubuntu/Debian | |
| # @author Erika Heidi<erika@do.co> | |
| # Edited by Sam Bellen <@sambego> | |
| # Usage: ./le-renew.sh [base-domain-name] | |
| # More info: http://do.co/1mbVihI | |
| #================================================================ | |
| domain=$1 | |
| le_path='/opt/letsencrypt' | |
| le_conf='/etc/letsencrypt' | |
| exp_limit=30; | |
| get_domain_list(){ | |
| certdomain=$1 | |
| config_file="$le_conf/renewal/$certdomain.conf" | |
| if [ ! -f $config_file ] ; then | |
| echo "[ERROR] The config file for the certificate $certdomain was not found." | |
| exit 1; | |
| fi | |
| domains=$(grep --only-matching --perl-regex "(?<=domains \= ).*" "${config_file}") | |
| last_char=$(echo "${domains}" | awk '{print substr($0,length,1)}') | |
| if [ "${last_char}" = "," ]; then | |
| domains=$(echo "${domains}" |awk '{print substr($0, 1, length-1)}') | |
| fi | |
| echo $domains; | |
| } | |
| if [ -z "$domain" ] ; then | |
| echo "[ERROR] you must provide the domain name for the certificate renewal." | |
| exit 1; | |
| fi | |
| cert_file="/etc/letsencrypt/live/$domain/fullchain.pem" | |
| if [ ! -f $cert_file ]; then | |
| echo "[ERROR] certificate file not found for domain $domain." | |
| exit 1; | |
| fi | |
| exp=$(date -d "`openssl x509 -in $cert_file -text -noout|grep "Not After"|cut -c 25-`" +%s) | |
| datenow=$(date -d "now" +%s) | |
| days_exp=$(echo \( $exp - $datenow \) / 86400 |bc) | |
| echo "Checking expiration date for $domain..." | |
| if [ "$days_exp" -gt "$exp_limit" ] ; then | |
| echo "The certificate is up to date, no need for renewal ($days_exp days left)." | |
| exit 0; | |
| else | |
| echo "The certificate for $domain is about to expire soon. Starting renewal request..." | |
| domain_list=$( get_domain_list $domain ) | |
| # In order to successfully run the Let's Encrypt renewak script, nginx needs to be stopped. | |
| # This means your site will be offline for a few seconds, | |
| # but don't wory, we'll restart nginx as soon as the script finishes. | |
| echo "Stopping nginx..." | |
| /usr/sbin/service nginx stop | |
| "$le_path"/letsencrypt-auto certonly --renew-by-default --domains "${domain_list}" | |
| echo "Starting nginx..." | |
| /usr/sbin/service nginx start | |
| echo "Renewal process finished for domain $domain" | |
| exit 0; | |
| fi |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment