From 5ce806a7d7ae0f32c62cadbbfd1f2523326cb166 Mon Sep 17 00:00:00 2001
From: "henry.chen" <henry.chen@trustaisa.com>
Date: Fri, 25 Aug 2017 18:01:37 +0800
Subject: [PATCH] =?UTF-8?q?=E6=8C=91=E6=88=98=20acme.sh=20=E6=96=87?=
 =?UTF-8?q?=E4=BB=B6=E9=AA=8C=E8=AF=81=E8=B7=AF=E5=BE=84?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Makefile                      | 54 ++++++++++++++---------------------
 conf/nginx/domain/eiblog.conf |  2 +-
 2 files changed, 23 insertions(+), 33 deletions(-)

diff --git a/Makefile b/Makefile
index 283f119..8dd338c 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@ test:
 build:
 	@echo "go build..."
 	@CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build && \
-	  docker build -t $(docker_registry)/deepzz/eiblog:latest .
+		docker build -t $(docker_registry)/deepzz/eiblog:latest .
 
 deploy:build
 	@docker push $(docker_registry)/deepzz/eiblog:latest
@@ -24,47 +24,37 @@ dist:
 	@./dist.sh
 
 gencert:makedir
-	@echo $(Ali_Key) $(Ali_Secret)
 	@if [ ! -n "$(sans)" ]; then \
-      printf "Need one argument [sans=params]\n"; \
-	  printf "example: sans=\"-d domain -d domain\"\n"; \
-      exit 1; \
-    fi; \
+		printf "Need one argument [sans=params]\n"; \
+		printf "example: sans=\"-d domain -d domain\"\n"; \
+		exit 1; \
+	fi; \
 	if [ ! -n "$(cn)" ]; then \
-      printf "Need one argument [cn=params]\n"; \
-	  printf "example: cn=domain\n"; \
-      exit 1; \
-    fi
+		printf "Need one argument [cn=params]\n"; \
+		printf "example: cn=domain\n"; \
+		exit 1; \
+	fi
 	@if [ ! -f $(acme.sh) ]; then \
-	  curl https://get.acme.sh | sh; \
+		curl https://get.acme.sh | sh; \
 	fi
 
 	@echo "generate rsa cert..."
-	@$(acme.sh) --force --issue --dns dns_ali \
-	  $(sans) --log --renew-hook "ct-submit ctlog.api.venafi.com < $(config)/ssl/domain.rsa.pem > $(config)/scts/rsa/venafi.sct && \
-	  ct-submit ctlog.wosign.com < $(config)/ssl/domain.rsa.pem > $(config)/scts/rsa/wosign.sct"
+	@$(acme.sh) --force --issue --dns dns_ali $(sans) --log \
+		--renew-hook "ct-submit ctlog.api.venafi.com < $(config)/ssl/domain.rsa.pem > $(config)/scts/rsa/venafi.sct \
+		&& ct-submit ctlog.wosign.com < $(config)/ssl/domain.rsa.pem > $(config)/scts/rsa/wosign.sct"
 	@$(acme.sh) --install-cert -d $(cn) \
-      --key-file       $(config)/ssl/domain.rsa.key \
-      --fullchain-file $(config)/ssl/domain.rsa.pem \
-      --reloadcmd      "service nginx force-reload"
+		--key-file       $(config)/ssl/domain.rsa.key \
+		--fullchain-file $(config)/ssl/domain.rsa.pem \
+		--reloadcmd      "service nginx force-reload"
 
 	@echo "generate ecc cert..."
-	@$(acme.sh) --force --issue --dns dns_ali \
-	  $(sans) -k ec-256 --log --renew-hook "ct-submit ctlog.api.venafi.com < $(config)/ssl/domain.ecc.pem > $(config)/scts/ecc/venafi.sct && \
-	  ct-submit ctlog.wosign.com < $(config)/ssl/domain.ecc.pem > $(config)/scts/ecc/wosign.sct"
+	@$(acme.sh) --force --issue --dns dns_ali $(sans) -k ec-256 --log \
+		--renew-hook "ct-submit ctlog.api.venafi.com < $(config)/ssl/domain.ecc.pem > $(config)/scts/ecc/venafi.sct \
+		&& ct-submit ctlog.wosign.com < $(config)/ssl/domain.ecc.pem > $(config)/scts/ecc/wosign.sct"
 	@$(acme.sh) --install-cert -d $(cn) --ecc \
-      --key-file       $(config)/ssl/domain.ecc.key \
-      --fullchain-file $(config)/ssl/domain.ecc.pem \
-      --reloadcmd      "service nginx force-reload"
-
-# fullchained:
-# 	@if [ ! -n "$(cn)" ]; then \
-#       printf "Use acme.sh generated certs, Need one argument [cn=params]\n"; \
-# 	  printf "example: cn=domain\n"; \
-#       exit 1; \
-#     fi
-# 	@cp $(acme)/$(cn)/ca.cer $(config)/ssl/full_chained.pem && \
-# 	   echo $(X3) >> $(config)/ssl/full_chained.pem
+		--key-file       $(config)/ssl/domain.ecc.key \
+		--fullchain-file $(config)/ssl/domain.ecc.pem \
+		--reloadcmd      "service nginx force-reload"
 
 dhparams:
 	@openssl dhparam -out $(config)/ssl/dhparams.pem 2048
diff --git a/conf/nginx/domain/eiblog.conf b/conf/nginx/domain/eiblog.conf
index dca77b8..de35080 100644
--- a/conf/nginx/domain/eiblog.conf
+++ b/conf/nginx/domain/eiblog.conf
@@ -124,7 +124,7 @@ server {
 
     # letsencrypt file verify
     location ^~ /.well-known/acme-challenge/ {
-        alias                    /data/letsencrypt/challenges/;
+        alias                    /data/eiblog/challenges/;
         try_files                $uri =404;
     }