Right yeah, probably should provide that file. It's safe enough, I guess.

mkcerts.sh

@@ -19,7 +19,7 @@ function hex2bin { cat | sed 's/\([0-9a-f]\{2\}\)/\\\\\\x\1/g' | xargs printf; }
 
 # UTILS
 
-function getCAURLs
+function get_CA_URLs
 {
 	declare -A CAs
 	CAs[LE]=https://acme-v02.api.letsencrypt.org/directory
@@ -31,11 +31,13 @@ function getCAURLs
 	CAs[sslcom_ecc]=https://acme.ssl.com/sslcom-dv-ecc
 	CAs[jewgle]=https://dv.acme-v02.api.pki.goog/directory
 	CAs[jewgletest]=https://dv.acme-v02.test-api.pki.goog/directory
-	endpoints=$(curl -s ${CAs[$1]})
+	CA=$1
-	export endpoints # I don't know if this works
+	endpoints=$(curl -s ${CAs[$CA]})
+	export CA
+	export endpoints # I don't know if this works, or if it matters
 } # $1=LE
 
-function readACME
+function read_ACME
 {
 	# Extract signature info from key:
 	read hex exp <<< $(openssl rsa -in account.key -noout -text | tr -d ': \r\n' | sed -E 's/^.*modulus00([a-f0-9]+)publicExponent[0-9]+\(0x([0-9a-f]+)\).*$/\1 \2/')
@@ -48,16 +50,16 @@ function readACME
 	thumb=$(echo -n "$jerk" | tr -d ' ' | short256 | hex2bin | b64u) # How many times can you b64 a bowl of ramen before it begins questioning its existence
 }
 
-function loadkid
+function load_kid
 {
 	kid=$1
-	if [ -z "$kid" -a -e "kid" ]; then kid=$(cat kid); fi
+	if [ -z "$kid" -a -e "$CA.kid" ]; then kid=$(cat $CA.kid); fi
 	if [ -n "$kid" ]; then
 		sig='{"alg": "RS256", "kid": "'$kid'"}'
 	fi
 }
 
-function getNonce
+function get_nonce
 {
 	# Get a nonce (nigger):
 	nonce_resp=$1
@@ -67,86 +69,127 @@ function getNonce
 	grep -i 'replay-nonce' <<< "$nonce_resp" | tr -d "\r" | grep -Eo '[0-9a-zA-Z_\-]+$' # Fucking Windows line endings
 }
 
+# ZONEFILE UTILS
+function czf { sed -i '/_ACME-CHALLENGE/d' "$1"; } # clear zone file
+function szf # setup zone file
+{
+	file=$1
+	shift
+	for tok in $@; do
+		echo _ACME-CHALLENGE	300	TXT	$(echo -n "$tok.$thumb" | short256 | hex2bin | b64u) >> $file
+	done
+}
+function usoa # update SOA
+{
+	inc=$(grep -Eo 'SOA	[^	]+	[^	]+	[0-9]+' $1 | grep -Eo '[0-9]+$')
+	sed -ie 's/SOA\t\([^\t]*\)\t\([^\t]*\)\t[0-9]*/SOA	\1	\2	'$((inc+1))'/' $1
+}
+
 # CHALLENGES
 
-function order
+function complete_challenges
 {
-	readACME # get thumb. It fucks up sig but I don't care, sendreq fixes it.
+	read_ACME # get thumb. It fucks up sig but I don't care, send_req fixes it.
-	declare -a urls
+	declare -A chals toks
-	i=0
+	urls=$(jq -r '.[]' <<< "$1")
-	doms=$(jq -r '.[]' <<< "$1")
+	while read url; do
-	while read dom; do
+		read dom chalurl tok <<< "$(send_req $url | jq -r '.identifier.value+" "+(.challenges | .[] | select(.type == "dns-01") | .url+" "+.token)')"
-		urls[$i]=$(challenge "$(sendreq $dom)") # this is meant to be signed but it seems to work without it...? But sign it just in case it's a test-only thing.
+		chals[$dom]="${chals[$dom]}$(base64 -w 0 <<< "$chalurl");"
-		i=$((i+1))
+		toks[$dom]="${toks[$dom]}$(base64 -w 0 <<< "$tok");"
-	done <<< "$doms"
+	done <<< "$urls"
-	systemctl reload named # Actually update DNS for real final7
+	for dom in ${!toks[@]}; do
-	sleep 120 # Wait for DNS to update. Generally it won't have been requested in ages so it won't be in any caches.
+		apply_challenge $dom ${toks[$dom]}
-	for url in ${urls[@]}; do
-		sendreq $url '{}' | jq '(.validationRecord | map(.hostname) | join(" "))+" "+.status' # need empty dict to tell server to validate challenge, empty body only checks status. Just another certified ACME moment.
 	done
-	sleep 30 # Wait for challenges to complete - the previous call can return before the challenge completes.
+	systemctl reload named # Actually update DNS for real final7
-	for url in ${urls[@]}; do
+	declare -a pending
-		sendreq $url | jq '(.validationRecord | map(.hostname) | join(" "))+" "+.status'
+	for dom in ${!chals[@]}; do
+		IFS=';' read -a chalurls <<< ${chals[$dom]}
+		for chalurl in ${chalurls[@]}; do
+			sleep 1 # Spam a bit less
+			rurl=$(base64 -d <<< $chalurl)
+			send_req $rurl '{}' > /dev/null # need empty dict to tell server to validate challenge, empty body only checks status. Just another certified ACME moment.
+			pending+=("$rurl")
+		done
+	done
+	# now we wait for validations
+	dirty=1
+	timer=10
+	backoff=1
+	tick=0
+	while [ $dirty -gt 0 ]; do
+		dirty=0
+		for url in ${pending[@]}; do
+			sleep 1
+			oof=$(send_req $url)
+			oof2=$(jq -r .status <<< "$oof")
+			nonce=$(get_nonce) # For some reason checking status doesn't come back with a nonce, or comes back with same nonce.
+			if [ $oof2 != valid ]; then dirty=1; fi
+		done
+		sleep $timer # This gets slower each iteration, to spam the server less
+		timer=$(($timer+$backoff))
+		tick=$(($tick+1))
+		if [ $tick -eq $backoff ]; then tick=0; backoff=$(($backoff+1)); fi
 	done
 }
 
-function challenge
+function apply_challenge
 {
-	read dom url tok <<< $(jq -r '.identifier.value+" "+(.challenges | .[] | select(.type == "dns-01") | .url+" "+.token)' <<< "$1")
+	dnsname="/var/named/$(ifsrev $1 .).zone"
-	tik=$(echo -n "$tok.$thumb" | short256 | hex2bin | b64u)
+	czf $dnsname
-	dnsname="/var/named/$(ifsrev $dom .).zone"
+	szf $dnsname $(tr ';' '\n' <<< $2 | base64 -d | tr '\n' ' ') # Actually update the DNS
-	inc=$(grep -Eo 'SOA	[^	]+	[^	]+	[0-9]+' $dnsname | grep -Eo '[0-9]+$')
+	usoa $dnsname # And don't forget to update the SOA number
-	if ! grep -i _ACME-CHALLENGE $dnsname > /dev/null; then echo >> $dnsname; echo "_ACME-CHALLENGE	300	TXT	aa" >> $dnsname; fi
-	sed -i -e 's/^_ACME-CHALLENGE	300	TXT	.*$/_ACME-CHALLENGE	300	TXT	'$tik'/' -e 's/SOA\t\([^\t]*\)\t\([^\t]*\)\t[0-9]*/SOA	\1	\2	'$((inc+1))'/' $dnsname # Actually update the DNS
-	echo $url # Then give back the verification URL to be used later
 }
 
 # CORE ACTIONS
 
-function genACMEkey { openssl genrsa -traditional 2048 > account.key; }
+function gen_ACME_key { openssl genrsa -traditional 2048 > account.key; }
 
-function registerAcc
+function register_acc
 {
 	# Create account:
-	readACME
+	read_ACME
 	url=$(echo $endpoints | jq -r .newAccount)
-	req='{"termsOfServiceAgreed": true, "contact": ["mailto:zerglingman@fedora.email"]}'
+	req='{"termsOfServiceAgreed": true, "contact": ["mailto:zerglingman@fedora.email"], "externalAccountBinding":"zerglingman@fedora.email"}'
-	out=$(sendreq "$url" "$req" yes)
+	out=$(send_req "$url" "$req" yes)
+	echo $out >&2
 	loc=$(grep -i 'location' <<< "$out" | grep -io http.*$)
-	loadkid $loc
+	load_kid $loc
 	echo $loc
 }
 
-function getcert
+function get_cert
 {
 	conf=$1
 	shift
 	url=$(echo $endpoints | jq -r .newOrder)
 	req='{"identifiers": ['
 	for n in $@; do
-		req=$req'{"type": "dns", "value": "'$n'"}, '
+		req=$req'{"type": "dns", "value": "'$n'"}, {"type": "dns", "value": "*.'$n'"}, ' # Do not put wildcard domains in; this will do it automatically. You still need to put them in the nuconf.
 	done
 	req=${req:0:-2}']}'
-	order=$(sendreq $url "$req")
+	order=$(send_req $url "$req" yes)
+	headers=$(sed -n 1,/^$/p <<< "$order")
+	order=$(sed 1,/^$/d <<< "$order")
 	# I can just access the headers lol
-	orderurl=$(grep -i location <<< "$req_heads" | grep -io http.*$)
+	# No I can't, assfucked by subshells again
+	orderurl=$(grep -i location <<< "$headers" | grep -io http.*$)
 	auths=$(jq '.authorizations' <<< "$order")
 	finalise=$(jq -r '.finalize' <<< "$order")
-	order "$auths"
+	complete_challenges "$auths"
 	openssl req -new -key live.key -out live.csr -sha256 -noenc -config $conf -outform DER
 	# I guess I should just include the conf file
-	sendreq $finalise '{"csr":"'$(cat live.csr | b64u)'"}'
+	send_req $finalise '{"csr":"'$(cat live.csr | b64u)'"}'
-	certurl=$(sendreq $orderurl | jq -r .certificate)
+	certurl=$(send_req $orderurl | jq -r .certificate)
 	curl $certurl > out.crt
 }
 
 # SERVER COMMUNICATION
 
-function sendreq
+function send_req
 {
-	loadkid # Just to make sure the sig is set correctly. It won't overwrite it unless it should be.
+	load_kid # Just to make sure the sig is set correctly. It won't overwrite it unless it should be.
 	url=$1; if [ -n "$2" ]; then req=$(b64u <<< "$2"); else req=""; fi
-	if [ -z "$nonce" ]; then nonce=$(getNonce); fi
+	if [ -z "$nonce" ]; then nonce=$(get_nonce); fi
 	data=$(jq '.+{"nonce":"'$nonce'","url":"'$url'"}' <<< "$sig" | tr -d '\r\n' | tr -s ' ' ' ' | sed -e 's/{ /{/g' -e 's/ }/}/g') # Keys don't need to be sorted here, but they still are.
 	# I don't know why the URL has to be in the body that is sent to the URL.
 	# ACME is a terrible protocol.
@@ -156,14 +199,14 @@ function sendreq
 	req_resp=$(curl -isH "Content-type:application/jose+json" $url --data "$mexican" | tr -d "\r") # Here is the line that does the work
 	req_heads=$(sed -n 1,/^$/p <<< "$req_resp")
 	req_resp=$(sed 1,/^$/d <<< "$req_resp")
-	nonce=$(getNonce "$req_heads")
+	nonce=$(get_nonce "$req_heads")
-	if [ -n "$3" ]; then echo "$req_heads"; fi
+	if [ -n "$3" ]; then printf "$req_heads"; echo; echo; fi
 	echo $req_resp
 }
 
 # MAIN
 
-getCAURLs $1
+get_CA_URLs $1
 shift
-loadkid
+load_kid
-$*
+$@

nuconf

@@ -0,0 +1,49 @@
+#This bit doesn't work for some reason, it complains about xmppAddr already existing, but then generates errors below because it doesn't exist, so fuck it, magic number.
+#oid_section             = new_oids
+#[ new_oids ]
+# RFC 6120 section 13.7.1.4 defines this OID
+#xmppAddr = 1.3.6.1.5.5.7.8.5
+
+[ req ]
+
+default_bits            = 2048
+distinguished_name      = distinguished_name
+req_extensions          = v3_extensions
+x509_extensions         = v3_extensions
+
+# don't ask about the DN
+prompt = no
+
+[ distinguished_name ]
+
+countryName                     = AU
+stateOrProvinceName             = TAS
+
+commonName                      = rakka.au
+
+[ v3_extensions ]
+
+# for certificate requests (req_extensions)
+# and self-signed certificates (x509_extensions)
+
+keyUsage                        = digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName                  = @subject_alternative_name
+
+[ subject_alternative_name ]
+
+DNS.0 = rakka.au
+otherName.0 = 1.3.6.1.5.5.7.8.5;UTF8:rakka.au
+
+#Append the following for a server which handles multiple domain names:
+DNS.1 = harpy.faith
+otherName.1 = 1.3.6.1.5.5.7.8.5;UTF8:harpy.faith
+DNS.2 = botegirl.parts
+otherName.2 = 1.3.6.1.5.5.7.8.5;UTF8:botegirl.parts
+
+DNS.3 = *.rakka.au
+otherName.3 = 1.3.6.1.5.5.7.8.5;UTF8:*.rakka.au
+DNS.4 = *.harpy.faith
+otherName.4 = 1.3.6.1.5.5.7.8.5;UTF8:*.harpy.faith
+DNS.5 = *.botegirl.parts
+otherName.5 = 1.3.6.1.5.5.7.8.5;UTF8:*.botegirl.parts