시놀로지 클라우드플레어 와일드 카드 인증서 발급 (acme.sh 사용)

ash-4.4# tar xvf master.tar.gz
acme.sh-master/
acme.sh-master/acme.sh
acme.sh-master/deploy/haproxy.sh
acme.sh-master/deploy/keychain.sh
acme.sh-master/deploy/kong.sh
acme.sh-master/deploy/lighttpd.sh
acme.sh-master/deploy/mailcow.sh
acme.sh-master/deploy/myapi.sh
acme.sh-master/deploy/mydevil.sh
acme.sh-master/deploy/mysqld.sh
acme.sh-master/deploy/nginx.sh
acme.sh-master/deploy/openmediavault.sh
acme.sh-master/deploy/opensshd.sh
[하략]

ash-4.4# ./acme.sh --install --nocron --home /usr/local/share/acme.sh --accountemail "admin@example.com"
[Mon Mar  4 07:02:34 PM KST 2024] It is recommended to install socat first.
[Mon Mar  4 07:02:34 PM KST 2024] We use socat for standalone server if you use standalone mode.
[Mon Mar  4 07:02:34 PM KST 2024] If you don't use standalone mode, just ignore this warning.
[Mon Mar  4 07:02:34 PM KST 2024] Installing to /usr/local/share/acme.sh
[Mon Mar  4 07:02:34 PM KST 2024] Installed to /usr/local/share/acme.sh/acme.sh
[Mon Mar  4 07:02:34 PM KST 2024] Installing alias to '/root/.profile'
[Mon Mar  4 07:02:34 PM KST 2024] OK, Close and reopen your terminal to start using acme.sh
[Mon Mar  4 07:02:34 PM KST 2024] Good, bash is found, so change the shebang to use bash as preferred.
[Mon Mar  4 07:02:36 PM KST 2024] OK

ash-4.4# export CF_Token="teYijHYmC05k0LxBVE2gAXIsWkC8ML"
ash-4.4# export CF_Email="admin@example.com"
ash-4.4# ./acme.sh --issue \
>   --server letsencrypt \
>   --home . \
>   -d navystack.com \
>   -d *.navystack.com \
>   --dns "dns_cf"
[Mon Mar  4 07:29:14 PM KST 2024] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Mon Mar  4 07:29:14 PM KST 2024] Create account key ok.
[Mon Mar  4 07:29:14 PM KST 2024] Registering account: https://acme-v02.api.letsencrypt.org/directory
[Mon Mar  4 07:29:16 PM KST 2024] Registered
[Mon Mar  4 07:29:16 PM KST 2024] ACCOUNT_THUMBPRINT='juX3O5JkWYQhkDV3MJBcUCbD9YURjc'
[Mon Mar  4 07:29:16 PM KST 2024] Creating domain key
[Mon Mar  4 07:29:16 PM KST 2024] The domain key is here: ./navystack.com_ecc/navystack.com.key
[Mon Mar  4 07:29:16 PM KST 2024] Multi domain='DNS:navystack.com,DNS:*.navystack.com'
[Mon Mar  4 07:29:19 PM KST 2024] Getting webroot for domain='navystack.com'
[Mon Mar  4 07:29:19 PM KST 2024] Getting webroot for domain='*.navystack.com'
[Mon Mar  4 07:29:19 PM KST 2024] Adding txt value: rPLmiPOUurIVus6LXUBAwoTLGAi8Zh for domain:  _acme-challenge.navystack.com
[Mon Mar  4 07:29:20 PM KST 2024] Adding record
[Mon Mar  4 07:29:21 PM KST 2024] Added, OK
[Mon Mar  4 07:29:21 PM KST 2024] The txt record is added: Success.
[Mon Mar  4 07:29:21 PM KST 2024] Adding txt value: iQQYKuBdCFVcFUuaxQ5Gy0VFu2ZVKb for domain:  _acme-challenge.navystack.com
[Mon Mar  4 07:29:22 PM KST 2024] Adding record
[Mon Mar  4 07:29:23 PM KST 2024] Added, OK
[Mon Mar  4 07:29:23 PM KST 2024] The txt record is added: Success.
[Mon Mar  4 07:29:23 PM KST 2024] Let's check each DNS record now. Sleep 20 seconds first.
[Mon Mar  4 07:29:44 PM KST 2024] You can use '--dnssleep' to disable public dns checks.
[Mon Mar  4 07:29:44 PM KST 2024] See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck
[Mon Mar  4 07:29:44 PM KST 2024] Checking navystack.com for _acme-challenge.navystack.com
[Mon Mar  4 07:29:44 PM KST 2024] Domain navystack.com '_acme-challenge.navystack.com' success.
[Mon Mar  4 07:29:44 PM KST 2024] Checking navystack.com for _acme-challenge.navystack.com
[Mon Mar  4 07:29:45 PM KST 2024] Domain navystack.com '_acme-challenge.navystack.com' success.
[Mon Mar  4 07:29:45 PM KST 2024] All success, let's return
[Mon Mar  4 07:29:45 PM KST 2024] Verifying: navystack.com
[Mon Mar  4 07:29:46 PM KST 2024] Pending, The CA is processing your order, please just wait. (1/30)
[Mon Mar  4 07:29:49 PM KST 2024] Success
[Mon Mar  4 07:29:49 PM KST 2024] Verifying: *.navystack.com
[Mon Mar  4 07:29:50 PM KST 2024] Pending, The CA is processing your order, please just wait. (1/30)
[Mon Mar  4 07:29:54 PM KST 2024] Success
[Mon Mar  4 07:29:54 PM KST 2024] Removing DNS records.
[Mon Mar  4 07:29:54 PM KST 2024] Removing txt: ljhRXfbutMTAqYo82CH0SylwXx3oDA for domain: _acme-challenge.navystack.com
[Mon Mar  4 07:29:56 PM KST 2024] Removed: Success
[Mon Mar  4 07:29:56 PM KST 2024] Removing txt: vrozqttp4tKoHwGjtCYwwjSyNW2Vkw for domain: _acme-challenge.navystack.com
[Mon Mar  4 07:29:58 PM KST 2024] Removed: Success
[Mon Mar  4 07:29:58 PM KST 2024] Verify finished, start to sign.
[Mon Mar  4 07:29:58 PM KST 2024] Lets finalize the order.
[Mon Mar  4 07:29:58 PM KST 2024] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/hzoNOnebvOFN4vD8V6z7PhCTed93c2/hzoNOnebvOFN4vD8V6z7PhCTed93c2'
[Mon Mar  4 07:30:00 PM KST 2024] Downloading cert.
[Mon Mar  4 07:30:00 PM KST 2024] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/m5XCIhnxcUJ4DFarHIc3qxWx5aMBFG'
[Mon Mar  4 07:30:01 PM KST 2024] Cert success.
-----BEGIN CERTIFICATE-----
소중한 나의 인증서 정보
-----END CERTIFICATE-----
[Mon Mar  4 07:30:01 PM KST 2024] Your cert is in: ./navystack.com_ecc/navystack.com.cer
[Mon Mar  4 07:30:01 PM KST 2024] Your cert key is in: ./navystack.com_ecc/navystack.com.key
[Mon Mar  4 07:30:01 PM KST 2024] The intermediate CA cert is in: ./navystack.com_ecc/ca.cer
[Mon Mar  4 07:30:01 PM KST 2024] And the full chain certs is there: ./navystack.com_ecc/fullchain.cer

ash-4.4# ./acme.sh --deploy --home . -d "navystack.com" --deploy-hook synology_dsm
[Mon Mar  4 07:34:31 PM KST 2024] The domain 'navystack.com' seems to have a ECC cert already, lets use ecc cert.
[Mon Mar  4 07:34:32 PM KST 2024] Logging into localhost:5000
[Mon Mar  4 07:34:35 PM KST 2024] Getting certificates in Synology DSM
[Mon Mar  4 07:34:35 PM KST 2024] Generate form POST request
[Mon Mar  4 07:34:35 PM KST 2024] Upload certificate to the Synology DSM
[Mon Mar  4 07:34:59 PM KST 2024] Restarting HTTP services succeeded
[Mon Mar  4 07:35:02 PM KST 2024] Success

#!/bin/bash

## SPDX-License-Identifier: MIT

# 변수 설정
ACME_HOME="/usr/local/share/acme.sh"
ACME_SERVER="google"
DNS_PROVIDER="dns_cf"
DOMAIN="navystack.com"

# SSL 인증서 갱신 및 로그 출력
log_output=$($ACME_HOME/acme.sh --cron --home $ACME_HOME --server $ACME_SERVER --dns "$DNS_PROVIDER")

# 다음 갱신 시간 파싱
next_renewal_time=$(echo "$log_output" | grep -oP 'Next renewal time is: \K[^ ]+')
next_renewal_time_kst=$(date -d "$next_renewal_time" +%Y-%m-%dT%H:%M:%S)

# 갱신할 필요가 없는 경우
if ! echo "$log_output" | grep -q "to force to renew"; then
    echo "$log_output"
else
    # 인증서 갱신 생략
    echo "인증서 갱신을 생략합니다."
    echo "갱신 가능 시간은 한국 기준 $next_renewal_time_kst 입니다."
    echo "따라서, 인증서 배포를 생략합니다."
    exit 0
fi

# 인증서 배포
deploy_output=$($ACME_HOME/acme.sh --deploy --home $ACME_HOME -d "$DOMAIN" --deploy-hook synology_dsm --server $ACME_SERVER)

# 배포 중 오류 처리
if [ $? -ne 0 ]; then
    echo "인증서 배포 중에 오류가 발생했습니다:"
    echo "$deploy_output"
    exit 1
fi

echo "인증서 배포가 완료되었습니다."

#!/bin/bash

## SPDX-License-Identifier: MIT

# 변수 설정
ACME_HOME="/usr/local/share/acme.sh"
ACME_SERVER="letsencrypt"
DNS_PROVIDER="dns_cf"
DOMAIN="navystack.com"

# SSL 인증서 갱신 및 로그 출력
log_output=$($ACME_HOME/acme.sh --cron --home $ACME_HOME --server $ACME_SERVER --dns "$DNS_PROVIDER")

# 다음 갱신 시간 파싱
next_renewal_time=$(echo "$log_output" | grep -oP 'Next renewal time is: \K[^ ]+')
next_renewal_time_kst=$(date -d "$next_renewal_time" +%Y-%m-%dT%H:%M:%S)

# 갱신할 필요가 없는 경우
if ! echo "$log_output" | grep -q "to force to renew"; then
    echo "$log_output"
else
    # 인증서 갱신 생략
    echo "인증서 갱신을 생략합니다."
    echo "갱신 가능 시간은 한국 기준 $next_renewal_time_kst 입니다."
    echo "따라서, 인증서 배포를 생략합니다."
    exit 0
fi

# 인증서 배포
deploy_output=$($ACME_HOME/acme.sh --deploy --home $ACME_HOME -d "$DOMAIN" --deploy-hook synology_dsm --server $ACME_SERVER)

# 배포 중 오류 처리
if [ $? -ne 0 ]; then
    echo "인증서 배포 중에 오류가 발생했습니다:"
    echo "$deploy_output"
    exit 1
fi

echo "인증서 배포가 완료되었습니다."