You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1041 lines
38 KiB
1041 lines
38 KiB
<?php
|
|
|
|
class Output {
|
|
private static $colorEnum = array(
|
|
'red' => '[31m',
|
|
'green' => '[32m',
|
|
'yellow' => '[33m',
|
|
'blue' => '[34m',
|
|
'purple' => '[35m',
|
|
'sky-blue' => '[36m',
|
|
);
|
|
|
|
public static function str($content, $color = '') { // 输出字符串
|
|
if (!isset(self::$colorEnum[$color])) {
|
|
echo $content;
|
|
return;
|
|
}
|
|
echo "\033" . self::$colorEnum[$color] . $content . "\033" . "[0m";
|
|
}
|
|
|
|
public static function line($content, $color = '') { // 输出一行
|
|
self::str($content . PHP_EOL, $color);
|
|
}
|
|
}
|
|
|
|
class Fake {
|
|
private static function randLocation() { // 生成虚假地址及编码
|
|
$gb2260 = Storage::getGB2260();
|
|
$subData = array();
|
|
foreach ($gb2260 as $code => $content) {
|
|
if (substr($code, 2, 2) === '00') { continue; }
|
|
if (substr($code, 4, 2) === '00') { continue; }
|
|
$subData[$code] = $content;
|
|
}
|
|
$code = array_rand($subData);
|
|
return array(
|
|
'code' => $code,
|
|
'level_1' => $gb2260[substr($code, 0, 2) . '0000'],
|
|
'level_2' => $gb2260[substr($code, 0, 4) . '00'],
|
|
'level_3' => $gb2260[$code],
|
|
);
|
|
}
|
|
|
|
private static function randDate() { // 随机生成日期
|
|
$time = rand(3000, 12000) * 24 * 3600;
|
|
return array(
|
|
'date' => date("Ymd", $time),
|
|
'format' => date("Y-m-d", $time)
|
|
);
|
|
}
|
|
|
|
public static function randIdNum() { // 生成身份证号
|
|
$wi = array(7, 9, 10, 5, 8, 4, 2, 1, 6, 3, 7, 9, 10, 5, 8, 4, 2);
|
|
$ai = array('1', '0', 'X', '9', '8', '7', '6', '5', '4', '3', '2');
|
|
$location = self::randLocation();
|
|
$date = self::randDate();
|
|
$orderNum = rand(100, 999);
|
|
$sex = ($orderNum % 2 !== 0) ? 'male' : 'female';
|
|
$idNum = $location['code'] . $date['date'] . $orderNum;
|
|
$sign = 0;
|
|
for ($i = 0; $i < 17; $i++) {
|
|
$bit = (int)$idNum{$i};
|
|
$sign += $bit * $wi[$i];
|
|
}
|
|
unset($location['code']);
|
|
return array(
|
|
'idNum' => $idNum . $ai[$sign % 11],
|
|
'location' => $location,
|
|
'date' => $date['format'],
|
|
'sex' => $sex
|
|
);
|
|
}
|
|
|
|
public static function randPhoneNum() { // 随机电话号码
|
|
$prefix = array(
|
|
130,131,132,133,134,135,136,137,138,139,
|
|
144,147,
|
|
150,151,152,153,155,156,157,158,159,
|
|
176,177,178,
|
|
180,181,182,183,184,185,186,187,188,189,
|
|
);
|
|
return $prefix[array_rand($prefix)] . rand(10000000, 99999999);
|
|
}
|
|
|
|
public static function randName($male = true) { // 随机姓名
|
|
$firstname = array(
|
|
'赵','钱','孙','李','周','吴','郑','王','冯','陈','褚','蒋','沈','韩','杨','朱','秦','姬','许','何','吕','张','孔','曹',
|
|
'戚','谢','邹','喻','章','苏','潘','葛','范','彭','鲁','韦','马','方','任','袁','柳','史','唐','姜','薛','雷','贺','陶',
|
|
'汤','殷','罗','毕','郝','常','傅','齐','顾','孟','黄','萧','尹','姚','邵','汪','祁','毛','米','戴','宋','庞','霍','倪',
|
|
'纪','项','祝','董','梁','杜','阮','季','贾','江','童','郭','梅','卢','林','钟','徐','邱','骆','夏','蔡','田','胡','凌',
|
|
);
|
|
$lastname_male = array(
|
|
'伟','刚','勇','毅','俊','峰','强','军','平','文','辉','力','明','永','健','志','兴','良','海','山','波','贵','福','龙',
|
|
'元','全','国','胜','学','祥','才','武','新','清','彬','富','顺','信','子','杰','涛','成','康','光','天','达','中','茂',
|
|
'和','彪','博','诚','震','振','壮','思','豪','邦','承','绍','松','善','磊','民','哲','江','超','浩','亮','政','瀚','行',
|
|
'翰','朗','伯','宏','鸣','斌','栋','维','启','克','伦','翔','旭','鹏','泽','晨','辰','士','建','家','致','树','德','坚',
|
|
);
|
|
$lastname_female = array(
|
|
'楠','榕','风','航','弘','秀','娟','英','慧','巧','美','娜','静','淑','珠','翠','雅','芝','玉','萍','红','娥','玲','芬',
|
|
'芳','燕','彩','春','兰','凤','洁','梅','琳','素','云','莲','雪','霞','香','月','莺','媛','艳','佳','嘉','琼','珍','莉',
|
|
'璐','晶','妍','茜','秋','珊','莎','黛','倩','婷','姣','婉','娴','瑾','颖','瑶','怡','婵','纨','仪','荷','丹','蓉','若',
|
|
'琴','蕊','薇','菁','梦','馨','瑗','韵','园','咏','卿','澜','纯','毓','悦','昭','冰','琬','羽','希','欣','滢','馥','贞',
|
|
);
|
|
$lastname = ($male) ? $lastname_male : $lastname_female;
|
|
$name = $lastname[array_rand($lastname)];
|
|
if (rand(1, 6) > 1) {
|
|
$name .= $lastname[array_rand($lastname)];
|
|
}
|
|
return $firstname[array_rand($firstname)] . $name;
|
|
}
|
|
}
|
|
|
|
class Storage {
|
|
private static $workDir = '/etc/encryption365';
|
|
|
|
public static function getGB2260() { // 读取GB2260数据
|
|
return json_decode(file_get_contents(self::$workDir . 'GB2260.json'), true);
|
|
}
|
|
|
|
public static function setClientInfo($email, $clientId, $token) { // 客户端凭证写入到本地文件
|
|
$content = 'account = ' . $email . PHP_EOL;
|
|
$content .= 'client_id = ' . $clientId . PHP_EOL;
|
|
$content .= 'access_token = ' . $token . PHP_EOL;
|
|
file_put_contents(self::$workDir . '/client.conf', $content);
|
|
}
|
|
|
|
public static function getClientInfo() { // 本地文件读取客户端凭证
|
|
$raw = explode(PHP_EOL, file_get_contents(self::$workDir . '/client.conf'));
|
|
$info = array();
|
|
foreach ($raw as $row) {
|
|
$row = explode('=', $row);
|
|
if (count($row) !== 2) { continue; }
|
|
$info[trim($row[0])] = trim($row[1]);
|
|
}
|
|
return $info;
|
|
}
|
|
|
|
public static function setValidation($content) { // 设置验证内容
|
|
file_put_contents(self::$workDir . '/validation.txt', $content);
|
|
}
|
|
|
|
public static function delValidation() { // 删除验证文件
|
|
unlink(self::$workDir . '/validation.txt');
|
|
}
|
|
|
|
public static function getHostList() { // 获取站点列表
|
|
$file = self::$workDir . '/site.json';
|
|
if (!is_file($file)) {
|
|
file_put_contents($file, '[]');
|
|
return array();
|
|
}
|
|
return json_decode(file_get_contents($file), true);
|
|
}
|
|
|
|
public static function setHostList($hosts) { // 写入站点列表
|
|
file_put_contents(self::$workDir . '/site.json', json_encode($hosts));
|
|
}
|
|
|
|
public static function addHost($host) { // 新增一个站点
|
|
self::setHostList(array_merge(
|
|
self::getHostList(), array($host)
|
|
));
|
|
}
|
|
|
|
public static function delHost($host) { // 删除一个站点
|
|
if (!self::isHost($host)) { return; }
|
|
$list = array_flip(self::getHostList());
|
|
unset($list[$host]);
|
|
self::setHostList(array_values(array_flip($list)));
|
|
}
|
|
|
|
public static function isHost($host) { // 检查站点是否存在
|
|
return in_array($host, self::getHostList());
|
|
}
|
|
|
|
private static function setHostConfig($host, $file, $content) { // 写入站点文件
|
|
$dir = self::$workDir . '/' . $host;
|
|
if (!is_dir($dir)) {
|
|
mkdir($dir);
|
|
}
|
|
file_put_contents(self::$workDir . '/' . $host . '/' . $file, $content);
|
|
}
|
|
|
|
private static function getHostConfig($host, $file) { // 读取站点文件
|
|
return file_get_contents(self::$workDir . '/' . $host . '/' . $file);
|
|
}
|
|
|
|
public static function setPrivkey($host, $content) { // 存储站点私钥
|
|
self::setHostConfig($host, 'private.key', $content);
|
|
}
|
|
|
|
public static function getPrivkey($host) { // 读取站点私钥
|
|
return self::getHostConfig($host, 'private.key');
|
|
}
|
|
|
|
public static function setCsr($host, $content) { // 存储站点CSR记录
|
|
self::setHostConfig($host, 'csr.dat', $content);
|
|
}
|
|
|
|
public static function getCsr($host) { // 读取站点CSR记录
|
|
return self::getHostConfig($host, 'csr.dat');
|
|
}
|
|
|
|
public static function setCert($host, $content) { // 储存站点证书文件
|
|
self::setHostConfig($host, 'cert.crt', $content);
|
|
}
|
|
|
|
public static function getCert($host) { // 读取站点证书文件
|
|
return self::getHostConfig($host, 'cert.crt');
|
|
}
|
|
|
|
public static function setCaCert($host, $content) { // 存储站点CA证书
|
|
self::setHostConfig($host, 'ca.crt', $content);
|
|
}
|
|
|
|
public static function getCaCert($host) { // 读取站点CA证书
|
|
return self::getHostConfig($host, 'ca.crt');
|
|
}
|
|
|
|
public static function setInfo($host, $info) { // 记录站点信息
|
|
self::setHostConfig($host, 'info.json', json_encode($info));
|
|
}
|
|
|
|
public static function getInfo($host) { // 读取站点信息
|
|
return json_decode(self::getHostConfig($host, 'info.json'), true);
|
|
}
|
|
}
|
|
|
|
class Encryption365 {
|
|
private static $version = '1.3.1';
|
|
private static $apiEntry = 'https://encrypt365.trustocean.com';
|
|
|
|
private function callApi(string $uri, array $params) { // Encrypt365 API接口
|
|
$curl = curl_init();
|
|
curl_setopt($curl, CURLOPT_URL, self::$apiEntry . $uri);
|
|
curl_setopt($curl, CURLOPT_POST, 1);
|
|
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
|
|
curl_setopt($curl, CURLOPT_CUSTOMREQUEST, "POST");
|
|
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode($params));
|
|
curl_setopt($curl, CURLOPT_USERAGENT, 'Encryption365-Client/' . self::$version . ';BaotaPanel-LinuxVersion');
|
|
curl_setopt($curl, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
|
|
$callResult = curl_exec($curl);
|
|
if (curl_error($curl)) {
|
|
die('Curl Error: ' . curl_error($curl));
|
|
}
|
|
curl_close($curl);
|
|
$result = json_decode($callResult, true);
|
|
if(isset($result['status']) && $result['status'] === 'error') {
|
|
return array(
|
|
'status' => 'error',
|
|
'message' => $result['message']
|
|
);
|
|
}
|
|
return $result;
|
|
}
|
|
|
|
private static function getClientInfo() { // 获取客户端ID和token
|
|
$info = Storage::getClientInfo();
|
|
if (!isset($info['client_id'])) {
|
|
die('Fail to get client_id');
|
|
}
|
|
if (!isset($info['access_token'])) {
|
|
die('Fail to get access_token');
|
|
}
|
|
return array(
|
|
'client_id' => $info['client_id'],
|
|
'access_token' => $info['access_token']
|
|
);
|
|
}
|
|
|
|
public static function getLatest() { // 获取最新版本
|
|
return self::callApi('/client/version', array());
|
|
}
|
|
|
|
public static function authcodeSend($email) { // 发送注册验证码
|
|
return self::callApi('/account/register/authcode', array(
|
|
'username' => $email
|
|
));
|
|
}
|
|
|
|
public static function accountRegister($info) { // 注册账号
|
|
return self::callApi('/account/register', array(
|
|
'username' => $info['email'],
|
|
'password' => $info['password'],
|
|
'authcode' => $info['authcode'],
|
|
'realName' => $info['realName'],
|
|
'idcardNumber' => $info['idcardNumber'],
|
|
'phoneNumber' => $info['phoneNumber'],
|
|
'country' => $info['country'],
|
|
'companyname' => $info['companyName']
|
|
));
|
|
}
|
|
|
|
public static function clientLogin($username, $password) { // 客户端登录
|
|
return self::callApi("/client/create", array(
|
|
'username' => $username,
|
|
'password' => $password,
|
|
'servername' => 'example.com',
|
|
));
|
|
}
|
|
|
|
public static function getAccountDetail() { // 获取账户信息
|
|
return self::callApi('/account/details', self::getClientInfo());
|
|
}
|
|
|
|
public static function getProducts() { // 获取可购买产品
|
|
return self::callApi('/account/products', self::getClientInfo())['products'];
|
|
}
|
|
|
|
public static function certCreate($productId, $csrCode, $domains) { // 创建证书
|
|
return self::callApi('/cert/create', self::getClientInfo() + array(
|
|
'pid' => $productId,
|
|
'period' => 'quarterly',
|
|
'csr_code' => $csrCode,
|
|
'domains' => implode(',', $domains),
|
|
'renew' => false,
|
|
'old_vendor_id' => -1,
|
|
));
|
|
}
|
|
|
|
public static function certReValidation($vendorId) { // 重新执行域名验证
|
|
return self::callApi('/cert/challenge', self::getClientInfo() + array(
|
|
'trustocean_id' => $vendorId
|
|
));
|
|
}
|
|
|
|
public static function certDetails($vendorId) { // 查询证书详细信息
|
|
return self::callApi('/cert/details', self::getClientInfo() + array(
|
|
'trustocean_id' => $vendorId
|
|
));
|
|
}
|
|
|
|
public static function certRenew($productId, $csrCode, $domains, $oldVendorId) { // 更新证书
|
|
return self::callApi('/cert/create', self::getClientInfo() + array(
|
|
'pid' => $productId,
|
|
'period' => 'quarterly',
|
|
'csr_code' => $csrCode,
|
|
'domains' => implode(',', $domains),
|
|
'renew' => true,
|
|
'old_vendor_id' => $oldVendorId,
|
|
));
|
|
}
|
|
|
|
public static function certReissue($vendorId, $csrCode, $domains) { // 重签SSL证书
|
|
return self::callApi('/cert/reissue', self::getClientInfo() + array(
|
|
'trustocean_id' => $vendorId,
|
|
'csr_code' => $csrCode,
|
|
'domains' => implode(',', $domains)
|
|
));
|
|
}
|
|
}
|
|
|
|
class Certificate {
|
|
public static function generateKeyPair($commonName, $isEcc = false) { // 生成密钥对
|
|
if (filter_var($commonName, FILTER_VALIDATE_IP)) { // 若为IP地址
|
|
$commonName = 'common-name-for-public-ip-address.com';
|
|
}
|
|
$subject = array(
|
|
"commonName" => $commonName,
|
|
"organizationName" => "Encryption365 SSL Security",
|
|
"organizationalUnitName" => "Encryption365 SSL Security",
|
|
"localityName" => "Xian",
|
|
"stateOrProvinceName" => "Shaanxi",
|
|
"countryName" => "CN",
|
|
);
|
|
if (!$isEcc) { // RSA证书
|
|
$private_key = openssl_pkey_new(array(
|
|
'private_key_type' => OPENSSL_KEYTYPE_RSA,
|
|
'private_key_bits' => 2048,
|
|
'config' => __DIR__ . '/openssl.cnf'
|
|
));
|
|
$csr_resource = openssl_csr_new($subject, $private_key, array(
|
|
'digest_alg' => 'sha256',
|
|
'config' => __DIR__ . '/openssl.cnf'
|
|
));
|
|
} else { // ECC证书
|
|
$private_key = openssl_pkey_new(array(
|
|
'private_key_type' => OPENSSL_KEYTYPE_EC,
|
|
'curve_name' => 'prime256v1',
|
|
'config' => __DIR__.'/openssl.cnf'
|
|
));
|
|
$csr_resource = openssl_csr_new($subject, $private_key, array(
|
|
'digest_alg' => 'sha384',
|
|
'config' => __DIR__ . '/openssl.cnf'
|
|
));
|
|
}
|
|
openssl_csr_export($csr_resource, $csr_string);
|
|
openssl_pkey_export($private_key, $private_key_string, null, array(
|
|
'config' => __DIR__ . '/openssl.cnf'
|
|
));
|
|
return array(
|
|
'csr_code' => $csr_string,
|
|
'key_code' => $private_key_string
|
|
);
|
|
}
|
|
|
|
public static function preCheck($domains) { // 预先检查http验证是否正常
|
|
$randStr = md5(uniqid(microtime(true), true));
|
|
Storage::setValidation($randStr);
|
|
$result = self::checkValidation($domains, $randStr);
|
|
Storage::delValidation();
|
|
return $result;
|
|
}
|
|
|
|
public static function checkValidation($domains, $expect) { // 检查http验证是否正常
|
|
foreach ($domains as $domain) {
|
|
$content = file_get_contents('http://' . $domain . '/.well-known/pki-validation/check');
|
|
if ($content !== $expect) { return false; }
|
|
}
|
|
return true;
|
|
}
|
|
|
|
private static function waitIssued($vendorId) { // 等待证书签发
|
|
$maxTime = 40;
|
|
$interval = 30;
|
|
for ($i = 0; $i < 20; $i++) {
|
|
Output::line('Let\'s wait ' . $interval . ' seconds and query certificate status...');
|
|
sleep($interval);
|
|
$detail = Encryption365::certDetails($vendorId);
|
|
if ($detail['result'] !== "success") {
|
|
Output::str('Fail to get certificate details => ');
|
|
Output::line($detail['message'], 'red');
|
|
break;
|
|
}
|
|
if ($detail['cert_status'] === 'issued_active') {
|
|
Output::line('Certificate issue success', 'green');
|
|
return $detail;
|
|
} else {
|
|
Output::str('Certificate status: ');
|
|
Output::line($detail['cert_status'], 'yellow');
|
|
}
|
|
}
|
|
return array('result' => 'fail');
|
|
}
|
|
|
|
private static function issueCert($host) { // 轮询证书签发并存储
|
|
$info = Storage::getInfo($host);
|
|
$vendorId = $info['vendorId'];
|
|
$domains = $info['domains'];
|
|
$certInfo = self::waitIssued($vendorId);
|
|
if ($certInfo['result'] !== "success") {
|
|
Output::line('Issue certificate time out, you may validate again...', 'red');
|
|
return false;
|
|
}
|
|
self::saveCert($host, $certInfo);
|
|
return true;
|
|
}
|
|
|
|
public static function saveCert($host, $certInfo) {
|
|
$info = Storage::getInfo($host);
|
|
$cert = trim($certInfo['cert_code']);
|
|
$caCert = trim($certInfo['ca_code']);
|
|
$startTime = $certInfo['created_at'];
|
|
$endTime = $certInfo['expire_at'];
|
|
$info['status'] = 'issued';
|
|
$info['createTime'] = $startTime;
|
|
$info['expireTime'] = $endTime;
|
|
Storage::setInfo($host, $info);
|
|
Storage::setCert($host, $cert);
|
|
Storage::setCaCert($host, $caCert);
|
|
Output::line('Certificate: ', 'purple');
|
|
echo $cert . PHP_EOL;
|
|
Output::line('CA Certificate: ', 'purple');
|
|
echo $caCert . PHP_EOL;
|
|
Output::str('Create time: ');
|
|
Output::line($startTime, 'sky-blue');
|
|
Output::str('Expire time: ');
|
|
Output::line($endTime, 'sky-blue');
|
|
}
|
|
|
|
public static function createCert($productId, $domains, $isEcc = false) { // 创建新的证书订单
|
|
if (!self::preCheck($domains)) {
|
|
Output::line('Inaccessible http://{domain}/.well-known/pki-validation/... as validation.');
|
|
return;
|
|
}
|
|
$host = $domains[0];
|
|
$newCsrKey = self::generateKeyPair($host, $isEcc);
|
|
Storage::setPrivkey($host, $newCsrKey['key_code']);
|
|
Storage::setCsr($host, $newCsrKey['csr_code']);
|
|
$orderRlt = Encryption365::certCreate($productId, $newCsrKey['csr_code'], $domains);
|
|
if ($orderRlt['result'] !== "success") {
|
|
Output::str('Fail to create certificate => ');
|
|
Output::line($orderRlt['message'], 'red');
|
|
return;
|
|
}
|
|
$vendorId = (string)$orderRlt['trustocean_id'];
|
|
foreach ($orderRlt['dcv_info'] as $domain => $dcvInfo) {
|
|
preg_match('/^http:\/\/[\S]*?(\/[\S]+.txt)/', $dcvInfo['http_verifylink'], $match);
|
|
$verifyLink = 'http://{domain}' . $match[1];
|
|
$verifyContent = $dcvInfo['http_filecontent'];
|
|
break;
|
|
}
|
|
Storage::setInfo($host, array(
|
|
'host' => $host,
|
|
'vendorId' => $vendorId,
|
|
'productId' => $productId,
|
|
'domains' => $domains,
|
|
'status' => 'issuing',
|
|
'isEcc' => $isEcc
|
|
));
|
|
Output::str('Vendor id: ');
|
|
Output::str($vendorId . PHP_EOL, 'sky-blue');
|
|
Output::str('Verify link: ');
|
|
Output::str($verifyLink . PHP_EOL, 'sky-blue');
|
|
Output::line('Verify content: ');
|
|
Output::str($verifyContent . PHP_EOL, 'sky-blue');
|
|
Storage::setValidation($verifyContent);
|
|
if (self::issueCert($host)) {
|
|
Storage::delValidation();
|
|
}
|
|
}
|
|
|
|
public static function reValidate($host) { // 重新发起验证
|
|
$info = Storage::getInfo($host);
|
|
if ($info['status'] === 'issued') {
|
|
Output::line('This site has been successfully issued.');
|
|
return;
|
|
}
|
|
if (!self::preCheck($info['domains'])) {
|
|
Output::line('Inaccessible http://{domain}/.well-known/pki-validation/... as validation.');
|
|
return;
|
|
}
|
|
$status = Encryption365::certReValidation($info['vendorId']);
|
|
if ($status['status'] !== "success") {
|
|
Output::str('Fail to revalidate certificate => ');
|
|
Output::line($status['message'], 'red');
|
|
return;
|
|
}
|
|
if (self::issueCert($host)) {
|
|
Storage::delValidation();
|
|
}
|
|
}
|
|
|
|
public static function renewCert($host) { // 更新证书
|
|
$info = Storage::getInfo($host);
|
|
if ($info['status'] !== 'issued') {
|
|
Output::line('This site has never been issued.', 'red');
|
|
return;
|
|
}
|
|
if (!self::preCheck($info['domains'])) {
|
|
Output::line('Inaccessible http://{domain}/.well-known/pki-validation/... as validation.');
|
|
return;
|
|
}
|
|
$newCsrKey = self::generateKeyPair($host, $info['isEcc']);
|
|
Storage::setPrivkey($host, $newCsrKey['key_code']);
|
|
Storage::setCsr($host, $newCsrKey['csr_code']);
|
|
$orderRlt = Encryption365::certRenew($info['productId'], $newCsrKey['csr_code'], $info['domains'], $info['vendorId']);
|
|
if ($orderRlt['result'] !== "success") {
|
|
Output::str('Fail to renew certificate => ');
|
|
Output::line($orderRlt['message'], 'red');
|
|
return;
|
|
}
|
|
$vendorId = (string)$orderRlt['trustocean_id'];
|
|
foreach ($orderRlt['dcv_info'] as $domain => $dcvInfo) {
|
|
preg_match('/^http:\/\/[\S]*?(\/[\S]+.txt)/', $dcvInfo['http_verifylink'], $match);
|
|
$verifyLink = 'http://{domain}' . $match[1];
|
|
$verifyContent = $dcvInfo['http_filecontent'];
|
|
break;
|
|
}
|
|
$info['status'] = 'issuing';
|
|
$info['vendorId'] = $vendorId;
|
|
unset($info['createTime']);
|
|
unset($info['expireTime']);
|
|
Storage::setInfo($host, $info);
|
|
Output::str('Vendor id: ');
|
|
Output::str($vendorId . PHP_EOL, 'sky-blue');
|
|
Output::str('Verify link: ');
|
|
Output::str($verifyLink . PHP_EOL, 'sky-blue');
|
|
Output::line('Verify content: ');
|
|
Output::str($verifyContent . PHP_EOL, 'sky-blue');
|
|
Storage::setValidation($verifyContent);
|
|
if (self::issueCert($host)) {
|
|
Storage::delValidation();
|
|
}
|
|
}
|
|
}
|
|
|
|
class RegistCtr {
|
|
public static function interact() { // 注册交互
|
|
Output::line('This process help you regist a Trustocean account, all you need is an email address to receive the verification code.');
|
|
Output::str('Email: ', 'yellow');
|
|
$email = trim(fgets(STDIN));
|
|
$result = Encryption365::authcodeSend($email);
|
|
if ($result['result'] !== 'success') {
|
|
Output::str('Fail to send auth code: ');
|
|
Output::str($result['message'], 'red');
|
|
return;
|
|
}
|
|
Output::line('There will be an email sent to ' . $email . ', please note checking.');
|
|
Output::str('Verification code: ', 'yellow');
|
|
$code = trim(fgets(STDIN));
|
|
Output::line('Set a password for your account.');
|
|
Output::str('Password: ', 'yellow');
|
|
$passwd = trim(fgets(STDIN));
|
|
Output::line('Trustocean need your Chinese ID card num, but you can just press ENTER to generate one.');
|
|
Output::str('ID card num: ', 'yellow');
|
|
$idNum = trim(fgets(STDIN));
|
|
if ($idNum === '') {
|
|
$fake = Fake::randIdNum();
|
|
Output::str('Random ID card num: ');
|
|
Output::str($fake['idNum'] . PHP_EOL, 'sky-blue');
|
|
Output::str('Random ID card info: ');
|
|
Output::str(implode(' ', $fake['location']) . ' ' . $fake['date'] . ' ' . $fake['sex'] . PHP_EOL, 'sky-blue');
|
|
}
|
|
Output::line('Please enter your real name, or press ENTER to generate one.');
|
|
Output::str('Name: ', 'yellow');
|
|
$name = trim(fgets(STDIN));
|
|
if ($name === '') {
|
|
$fake['name'] = Fake::randName(($fake['sex'] === 'male'));
|
|
Output::str('Random name: ');
|
|
Output::str($fake['name'] . PHP_EOL, 'sky-blue');
|
|
}
|
|
Output::line('Last step, enter your phone num, or randomly generate one by press ENTER.');
|
|
Output::str('Phone: ', 'yellow');
|
|
$phone = trim(fgets(STDIN));
|
|
if ($phone === '') {
|
|
$fake['phone'] = Fake::randPhoneNum();
|
|
Output::str('Random phone: ');
|
|
Output::str($fake['phone'] . PHP_EOL, 'sky-blue');
|
|
}
|
|
Output::str('It seems that all the information is complete, press ENTER to register your account...');
|
|
fgets(STDIN);
|
|
self::regist($email, $passwd, $code, $fake['name'], $fake['idNum'], $fake['phone']);
|
|
Output::line('Use "encryption365 login" command to login.');
|
|
}
|
|
|
|
private static function regist($email, $passwd, $code, $name, $idNum, $phone) { // 发起注册
|
|
$result = Encryption365::accountRegister(array(
|
|
'email' => $email,
|
|
'password' => $passwd,
|
|
'authcode' => $code,
|
|
'realName' => $name,
|
|
'idcardNumber' => $idNum,
|
|
'phoneNumber' => $phone,
|
|
'country' => 'CN',
|
|
'companyName' => '无'
|
|
));
|
|
if ($result['result'] !== 'success') {
|
|
Output::str('Fail to regist: ');
|
|
Output::str($result['message'], 'red');
|
|
return;
|
|
}
|
|
Output::str('Regist success' . PHP_EOL, 'green');
|
|
}
|
|
}
|
|
|
|
class LoginCtr {
|
|
public static function entry($params) {
|
|
switch (count($params)) {
|
|
case '0':
|
|
self::interact();
|
|
break;
|
|
case '2':
|
|
self::login($params[0], $params[1]);
|
|
break;
|
|
default:
|
|
Output::line('Unknow params');
|
|
}
|
|
}
|
|
|
|
public static function interact() { // 登录交互
|
|
Output::line('This process need a Trustocean account, if you don\'t have it currently, there are two methods:');
|
|
Output::line('1. Manually register at "https://page.trustocean.com/websecurity/welcome"');
|
|
Output::line('2. Use "encryption365 regist" command regist automatically');
|
|
Output::str('Email: ');
|
|
$email = trim(fgets(STDIN));
|
|
Output::str('Password: ');
|
|
$passwd = trim(fgets(STDIN));
|
|
self::login($email, $passwd);
|
|
}
|
|
|
|
public static function login($email, $passwd) { // 发起登录
|
|
$result = Encryption365::clientLogin($email, $passwd);
|
|
if ($result['result'] !== 'success') {
|
|
Output::str('Fail to login: ');
|
|
Output::line($result['message'], 'red');
|
|
return;
|
|
}
|
|
Output::line('Login success', 'green');
|
|
Output::line('Account status: ' . $result['status']);
|
|
Output::line('Login time: ' . $result['created_at']);
|
|
Storage::setClientInfo($email, $result['client_id'], $result['access_token']);
|
|
}
|
|
}
|
|
|
|
class ListCtr {
|
|
public static function list() { // 列出所有证书
|
|
$list = Storage::getHostList();
|
|
if (count($list) === 0) {
|
|
Output::line('There are not any host yet.', 'yellow');
|
|
return;
|
|
}
|
|
Output::line("Host\t\tID\tDomains\t\t\tCreate Time\t\tExpire Time");
|
|
foreach ($list as $host) {
|
|
$info = Storage::getInfo($host);
|
|
Output::str($info['host'] . "\t", 'yellow');
|
|
Output::str($info['vendorId'] . "\t", 'sky-blue');
|
|
Output::str(implode('/', $info['domains']) . "\t", 'purple');
|
|
if (isset($info['createTime'])) {
|
|
Output::str($info['createTime'] . "\t", 'blue');
|
|
} else {
|
|
Output::str('-' . "\t\t", 'blue');
|
|
}
|
|
if (isset($info['expireTime'])) {
|
|
Output::str($info['expireTime'] . "\t", 'blue');
|
|
} else {
|
|
Output::str('-' . "\t\t", 'blue');
|
|
}
|
|
Output::line('');
|
|
}
|
|
}
|
|
}
|
|
|
|
class IssueCtr {
|
|
public static function entry($params) {
|
|
if (count($params) === 0) {
|
|
Output::line('You must specify encryption method.', 'red');
|
|
return;
|
|
}
|
|
if ($params[0] === 'ECC') { $isEcc = true; }
|
|
if ($params[0] === 'RSA') { $isEcc = false; }
|
|
if (!isset($isEcc)) {
|
|
Output::line('You must specify RSA or ECC.', 'red');
|
|
return;
|
|
}
|
|
if (count($params) === 1) {
|
|
Output::line('You must specify at least one IP or domain name.', 'red');
|
|
return;
|
|
}
|
|
unset($params[0]);
|
|
$domains = array_values($params);
|
|
foreach ($domains as $host) {
|
|
if (!self::isHost($host)) {
|
|
Output::str($host, 'red');
|
|
Output::line(' is not a legel IP or domain name.');
|
|
return;
|
|
}
|
|
}
|
|
$productId = self::getProductId();
|
|
if (!is_numeric($productId)) {
|
|
Output::line('Illegal product ID.', 'red');
|
|
return;
|
|
}
|
|
Storage::addHost($domains[0]);
|
|
Certificate::createCert($productId, $domains, $isEcc);
|
|
}
|
|
|
|
private function isHost($host) { // 判断host是否合法
|
|
preg_match('/^(?=^.{3,255}$)[a-zA-Z0-9][-a-zA-Z0-9]{0,62}(\.[a-zA-Z0-9][-a-zA-Z0-9]{0,62})+$/', $host, $match);
|
|
if (count($match) !== 0) {
|
|
if (!is_numeric(substr($host, -1))) { return true; }
|
|
}
|
|
if (filter_var($host, FILTER_VALIDATE_IP)) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
private static function getProductId() { // 获取免费证书产品ID
|
|
$products = Encryption365::getProducts();
|
|
if (count($products) === 0) {
|
|
Output::line('Can\'t find any available products.', 'red');
|
|
return;
|
|
}
|
|
foreach ($products as $productId => $product) {
|
|
if (strpos($product['title'], '免费') !== false) {
|
|
return (string)$productId;
|
|
}
|
|
}
|
|
Output::line('We\'ve encountered an error while processing your request, you might want to select the free certificate\'s product ID manually.', 'yellow');
|
|
foreach ($products as $productId => $product) {
|
|
Output::str('Product ID: ' . $productId . ' => ', 'sky-blue');
|
|
Output::line($product['title'] . ' ' . $product['class'] . ' ' . $product['useage'] . ' ' . $product['term'], 'sky-blue');
|
|
}
|
|
Output::str('Product ID: ');
|
|
return trim(fgets(STDIN));
|
|
}
|
|
}
|
|
|
|
class ReverifyCtr {
|
|
public static function entry($params) {
|
|
if (count($params) === 0) {
|
|
Output::line('Host must be specified.', 'red');
|
|
return;
|
|
}
|
|
if (count($params) > 1) {
|
|
Output::line('Too many parameters to reverify command.', 'red');
|
|
return;
|
|
}
|
|
Certificate::reValidate($params[0]);
|
|
}
|
|
}
|
|
|
|
class FlashCtr {
|
|
public static function entry($params) {
|
|
if (count($params) === 0) {
|
|
Output::line('Host must be specified.', 'red');
|
|
return;
|
|
}
|
|
if (count($params) > 1) {
|
|
Output::line('Too many parameters to flash certificate.', 'red');
|
|
return;
|
|
}
|
|
$host = $params[0];
|
|
$info = Storage::getInfo($host);
|
|
$detail = Encryption365::certDetails($info['vendorId']);
|
|
if ($detail['result'] !== "success") {
|
|
Output::str('Fail to flash certificate => ');
|
|
Output::line($detail['message'], 'red');
|
|
}
|
|
Output::str('Certificate status: ');
|
|
Output::line($detail['cert_status'], 'sky-blue');
|
|
if ($detail['cert_status'] === 'issued_active') {
|
|
Certificate::saveCert($host, $detail);
|
|
}
|
|
}
|
|
}
|
|
|
|
class RenewCtr {
|
|
public static function entry($params) {
|
|
if (count($params) === 0) {
|
|
Output::line('Host must be specified.', 'red');
|
|
return;
|
|
}
|
|
if (count($params) > 1) {
|
|
Output::line('Too many parameters to reverify command.', 'red');
|
|
return;
|
|
}
|
|
Certificate::renewCert($params[0]);
|
|
}
|
|
}
|
|
|
|
class InstallCtr {
|
|
public static function entry($params) {
|
|
if (count($params) === 0) {
|
|
Output::line('Host must be specified.', 'red');
|
|
return;
|
|
}
|
|
if (count($params) === 1) {
|
|
Output::line('You must provide at least one parameter.', 'red');
|
|
return;
|
|
}
|
|
$host = $params[0];
|
|
unset($params[0]);
|
|
$params = array_values($params);
|
|
foreach ($params as $field) {
|
|
preg_match('/^([a-zA-Z]+)=([\s\S]*)$/', $field, $match);
|
|
if (count($match) !== 3) {
|
|
Output::str($field, 'red');
|
|
Output::line(' is illegal.');
|
|
return;
|
|
}
|
|
$match[1] = strtolower($match[1]);
|
|
if ($match[1] !== 'fullchain' && $match[1] !== 'key' && $match[1] !== 'cert' && $match[1] !== 'ca' && $match[1] !== 'cmd') {
|
|
Output::str($match[1], 'red');
|
|
Output::line(' is not a legal option.');
|
|
return;
|
|
}
|
|
$option[$match[1]] = trim($match[2]);
|
|
}
|
|
if (!Storage::isHost($host)) {
|
|
Output::str($host, 'red');
|
|
Output::line(' is not exist.');
|
|
return;
|
|
}
|
|
$info = Storage::getInfo($host);
|
|
Storage::setInfo($host, array_merge($info, $option));
|
|
self::install($host);
|
|
}
|
|
|
|
public static function install($host) { // 安装证书
|
|
$info = Storage::getInfo($host);
|
|
if ($info['status'] !== 'issued') {
|
|
Output::line('This site has never been issued.', 'red');
|
|
return;
|
|
}
|
|
$fields = array('fullchain', 'key', 'cert', 'ca');
|
|
foreach ($fields as $field) {
|
|
if (isset($info[$field]) && $info[$field] !== '') {
|
|
switch ($field) {
|
|
case 'fullchain':
|
|
$content = Storage::getCert($host) . PHP_EOL . Storage::getCaCert($host);
|
|
break;
|
|
case 'key':
|
|
$content = Storage::getPrivkey($host);
|
|
break;
|
|
case 'cert':
|
|
$content = Storage::getCert($host);
|
|
break;
|
|
case 'ca':
|
|
$content = Storage::getCaCert($host);
|
|
break;
|
|
}
|
|
file_put_contents($info[$field], $content);
|
|
if ($field === 'key') {
|
|
chmod($info[$field], 0600);
|
|
}
|
|
}
|
|
}
|
|
if (isset($info['cmd']) && $info['cmd'] !== '') {
|
|
shell_exec($info['cmd']);
|
|
}
|
|
Output::line('Install OK', 'green');
|
|
}
|
|
}
|
|
|
|
class AutorenewCtr {
|
|
public static function renew() {
|
|
$list = Storage::getHostList();
|
|
foreach ($list as $host) {
|
|
$info = Storage::getInfo($host);
|
|
if ($info['status'] !== 'issued') { continue; }
|
|
$expire = strtotime($info['expireTime']);
|
|
$now = strtotime(date('Y-m-d H:i:s'));
|
|
$remainDays = intval(($expire - $now) / 3600 / 24);
|
|
if ($remainDays >= 10) { continue; }
|
|
Output::str('Renew certificate for ');
|
|
Output::line($host, 'yellow');
|
|
Certificate::renewCert($host);
|
|
InstallCtr::install($host);
|
|
}
|
|
}
|
|
}
|
|
|
|
function noParam($params) { // 命令不含参数情况
|
|
if (count($params) === 0) { return; }
|
|
echo 'Unknow params' . PHP_EOL;
|
|
exit;
|
|
}
|
|
|
|
function showHelp() { // 显示帮助信息
|
|
echo <<<EOF
|
|
|
|
A tool to automatically apply and manage for Encryption365 free certificate.
|
|
|
|
Source code repository: https://github.com/dnomd343/Encryption365.git
|
|
|
|
Usage: encryption365 COMMAND [OPTIONS]
|
|
|
|
help => Output this help information.
|
|
|
|
regist => Register Trustocean account in command line.
|
|
|
|
login => Login your Trustocean account.
|
|
|
|
list => List all sites.
|
|
|
|
issue METHOD DOMAIN_1 DOMAIN_2 ... => Try to apply for TLS certificate.
|
|
|
|
METHOD => ECC or RSA (ECC recommended)
|
|
|
|
DOMAIN_x => Domain name or IP address included in the certificate.
|
|
(The first one will be the common name)
|
|
|
|
reverify HOST => Re-apply for verification.
|
|
|
|
flash HOST => Check the site status and download the certificate again.
|
|
|
|
renew HOST => Renew a certificate that is nearly expire.
|
|
|
|
install HOST [fullchain=...] [key=...] [cert=...] [ca=...] [cmd=...]
|
|
=> Install the TLS certificate.
|
|
|
|
fullchain => Full certificate chain.
|
|
|
|
key => Private key of certificate.
|
|
|
|
cert => Certificate
|
|
|
|
ca => CA certificate
|
|
|
|
cmd => Running command after installation
|
|
|
|
autorenew => Check all sites and update certificates that are about to expire.
|
|
|
|
Examples:
|
|
|
|
> encryption365 login dnomd343@163.com {password}
|
|
|
|
> encryption365 issue ECC 8.210.148.24 dns.343.re
|
|
|
|
> encryption365 install 8.210.148.24 \
|
|
fullchain=/etc/ssl/certs/8.210.148.24/fullchain.pem \
|
|
key=/etc/ssl/certs/8.210.148.24/privkey.pem \
|
|
cmd="systemctl force-reload nginx"
|
|
|
|
|
|
EOF;
|
|
}
|
|
|
|
function main($argv) { // 脚本入口
|
|
unset($argv[0]);
|
|
if (count($argv) === 0) {
|
|
$argv[] = 'help';
|
|
}
|
|
$command = $argv[1];
|
|
unset($argv[1]);
|
|
$params = array_values($argv);
|
|
switch ($command) {
|
|
case 'help':
|
|
noParam($params);
|
|
showHelp();
|
|
break;
|
|
case 'regist':
|
|
noParam($params);
|
|
RegistCtr::interact();
|
|
break;
|
|
case 'login':
|
|
LoginCtr::entry($params);
|
|
break;
|
|
case 'list':
|
|
noParam($params);
|
|
ListCtr::list();
|
|
break;
|
|
case 'issue':
|
|
IssueCtr::entry($params);
|
|
break;
|
|
case 'reverify':
|
|
ReverifyCtr::entry($params);
|
|
break;
|
|
case 'flash':
|
|
FlashCtr::entry($params);
|
|
break;
|
|
case 'renew':
|
|
RenewCtr::entry($params);
|
|
break;
|
|
case 'install':
|
|
InstallCtr::entry($params);
|
|
break;
|
|
case 'autorenew':
|
|
noParam($params);
|
|
AutorenewCtr::renew();
|
|
break;
|
|
default:
|
|
echo 'Unknow command, please use "encryption365 help" to show the usage.' . PHP_EOL;
|
|
}
|
|
}
|
|
|
|
main($argv);
|
|
|
|
?>
|
|
|