acme_ssl 函数，方便通过 acme.sh 注册证书

acme_ssl.sh

# acme.sh ssl function
acme_ssl() {
    # ------------------------
    # Configurable variables
    # ------------------------
    ACME_BIN="/root/.acme.sh/acme.sh"
    WEBROOT="/usr/local/openresty/nginx/html"
    CERT_DIR="/usr/local/openresty/nginx/conf/ssl"
#    DOCKER_CONTAINER="openresty"
#    RELOAD_CMD="/usr/bin/docker exec ${DOCKER_CONTAINER} /usr/local/openresty/nginx/sbin/nginx -t && \
#                /usr/bin/docker exec ${DOCKER_CONTAINER} /usr/local/openresty/nginx/sbin/nginx -s reload"
    RELOAD_CMD="/usr/local/openresty/nginx/sbin/nginx -t && \
                /usr/local/openresty/nginx/sbin/nginx -s reload"

    # ------------------------
    # Basic validation
    # ------------------------
    if [[ ! -x "$ACME_BIN" ]]; then
        echo "[ERR] acme.sh not found at: ${ACME_BIN}"
        return 1
    fi

    if [[ $# -lt 1 ]]; then
        echo "[ERR] Please specify at least one domain via -d"
        echo "Usage: acme_ssl -d example.com -d www.example.com -d '*.example.com'"
        return 1
    fi

    # ------------------------
    # Collect all -d parameters
    # ------------------------
    DOMAINS=()
    while [[ $# -gt 0 ]]; do
        case "$1" in
            -d|--domain)
                if [[ -n "$2" ]]; then
                    DOMAINS+=("$2")
                    shift 2
                else
                    echo "[ERR] Missing value for -d"
                    return 1
                fi
                ;;
            *)
                echo "[ERR] Unknown argument: $1"
                return 1
                ;;
        esac
    done

    if [[ ${#DOMAINS[@]} -eq 0 ]]; then
        echo "[ERR] No domains specified"
        return 1
    fi

    # Primary domain (first one) used for cert filenames
    PRIMARY_DOMAIN="${DOMAINS[0]}"

    echo "[INFO] Primary domain: $PRIMARY_DOMAIN"
    echo "[INFO] All domains:"
    printf '  - %s\n' "${DOMAINS[@]}"

    # ------------------------
    # Build acme.sh -d options
    # ------------------------
    DOMAIN_ARGS=()
    for D in "${DOMAINS[@]}"; do
        DOMAIN_ARGS+=("-d" "$D")
    done

    # ------------------------
    # Issue certificate
    # ------------------------
    echo "[INFO] Requesting certificate..."
    "$ACME_BIN" --issue \
        "${DOMAIN_ARGS[@]}" \
        -w "$WEBROOT"

    if [[ $? -ne 0 ]]; then
        echo "[ERR] Certificate issuance failed!"
        return 1
    fi

    # ------------------------
    # Install certificate
    # ------------------------
    echo "[INFO] Installing certificate..."
    "$ACME_BIN" --install-cert \
        -d "$PRIMARY_DOMAIN" \
        --cert-file "${CERT_DIR}/${PRIMARY_DOMAIN}.cer" \
        --key-file "${CERT_DIR}/${PRIMARY_DOMAIN}.key" \
        --fullchain-file "${CERT_DIR}/${PRIMARY_DOMAIN}.fullchain.cer" \
        --ca-file "${CERT_DIR}/${PRIMARY_DOMAIN}.ca.cer" \
        --reloadcmd "$RELOAD_CMD"

    if [[ $? -ne 0 ]]; then
        echo "[ERR] Certificate installation failed!"
        return 1
    fi

    echo "[OK] SSL certificate successfully installed for ${DOMAINS[*]}"
}