1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
//go:build ignore
// +build ignore
// this example tests the asynchronous order status and fetching renewal information
// has been tested using the following,
// $ cloudflared tunnel --url http://192.168.2.178:9999
// $ go run renewalinfo.go -domain [tunnel domain]
// output -
// Renewal info:
// - Start: 2023-06-08 00:37:21 +0000 UTC
// - End: 2023-06-10 00:37:21 +0000 UTC
// - URL:
// - Retry-After: 2023-04-10 17:17:25.6274661 +1000 AEST m=+21608.774701601
package main
import (
"crypto/ecdsa"
"crypto/elliptic"
"crypto/rand"
"crypto/x509"
"crypto/x509/pkix"
"flag"
"fmt"
"log"
"net/http"
"time"
"github.com/eggsampler/acme/v3"
)
var (
domain string
keyAuth string
)
func main() {
flag.StringVar(&domain, "domain", "",
"domain to use for testing")
flag.Parse()
if domain == "" {
panic("no domain")
}
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
_, _ = w.Write([]byte(keyAuth))
})
go func() {
err := http.ListenAndServe(":9999", nil)
ifpanic(err)
}()
<-time.After(2 * time.Second)
client, err := acme.NewClient(acme.LetsEncryptStaging)
ifpanic(err)
privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
ifpanic(err)
account, err := client.NewAccount(privKey, false, true, "mailto:test@eggsampler.com")
ifpanic(err)
order, err := client.NewOrder(account, []acme.Identifier{{Type: "dns", Value: domain}})
ifpanic(err)
auth, err := client.FetchAuthorization(account, order.Authorizations[0])
ifpanic(err)
chal, ok := auth.ChallengeMap[acme.ChallengeTypeHTTP01]
if !ok {
panic("no challenge")
}
keyAuth = chal.KeyAuthorization
chal, err = client.UpdateChallenge(account, chal)
ifpanic(err)
certKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
ifpanic(err)
tpl := &x509.CertificateRequest{
SignatureAlgorithm: x509.ECDSAWithSHA256,
PublicKeyAlgorithm: x509.ECDSA,
PublicKey: certKey.Public(),
Subject: pkix.Name{CommonName: domain},
DNSNames: []string{domain},
}
csrDer, err := x509.CreateCertificateRequest(rand.Reader, tpl, certKey)
if err != nil {
log.Fatalf("Error creating certificate request: %v", err)
}
csr, err := x509.ParseCertificateRequest(csrDer)
if err != nil {
log.Fatalf("Error parsing certificate request: %v", err)
}
client.IgnoreRetryAfter = true
client.IgnorePolling = true
order, err = client.FinalizeOrder(account, order, csr)
ifpanic(err)
if order.Status != "processing" {
panic("expected async processing order")
}
for {
<-time.After(time.Until(order.RetryAfter) + 5*time.Second)
order, err = client.FetchOrder(account, order.URL)
ifpanic(err)
if order.Status == "valid" {
break
}
}
cert, err := client.FetchCertificates(account, order.Certificate)
ifpanic(err)
ri, err := client.GetRenewalInfo(cert[0])
ifpanic(err)
shouldRenewAt := ri.ShouldRenewAt(time.Now(), time.Duration(1*time.Second))
fmt.Println("Renewal info:")
fmt.Printf(" - Start: %s\n", ri.SuggestedWindow.Start)
fmt.Printf(" - End: %s\n", ri.SuggestedWindow.End)
fmt.Printf(" - URL: %s\n", ri.ExplanationURL)
fmt.Printf(" - Retry-After: %s\n", ri.RetryAfter)
fmt.Printf(" - Renew-At: %s\n", shouldRenewAt)
}
func ifpanic(err error) {
if err != nil {
panic(err)
}
}
|
