This is not supported by letsencrypt, so issuing the certificate will fail.
Instead, add 3072 bits as an intermediate option.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>

As pointed out by @andersk, acme.sh already supports ECC certificates, and
they can be set manually in the uci file, just not in Luci. Fix this by
changing the key size selector into a listbox, and adding ECC certs as
options.

Fixes #7825.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>

Thanks to @jow- for pointing out the mistake.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

This adds a metapakcge for acme luci ap without uhttpd dependency and adds entities and check to stop handle nginx server and modify the certificate set automatically.

Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>

The upstream acme.sh package changed to using socat instead of netcat;
update the dependencies to reflect this, and pass --listen-v6 when running
in standalone mode (since socat only listens on IPv4 by default).

Also add a missing cleanup call when certificate issuance fails.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

Switch to codeload. Simplifies the Makefile.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Fixes #6370.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

The new procd config dependency tracking requires the start method to be
called even on boot. So add a state file that is checked by the run script
to condition the special-case boot run instead of the previous independent
call to the run script.

Ref: https://github.com/openwrt/luci/pull/1769

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

Signed-off-by: Zhong Jianxin <azuwis@gmail.com>

Tested with dynu.com ddns.

Install acme-dnsapi:

    # opkg install acme-dnsapi

Example `/etc/config/acme`:

    config acme
        option state_dir '/etc/acme'
        option account_email email@example.org'
        option debug '0'

    config cert 'foo'
        option enabled '1'
        option use_staging '1'
        option keylength '2048'
        option update_uhttpd '0'
        option dns 'dns_dynu'
        list domains 'foo.dynu.com'
        list domains '*.foo.dynu.com'
        list credentials 'Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"'
        list credentials 'Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy"'

Run:

    # /etc/init.d/acme start

Signed-off-by: Zhong Jianxin <azuwis@gmail.com>

As acme.sh has releases, switch to using those. Update the version accordingly.

Also rearranged some stuff in the hope that uscan will start tracking releases instead of git commits. Makefile is more simple as a result.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

adds V2 support

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

fix Makefile chmod (644)
replace MD5SUM with HASH
add PKG_MIRROR_HASH when PKG_SOURCE_PROTO:=git

(PKG_SOURCE_PROTO:=svn tarballs are not reproducible for now)

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

fixes webroot to be defined as 
_currentRoot='/www'
instead of being interpreted as
_currentRoot='"/www"'

Signed-off-by: Aleksei Nosachev <nos1609@hotmail.com>

For configurations where another web server is running on port 80, running
acme.sh in standalone mode fails. Try to detect this and refuse to run; and
allow the user to configure a webroot directory to use the running webserver for
certificate verification.

This also updates acme.sh to the latest version.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

Use newest acme.sh release (2.6.8).
Remove dependency on ca-certificates and add dependency on ca-bundle.
Update environment variable.

Signed-off-by: Daniel Halmschlager <da@halms.at>

This updates to the latest git version of acme.sh and drops the patch to
disable timestamps from the output (since that is now supported
upstream).

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

This version handles transitioning from a previous certificate that was
issues using the staging server, adds more debug logging, and handles
state directories better if issuing fails.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

Fixes butched update to 1.2.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

This version will use the standalone (netcat) mode of acme.sh during
verification instead of exposing uhttpd to the internet for the duration
of the verification. It will also add an ip6tables rule to also support
verification over IPv6.

Also contains an updated version of acme.sh.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

This adds a Luci configuration app for the ACME certificate package.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>

This adds a package wrapping the acme.sh script from
https://github.com/Neilpang/acme.sh in Uci config and hooks to interact
correctly with uhttpd.

Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>