search

acmesh-official / acme.sh

A pure Unix shell script implementing ACME client protocol
https://acme.sh
GNU General Public License v3.0
39.2k stars 4.95k forks source link

数字开头的泛域名识别有误 #2498

Open ezergame opened 5 years ago

ezergame commented 5 years ago

Steps to reproduce

Debug log

acme.sh --issue --dns dns_cf -d 1zfun.com -d '*.1zfun.com' --debug

[Mon Sep 23 04:22:58 EDT 2019] pid
[Mon Sep 23 04:22:58 EDT 2019] No need to restore nginx, skip.
[Mon Sep 23 04:22:58 EDT 2019] _clearupdns
[Mon Sep 23 04:22:58 EDT 2019] dns_entries
[Mon Sep 23 04:22:58 EDT 2019] skip dns.
[eric@bwh-us ~]$ export CF_Key="383c3a6a2782c175914349322bdfdae774d83"
[eric@bwh-us ~]$ export CF_Email="danericzhang@gmail.com"
[eric@bwh-us ~]$ acme.sh --issue --dns dns_cf -d 1zfun.com -d '*.1zfun.com' --debug
[Mon Sep 23 04:59:21 EDT 2019] Lets find script dir.
[Mon Sep 23 04:59:21 EDT 2019] _SCRIPT_='/home/eric/.acme.sh/acme.sh'
[Mon Sep 23 04:59:21 EDT 2019] _script='/home/eric/.acme.sh/acme.sh'
[Mon Sep 23 04:59:21 EDT 2019] _script_home='/home/eric/.acme.sh'
[Mon Sep 23 04:59:21 EDT 2019] Using default home:/home/eric/.acme.sh
[Mon Sep 23 04:59:21 EDT 2019] Using config home:/home/eric/.acme.sh
https://github.com/Neilpang/acme.sh
v2.8.3
[Mon Sep 23 04:59:21 EDT 2019] Running cmd: issue
[Mon Sep 23 04:59:21 EDT 2019] _main_domain='1zfun.com'
[Mon Sep 23 04:59:21 EDT 2019] _alt_domains='*.1zfun.com'
[Mon Sep 23 04:59:21 EDT 2019] Using config home:/home/eric/.acme.sh
[Mon Sep 23 04:59:21 EDT 2019] ACME_DIRECTORY='https://acme-v02.api.letsencrypt.org/directory'
[Mon Sep 23 04:59:21 EDT 2019] DOMAIN_PATH='/home/eric/.acme.sh/1zfun.com'
[Mon Sep 23 04:59:21 EDT 2019] Using ACME_DIRECTORY: https://acme-v02.api.letsencrypt.org/directory
[Mon Sep 23 04:59:21 EDT 2019] _init api for server: https://acme-v02.api.letsencrypt.org/directory
[Mon Sep 23 04:59:21 EDT 2019] GET
[Mon Sep 23 04:59:21 EDT 2019] url='https://acme-v02.api.letsencrypt.org/directory'
[Mon Sep 23 04:59:21 EDT 2019] timeout=
[Mon Sep 23 04:59:21 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:22 EDT 2019] ret='0'
[Mon Sep 23 04:59:22 EDT 2019] ACME_KEY_CHANGE='https://acme-v02.api.letsencrypt.org/acme/key-change'
[Mon Sep 23 04:59:22 EDT 2019] ACME_NEW_AUTHZ
[Mon Sep 23 04:59:22 EDT 2019] ACME_NEW_ORDER='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Mon Sep 23 04:59:22 EDT 2019] ACME_NEW_ACCOUNT='https://acme-v02.api.letsencrypt.org/acme/new-acct'
[Mon Sep 23 04:59:22 EDT 2019] ACME_REVOKE_CERT='https://acme-v02.api.letsencrypt.org/acme/revoke-cert'
[Mon Sep 23 04:59:22 EDT 2019] ACME_AGREEMENT='https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf'
[Mon Sep 23 04:59:22 EDT 2019] ACME_NEW_NONCE='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
[Mon Sep 23 04:59:22 EDT 2019] ACME_VERSION='2'
[Mon Sep 23 04:59:22 EDT 2019] Le_NextRenewTime
[Mon Sep 23 04:59:22 EDT 2019] _on_before_issue
[Mon Sep 23 04:59:22 EDT 2019] _chk_main_domain='1zfun.com'
[Mon Sep 23 04:59:22 EDT 2019] _chk_alt_domains='*.1zfun.com'
[Mon Sep 23 04:59:22 EDT 2019] Le_LocalAddress
[Mon Sep 23 04:59:22 EDT 2019] d='1zfun.com'
[Mon Sep 23 04:59:22 EDT 2019] Check for domain='1zfun.com'
[Mon Sep 23 04:59:22 EDT 2019] _currentRoot='dns_cf'
[Mon Sep 23 04:59:22 EDT 2019] d='*.1zfun.com'
[Mon Sep 23 04:59:22 EDT 2019] Check for domain='*.1zfun.com'
[Mon Sep 23 04:59:22 EDT 2019] _currentRoot='dns_cf'
[Mon Sep 23 04:59:22 EDT 2019] d
[Mon Sep 23 04:59:22 EDT 2019] _saved_account_key_hash is not changed, skip register account.
[Mon Sep 23 04:59:22 EDT 2019] Read key length:
[Mon Sep 23 04:59:22 EDT 2019] _createcsr
[Mon Sep 23 04:59:22 EDT 2019] Multi domain='DNS:1zfun.com,DNS:*.1zfun.com'
[Mon Sep 23 04:59:22 EDT 2019] Getting domain auth token for each domain
[Mon Sep 23 04:59:22 EDT 2019] d='*.1zfun.com'
[Mon Sep 23 04:59:22 EDT 2019] d
[Mon Sep 23 04:59:22 EDT 2019] url='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Mon Sep 23 04:59:22 EDT 2019] payload='{"identifiers": [{"type":"dns","value":"1zfun.com"},{"type":"dns","value":"*.1zfun.com"}]}'
[Mon Sep 23 04:59:22 EDT 2019] RSA key
[Mon Sep 23 04:59:22 EDT 2019] HEAD
[Mon Sep 23 04:59:22 EDT 2019] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
[Mon Sep 23 04:59:22 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:23 EDT 2019] _ret='0'
[Mon Sep 23 04:59:23 EDT 2019] POST
[Mon Sep 23 04:59:23 EDT 2019] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-order'
[Mon Sep 23 04:59:23 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:24 EDT 2019] _ret='0'
[Mon Sep 23 04:59:24 EDT 2019] code='201'
[Mon Sep 23 04:59:24 EDT 2019] Le_LinkOrder='https://acme-v02.api.letsencrypt.org/acme/order/66998218/1144188196'
[Mon Sep 23 04:59:24 EDT 2019] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/66998218/1144188196'
[Mon Sep 23 04:59:24 EDT 2019] url='https://acme-v02.api.letsencrypt.org/acme/authz-v3/467159903'
[Mon Sep 23 04:59:24 EDT 2019] payload
[Mon Sep 23 04:59:24 EDT 2019] POST
[Mon Sep 23 04:59:24 EDT 2019] _post_url='https://acme-v02.api.letsencrypt.org/acme/authz-v3/467159903'
[Mon Sep 23 04:59:24 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:25 EDT 2019] _ret='0'
[Mon Sep 23 04:59:25 EDT 2019] code='200'
[Mon Sep 23 04:59:25 EDT 2019] url='https://acme-v02.api.letsencrypt.org/acme/authz-v3/467159904'
[Mon Sep 23 04:59:25 EDT 2019] payload
[Mon Sep 23 04:59:25 EDT 2019] POST
[Mon Sep 23 04:59:25 EDT 2019] _post_url='https://acme-v02.api.letsencrypt.org/acme/authz-v3/467159904'
[Mon Sep 23 04:59:25 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:26 EDT 2019] _ret='0'
[Mon Sep 23 04:59:26 EDT 2019] code='200'
[Mon Sep 23 04:59:26 EDT 2019] d='1zfun.com'
[Mon Sep 23 04:59:26 EDT 2019] Getting webroot for domain='1zfun.com'
[Mon Sep 23 04:59:26 EDT 2019] _w='dns_cf'
[Mon Sep 23 04:59:26 EDT 2019] _currentRoot='dns_cf'
[Mon Sep 23 04:59:26 EDT 2019] entry='"type":"dns-01","status":"pending","url":"https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159904/W8UC5A","token":"rzgFfBLpD85-Ma3FHLHELn30K0KHfU2w4K22X6WXjvI"'
[Mon Sep 23 04:59:26 EDT 2019] token='rzgFfBLpD85-Ma3FHLHELn30K0KHfU2w4K22X6WXjvI'
[Mon Sep 23 04:59:26 EDT 2019] uri='https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159904/W8UC5A'
[Mon Sep 23 04:59:26 EDT 2019] keyauthorization='rzgFfBLpD85-Ma3FHLHELn30K0KHfU2w4K22X6WXjvI.AP98HYej7-SCj90EQbVGECiz9NPsCn5CSNmYFxjqhkw'
[Mon Sep 23 04:59:26 EDT 2019] dvlist='1zfun.com#rzgFfBLpD85-Ma3FHLHELn30K0KHfU2w4K22X6WXjvI.AP98HYej7-SCj90EQbVGECiz9NPsCn5CSNmYFxjqhkw#https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159904/W8UC5A#dns-01#dns_cf'
[Mon Sep 23 04:59:26 EDT 2019] d='*.1zfun.com'
[Mon Sep 23 04:59:26 EDT 2019] Getting webroot for domain='*.1zfun.com'
[Mon Sep 23 04:59:26 EDT 2019] _w='dns_cf'
[Mon Sep 23 04:59:26 EDT 2019] _currentRoot='dns_cf'
[Mon Sep 23 04:59:26 EDT 2019] entry='"type":"dns-01","status":"pending","url":"https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159903/T7Jq7w","token":"g6NrJ40xWtP_PBmvweLxTV7WJzvEh_fUq7q4vlr7wHE"'
[Mon Sep 23 04:59:26 EDT 2019] token='g6NrJ40xWtP_PBmvweLxTV7WJzvEh_fUq7q4vlr7wHE'
[Mon Sep 23 04:59:26 EDT 2019] uri='https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159903/T7Jq7w'
[Mon Sep 23 04:59:26 EDT 2019] keyauthorization='g6NrJ40xWtP_PBmvweLxTV7WJzvEh_fUq7q4vlr7wHE.AP98HYej7-SCj90EQbVGECiz9NPsCn5CSNmYFxjqhkw'
[Mon Sep 23 04:59:26 EDT 2019] dvlist='*.1zfun.com#g6NrJ40xWtP_PBmvweLxTV7WJzvEh_fUq7q4vlr7wHE.AP98HYej7-SCj90EQbVGECiz9NPsCn5CSNmYFxjqhkw#https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159903/T7Jq7w#dns-01#dns_cf'
[Mon Sep 23 04:59:26 EDT 2019] d
[Mon Sep 23 04:59:26 EDT 2019] vlist='1zfun.com#rzgFfBLpD85-Ma3FHLHELn30K0KHfU2w4K22X6WXjvI.AP98HYej7-SCj90EQbVGECiz9NPsCn5CSNmYFxjqhkw#https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159904/W8UC5A#dns-01#dns_cf,*.1zfun.com#g6NrJ40xWtP_PBmvweLxTV7WJzvEh_fUq7q4vlr7wHE.AP98HYej7-SCj90EQbVGECiz9NPsCn5CSNmYFxjqhkw#https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159903/T7Jq7w#dns-01#dns_cf,'
[Mon Sep 23 04:59:26 EDT 2019] d='1zfun.com'
[Mon Sep 23 04:59:26 EDT 2019] _d_alias
[Mon Sep 23 04:59:26 EDT 2019] txtdomain='_acme-challenge.1zfun.com'
[Mon Sep 23 04:59:26 EDT 2019] txt='PRghVnL78_eWHN2b7fqmLNbuXQr437GwIyA3L6w_zyY'
[Mon Sep 23 04:59:26 EDT 2019] d_api='/home/eric/.acme.sh/dnsapi/dns_cf.sh'
[Mon Sep 23 04:59:26 EDT 2019] Found domain api file: /home/eric/.acme.sh/dnsapi/dns_cf.sh
[Mon Sep 23 04:59:26 EDT 2019] Adding txt value: PRghVnL78_eWHN2b7fqmLNbuXQr437GwIyA3L6w_zyY for domain:  _acme-challenge.1zfun.com
[Mon Sep 23 04:59:26 EDT 2019] First detect the root zone
[Mon Sep 23 04:59:26 EDT 2019] h='_acme-challenge.1zfun.com'
[Mon Sep 23 04:59:26 EDT 2019] zones?name=_acme-challenge.1zfun.com&account.id=a9bb2bf7269314e2ee0204998df2cfdf
[Mon Sep 23 04:59:26 EDT 2019] GET
[Mon Sep 23 04:59:26 EDT 2019] url='https://api.cloudflare.com/client/v4/zones?name=_acme-challenge.1zfun.com&account.id=a9bb2bf7269314e2ee0204998df2cfdf'
[Mon Sep 23 04:59:26 EDT 2019] timeout=
[Mon Sep 23 04:59:26 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:27 EDT 2019] ret='0'
[Mon Sep 23 04:59:27 EDT 2019] h='1zfun.com'
[Mon Sep 23 04:59:27 EDT 2019] zones?name=1zfun.com&account.id=a9bb2bf7269314e2ee0204998df2cfdf
[Mon Sep 23 04:59:27 EDT 2019] GET
[Mon Sep 23 04:59:27 EDT 2019] url='https://api.cloudflare.com/client/v4/zones?name=1zfun.com&account.id=a9bb2bf7269314e2ee0204998df2cfdf'
[Mon Sep 23 04:59:27 EDT 2019] timeout=
[Mon Sep 23 04:59:27 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:27 EDT 2019] ret='0'
[Mon Sep 23 04:59:27 EDT 2019] h='com'
[Mon Sep 23 04:59:27 EDT 2019] zones?name=com&account.id=a9bb2bf7269314e2ee0204998df2cfdf
[Mon Sep 23 04:59:27 EDT 2019] GET
[Mon Sep 23 04:59:27 EDT 2019] url='https://api.cloudflare.com/client/v4/zones?name=com&account.id=a9bb2bf7269314e2ee0204998df2cfdf'
[Mon Sep 23 04:59:27 EDT 2019] timeout=
[Mon Sep 23 04:59:27 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:27 EDT 2019] ret='0'
[Mon Sep 23 04:59:27 EDT 2019] h
[Mon Sep 23 04:59:27 EDT 2019] invalid domain
[Mon Sep 23 04:59:27 EDT 2019] Error add txt for domain:_acme-challenge.1zfun.com
[Mon Sep 23 04:59:27 EDT 2019] _on_issue_err
[Mon Sep 23 04:59:27 EDT 2019] Please add '--debug' or '--log' to check more details.
[Mon Sep 23 04:59:27 EDT 2019] See: https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh
[Mon Sep 23 04:59:27 EDT 2019] url='https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159904/W8UC5A'
[Mon Sep 23 04:59:27 EDT 2019] payload='{}'
[Mon Sep 23 04:59:27 EDT 2019] POST
[Mon Sep 23 04:59:27 EDT 2019] _post_url='https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159904/W8UC5A'
[Mon Sep 23 04:59:27 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:28 EDT 2019] _ret='0'
[Mon Sep 23 04:59:28 EDT 2019] code='200'
[Mon Sep 23 04:59:28 EDT 2019] url='https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159903/T7Jq7w'
[Mon Sep 23 04:59:28 EDT 2019] payload='{}'
[Mon Sep 23 04:59:29 EDT 2019] POST
[Mon Sep 23 04:59:29 EDT 2019] _post_url='https://acme-v02.api.letsencrypt.org/acme/chall-v3/467159903/T7Jq7w'
[Mon Sep 23 04:59:29 EDT 2019] _CURL='curl -L --silent --dump-header /home/eric/.acme.sh/http.header  -g '
[Mon Sep 23 04:59:29 EDT 2019] _ret='0'
[Mon Sep 23 04:59:29 EDT 2019] code='200'
[Mon Sep 23 04:59:29 EDT 2019] socat doesn't exists.
[Mon Sep 23 04:59:29 EDT 2019] Diagnosis versions:
openssl:openssl
OpenSSL 1.0.2k-fips  26 Jan 2017
apache:
apache doesn't exists.
nginx:
nginx version: nginx/1.16.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-36) (GCC)
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib64/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -fPIC' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -pie'

*.1zfun.com被识别为了com，所以报invalid domain错误，因为Cloud Flare找不到这个域名

Neilpang commented 5 years ago

dns_cf 有两种方式 , 你用的试哪一种. https://github.com/Neilpang/acme.sh/wiki/dnsapi#1-use-cloudflare-domain-api-to-automatically-issue-cert

ezergame commented 5 years ago

用的是第二种，Email和Global Key的方式，感觉不是这个问题，因为日志上第一个根域名是OK的，第二个*.1zfun.com的泛域名出现的错误，打印的参数h=com，而url的参数也是zones?name=com&account.id=a9bb2bf7269314e2ee0204998df2cfdf，这个应该是解析出错了吧

Neilpang commented 5 years ago

貼上 --debug 2 的 log