Windows的acme.sh——win-acme使用教程

hl128k

已于 2022-09-08 20:46:00 修改

阅读量6.7k

点赞数 8

分类专栏： ACME 文章标签： ssl windows 服务器网络

于 2022-09-08 17:54:56 首次发布

本文链接：https://blog.csdn.net/hl128k/article/details/126764849

版权

ACME 专栏收录该内容

1 篇文章 0 订阅

订阅专栏

废话部分

win-acme是一个适用于 Windows 的 ACMEv2 客户端，旨在非常简单地开始，但功能强大到足以扩展到几乎所有场景。巴拉巴拉巴，详情请看官网介绍。→WIN-ACME官网

这个教程是腾讯域名用win-acme给windows服务器通过脚本自动添加更新SSL（Let’s Encrypt）证书的方法过程。

手动录入的方法可以参看这篇文章→用win-acme给windows服务器添加SSL

手动录入可以满足大部分情况的使用要求，只不过缺点得每隔3个月左右重新走一次验证才能保证证书不失效

正文部分

首先先去官网下载最新的win-acme

解压出来是这些玩意。注：当前版本是v2.1.22.1289.x64，其他版本可能会有不同但是大体操作一致

双击运行wacs.exe

根据网络情况可能会卡此行片刻，属于正常情况

加载好的界面

菜单依次是：

创建证书默认

创建证书全配置

运行自动更新任务

自动更新任务管理

更多设置

退出

默认是使用iis服务器配置的，本人使用的ng所以输入m

请指定应如何确定证书中包含的域名列表。如果选择“所有绑定”选项之一，则该列表将自动更新，以便将来续订以反映当时的绑定。

菜单依次是：

1：从 IIS 读取绑定
2：手动输入
3：由另一个进程创建的 CSR
C：中止

本人使用的ng所以输入2

输入域名如：*.example.com

然后再敲一次回车

泛域名需要使用dns-01这部分，但是这个工具自带的脚本不支持腾讯域名，所以输入8使用自己的脚本。

把脚本dnspod.ps1放入这个根目录

输入脚本路径

本人的脚本是一个文件所以选择1，个人感觉即使不用删除应该也是可以的也就是3

脚本文件会在下方。输入脚本方法名称以及所需参数：create {RecordName} {Token}

输入脚本的添加方法名称以及所需参数：create {RecordName} {Token}

输入脚本的删除方法名称以及所需参数：delete {RecordName} {Token}

菜单依次

1：逐个运行所有内容（默认）
2：允许脚本的多个实例同时运行
3：允许同时验证多个记录
4：允许两种并行模式

这个脚本写的简单，所以选1

生成的类型本人要用rsa的所以选2

选择2，本人用ng做的转发处理，而且这个生成的文件比较通用，如果有别的需求就换别的吧

根目录创建一个ssl文件夹，后续程序生成的证书会在这个目录，后续更新的也是在这个目录

选择1不设置密码

5不再设置

选择3

然后第一次设置会提示你看他的文档选择y，不看不知道行不行如果你们如果有时间可以试一试

是否同意条款同意y

输入邮箱然后程序就会开始自己跑脚本

应该是腾讯这边处理的问题验证会比较慢

是否设置为自动任务输入y

接着输入主机的用户名密码就创建ok了

输入a就可以查看现在创建的信息了

下面是脚本

脚本内容一致

脚本里面的id和token为腾讯云的api，token申请地址→dnspod的token申请地址

将脚本中“你的id”和“你的token”替换为申请的即可使用

注意脚本内有多处都需要替换

本脚本是实现了本人需求的产物，并不是最优解有能力的可以进行修改调整，但是一切后果情况与本人无关

富哥支持区→DNSPod.ps1

白嫖区↓

<#
.SYNOPSIS
Add or remove a DNS TXT record to EasyDNS
.DESCRIPTION
Note that this script is intended to be run via the install script plugin from win-acme via the batch script wrapper. 
As such, we use positional parameters to avoid issues with using a dash in the cmd line. 

This script was copied and modified from the Posh-ACME repository.  
Please reference their license terms for use/modification:  https://github.com/rmbolger/Posh-ACME/blob/main/LICENSE

Credit for the original script goes to RMBolger, Thanks!


.PARAMETER RecordName
The fully qualified name of the TXT record.

.PARAMETER TxtValue
The value of the TXT record.

.PARAMETER EDToken
The EasyDNS API Token.

.PARAMETER EDKey
The EasyDNS API Key.

.PARAMETER EDUseSandbox
If specified, the plugin runs against the EasyDNS Sandbox environment instead of the Live environment.

.PARAMETER ExtraParams
This parameter can be ignored and is only used to prevent errors when splatting with more parameters than this function supports.


.EXAMPLE 

EasyDNS.ps1 create {RecordName} {Token} EDToken EDKey

EasyDNS.ps1 delete {RecordName} {Token} EDToken EDKey

.NOTES

#>
param(
	[string]$Task,
	[string]$RecordName,
	[string]$TxtValue,
	[string]$DNSPodKeyId='你的id',
	[string]$DNSPodKeyToken='你的Token',
	[string]$DNSPodKeyTokenInsecure,
	[string]$DNSPodApiRoot='https://dnsapi.cn',
	[pscredential]$DNSPodCredential,
	[string]$DNSPodUsername,
	[string]$DNSPodPwdInsecure
)

function Get-CurrentPluginType { 'dns-01' }

function Add-DnsTxt {
    [CmdletBinding(DefaultParameterSetName = 'Secure')]
    param(
        [Parameter(Mandatory,Position=0)]
        [string]$RecordName,
        [Parameter(Mandatory,Position=1)]
        [string]$TxtValue,
        [string]$DNSPodKeyId='你的id',
        [string]$DNSPodKeyToken='你的Token',
        [string]$DNSPodApiRoot='https://dnsapi.cn',
        [Parameter(ParameterSetName='Obsolete_DO_NOT_USE',Mandatory)]
        [pscredential]$DNSPodCredential,
        [Parameter(ParameterSetName='Obsolete_DO_NOT_USE',Mandatory)]
        [string]$DNSPodUsername,
        [Parameter(ParameterSetName='Obsolete_DO_NOT_USE',Mandatory)]
        [string]$DNSPodPwdInsecure,
        [Parameter(ValueFromRemainingArguments)]
        $ExtraParams
    )

    if ('Obsolete_DO_NOT_USE' -eq $PSCmdlet.ParameterSetName) {
        throw "DNSPod requires updated API Key/Token values. See user guide for details."
    }

    # build the login_token value

    $authToken = "$DNSPodKeyId%2C$DNSPodKeyToken"

    try {
        Write-Verbose "Searching for existing TXT record"
        $zone, $rec = Get-DNSPodTxtRecord $RecordName $TxtValue $authToken $DNSPodApiRoot
    }
    catch { throw }

    if ($rec) {
        Write-Debug "Record $RecordName already contains $TxtValue. Nothing to do."
    }
    else {
        # add a new record
        try {
            Write-Verbose "Adding $RecordName with value $TxtValue"

            $recShort = ($RecordName -ireplace [regex]::Escape($zone.name), [string]::Empty).TrimEnd('.')
            $addQuery = @{
                Uri = "$DNSPodApiRoot/Record.Create"
                Method = 'POST'
                Body = "domain_id=$($zone.id)&sub_domain=$recShort&record_type=TXT&value=$TxtValue&record_line=%E9%BB%98%E8%AE%A4&login_token=$authToken&format=json&lang=en"
                UserAgent = $script:USER_AGENT
                ErrorAction = 'Stop'
            }
            #Write-Verbose ($addQuery.Body)
            $response = Invoke-RestMethod @addQuery 

            if ($response.status.code -ne 1 -and $response.status.code -ne 31) {
                Write-Verbose ($response | ConvertTo-Json -dep 10)
                throw $response.status.message
            }
        }
        catch { throw }
    }

    <#
    .SYNOPSIS
        Add a DNS TXT record to DNSPod.

    .DESCRIPTION
        Uses the DNSPod DNS API to add a DNS TXT record.

    .PARAMETER RecordName
        The fully qualified name of the TXT record.

    .PARAMETER TxtValue
        The value of the TXT record.

    .PARAMETER DNSPodKeyId
        The API Key ID value.

    .PARAMETER DNSPodKeyToken
        The API Key Token value as a SecureString value.

    .PARAMETER DNSPodKeyTokenInsecure
        (DEPRECATED) The API Key Token value as a standard String value.

    .PARAMETER DNSPodApiRoot
        The root URL for the DNSPod API you are using. Default to "https://api.dnspod.com" but may also be set to "https://dnsapi.cn".

    .PARAMETER DNSPodCredential
        Obsolete parameter that no longer works with DNSPod API. Do not use.

    .PARAMETER DNSPodUsername
        Obsolete parameter that no longer works with DNSPod API. Do not use.

    .PARAMETER DNSPodPwdInsecure
        Obsolete parameter that no longer works with DNSPod API. Do not use.

    .PARAMETER ExtraParams
        This parameter can be ignored and is only used to prevent errors when splatting with more parameters than this function supports.

    .EXAMPLE
        Add-DnsTxt '_acme-challenge.example.com' 'txt-value' -DNSPodKeyId '1' -DnsPodKeyToken (Read-Host -AsSecureString)

        Adds a TXT record for the specified site with the specified value using a secure token value.
    #>
}

function Remove-DnsTxt {
    [CmdletBinding(DefaultParameterSetName = 'Secure')]
    param(
        [Parameter(Mandatory,Position=0)]
        [string]$RecordName,
        [Parameter(Mandatory,Position=1)]
        [string]$TxtValue,
        [string]$DNSPodKeyId='你的id',
        [string]$DNSPodKeyToken='你的Token',
        [string]$DNSPodApiRoot='https://dnsapi.cn',
        [Parameter(ParameterSetName='Obsolete_DO_NOT_USE',Mandatory)]
        [pscredential]$DNSPodCredential,
        [Parameter(ParameterSetName='Obsolete_DO_NOT_USE',Mandatory)]
        [string]$DNSPodUsername,
        [Parameter(ParameterSetName='Obsolete_DO_NOT_USE',Mandatory)]
        [string]$DNSPodPwdInsecure,
        [Parameter(ValueFromRemainingArguments)]
        $ExtraParams
    )

    if ('Obsolete_DO_NOT_USE' -eq $PSCmdlet.ParameterSetName) {
        throw "DNSPod requires updated API Key/Token values. See user guide for details."
    }

    # build the login_token value
    $authToken = "$DNSPodKeyId%2C$DNSPodKeyToken"

    try {
        Write-Verbose "Searching for existing TXT record"
        $zone, $rec = Get-DNSPodTxtRecord $RecordName $TxtValue $authToken $DNSPodApiRoot
    }
    catch { throw }

    if ($rec) {
        # delete the record
        try {
            Write-Verbose "Removing $RecordName with value $TxtValue"

            $delQuery = @{
                Uri = "$DNSPodApiRoot/Record.Remove"
                Method = 'POST'
                Body = "domain_id=$($zone.id)&record_id=$($rec.id)&login_token=$authToken&format=json&lang=en"
                UserAgent = $script:USER_AGENT
                ErrorAction = 'Stop'
            }
            $response = Invoke-RestMethod @delQuery 

            if ($response.status.code -ne 1 -and $response.status.code -ne 8) {
                throw $response.status.message
            }
        }
        catch { throw }
    }
    else {
        Write-Debug "Record $RecordName with value $TxtValue doesn't exist. Nothing to do."
    }

    <#
    .SYNOPSIS
        Remove a DNS TXT record from DNSPod.

    .DESCRIPTION
        Uses the DNSPod DNS API to remove a DNS TXT record.

    .PARAMETER RecordName
        The fully qualified name of the TXT record.

    .PARAMETER TxtValue
        The value of the TXT record.

    .PARAMETER DNSPodKeyId
        The API Key ID value.

    .PARAMETER DNSPodKeyToken
        The API Key Token value as a SecureString value.

    .PARAMETER DNSPodKeyTokenInsecure
        (DEPRECATED) The API Key Token value as a standard String value.

    .PARAMETER DNSPodApiRoot
        The root URL for the DNSPod API you are using. Default to "https://api.dnspod.com" but may also be set to "https://dnsapi.cn".

    .PARAMETER DNSPodCredential
        Obsolete parameter that no longer works with DNSPod API. Do not use.

    .PARAMETER DNSPodUsername
        Obsolete parameter that no longer works with DNSPod API. Do not use.

    .PARAMETER DNSPodPwdInsecure
        Obsolete parameter that no longer works with DNSPod API. Do not use.

    .PARAMETER ExtraParams
        This parameter can be ignored and is only used to prevent errors when splatting with more parameters than this function supports.

    .EXAMPLE
        Remove-DnsTxt '_acme-challenge.example.com' 'txt-value' -DNSPodKeyId '1' -DnsPodKeyToken (Read-Host -AsSecureString)

        Removes a TXT record for the specified site with the specified value using a secure token value.
    #>
}

function Save-DnsTxt {
    [CmdletBinding()]
    param(
        [Parameter(ValueFromRemainingArguments)]
        $ExtraParams
    )
    <#
    .SYNOPSIS
        Not required.

    .DESCRIPTION
        This provider does not require calling this function to commit changes to DNS records.

    .PARAMETER ExtraParams
        This parameter can be ignored and is only used to prevent errors when splatting with more parameters than this function supports.
    #>
}

############################
# Helper Functions
############################

# API Docs
# https://docs.dnspod.cn/api

function Get-DNSPodTxtRecord {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory,Position=0)]
        [string]$RecordName,
        [Parameter(Mandatory,Position=1)]
        [string]$TxtValue,
        [Parameter(Mandatory,Position=2)]
        [string]$LoginToken,
        [Parameter(Mandatory,Position=3)]
        [string]$ApiRoot
    )

    # setup a module variable to cache the record to zone mapping
    # so it's quicker to find later
    if (!$script:DNSPodRecordZones) { $script:DNSPodRecordZones = @{ } }

    # check for the record in the cache
    if ($script:DNSPodRecordZones.ContainsKey($RecordName)) {
        $zone = $script:DNSPodRecordZones.$RecordName
    }

    if (-not $zone) {

        try {
            # get zone
            $zoneQuery = @{
                Uri = "$ApiRoot/Domain.List"
                Method = 'POST'
                Body = "login_token=$LoginToken&format=json&lang=en"
                UserAgent = $script:USER_AGENT
                ErrorAction = 'Stop'
            }
            $response = Invoke-RestMethod @zoneQuery 

            if ($response.status.code -ne 1) {
                throw $response.status.message
            }
            else {
                [array]$hostedZones = $response.domains
            }

            $zone = $hostedZones | Where-Object { $RecordName -match $_.name }

            # save zone to cache
            $script:DNSPodRecordZones.$RecordName = $zone
        }
        catch { throw }

        if (-not $zone) {
            throw "Failed to find hosted zone for $RecordName"
        }

    }

    try {

        # separate the portion of the name that doesn't contain the zone name
        $recShort = ($RecordName -ireplace [regex]::Escape($zone.name), [string]::Empty).TrimEnd('.')

        # get record
        $recQuery = @{
            Uri = "$ApiRoot/Record.List"
            Method = 'POST'
            Body = "login_token=$LoginToken&format=json&lang=en&domain_id=$($zone.id)"
            UserAgent = $script:USER_AGENT
            ErrorAction = 'Stop'
        }
        $response = Invoke-RestMethod @recQuery 

        if ($response.status.code -ne 1) {
            throw $response.status.message
        }
        else {
            $rec = $response.records | Where-Object {
                $_.name -eq $recShort -and
                $_.type -eq 'TXT' -and
                $_.value -eq $TxtValue
            }
        }
    }
    catch { throw }

    return @($zone, $rec)
}



if ($Task -eq 'create'){
	Add-DnsTxt $RecordName $TxtValue 
}

if ($Task -eq 'delete'){
	Remove-DnsTxt $RecordName $TxtValue 
}