wehub-resource-sync
688 lines
20 KiB
Python
688 lines
20 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""
|
|
@File : issue_certificate_service.py
|
|
@Date : 2023-07-23
|
|
"""
|
|
import json
|
|
import time
|
|
import traceback
|
|
from datetime import datetime, timedelta
|
|
|
|
import OpenSSL
|
|
import requests
|
|
|
|
from domain_admin.enums.dns_type_enum import DnsTypeEnum
|
|
from domain_admin.enums.host_auth_type_enum import HostAuthTypeEnum
|
|
from domain_admin.log import logger
|
|
from domain_admin.model.dns_model import DnsModel
|
|
from domain_admin.model.host_model import HostModel
|
|
from domain_admin.model.issue_certificate_model import IssueCertificateModel, ValidStatus, ChallengeDeployTypeEnum, \
|
|
SSLDeployTypeEnum
|
|
from domain_admin.utils import datetime_util, fabric_util, domain_util
|
|
from domain_admin.utils.acme_util import acme_v2_api
|
|
from domain_admin.utils.acme_util.challenge_type import ChallengeType
|
|
from domain_admin.utils.acme_util.directory_type_enum import DirectoryTypeEnum
|
|
from domain_admin.utils.acme_util.key_type_enum import KeyTypeEnum
|
|
from domain_admin.utils.cert_util import cert_common
|
|
from domain_admin.utils.flask_ext.app_exception import AppException
|
|
from domain_admin.utils.open_api import aliyun_domain_api, tencentcloud_domain_api, aliyun_oss_api, aliyun_cdn_api, \
|
|
aliyun_dcdn_api
|
|
from domain_admin.utils.open_api.aliyun_domain_api import RecordTypeEnum
|
|
from domain_admin import config
|
|
|
|
|
|
def issue_certificate(
|
|
domains, user_id,
|
|
directory_type=DirectoryTypeEnum.LETS_ENCRYPT,
|
|
key_type=KeyTypeEnum.RSA
|
|
):
|
|
"""
|
|
申请新证书
|
|
:param key_type:
|
|
:param directory_type:
|
|
:param domains:
|
|
:param user_id:
|
|
:return:
|
|
"""
|
|
# Issue certificate
|
|
|
|
# Create domain private key and CSR
|
|
pkey_pem, csr_pem = acme_v2_api.new_csr_comp(domains=domains)
|
|
|
|
issue_certificate_row = IssueCertificateModel.create(
|
|
user_id=user_id,
|
|
# challenge_type=challenge_type,
|
|
domain_raw=json.dumps(domains),
|
|
ssl_certificate_key=pkey_pem,
|
|
directory_type=directory_type,
|
|
key_type=key_type,
|
|
# status='pending',
|
|
)
|
|
|
|
return issue_certificate_row
|
|
|
|
|
|
def get_certificate_challenges(issue_certificate_id):
|
|
"""
|
|
获取验证方式
|
|
:param issue_certificate_id:
|
|
:return:
|
|
"""
|
|
issue_certificate_row = IssueCertificateModel.get_by_id(issue_certificate_id)
|
|
# Create domain private key and CSR
|
|
domains = issue_certificate_row.domains
|
|
pkey_pem = issue_certificate_row.ssl_certificate_key
|
|
|
|
pkey_pem, csr_pem = acme_v2_api.new_csr_comp(
|
|
domains=domains,
|
|
pkey_pem=pkey_pem,
|
|
)
|
|
|
|
acme_client = acme_v2_api.get_acme_client(
|
|
directory_type=issue_certificate_row.directory_type,
|
|
key_type=issue_certificate_row.key_type
|
|
)
|
|
orderr = acme_client.new_order(csr_pem)
|
|
|
|
# Select HTTP-01 within offered challenges by the CA server
|
|
lst = []
|
|
|
|
for domain, domain_challenges in acme_v2_api.select_challenge(orderr).items():
|
|
for challenge in domain_challenges:
|
|
response, validation = challenge.response_and_validation(acme_client.net.key)
|
|
|
|
data = {
|
|
'domain': domain,
|
|
'sub_domain': domain_util.get_subdomain(domain),
|
|
'root_domain': domain_util.get_root_domain(domain),
|
|
'validation': validation,
|
|
'challenge': challenge
|
|
}
|
|
|
|
lst.append(data)
|
|
|
|
return lst
|
|
|
|
|
|
def verify_certificate(issue_certificate_id, challenge_type, verify_deploy_path, host_id, dns_id):
|
|
"""
|
|
验证域名
|
|
:param issue_certificate_id:
|
|
:param challenge_type:
|
|
:return:
|
|
"""
|
|
|
|
issue_certificate_row = IssueCertificateModel.get_by_id(issue_certificate_id)
|
|
|
|
items = get_certificate_challenges(issue_certificate_id)
|
|
acme_client = acme_v2_api.get_acme_client(
|
|
directory_type=issue_certificate_row.directory_type,
|
|
key_type=issue_certificate_row.key_type
|
|
)
|
|
# 如果有challenge_type对应的部署信息，则进行部署
|
|
if challenge_type == ChallengeType.HTTP01 and verify_deploy_path and host_id:
|
|
itemsCopy = []
|
|
for item in items:
|
|
temp = item['challenge'].to_json()
|
|
temp['validation'] = item['validation']
|
|
itemsCopy.append(temp)
|
|
deploy_verify_file(
|
|
host_id=host_id,
|
|
verify_deploy_path=verify_deploy_path,
|
|
challenges=itemsCopy
|
|
)
|
|
|
|
if challenge_type == ChallengeType.DNS01 and dns_id:
|
|
add_dns_domain_record(
|
|
dns_id=dns_id,
|
|
challenges=items
|
|
)
|
|
# 开始验证
|
|
verify_count = 0
|
|
for item in items:
|
|
challenge = item['challenge']
|
|
challenge_json = challenge.to_json()
|
|
|
|
# 指定认证类型
|
|
if challenge_type != challenge_json['type']:
|
|
continue
|
|
|
|
response, validation = challenge.response_and_validation(acme_client.net.key)
|
|
logger.info(validation)
|
|
|
|
# Let the CA server know that we are ready for the challenge.
|
|
acme_client.answer_challenge(challenge, response)
|
|
|
|
count = 0
|
|
max_count = 5
|
|
|
|
while True:
|
|
count += 1
|
|
|
|
status = get_challenge_status(challenge_json['url'])
|
|
|
|
if status == 'valid':
|
|
IssueCertificateModel.update(
|
|
status=status,
|
|
update_time=datetime_util.get_datetime()
|
|
).where(
|
|
IssueCertificateModel.id == issue_certificate_id
|
|
).execute()
|
|
|
|
break
|
|
|
|
if count >= max_count:
|
|
raise AppException("域名验证失败：{}".format(item['domain']))
|
|
|
|
time.sleep(count)
|
|
verify_count += 1
|
|
|
|
if verify_count == 0:
|
|
raise AppException("域名验证失败")
|
|
|
|
# if success update challenge_type
|
|
IssueCertificateModel.update(
|
|
challenge_type=challenge_type,
|
|
).where(
|
|
IssueCertificateModel.id == issue_certificate_id
|
|
).execute()
|
|
|
|
|
|
def renew_certificate(row_id):
|
|
"""
|
|
Renew certificate
|
|
:param row_id:
|
|
:return:
|
|
"""
|
|
issue_certificate_row = IssueCertificateModel.get_by_id(row_id)
|
|
|
|
pkey_pem = issue_certificate_row.ssl_certificate_key
|
|
domains = issue_certificate_row.domains
|
|
|
|
acme_client = acme_v2_api.get_acme_client(
|
|
directory_type=issue_certificate_row.directory_type,
|
|
key_type=issue_certificate_row.key_type
|
|
)
|
|
|
|
# Create domain private key and CSR
|
|
pkey_pem, csr_pem = acme_v2_api.new_csr_comp(
|
|
domains=domains,
|
|
pkey_pem=pkey_pem,
|
|
)
|
|
|
|
orderr = acme_client.new_order(csr_pem)
|
|
|
|
# Select HTTP-01 within offered challenges by the CA server
|
|
# challb = acme_v2_api.select_challenge(orderr, challenge_type)
|
|
# logger.debug(json_util.json_dump(challb.to_json()))
|
|
|
|
# Performing challenge
|
|
|
|
fullchain_pem = acme_v2_api.perform_http01(acme_client, orderr)
|
|
|
|
logger.debug(fullchain_pem)
|
|
|
|
fullchain_com = OpenSSL.crypto.load_certificate(
|
|
OpenSSL.crypto.FILETYPE_PEM, fullchain_pem
|
|
)
|
|
|
|
cert = cert_common.parse_cert(fullchain_com)
|
|
|
|
IssueCertificateModel.update(
|
|
ssl_certificate=fullchain_pem,
|
|
start_time=cert.notBefore,
|
|
expire_time=cert.notAfter,
|
|
update_time=datetime_util.get_datetime()
|
|
).where(
|
|
IssueCertificateModel.id == issue_certificate_row.id
|
|
).execute()
|
|
|
|
|
|
def get_challenge_status(url):
|
|
"""
|
|
:param url:
|
|
:return:
|
|
{
|
|
"type": "http-01",
|
|
"status": "valid",
|
|
"url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/8189968164/2x43yw",
|
|
"token": "uEy2gzPlQN1IIE541sbRK23AQWFh87MvmvzMDOUvIKk",
|
|
"validationRecord": [],
|
|
"validated": "2023-07-23T08:59:59Z"
|
|
}
|
|
"""
|
|
logger.debug(url)
|
|
|
|
res = requests.get(url)
|
|
|
|
data = res.json()
|
|
logger.debug(data)
|
|
|
|
return data['status']
|
|
|
|
|
|
def renew_all_certificate():
|
|
"""
|
|
更新所有证书
|
|
:return:
|
|
"""
|
|
|
|
now = datetime.now()
|
|
notify_expire_time = now + timedelta(days=config.DEFAULT_RENEW_DAYS)
|
|
|
|
rows = IssueCertificateModel.select().where(
|
|
(IssueCertificateModel.is_auto_renew == True)
|
|
& (
|
|
(IssueCertificateModel.expire_time <= notify_expire_time)
|
|
| (IssueCertificateModel.expire_time == None)
|
|
)
|
|
).order_by(IssueCertificateModel.expire_time.asc())
|
|
|
|
for row in rows:
|
|
try:
|
|
renew_certificate_row(row)
|
|
|
|
IssueCertificateModel.update(
|
|
renew_status=0,
|
|
renew_message='成功',
|
|
update_time=datetime.now()
|
|
).where(
|
|
IssueCertificateModel.id == row.id
|
|
).execute()
|
|
|
|
except Exception as e:
|
|
logger.error(traceback.format_exc())
|
|
|
|
IssueCertificateModel.update(
|
|
renew_status=1,
|
|
renew_message=str(e),
|
|
update_time=datetime.now()
|
|
).where(
|
|
IssueCertificateModel.id == row.id
|
|
).execute()
|
|
|
|
|
|
def renew_certificate_row(row):
|
|
"""
|
|
证书自动续期
|
|
:param row:
|
|
:return:
|
|
"""
|
|
# 重新申请
|
|
pkey_pem, csr_pem = acme_v2_api.new_csr_comp(
|
|
domains=row.domains,
|
|
)
|
|
|
|
IssueCertificateModel.update(
|
|
ssl_certificate_key=pkey_pem,
|
|
ssl_certificate='',
|
|
start_time=None,
|
|
expire_time=None,
|
|
status=ValidStatus.PENDING,
|
|
).where(
|
|
IssueCertificateModel.id == row.id
|
|
)
|
|
|
|
# 验证文件部署 & 验证域名
|
|
verify_certificate(
|
|
issue_certificate_id=row.id,
|
|
challenge_type=row.challenge_type,
|
|
verify_deploy_path=row.deploy_verify_path,
|
|
host_id=row.challenge_deploy_id,
|
|
dns_id=row.challenge_deploy_id
|
|
)
|
|
|
|
# 下载证书
|
|
renew_certificate(row.id)
|
|
|
|
# 自动部署，重启服务
|
|
if row.deploy_type_id == SSLDeployTypeEnum.SSH:
|
|
issue_certificate_row = IssueCertificateModel.get_by_id(row.id)
|
|
|
|
deploy_certificate_file(
|
|
host_id=row.deploy_host_id,
|
|
key_content=issue_certificate_row.ssl_certificate_key,
|
|
pem_content=issue_certificate_row.ssl_certificate,
|
|
key_deploy_path=row.deploy_key_file,
|
|
pem_deploy_path=row.deploy_fullchain_file,
|
|
reload_cmd=row.deploy_reloadcmd
|
|
)
|
|
elif row.deploy_type_id == SSLDeployTypeEnum.WEB_HOOK:
|
|
deploy_ssl_by_web_hook(
|
|
issue_certificate_id=row.id,
|
|
url=row.deploy_url,
|
|
headers=row.deploy_header,
|
|
)
|
|
|
|
elif row.deploy_type_id == SSLDeployTypeEnum.OSS:
|
|
deploy_cert_to_oss(
|
|
issue_certificate_id=row.id,
|
|
dns_id=row.deploy_host_id
|
|
)
|
|
|
|
elif row.deploy_type_id == SSLDeployTypeEnum.CDN:
|
|
deploy_cert_to_cdn(
|
|
issue_certificate_id=row.id,
|
|
dns_id=row.deploy_host_id
|
|
)
|
|
elif row.deploy_type_id == SSLDeployTypeEnum.DCDN:
|
|
deploy_cert_to_dcdn(
|
|
issue_certificate_id=row.id,
|
|
dns_id=row.deploy_host_id
|
|
)
|
|
|
|
|
|
def deploy_verify_file(host_id, verify_deploy_path, challenges):
|
|
"""
|
|
部署验证文件
|
|
:return:
|
|
"""
|
|
logger.info(challenges)
|
|
|
|
host_row = HostModel.get_by_id(host_id)
|
|
|
|
host = host_row.host
|
|
port = host_row.port
|
|
user = host_row.user
|
|
password = host_row.password
|
|
private_key = host_row.private_key
|
|
auth_type = host_row.auth_type
|
|
|
|
for row in challenges:
|
|
if not row['token']:
|
|
raise AppException('token is empty')
|
|
|
|
verify_deploy_filename = verify_deploy_path + row['token']
|
|
|
|
if not verify_deploy_filename:
|
|
raise AppException('verify_deploy_filename is empty')
|
|
|
|
logger.debug("verify_deploy_filename: %s", verify_deploy_filename)
|
|
|
|
if not row['validation']:
|
|
raise AppException('validation is empty')
|
|
|
|
if auth_type == HostAuthTypeEnum.PRIVATE_KEY:
|
|
fabric_util.deploy_file_by_key(
|
|
host=host,
|
|
port=port,
|
|
user=user,
|
|
private_key=private_key,
|
|
content=row['validation'],
|
|
remote=verify_deploy_filename
|
|
)
|
|
else:
|
|
fabric_util.deploy_file(
|
|
host=host,
|
|
port=port,
|
|
user=user,
|
|
password=password,
|
|
content=row['validation'],
|
|
remote=verify_deploy_filename
|
|
)
|
|
|
|
|
|
def deploy_certificate_file(
|
|
host_id,
|
|
key_content,
|
|
key_deploy_path,
|
|
pem_content,
|
|
pem_deploy_path,
|
|
reload_cmd
|
|
):
|
|
"""
|
|
自动部署SSL证书到服务器
|
|
:param host_id: 主机id
|
|
|
|
:param key_deploy_path: 私钥部署路径
|
|
:param key_content: 私钥内容
|
|
|
|
:param pem_deploy_path: 公钥部署路径
|
|
:param pem_content: 公钥内容
|
|
|
|
:param reload_cmd: 重启命令
|
|
:return:
|
|
"""
|
|
host_row = HostModel.get_by_id(host_id)
|
|
|
|
host = host_row.host
|
|
port = host_row.port
|
|
user = host_row.user
|
|
password = host_row.password
|
|
auth_type = host_row.auth_type
|
|
private_key = host_row.private_key
|
|
|
|
# deploy key
|
|
if key_deploy_path:
|
|
if auth_type == HostAuthTypeEnum.PRIVATE_KEY:
|
|
fabric_util.deploy_file_by_key(
|
|
host=host,
|
|
port=port,
|
|
user=user,
|
|
private_key=private_key,
|
|
content=key_content,
|
|
remote=key_deploy_path
|
|
)
|
|
else:
|
|
fabric_util.deploy_file(
|
|
host=host,
|
|
port=port,
|
|
user=user,
|
|
password=password,
|
|
content=key_content,
|
|
remote=key_deploy_path
|
|
)
|
|
|
|
# deploy ssl_certificate
|
|
if pem_deploy_path:
|
|
if auth_type == HostAuthTypeEnum.PRIVATE_KEY:
|
|
fabric_util.deploy_file_by_key(
|
|
host=host,
|
|
port=port,
|
|
user=user,
|
|
private_key=private_key,
|
|
content=pem_content,
|
|
remote=pem_deploy_path
|
|
)
|
|
else:
|
|
fabric_util.deploy_file(
|
|
host=host,
|
|
port=port,
|
|
user=user,
|
|
password=password,
|
|
content=pem_content,
|
|
remote=pem_deploy_path
|
|
)
|
|
|
|
# reload
|
|
if reload_cmd:
|
|
if auth_type == HostAuthTypeEnum.PRIVATE_KEY:
|
|
fabric_util.run_command_by_key(
|
|
host=host,
|
|
port=port,
|
|
user=user,
|
|
private_key=private_key,
|
|
command=reload_cmd
|
|
)
|
|
else:
|
|
fabric_util.run_command(
|
|
host=host,
|
|
port=port,
|
|
user=user,
|
|
password=password,
|
|
command=reload_cmd
|
|
)
|
|
|
|
|
|
def add_dns_domain_record(dns_id, challenges):
|
|
"""
|
|
添加dns记录
|
|
:param dns_id:
|
|
:param challenges:
|
|
:return:
|
|
"""
|
|
dns_row = DnsModel.get_by_id(dns_id)
|
|
|
|
for challenge_row in challenges:
|
|
challenge_json = challenge_row['challenge'].to_json()
|
|
if challenge_json['type'] == ChallengeType.DNS01:
|
|
|
|
if challenge_row['sub_domain']:
|
|
record_key = '_acme-challenge.' + challenge_row['sub_domain']
|
|
else:
|
|
record_key = '_acme-challenge'
|
|
if dns_row.dns_type_id == DnsTypeEnum.ALIYUN:
|
|
aliyun_domain_api.add_domain_record(
|
|
access_key_id=dns_row.access_key,
|
|
access_key_secret=dns_row.secret_key,
|
|
domain_name=challenge_row['root_domain'],
|
|
record_type=RecordTypeEnum.TXT,
|
|
record_key=record_key,
|
|
record_value=challenge_row['validation']
|
|
)
|
|
elif dns_row.dns_type_id == DnsTypeEnum.TENCENT_CLOUD:
|
|
tencentcloud_domain_api.add_domain_record(
|
|
access_key_id=dns_row.access_key,
|
|
access_key_secret=dns_row.secret_key,
|
|
domain_name=challenge_row['root_domain'],
|
|
record_type=RecordTypeEnum.TXT,
|
|
record_key=record_key,
|
|
record_value=challenge_row['validation']
|
|
)
|
|
|
|
|
|
def deploy_ssl_by_web_hook(issue_certificate_id, url, headers):
|
|
"""
|
|
通过webhook部署ssl证书
|
|
:param issue_certificate_id:
|
|
:param url:
|
|
:param headers:
|
|
:return:
|
|
"""
|
|
issue_certificate_row = IssueCertificateModel.get_by_id(issue_certificate_id)
|
|
|
|
if not issue_certificate_row:
|
|
raise AppException('数据不存在')
|
|
|
|
data = {
|
|
'domains': issue_certificate_row.domains,
|
|
'ssl_certificate': issue_certificate_row.ssl_certificate,
|
|
'ssl_certificate_key': issue_certificate_row.ssl_certificate_key,
|
|
'start_time': datetime_util.format_datetime(issue_certificate_row.start_time),
|
|
'expire_time': datetime_util.format_datetime(issue_certificate_row.expire_time),
|
|
}
|
|
|
|
res = requests.request(
|
|
method='POST',
|
|
url=url,
|
|
headers=headers,
|
|
json=data
|
|
)
|
|
|
|
if not res.ok:
|
|
raise res.raise_for_status()
|
|
|
|
return res.text
|
|
|
|
|
|
def deploy_cert_to_oss(issue_certificate_id, dns_id):
|
|
"""
|
|
部署ssl证书到oss
|
|
"""
|
|
issue_certificate_row = IssueCertificateModel.get_by_id(issue_certificate_id)
|
|
|
|
if not issue_certificate_row:
|
|
raise AppException('证书数据不存在')
|
|
|
|
dns_row = DnsModel.get_by_id(dns_id)
|
|
if not dns_row:
|
|
raise AppException('DNS数据不存在')
|
|
|
|
domain = issue_certificate_row.domains[0]
|
|
|
|
oss_info = aliyun_oss_api.cname_to_oss_info(domain)
|
|
if not oss_info:
|
|
raise AppException('dns 未设置')
|
|
|
|
logger.info("oss_info: %s", oss_info)
|
|
|
|
aliyun_oss_api.put_bucket_cname(
|
|
access_key_id=dns_row.access_key,
|
|
access_key_secret=dns_row.secret_key,
|
|
bucket_name=oss_info['bucket_name'],
|
|
domain=domain,
|
|
certificate=issue_certificate_row.ssl_certificate,
|
|
private_key=issue_certificate_row.ssl_certificate_key,
|
|
endpoint=oss_info['endpoint'],
|
|
)
|
|
|
|
|
|
def deploy_cert_to_cdn(issue_certificate_id, dns_id):
|
|
"""
|
|
部署ssl证书到cdn
|
|
"""
|
|
issue_certificate_row = IssueCertificateModel.get_by_id(issue_certificate_id)
|
|
|
|
if not issue_certificate_row:
|
|
raise AppException('证书数据不存在')
|
|
|
|
dns_row = DnsModel.get_by_id(dns_id)
|
|
if not dns_row:
|
|
raise AppException('DNS数据不存在')
|
|
|
|
domain = issue_certificate_row.domains[0]
|
|
|
|
# oss_info = aliyun_oss_api.cname_to_oss_info(domain)
|
|
# if not oss_info:
|
|
# raise AppException('dns 未设置')
|
|
#
|
|
# logger.info("oss_info: %s", oss_info)
|
|
|
|
aliyun_cdn_api.set_cdn_domain_ssl_certificate_v2(
|
|
access_key_id=dns_row.access_key,
|
|
access_key_secret=dns_row.secret_key,
|
|
domain_name=domain,
|
|
certificate=issue_certificate_row.ssl_certificate,
|
|
private_key=issue_certificate_row.ssl_certificate_key,
|
|
)
|
|
|
|
|
|
def deploy_cert_to_dcdn(issue_certificate_id, dns_id):
|
|
"""
|
|
部署ssl证书到dcdn
|
|
"""
|
|
issue_certificate_row = IssueCertificateModel.get_by_id(issue_certificate_id)
|
|
|
|
if not issue_certificate_row:
|
|
raise AppException('证书数据不存在')
|
|
|
|
dns_row = DnsModel.get_by_id(dns_id)
|
|
if not dns_row:
|
|
raise AppException('DNS数据不存在')
|
|
|
|
domain = issue_certificate_row.domains[0]
|
|
|
|
aliyun_dcdn_api.set_dcdn_domain_ssl_certificate(
|
|
access_key_id=dns_row.access_key,
|
|
access_key_secret=dns_row.secret_key,
|
|
domain_name=domain,
|
|
certificate=issue_certificate_row.ssl_certificate,
|
|
private_key=issue_certificate_row.ssl_certificate_key,
|
|
)
|
|
|
|
|
|
def check_auto_renew(issue_certificate_id):
|
|
"""
|
|
首次申请，自动判断是否可以自动续期
|
|
:param issue_certificate_id:
|
|
:return:
|
|
"""
|
|
issue_certificate_row = IssueCertificateModel.get_by_id(issue_certificate_id)
|
|
|
|
if issue_certificate_row.can_auto_renew:
|
|
IssueCertificateModel.update(
|
|
is_auto_renew=True
|
|
).where(
|
|
IssueCertificateModel.id == issue_certificate_id
|
|
).execute()
|