6 # Check if running in CI environment
7 if [[ ! "${CI:-false}" == "true" ]]; then
8 echo "ERROR: Not running in CI environment!"
20 echo -e "[\u001B[32mPASS\u001B[0m]"
23 echo -e "[\u001B[31mFAIL\u001B[0m]"
35 _SUBTEST "Checking if file '${1}' exists..."
36 if [[ -e "${1}" ]]; then
39 _FAIL "Missing file: ${1}"
43 _SUBTEST "Checking if log contains '${1}'..."
44 if grep -- "${1}" tmplog > /dev/null; then
47 _FAIL "Missing in log: ${1}"
51 _SUBTEST "Checking if log doesn't contain '${1}'..."
52 if grep -- "${1}" tmplog > /dev/null; then
53 _FAIL "Found in log: ${1}"
59 _SUBTEST "Checking if errorlog is empty..."
60 if [[ -z "$(cat errorlog)" ]]; then
63 _FAIL "Non-empty errorlog"
67 # If not found (should be cached in travis) download ngrok
68 if [[ ! -e "ngrok/ngrok" ]]; then
72 wget https://dl.ngrok.com/ngrok_2.0.19_linux_amd64.zip -O ngrok.zip
78 # Run ngrok and grab temporary url from logfile
79 ngrok/ngrok http 8080 --log stdout --log-format logfmt --log-level debug > tmp.log &
81 TMP_URL="$(grep -Eo "Hostname:[a-z0-9]+.ngrok.io" tmp.log | head -1 | cut -d':' -f2)"
82 if [[ -z "${TMP_URL}" ]]; then
83 echo "Couldn't get an url from ngrok, not a letsencrypt.sh bug, tests can't continue."
87 # Run python webserver in .acme-challenges directory to serve challenge responses
88 mkdir -p .acme-challenges/.well-known/acme-challenge
91 python -m SimpleHTTPServer 8080 > /dev/null 2> /dev/null
94 # Generate config and create empty domains.txt
95 echo 'CA="https://testca.kurz.pw/directory"' > config.sh
96 echo 'LICENSE="https://testca.kurz.pw/terms/v1"' >> config.sh
97 echo 'WELLKNOWN=".acme-challenges/.well-known/acme-challenge"' >> config.sh
100 # Check if help command is working
101 _TEST "Checking if help command is working..."
102 ./letsencrypt.sh --help > tmplog 2> errorlog || _FAIL "Script execution failed"
103 _CHECK_LOG "Default command: help"
104 _CHECK_LOG "--help (-h)"
105 _CHECK_LOG "--domain (-d) domain.tld"
108 # Run in cron mode with empty domains.txt (should only generate private key and exit)
109 _TEST "First run in cron mode, checking if private key is generated and registered"
110 ./letsencrypt.sh --cron > tmplog 2> errorlog || _FAIL "Script execution failed"
111 _CHECK_LOG "Registering account key"
112 _CHECK_FILE "private_key.pem"
115 # Temporarily move config out of the way and try signing certificate by using temporary config location
116 _TEST "Try signing using temporary config location and with domain as command line parameter"
117 mv config.sh tmp_config.sh
118 ./letsencrypt.sh --cron --domain "${TMP_URL}" -f tmp_config.sh > tmplog 2> errorlog || _FAIL "Script execution failed"
119 _CHECK_NOT_LOG "Checking domain name(s) of existing cert"
120 _CHECK_LOG "Generating private key"
121 _CHECK_LOG "Requesting challenge for ${TMP_URL}"
122 _CHECK_LOG "Challenge is valid!"
123 _CHECK_LOG "Creating fullchain.pem"
126 mv tmp_config.sh config.sh
128 # Move private key and add new location to config
129 mv private_key.pem account_key.pem
130 echo 'PRIVATE_KEY="./account_key.pem"' >> config.sh
132 # Add domain to domains.txt and run in cron mode again (should find a non-expiring certificate and do nothing)
133 _TEST "Run in cron mode again, this time with domain in domains.txt, should find non-expiring certificate"
134 echo "${TMP_URL}" >> domains.txt
135 ./letsencrypt.sh --cron > tmplog 2> errorlog || _FAIL "Script execution failed"
136 _CHECK_LOG "Checking domain name(s) of existing cert... unchanged."
137 _CHECK_LOG "Skipping!"
140 # Run in cron mode one last time, with domain in domains.txt and force-resign (should find certificate, resign anyway, and not generate private key)
141 _TEST "Run in cron mode one last time, with domain in domains.txt and force-resign"
142 echo "${TMP_URL}" >> domains.txt
143 ./letsencrypt.sh --cron --force > tmplog 2> errorlog || _FAIL "Script execution failed"
144 _CHECK_LOG "Checking domain name(s) of existing cert... unchanged."
145 _CHECK_LOG "Ignoring because renew was forced!"
146 _CHECK_NOT_LOG "Generating private key"
147 _CHECK_LOG "Requesting challenge for ${TMP_URL}"
148 _CHECK_LOG "Challenge is valid!"
149 _CHECK_LOG "Creating fullchain.pem"
153 # Delete account key (not needed anymore)
156 # Check if renewal works
157 _TEST "Run in cron mode again, to check if renewal works"
158 echo 'RENEW_DAYS="300"' >> config.sh
159 ./letsencrypt.sh --cron > tmplog 2> errorlog || _FAIL "Script execution failed"
160 _CHECK_LOG "Checking domain name(s) of existing cert... unchanged."
161 _CHECK_LOG "Renewing!"
164 # Check if certificate is valid in various ways
165 _TEST "Verifying certificate..."
166 _SUBTEST "Verifying certificate on its own..."
167 openssl x509 -in "certs/${TMP_URL}/cert.pem" -noout -text > tmplog 2> errorlog && _PASS || _FAIL
168 _CHECK_LOG "CN=${TMP_URL}"
169 _SUBTEST "Verifying file with full chain..."
170 openssl x509 -in "certs/${TMP_URL}/fullchain.pem" -noout -text > /dev/null 2>> errorlog && _PASS || _FAIL
171 _SUBTEST "Verifying certificate against CA certificate..."
172 (openssl verify -verbose -CAfile "certs/${TMP_URL}/fullchain.pem" -purpose sslserver "certs/${TMP_URL}/fullchain.pem" 2>&1 || true) | (grep -v ': OK$' || true) >> errorlog 2>> errorlog && _PASS || _FAIL
175 # Revoke certificate using certificate key
176 _TEST "Revoking certificate..."
177 ./letsencrypt.sh --revoke "certs/${TMP_URL}/cert.pem" --privkey "certs/${TMP_URL}/privkey.pem" > tmplog 2> errorlog || _FAIL "Script execution failed"
178 _CHECK_LOG "Revoking certs/${TMP_URL}/cert.pem"
180 _CHECK_FILE "certs/${TMP_URL}/cert.pem-revoked"