lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: tool detects LE vs self-signed, retries LE for fallback certs

Browse source
This commit is contained in:
Claus Lohmar 2026-07-07 14:45:45 +01:00
parent 63099703a1
commit 434b23aee2
1 changed files with 29 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
tools/nextwks-tool/main.go
View file

@ -60,7 +60,7 @@ func runCert(args []string) {
log.Fatalf("Failed to create backup dir: %v", err)
}
// Check if all domains have valid certs in backup
// Check if all domains have valid LE certs in backup
needIssue := false
for _, domain := range domains {
certFile := filepath.Join(*backupDir, domain, "fullchain.pem")
@ -69,9 +69,15 @@ func runCert(args []string) {
needIssue = true
break
}
// Check expiry
if isCertExpired(certFile, 7*24*time.Hour) {
log.Printf("[INFO] Cert for %s expires soon or is invalid, reissuing", domain)
// Check if cert is from LE (not self-signed fallback)
if !isCertFromLE(certFile) {
log.Printf("[INFO] Cert for %s is not from Let's Encrypt (self-signed fallback), reissuing", domain)
needIssue = true
break
}
// Check expiry (renew if within 30 days)
if isCertExpired(certFile, 30*24*time.Hour) {
log.Printf("[INFO] Cert for %s expires soon, reissuing", domain)
needIssue = true
break
}
@ -274,6 +280,25 @@ func fileExists(path string) bool {
return err == nil
}
func isCertFromLE(certFile string) bool {
data, err := os.ReadFile(certFile)
if err != nil {
return false
}
block, _ := pem.Decode(data)
if block == nil {
return false
}
cert, err := x509.ParseCertificate(block.Bytes)
if err != nil {
return false
}
if len(cert.Issuer.Organization) > 0 {
return strings.Contains(cert.Issuer.Organization[0], "Let's Encrypt")
}
return false
}
func isCertExpired(certFile string, threshold time.Duration) bool {
data, err := os.ReadFile(certFile)
if err != nil {