1
name: "SSL: 0.Check"
2

3
on:
4
  schedule:
5
    - cron: '0 0 * * 1' # 每周一检测
6
  workflow_dispatch:
7

8
permissions:
9
  actions: write
10

11
jobs:
12
  check:
13
    runs-on: ubuntu-latest
14
    steps:
15
      - id: check
16
        run: |
17
          T="${{ vars.DOMAIN_CHECK }}" # 在 Variables 中配置
18
          E=$(echo | openssl s_client -4 -connect $T:443 -servername $T -timeout 5 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
19
          D=$(( ($(date -d "$E" +%s) - $(date +%s)) / 86400 ))
20
          echo "Days: $D"
21
          [ $D -lt 20 ] && echo "renew=true" >> $GITHUB_OUTPUT || echo "renew=false" >> $GITHUB_OUTPUT
22

23
      - if: steps.check.outputs.renew == 'true'
24
        uses: actions/github-script@v7
25
        with:
26
          script: |
27
            github.rest.actions.createWorkflowDispatch({
28
              owner: context.repo.owner,
29
              repo: context.repo.repo,
30
              workflow_id: 'ssl_issue.yml',
31
              ref: 'main'
32
            })

1
name: "SSL: 1.Issue"
2

3
on:
4
  workflow_dispatch:
5

6
permissions:
7
  actions: write
8
  contents: read
9

10
jobs:
11
  issue:
12
    runs-on: ubuntu-latest
13
    env:
14
      ACME: "https://acme.litessl.com/acme/v2/directory"
15
      DOMAIN: "${{ vars.DOMAIN_MAIN }}"
16
    steps:
17
      - uses: actions/checkout@v4
18

19
      - name: Issue Certificate
20
        env:
21
          Ali_Key: ${{ secrets.ALIYUN_AK }}
22
          Ali_Secret: ${{ secrets.ALIYUN_SK }}
23
        run: |
24
          curl https://get.acme.sh | sh
25
          ~/.acme.sh/acme.sh --register-account --server "$ACME" \
26
            --eab-kid "${{ secrets.EAB_ID }}" \
27
            --eab-hmac-key "${{ secrets.EAB_KEY }}" -m "${{ vars.EMAIL }}"
28

29
          ~/.acme.sh/acme.sh --issue --dns dns_ali -d "$DOMAIN" -d "*.$DOMAIN" \
30
            --server "$ACME" --keylength ec-384 --force --dnssleep 60
31

32
          mkdir -p ./out
33
          ~/.acme.sh/acme.sh --install-cert -d "$DOMAIN" --ecc \
34
            --key-file ./out/cert.key --fullchain-file ./out/cert.pem
35

36
      - uses: actions/upload-artifact@v4
37
        with:
38
          name: ssl-cert-package
39
          path: ./out/
40
          retention-days: 7
41

42
      - name: Trigger Deploy
43
        uses: actions/github-script@v7
44
        with:
45
          script: |
46
            await github.rest.actions.createWorkflowDispatch({
47
              owner: context.repo.owner,
48
              repo: context.repo.repo,
49
              workflow_id: 'ssl_deploy.yml',
50
              ref: 'main',
51
              inputs: { run_id: '${{ github.run_id }}' }
52
            });

1
name: "SSL: 2.Deploy"
2

3
on:
4
  workflow_dispatch:
5
    inputs:
6
      run_id:
7
        required: true
8

9
jobs:
10
  deploy:
11
    runs-on: ubuntu-latest
12
    env:
13
      DOMAIN: "${{ vars.DOMAIN_MAIN }}"
14
    steps:
15
      - uses: actions/checkout@v4
16

17
      - name: Download Cert
18
        uses: actions/download-artifact@v4
19
        with:
20
          name: ssl-cert-package
21
          path: ./certs
22
          run-id: ${{ github.event.inputs.run_id }}
23
          github-token: ${{ secrets.PAT_TOKEN }}
24

25
      - name: Aliyun ESA
26
        env:
27
          ALICLOUD_AK: ${{ secrets.ALIYUN_AK }}
28
          ALICLOUD_SK: ${{ secrets.ALIYUN_SK }}
29
          SITE_IDS: ${{ secrets.ESA_SITE_ID }}
30
        run: |
31
          curl -L https://aliyuncli.alicdn.com/aliyun-cli-linux-latest-amd64.tgz | tar -xz
32
          sudo mv aliyun /usr/local/bin/
33
          aliyun configure set --access-key-id "$ALICLOUD_AK" --access-key-secret "$ALICLOUD_SK" --region "cn-hangzhou"
34

35
          NAME="${DOMAIN}_$(date +%Y%m%d_%H%M%S)"
36
          CID=$(aliyun cas UploadUserCertificate --Cert "$(cat ./certs/cert.pem)" --Key "$(cat ./certs/cert.key)" --Name "$NAME" | jq -r '.CertId')
37

38
          IFS=',' read -r -a ids <<< "$SITE_IDS"
39
          for sid in "${ids[@]}"; do
40
            sid=$(echo $sid | xargs)
41
            for oid in $(aliyun esa ListCertificates --SiteId "$sid" | jq -r '.Result[].Id // empty'); do
42
              aliyun esa DeleteCertificate --SiteId "$sid" --Id "$oid" || true
43
            done
44
            sleep 2
45
            aliyun esa SetCertificate --SiteId "$sid" --Type cas --CasId "$CID"
46
          done
47

48
      - name: Tencent SSL
49
        env:
50
          TENCENT_AK: ${{ secrets.TENCENT_AK }}
51
          TENCENT_SK: ${{ secrets.TENCENT_SK }}
52
        run: |
53
          pip install requests
54
          python3 - <<'EOF'
55
          import requests, os, hashlib, hmac, json, time
56
          from datetime import datetime
57
          ak, sk, dom = os.environ["TENCENT_AK"], os.environ["TENCENT_SK"], os.environ["DOMAIN"]
58
          with open("./certs/cert.pem") as f: pub = f.read()
59
          with open("./certs/cert.key") as f: pri = f.read()
60
          name = f"{dom}_{datetime.now().strftime('%Y%m%d_%H%M%S')}"
61
          def sign(key, msg): return hmac.new(key, msg.encode(), hashlib.sha256).digest()
62
          ts = int(time.time())
63
          dt = datetime.utcfromtimestamp(ts).strftime("%Y-%m-%d")
64
          body = {"CertificatePublicKey": pub, "CertificatePrivateKey": pri, "Alias": name, "Repeatable": True}
65
          p = json.dumps(body)
66
          can = f"POST\n/\n\ncontent-type:application/json; charset=utf-8\nhost:ssl.tencentcloudapi.com\nx-tc-action:uploadcertificate\n\ncontent-type;host;x-tc-action\n{hashlib.sha256(p.encode()).hexdigest()}"
67
          s = f"TC3-HMAC-SHA256\n{ts}\n{dt}/ssl/tc3_request\n{hashlib.sha256(can.encode()).hexdigest()}"
68
          sig = hmac.new(sign(sign(sign(("TC3"+sk).encode(), dt), "ssl"), "tc3_request"), s.encode(), hashlib.sha256).hexdigest()
69
          h = {"Authorization": f"TC3-HMAC-SHA256 Credential={ak}/{dt}/ssl/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature={sig}", "Content-Type": "application/json; charset=utf-8", "Host": "ssl.tencentcloudapi.com", "X-TC-Action": "UploadCertificate", "X-TC-Timestamp": str(ts), "X-TC-Version": "2019-12-05"}
70
          r = requests.post("https://ssl.tencentcloudapi.com", headers=h, json=body).json()
71
          if "Error" in r.get("Response", {}): print(r); exit(1)
72
          print(f"Tencent ID: {r['Response']['CertificateId']}")
73
          EOF
74

75
      - name: Server Deploy
76
        uses: appleboy/scp-action@master
77
        with:
78
          host: ${{ secrets.SSH_HOST }}
79
          username: ${{ secrets.SSH_USER }}
80
          key: ${{ secrets.SSH_KEY }}
81
          source: "./certs/*"
82
          target: "${{ vars.SERVER_CERT_PATH }}"
83
          strip_components: 1
84

85
      - name: Server Restart
86
        uses: appleboy/ssh-action@master
87
        with:
88
          host: ${{ secrets.SSH_HOST }}
89
          username: ${{ secrets.SSH_USER }}
90
          key: ${{ secrets.SSH_KEY }}
91
          script: ${{ vars.RESTART_CMD }}