From bb06e502c7cdb90a3b6729e633dd25f320d9a2ed Mon Sep 17 00:00:00 2001
From: Haitao Pan <manbuzhe2009@qq.com>
Date: Sat, 7 Oct 2023 10:04:47 +0800
Subject: [PATCH] 
 playbook/roles/cert-manager/files/certs_automated_issuance.sh: update

---
 .../files/certs_automated_issuance.sh         | 39 ++++++++++++++-----
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/playbook/roles/cert-manager/files/certs_automated_issuance.sh b/playbook/roles/cert-manager/files/certs_automated_issuance.sh
index e5c5f80b..0e7510f7 100644
--- a/playbook/roles/cert-manager/files/certs_automated_issuance.sh
+++ b/playbook/roles/cert-manager/files/certs_automated_issuance.sh
@@ -1,16 +1,37 @@
+#!/bin/bash
+
+
 #!/bin/bash
 set -x
-export domain=$1
+export Domain=$1
 export Ali_Key=$2
 export Ali_Secret=$3
 
+# Non-empty check for Ali_Key and Ali_Secret
+if [ -z "$Ali_Key" ] || [ -z "$Ali_Secret" ] || [ -z "$domain" ]; then
+    echo "Domain, Ali_Key and Ali_Secret must not be empty"
+    exit 1
+fi
+
 curl https://get.acme.sh | sh -s email=156405189@qq.com
 
-rm -rvf ${domain}.* -f
-sh ~/.acme.sh/acme.sh --set-default-ca --server zerossl --issue --force --dns dns_ali -d ${domain} -d "*.${domain}"
-sh ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt --issue --force --dns dns_ali -d ${domain} -d "*.${domain}"
-cat ~/.acme.sh/${domain}_ecc/${domain}.cer > ${domain}.pem
-cat ~/.acme.sh/${domain}_ecc/ca.cer >> ${domain}.pem
-cat ~/.acme.sh/${domain}_ecc/${domain}.key > ${domain}.key
-sudo cp ${domain}.pem /etc/ssl/
-sudo cp ${domain}.key /etc/ssl/
+rm -rvf ${Domain}.* -f
+rm -rvf /etc/ssl/${Domain}.* -f
+
+# Try to issue a certificate from ZeroSSL. If it fails, try Let's Encrypt.
+if ! sh ~/.acme.sh/acme.sh --set-default-ca --server zerossl --issue --force --dns dns_ali -d ${Domain} -d "*.${Domain}"; 
+then
+    sh ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt --issue --force --dns dns_ali -d ${Domain} -d "*.${Domain}"
+fi
+
+cat ~/.acme.sh/${Domain}_ecc/${domain}.cer > ${Domain}.pem
+cat ~/.acme.sh/${Domain}_ecc/ca.cer >> ${Domain}.pem
+cat ~/.acme.sh/${Domain}_ecc/${Domain}.key > ${Domain}.key
+sudo cp ${Domain}.pem /etc/ssl/
+sudo cp ${Domain}.key /etc/ssl/
+
+# Non-empty check for ${domain}.pem and ${Domain}.key
+if [ ! -s "${Domain}.pem" ] || [ ! -s "${Domain}.key" ]; then
+    echo "${Domain}.pem and ${Domain}.key must not be empty"
+    exit 1
+fi