/usr/local/pkg/acme/acme_command.sh importcert

luisenrique

like the command help says:

/usr/local/pkg/acme/acme_command.sh
Use acme_command.sh like this:
acme_command.sh renewall
acme_command.sh importcert MyCertificate DomainName CertKeyPath CertPath CaCertPath CertFullChainPath
acme_command.sh deploykey MyCertificate DomainName Token Payload
acme_command.sh removekey MyCertificate DomainName Token
acme_command.sh -- -perform=issue -certname=MyCertificate [-force]
i run
/usr/local/pkg/acme/acme_command.sh importcert Myibicsa ibicsa.co.cu iBICSA.CO.CU.key iBICSA.CO.CU.crt iBICSA.CO.CU.ca iBICSA.CO.CU.fullchain
but nothin happens. my question is if i can execute alone this script to import from command line in another pfsense wiout internet access on it afther my certs are copiet to it. i'm looking and looking for some solution.
regards
/usr/local/pkg/acme/acme_command.sh
Use acme_command.sh like this:
acme_command.sh renewall
acme_command.sh importcert MyCertificate DomainName CertKeyPath CertPath CaCertPath CertFullChainPath
acme_command.sh deploykey MyCertificate DomainName Token Payload
acme_command.sh removekey MyCertificate DomainName Token
acme_command.sh -- -perform=issue -certname=MyCertificate [-force]
i run
/usr/local/pkg/acme/acme_command.sh importcert Myibicsa ibicsa.co.cu iBICSA.CO.CU.key iBICSA.CO.CU.crt iBICSA.CO.CU.ca iBICSA.CO.CU.fullchain
but nothin happens. my question is if i can execute alone this script to import from command line in another pfsense wiout internet access on it afther my certs are copiet to it. i'm looking and looking for some solution.
regards

jimp

That script is not intended to be used manually, only by the ACME package itself as a part of the renewal process.

It might work, it might not. I'd lean toward it not working, at least not how you expect.

First thing I'd try is to use the full path to the files and not just the filenames.

luisenrique

hi @jimp i run the command in the directory where the certificates are, once executed apparently does not do anything, then I go to the web configuration and I see that I added a blank entry in acme certificates, so enable and edit that entry with the corresponding name ony, run issue button and i see in the system/certificate manager a private key alone... themr again execute the command with the paths of files and keys and there is the certificate imported.
This command should be able to be executed manually, thus removing headaches using third-party scripts
please sorry about my english and thanks for u time

Gertjan

@luisenrique said in /usr/local/pkg/acme/acme_command.sh importcert:

thus removing headaches using third-party scripts

The acme package could be considered as a third party script
Ok, true, it has been developed by someone who happens to know pfSense pretty well.

The thing is : the acme package is build own the existent acme freebsd package, and a boatload of GUI and other glue ware. If @jimp decides to remodel the package, your 'solution' will be broken.

I advise you to use parts of the present (acme) code to make your own "insert cert" script.

Btw : check out the code (acme.inc) : the cert should exists already :

($cert['descr'] == $certificatename)

thus the cert description / name should already exists, and then it's updated.