commit 30faa3e60ea79b6ed7710bc9aaef678c63a87e41
Author: Přemysl Janouch <p.janouch@gmail.com>
Date:   Tue May 16 17:01:24 2017 +0200

    Initial commit

diff --git a/acme-tinier.pl b/acme-tinier.pl
new file mode 100755
index 0000000..c0c54f5
--- /dev/null
+++ b/acme-tinier.pl
@@ -0,0 +1,159 @@
+#!/usr/bin/env perl
+# This is a simplified rewrite of acme-tiny in Perl, since Python 3 is 125 MiB
+# but Perl is everywhere and JSON::PP mostly in default installations.
+# Depends on curl and openssl.
+use strict;
+use warnings;
+use MIME::Base64 qw(encode_base64 encode_base64url);
+use JSON::PP;
+use Digest::SHA qw(sha256);
+use IPC::Open2;
+
+my $ca = 'https://acme-staging.api.letsencrypt.org';
+# 'https://acme-v01.api.letsencrypt.org'
+my $account_key = 'account.key';
+my $csr_file = shift;
+my $public_dir = '/srv/http/htdocs/acme-challenge';
+
+# Prepare some values derived from account key for the ACME protocol
+sub b64 { encode_base64url(shift, '') =~ s/=//gr }
+$_ = `openssl rsa -in '$account_key' -noout -text`;
+die 'cannot process account key' if $?;
+
+my ($pub_hex, $pub_exp) =
+	/modulus:\n\s+00:([a-f\d:\s]+?)\npublicExponent: (\d+)/m;
+$pub_exp = sprintf("%x", $pub_exp);
+$pub_exp = "0$pub_exp" if length($pub_exp) % 2;
+
+my $header = { alg => 'RS256', jwk => { kty => 'RSA',
+	e => b64(pack 'H*', $pub_exp),
+	n => b64(pack 'H*', $pub_hex =~ s/\s|://gr)
+}};
+
+my $json = JSON::PP->new->pretty(0);
+my $thumbprint = b64(sha256($json->encode($header->{jwk})));
+
+# Pipe data through an external program, keeping status in $?
+sub communicate {
+	my $data = pop;
+	my $pid = open2(\*Reader, \*Writer, @_);
+	print Writer $data if defined($data);
+	close Writer;
+	local $/ = undef;
+	my $resp = <Reader>;
+	waitpid $pid, 0;
+	return $resp;
+}
+
+# Use cURL to download a file over HTTPS but parse it ourselves
+sub get {
+	my ($url, $data) = @_;
+	my @args = ('curl', '-sS', '-D-', '-H', 'Expect:');
+	push @args, ('-X', 'POST', '--data-binary', '@-') if defined($data);
+	my $resp = communicate(@args, $url, $data);
+	die 'cannot download' if $? >> 8;
+	my ($code, $headers, $body) =
+		$resp =~ m#\AHTTP/\d\.\d (\d+) .*?\r\n(.*?)\r\n\r\n(.*)#sm;
+	return ($code, $body, { $headers =~ /(\S+?): (.*)$/mg })
+}
+
+# Make a signed request to an ACME endpoint
+sub send_signed {
+	my ($url, $payload) = @_;
+	my $protected = { nonce => `curl -sSfI '$ca/directory'`
+		=~ /Replay-Nonce: (\S+)/i, %$header };
+	die 'cannot retrieve nonce' if $?;
+
+	my $b64payload = b64 $json->encode($payload);
+	my $b64protected = b64 $json->encode($protected);
+	my $out = communicate('openssl', 'dgst', '-sha256', '-sign', $account_key,
+		"$b64protected.$b64payload");
+	die 'cannot sign request' if $? >> 8;
+	return get $url, $json->encode({
+		header => $header, protected => $b64protected,
+		payload => $b64payload, signature => b64 $out
+	})
+}
+
+# Find all domains specified in the certificate request
+my $csr = `openssl req -in '$csr_file' -noout -text`;
+die 'cannot parse CSR' if $?;
+
+my @domains;
+push @domains, $1 if $csr =~ /Subject:.*? CN *= *([^\s,;\/]+)/;
+# FIXME: this may not parse correctly either, try it out
+push @domains, map { substr $_, 4 } grep { /^DNS:/ } split(/, /)
+	for $csr =~ /X509v3 Subject Alternative Name: \n +([^\n]+)\n/g;
+
+# Get certificate domains and expiration
+# FIXME: don't hardcode the agreement, that may stop working
+my ($code, $result) = send_signed("$ca/acme/new-reg", {
+	resource => 'new-reg',
+	agreement => 'https://letsencrypt.org/documents/'
+		. 'LE-SA-v1.1.1-August-1-2016.pdf'
+});
+die "cannot register: $code" if $code != 201 && $code != 409;
+
+# Run each domain through the ACME challenge
+for my $domain (@domains) {
+	my ($code, $result) = send_signed("$ca/acme/new-authz", {
+		resource => 'new-authz',
+		identifier => { type => 'dns', value => $domain }
+	});
+	die "cannot request challenge: $code" if $code != 201;
+
+	my ($challenge) = grep { $_->{type} eq 'http-01' }
+		@{$json->decode($result)->{challenges}};
+	my $token = $challenge->{token} =~ s/[^A-Za-z0-9_-]/_/r;
+	my $key_auth = "$token.$thumbprint";
+	my $known_path = "$public_dir/$token";
+
+	# Make the challenge file and check that it can be retrieved
+	open(my $fh, '>', $known_path) or die "cannot write $known_path: $!";
+	print $fh $key_auth;
+	close $fh;
+
+eval {
+	my $url = "http://$domain/.well-known/acme-challenge/$token";
+	my ($code, $result) = get $url;
+	die "checking challenge failed: $code" if $code != 200;
+	die 'challenge contents differ' if $result ne $key_auth;
+
+	# Submit the challenge and wait for the verification to finish
+	($code, $result) = send_signed($challenge->{uri}, {
+		resource => 'challenge',
+		keyAuthorization => $key_auth
+	});
+	die "checking challenge failed: $code" if $code != 202;
+
+	while (1) {
+		($code, $result) = get $challenge->{uri};
+		die "verifying challenge failed: $code" if $code >= 400;
+		my $status = $json->decode($result);
+		if ($status->{status} eq 'valid') {
+			last;
+		} elsif ($status->{status} eq 'pending') {
+			sleep 1;
+		} else {
+			die "verifying challenge failed: $status";
+		}
+	}
+};
+
+	# Make sure our file gets deleted and rethrow any error
+	unlink $known_path;
+	die $@ if $@;
+}
+
+# Get the new certificate and print it in the PEM format
+my $der = `openssl req -in '$csr_file' -outform DER`;
+die 'cannot convert CSR' if $?;
+($code, $result) = send_signed("$ca/acme/new-cert", {
+	resource => 'new-cert',
+	csr => b64 $der
+});
+die "cannot sign certificate: $code" if $code != 201;
+
+print "-----BEGIN CERTIFICATE-----\n"
+	. join("\n", unpack '(A64)*', encode_base64($result, ''))
+	. "\n-----END CERTIFICATE-----\n";