mirror of
https://github.com/certimate-go/certimate.git
synced 2026-04-26 21:25:54 +03:00
[GH-ISSUE #397] [Feature] 怎么群晖自动替换 #251
Labels
No labels
announcement
backlog
bug
declined
documentation
duplicate
enhancement
good first issue
good first issue
help wanted
invalid
pull-request
question
stale
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/certimate#251
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @yeyinghai on GitHub (Dec 27, 2024).
Original GitHub issue: https://github.com/certimate-go/certimate/issues/397
部署成功也会自动签发，就是需要手动在群晖里修改下
@heiyu8 commented on GitHub (Jan 11, 2025):
我也是，签名还有问题
@zijiwork commented on GitHub (Jan 21, 2025):
可以试试这个 https://ssl.dnsjia.com
@fudiwei commented on GitHub (Feb 11, 2025):
可参考此链接，以 SSH 方式部署：
@acevsok commented on GitHub (Apr 5, 2025):
如果群晖开启二次验证还有did
不光是文件夹映射的问题
还有证书安装的问题
本地ssh部署 估计必须自己加代码才能实现。
@zczc0417 commented on GitHub (May 16, 2025):
@fudiwei 群晖的脚本可能有点问题
failed to execute post-command (stdout: [DEBUG] Default cert directory found: '/usr/syno/etc/certificate/_archive/hdiXXX' [DEBUG] Found proxy dir: /usr/syno/etc/certificate/ReverseProxy/11764be9-f584-4ce6-94b0-96df7aef9383/ [DEBUG] Found proxy dir: /usr/syno/etc/certificate/ReverseProxy/5d98caeb-5cf9-4d5b-bd62-2b0c4e13d6ef/ [DEBUG] Found proxy dir: /usr/syno/etc/certificate/ReverseProxy/69d1f7ec-b080-4af6-986a-708ec4140027/ [ERROR] Halting because of error moving fullchain file , stderr: ash: line 4: =: command not found ash: line 5: =: command not found ash: line 6: =: command not found + cp -rf '' /usr/syno/etc/certificate/system/default/fullchain.pem cp: cannot stat '': No such file or directory + error_exit 'Halting because of error moving fullchain file' + echo '[ERROR] Halting because of error moving fullchain file' + exit 1 ): failed to execute ssh command: Process exited with status 1
@charley008 commented on GitHub (May 30, 2025):
通过
inotifywait -m -r -e create,move,modify --format '%w%f %e'
/usr/syno/etc/
/etc/ssl/certs/
/usr/syno/etc/www/certificate/
/etc/ssl/
/usr/local/etc 2>&1 | tee /tmp/cert_monitor.log
手动更新证书时候发现：
/usr/syno/etc/certificate/_archive/xxxx
/usr/syno/etc/certificate/kmip/kmip
/usr/syno/etc/certificate/smbftpd/ftpd
/usr/local/etc/certificate/WebDAVServer/webdav
/usr/local/etc/certificate/LogCenter/pkg-LogCenter
/usr/local/etc/certificate/ReplicationService/snapshot_receiver
/usr/local/etc/certificate/SynologyDrive/SynologyDrive
/usr/local/etc/certificate/ActiveBackup/ActiveBackup
/usr/local/etc/certificate/ScsiTarget/pkg-scsi-plugin-server
/usr/syno/etc/certificate/system/default
/usr/syno/etc/certificate/AppPortal/VideoStation_AltPort
/usr/syno/etc/certificate/AppPortal/SynologyPhotos_AltPort
/usr/syno/etc/certificate/AppPortal/SynologyDrive_AltPort
/usr/syno/etc/certificate/ReverseProxy/*/
这几个目录有了变更，替换了fullchain.pem privkey.pem cert.pem
@zczc0417 commented on GitHub (May 30, 2025):
这个是我用AI修改后的群晖替换脚本,在我的DSM上经过验证,希望可以帮到你们
#!/bin/bash
设置脚本遇到错误时自动退出
set -e
开启调试模式（设为0则关闭）
DEBUG=1
错误退出函数
error_exit() {
echo "[ERROR] $1"
exit 1
}
警告信息函数
warn() {
echo "[WARN] $1"
}
普通信息输出
info() {
echo "[INFO] $1"
}
调试信息输出
debug() {
"${DEBUG}" && echo "[DEBUG] $1"
}
默认系统证书存放路径（你已将新证书上传到这里）
certs_src_dir="/usr/syno/etc/certificate/system/default"
其他需要更新证书的目录列表
target_cert_dirs=(
"/usr/syno/etc/certificate/system/FQDN"
"/usr/local/etc/certificate/ScsiTarget/pkg-scsi-plugin-server/"
"/usr/local/etc/certificate/SynologyDrive/SynologyDrive/"
"/usr/local/etc/certificate/WebDAVServer/webdav/"
"/usr/syno/etc/certificate/smbftpd/ftpd/"
)
获取默认证书目录名（用于定位 _archive 目录）
default_dir_name=$(</usr/syno/etc/certificate/_archive/DEFAULT)
if -n "$default_dir_name" ; then
target_cert_dirs+=("/usr/syno/etc/certificate/_archive/${default_dir_name}")
debug "找到默认证书归档目录: '/usr/syno/etc/certificate/_archive/${default_dir_name}'"
else
warn "未找到默认证书归档目录，请检查 '/usr/syno/etc/certificate/_archive/DEFAULT'"
fi
查找所有反向代理证书目录并加入目标列表
for proxy in /usr/syno/etc/certificate/ReverseProxy/*/
do
debug "发现反向代理证书目录: ${proxy}"
target_cert_dirs+=("${proxy}")
done
显示调试命令（仅当 DEBUG=1 时）
"${DEBUG}" && set -x
=== 复制证书到各个目标目录 ===
for target_dir in "${target_cert_dirs[@]}"
do
if ! -d "$target_dir" ; then
debug "目标证书目录 '$target_dir' 不存在，跳过..."
continue
fi
info "正在复制证书到目录: $target_dir"
只复制证书文件，不更改权限或属主
cp "${certs_src_dir}/"{privkey,fullchain,cert}.pem "$target_dir/" ||
warn "⚠️ 无法复制证书到目录: $target_dir"
done
=== 重启相关服务使证书生效 ===
通用服务重启函数（带成功/失败提示）
restart_service() {
local service="$1"
/usr/syno/bin/synosystemctl restart "$service"
&& info "✅ 已重启服务: $service"
|| warn "⚠️ 重启服务失败: $service"
}
重启基础网络服务
restart_service nmbd
restart_service avahi
restart_service ldap-server
有条件地重启插件服务（只在运行时重启）
restart_if_running() {
local package="$1"
if /usr/syno/bin/synopkg status "$package" | grep -q 'running'; then
/usr/syno/bin/synopkg restart "$package"
info "✅ 已重启插件: $package"
else
debug "插件未运行，跳过重启: $package"
fi
}
restart_if_running ScsiTarget
restart_if_running SynologyDrive
restart_if_running WebDAVServer
更新 Web 服务器配置并重启 nginx
/usr/syno/bin/synow3tool --gen-all
if /usr/syno/bin/synosystemctl restart nginx; then
info "✅ Nginx 服务已重启"
else
warn "⚠️ Nginx 重启失败，请手动检查配置"
fi
=== 脚本执行完毕 ===
info "🎉 证书更新与服务重启已完成！"
@charley008 commented on GitHub (May 31, 2025):
@zczc0417 nmbd服务不存在，/usr/syno/etc/certificate/system/FQDN 目录不存在，我的是dsm7.2.1，我对你的脚本做了相应修改。
通过dsm web手动更新证书的话，看到/var/log/system.log
所以好像没有必要重启那么多服务或者套件。
@charley008 commented on GitHub (Jun 5, 2025):
新增验证证书文件是否需要替换
@LuCatIsFun commented on GitHub (Aug 12, 2025):
亲测可用，可以参考这个配置