脚本解决雷池WAF的域名证书自动续签

在没有自动化执行之前，我都是用的 utool 中的域名插件，手动生成泛域名证书，然后拷贝到 WAF 中的。 雷池支持自动申请证书，但是不支持泛域名证书。 最近想要把这件事自动化一下。 折腾第一次～ 看到了一个 github 帖子【推荐】纯脚本解决雷池 WAF 自动续签问题 #987 ↗ 该帖子发布较早，现在已经无法正确执行。 docker run --rm -it -v "/data/acme":/acme.sh neilpang/acme.sh --issue --dns dns_tencent -d *.987654321.xyz -d 987654321.xyz --yes-I-know-dns-manual-mode-enough-go-ahead-please 会报错： [Tue Aug 25 07:35:45 UTC 2026] Using CA: https://acme.zerossl.com/v2/DV90 [Tue Aug 25 07:35:45 UTC 2026] No EAB credentials found for ZeroSSL, let's obtain them [Tue Aug 25 07:35:45 UTC 2026] acme.sh is using ZeroSSL as default CA now. [Tue Aug 25 07:35:45 UTC 2026] Please update your account with an email address first. [Tue Aug 25 07:35:45 UTC 2026] acme.sh --register-account -m my@example.com [Tue Aug 25 07:35:45 UTC 2026] See: https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA [Tue Aug 25 07:35:45 UTC 2026] Please add '--debug' or '--log' to see more information. [Tue Aug 25 07:35:45 UTC 2026] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh acme.sh is using ZeroSSL as default CA now. 默认使用服务 ZeroSSL 需要提供邮箱📮信息。 所以脚本需要添加：--register-account -m my@example.com 增加这个以后会自动拿着这个邮箱注册。 我也用的是腾讯云的域名管理，然后按照要求把SAVED_Tencent_SecretId 和 SAVED_Tencent_SecretKey 写入到 account.conf 文件。 如果使用了--issue --dns dns_tencent DNS 验证的话，那么就不需要--yes-I-know-dns-manual-mode-enough-go-ahead-please手动验证的参数了。 再次执行修改后的脚本： docker run --rm -it -v /opt/myapp/acme:/acme.sh neilpang/acme.sh --register-account -m aaa@qq.com --server zerossl --issue --dns dns_tencent -d *.lichenghao.cn 执行结果，大概如下所示： Using CA: https://acme.zerossl.com/v2/DV90 Single domain='*.lichenghao.cn' Getting webroot for domain='*.lichenghao.cn' Adding TXT value: Dx-5nGnsfULyqNR6K6tqniMbI for domain: _acme-challenge.lichenghao.cn The TXT record has been successfully added. Let's check each DNS record now. Sleeping for 20 seconds first. You can use '--dnssleep' to disable public dns checks. See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck Checking lichenghao.cn for _acme-challenge.lichenghao.cn Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 35 Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28 Not valid yet, let's wait for 10 seconds then check the next one. Let's wait for 10 seconds and check again. You can use '--dnssleep' to disable public dns checks. See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck Checking lichenghao.cn for _acme-challenge.lichenghao.cn Success for domain lichenghao.cn '_acme-challenge.lichenghao.cn'. All checks succeeded Verifying: *.lichenghao.cn Processing. The CA is processing your order, please wait. (1/30) Pending. The CA is processing your order, please wait. (2/30) Success Removing DNS records. Removing txt: Dx-5nGnsfU5DVC6LyqNJ_lZZIgShP11eR6K6tqniMbI for domain: _acme-challenge.lichenghao.cn Successfully removed Verification finished, beginning signing. Let's finalize the order. Le_OrderFinalize='https://acme.zerossl.com/v2/DV90/order/suec4vMZuHaDZKQ/finalize' Order status is 'processing', let's sleep and retry. Sleeping for 15 seconds then retrying Polling order status: https://acme.zerossl.com/v2/DV90/order/suec4vMDaDZKQ Downloading cert. Le_LinkCert='https://acme.zerossl.com/v2/DV90/cert/LB9E122S4t-g' Cert success. -----BEGIN CERTIFICATE----- MIIDfzCCAyagAwIBAgIRAKWk8AY1fNKWe64zQciAJtcwCgYIKoZIzj0EAwIwRjEL ...... hkjOPQMBBwNCAASmRtrrDZ7ByjaHX11+D76N1I85BsupVmGGOSi+ActjyK7ziO32 ...... UAIgdEzu7GvLOBTavFZKZXsshpPb9eMTp3vRMYQDOM+czsc= -----END CERTIFICATE----- Your cert is in: /acme.sh/*.lichenghao.cn_ecc/*.lichenghao.cn.cer Your cert key is in: /acme.sh/*.lichenghao.cn_ecc/*.lichenghao.cn.key The intermediate CA cert is in: /acme.sh/*.lichenghao.cn_ecc/ca.cer And the full-chain cert is in: /acme.sh/*.lichenghao.cn_ecc/fullchain.cer ARI suggestedWindow: 2026-11-10T23:59:59Z to 2026-11-12T23:59:59Z Next renewal time picked from ARI window: 2026-11-11T01:11:45Z 中间有两个错误码，别担心，不影响最终证书的生成～ 最终会生成 *.lichenghao.cn.cer 和 *.lichenghao.cn.key 这俩是我们最终要用的。 可以先把他俩手动复制到雷池的证书管理中，验证一下是否可用，出现如下就是没问题了哦～ 没有问题以后，接下来修改renew.sh。 考虑修改： 建立脚本目录, 所有脚本以及生成的文件存放目录，我修改为： /opt/myapp/acme； 建立证书归档目录, 我修改为： /opt/myapp/acme/archived/； WAF 证书 ID, 雷池 WAF 域名证书的 ID； DOMAIN, 需要生成证书的域名，我的域名 lichenghao.cn； newfile 和 oldfile 的路径； 修改后的脚本： #!/bin/bash #auto renew ssl for safeline waf #by dominicx #cert id in safeline for this ssl CERTID=1 DOMAIN="lichenghao.cn" ARCHIVEDDIR="/opt/myapp/acme/archived/" #step 1 renew ssl cert docker run --rm -it -v "/opt/acme":/acme.sh neilpang/acme.sh --issue --dns dns_tencent -d "*.$DOMAIN" -d "$DOMAIN" newfile="/opt/myapp/acme/*.$DOMAIN\_ecc/*.$DOMAIN.cer" oldfile="/data/safeline/resources/nginx/certs/cert_$CERTID.crt" newkey="/opt/myapp/acme/*.$DOMAIN\_ecc/*.$DOMAIN.key" oldkey="/data/safeline/resources/nginx/certs/cert_$CERTID.key" if [ ! -e $newfile ] || [ ! -e $newkey ] ; then echo "至少有一个文件不存在，请检查文件路径。" echo $newfile echo $newkey exit 1 fi newfile_ts=$(stat -c %Y $newfile) oldfile_ts=$(stat