腾讯云函数实现 ACME 协议下自动申请配置 SSL 证书

早在今日之前，本站一直使用OHTTPS来申请、部署 CDN 加速域名的 SSL 证书，以便开启HTTPS支持。

免费申请SSL证书

/posts/38768

为什么不再使用该方法了？

收费……虽然有额度，但看着每次更新一次扣 50，部署一次扣 50，多少有点隐忧；
繁琐。这是因为，每次新增 CDN 域名时，都需要重新在OHTTPS管理台手动新增配置；

云函数自动申请&部署证书

终极解决方案就是本篇。通过腾讯云函数（SCF），借助ACME协议，从 Let’s Encrypt 获得免费的 SSL 证书！优点：

部署在 SCF 上，成本基本为 0 （腾讯云托管的域名，一定要备案关联到某个 IP 上，当时就买了这个备案用的 SCF 套餐，3 年也没多少钱，还能用在好多地方）；
自动申请：配置定时任务后，证书到期前自动申请；
自动配置：改进后的版本，支持从 CDN 自动获取已配置的加速域名，自动完成域名证书绑定；
事件通知：配置成功 or 失败时，会通过企业微信机器人通知；

感谢原作者 Jeff2Ma 分享方法，我只是略作以下改进：

自动获取域名:无需配置 cdnDomainList，不再从配置中获取 cdn 域名列表；
延迟处理：执行删除旧证书时，增加 300ms 延迟，避免超出 1s 最多 10 条的最大限制导致的接口报错；
环境变量：变量信息调整为环境变量获取；
成功通知：增加了更新成功时机器人通知信息；

第一步：克隆本项目，本地安装依赖

本地新建一个文件夹，直接克隆：

1	git clone git@github.com:kuole-o/acme-qcloud-scf.git

或点击下面链接直接下载代码包，解压缩；

acme-qcloud-scf

https://github.com/kuole-o/acme-qcloud-scf

第二步：安装依赖

进入该文件夹，执行npm install安装依赖。

第三步：打包依赖包，创建层

进入node_modules目录，全选压缩为 .zip 包（一定要进入后全选）。随后打开云函数 · 层，新建层，名称随意，上传该压缩包。运行环境与下文创建的云函数相同即可，建议 Node.js 16.13 及以上版本。

第四步：新建云函数

在刚才层的界面，点击函数服务 — 新建，选择“从头开始”，接着“事件函数”。函数名称自定义，地域建议香港一类的海外，运行环境同上述层的环境比如 Node.js 16.13。其他默认，在线编辑代码中，粘贴我代码仓里index.js内容，再新建一个config.js同理粘贴代码。

let isScfEnv = false; // 是否是云函数环境
const moment = require('moment');
const acme = require('acme-client');
const tencentcloud = require("tencentcloud-sdk-nodejs");
const axios = require('axios');
const appName = '[acme-qcloud-scf]';

acme.setLogger((message) => {
  console.log(message);
});

// 读取配置文件
let config = {};
try {
  config = require('./config.js')
} catch (e) {
  console.log(e);
}

function log() {
  const args = [];
  args.push(appName);
  for (let i = 0; i < arguments.length; i++) {
    args.push(arguments[i]);
  }
  console.log.apply(console, args);
}

// dnspod 实例
const DnspodApi = require('dnspod-api');
const dnspodApi = new DnspodApi({
  server: config.dnspodServer || 'dnspod.cn',
  token: config.dnspodToken // your login token, you can find how to get this at the top.
});

const sslClient = new tencentcloud.ssl.v20191205.Client({
  credential: {
    secretId: config.qcloudSecretId,
    secretKey: config.qcloudSecretKey,
  },
  // region: "ap-shanghai",
  profile: {
    signMethod: "TC3-HMAC-SHA256",
    httpProfile: {
      reqMethod: "POST",
      reqTimeout: 30,
      endpoint: "ssl.tencentcloudapi.com",
    },
  },
})

const cdnClient = new tencentcloud.cdn.v20180606.Client({
  credential: {
    secretId: config.qcloudSecretId,
    secretKey: config.qcloudSecretKey,
  },
  profile: {
    signMethod: "TC3-HMAC-SHA256",
    httpProfile: {
      reqMethod: "POST",
      reqTimeout: 30,
      endpoint: "cdn.tencentcloudapi.com",
    },
  },
})

async function cdnList() {
  const params = {};
  try {
    const data = await cdnClient.DescribeDomains(params);
    if (data && data.Domains) {
      const domainArray = data.Domains.map((domainInfo) => domainInfo.Domain);
      console.log(domainArray);
      return domainArray;
    } else {
      console.error("Error: Unable to retrieve domain data");
      return [];
    }
  } catch (err) {
    console.error("error", err);
    return [];
  }
}

const webHookUrl = config?.wecomWebHook || ''; // 暂时不用

async function challengeCreateFn(authz, challenge, keyAuthorization) {
  const dnsRecord = `_acme-challenge.${authz.identifier.value}`;
  const recordValue = keyAuthorization;
  log(`Creating TXT record for ${authz.identifier.value}: ${dnsRecord}`);
  // 清空所有的 DNS 记录
  await removeOldDNSRecords('firstTime');
  const createRes = await dnspodApi.do({
    action: 'Record.Create',
    params: {
      domain: config.domain,
      sub_domain: '_acme-challenge',
      record_line: '默认',
      mx: '1',
      record_type: 'TXT',
      value: recordValue
    }
  })
  log('createRes', createRes.status)
  return createRes
}

async function challengeRemoveFn(authz, challenge, keyAuthorization) {
  const dnsRecord = `_acme-challenge.${authz.identifier.value}`;
  const recordValue = keyAuthorization;
  log(`Removing TXT record for ${authz.identifier.value}: ${dnsRecord}`);
  const recordListData = await dnspodApi.do({
    action: 'Record.List',
    params: {
      domain: config.domain,
      sub_domain: '_acme-challenge',
    }
  }).catch((e) => {
    log(e)
    return {}
  })
  log('challengeRemoveFn:recordListData', recordListData.status)
  //   status: { code: '10', message: '记录列表为空', created_at: '2022-05-01 11:23:49' },
  if (recordListData?.status?.code + '' === '10') {
    log('删除 dns 记录，已为空')
    return {}
  } else {
    const records = recordListData?.records;
    // log('records', records)
    const record = records.find(item => item.value === dnsRecord)
    const res = await dnspodApi.do({
      action: 'Record.Remove',
      params: {
        domain: config.domain,
        sub_domain: '_acme-challenge',
        record_line: '默认',
        mx: '1',
        record_id: record.id,
        record_type: 'TXT',
        // value: recordValue
      }
    })
    log('Record.Remove Success:', res.status);
    return {}
  }
}

async function removeOldDNSRecords(from = '') {
  // https://docs.dnspod.cn/api/modify-records/
  const recordListData = await dnspodApi.do({
    action: 'Record.List',
    params: {
      domain: config.domain,
      sub_domain: '_acme-challenge',
    }
  }).catch((e) => {
    log(e)
    return {}
  })
  log('removeOldDNSRecords:recordListData', recordListData.status);
  if (recordListData?.status?.code + '' === '10') {
    return Promise.resolve({
      empty: true,
      length: 0,
    });
  }
  const records = recordListData?.records;
  if (records.length) {
    log('提示：检测到有旧的 dns 记录，尝试全部删除');
    await Promise.all(records.map(async item => {
      const res = await dnspodApi.do({
        action: 'Record.Remove',
        params: {
          domain: config.domain,
          sub_domain: '_acme-challenge',
          record_line: '默认',
          mx: '1',
          record_id: item.id,
          record_type: 'TXT',
          // value: recordValue
        }
      })
      log(`Record.Remove Success:${item.id}`, res.status)
    }))

    if (from && from === 'firstTime') {
      log('延迟 15s，预防 dns 缓存因素影响');
      await sleep(15);
    }

    return {}
  }
  return Promise.resolve({
    empty: true,
    length: 0,
  });
}

async function sleep(s) {
  return new Promise(resolve => setTimeout(resolve, s * 1000));
}

async function uploadCert2QcloudSSL(cert, key) {
  // 腾讯云 SDK
  log('正在上传到腾讯云 SSL 管理...');

  // 待删除旧的
  const { TotalCount, Certificates } = await sslClient.DescribeCertificates(
    {
      SearchKey: config.domain
    }
  ).catch(() => {
  })

  if (TotalCount && Certificates.length) {
    await Promise.all(Certificates.map(async (item, index) => {
      await new Promise(resolve => setTimeout(resolve, index * 300));

      await sslClient.DeleteCertificate({
        CertificateId: item.CertificateId
      });
      log(`正在删除${item.CertificateId}, ${item.Domain} 证书`);
    }));
  }

  const uploadCertificateRes = await sslClient.UploadCertificate({
    CertificatePublicKey: cert.toString(),
    CertificatePrivateKey: key.toString(),
    Alias: config.domain
  }).catch((e) => {
    console.error(e);
  });
  log('上传本次产生的证书: ', uploadCertificateRes);
  return uploadCertificateRes;
}

async function initConfig(config, env) {
  let envFormat = {};
  if (env && typeof env === 'string') {
    try {
      envFormat = JSON.parse(env)
    } catch (e) {
    }
  }
  return Object.assign({}, config, envFormat)
}

async function updateCDNDomains(cert, key, CertificateId) {
  const nowStr = moment(new Date()).utcOffset(8).format('YYYY-MM-DD HH:mm:ss');
  const list = await cdnList();
  if (!list || !list.length) return Promise.resolve({})
  try {
    await Promise.all(list.map(async item => {
      log(`正在为如下 cdn 域名进行 https 证书绑定：${item}, ${CertificateId}`)
      await cdnClient.UpdateDomainConfig({
        Domain: item,
        Https: {
          Switch: 'on',
          Http2: 'on',
          CertInfo: {
            CertId: CertificateId,
            Message: `${appName}${nowStr}`,
          }
        }
      }).then(
        (data) => {
          log(data);
        },
        (err) => {
          console.error("error", err);
        }
      );
    }))
    return list
  } catch (err) {
    console.error("error", err);
  }
}

async function postWeComRobotMsg(options) {
  const content = options?.content || ''
  if (!content) return '没有消息要发送';
  const postData = {
    "msgtype": "text",
    "text": {
      content: (!isScfEnv ? '[本地调试发送]' : '') + content
    }, "mentioned_list": ["@all"]
  };
  return axios.post(config.wecomWebHook, postData)
    .then(function (res) {
      console.log(res.data);
      return res.data;
    })
    .catch(function (error) {
      console.log(error);
      return 'st wrong when post qywx robot api';
    })
    .then(function (result) {
      return '发送企业微信机器人成功:' + JSON.stringify(result) + 'H:' + moment().utcOffset(8).format('kk');
    });
}

const main_handler = async (event = {}, context = {}, callback) => {
  const environment = context?.environment || {}
  config = await initConfig(config, environment);

  // 云函数环境特有
  if (config['SCF_NAMESPACE']) {
    isScfEnv = true
  }
  log('isScfEnv', isScfEnv)

  /* Init client */
  const client = new acme.Client({
    directoryUrl: (!isScfEnv || +(config.isDebug)) ? acme.directory.letsencrypt.staging : acme.directory.letsencrypt.production,
    accountKey: await acme.forge.createPrivateKey(),
    termsOfServiceAgreed: true,
    challengePriority: ['dns-01'],
  });

  /* Register account */
  await client.createAccount({
    termsOfServiceAgreed: true,
    contact: [`mailto:${config.email}`]
  });

  /* Place new order */
  const order = await client.createOrder({
    wildcard: true,
    identifiers: [
      { type: 'dns', value: `${config.domain}` },
      { type: 'dns', value: `*.${config.domain}` }
    ]
  });

  /**
   * authorizations / client.getAuthorizations(order);
   * An array with one item per DNS name in the certificate order.
   * All items require at least one satisfied challenge before order can be completed.
   */

  const authorizations = await client.getAuthorizations(order);

  const promises = authorizations.map(async (authz) => {
    let challengeCompleted = false;

    try {
      /**
       * challenges / authz.challenges
       * An array of all available challenge types for a single DNS name.
       * One of these challenges needs to be satisfied.
       */

      const { challenges } = authz;

      /* Just select Dns Way */
      const challenge = challenges.find(c => c.type === 'dns-01');

      const keyAuthorization = await client.getChallengeKeyAuthorization(challenge);

      try {
        /* Satisfy challenge */
        await challengeCreateFn(authz, challenge, keyAuthorization);

        log('延迟 15s，预防 dns 缓存因素影响');
        await sleep(15);

        /* Verify that challenge is satisfied */
        await client.verifyChallenge(authz, challenge);

        /* Notify ACME provider that challenge is satisfied */
        await client.completeChallenge(challenge);
        challengeCompleted = true;

        /* Wait for ACME provider to respond with valid status */
        await client.waitForValidStatus(challenge);
      } finally {
        /* Clean up challenge response */
        try {
          // await challengeRemoveFn(authz, challenge, keyAuthorization);
        } catch (e) {
          /**
           * Catch errors thrown by challengeRemoveFn() so the order can
           * be finalized, even though something went wrong during cleanup
           */
        }
      }
    } catch (e) {
      /* Deactivate pending authz when unable to complete challenge */
      if (!challengeCompleted) {
        try {
          await client.deactivateAuthorization(authz);
        } catch (f) {
          /* Catch and suppress deactivateAuthorization() errors */
        }
      }

      throw e;
    }
  });

  /* Wait for challenges to complete */
  await Promise.all(promises);

  try {
    /* Finalize order */
    const [key, csr] = await acme.forge.createCsr({
      commonName: `*.${config.domain}`,
      altNames: [`${config.domain}`]
      // commonName: `${config.domain}`,//  建议用根域名
      // altNames: [`${config.domain}`, `*.${config.domain}`]
    });

    const finalized = await client.finalizeOrder(order, csr);
    const cert = await client.getCertificate(finalized);

    /* 完成 */
    log(`CSR:\n${csr.toString()}`);
    log(`Private key:\n${key.toString()}`);
    log(`Certificate:\n${cert.toString()}`);
    const { CertificateId } = await uploadCert2QcloudSSL(cert, key);
    const list = await updateCDNDomains(cert, key, CertificateId);
    const formattedList = list.join('\n');
    await postWeComRobotMsg({
      content: `SSL 证书已更新！\n\n证书ID：${CertificateId}\n更新域名：\n${formattedList}`
    })
  } catch (e) {
    log('Finalize order error: ', e)
    await postWeComRobotMsg({
      content: `生成证书失败${JSON.parse(JSON.stringify(e))}`
    })
  }
  // 清空多余的 dnsPod 记录
  await removeOldDNSRecords()
};

// 调试
const main_handler_bak = async (event = {}, context = {}, callback) => {
  try {
    const params = {};
    const data = await cdnClient.DescribeDomains(params);
    const domainArray = data.Domains.map((domainInfo) => domainInfo.Domain);
    console.log(domainArray);
    return domainArray;
  } catch (err) {
    console.error("error", err);
    return err;
  }
}

exports.main_handler = main_handler

module.exports = {
    isDebug: true, // 验证完成后，此项必须配置为 false，否则申请的是测试证书，浏览器会报错“无效证书”
    email: process.env.Email,  // 你的邮箱
    domain: process.env.Domain, // 需要生成证书的根域名，最终生成通配符证书
    qcloudSecretId: process.env.Tcb_SecretId, // 腾讯云 SecretId, https://console.cloud.tencent.com/cam/capi
    qcloudSecretKey: process.env.Tcb_SecretKey, // 腾讯云 SecretKey
    dnspodServer: 'dnspod.cn', // 国内版用 dnspod.cn（默认），国际版用 dnspod.com
    dnspodToken: process.env.Tcb_DnspodToken, // 在 https://console.dnspod.cn/account/token/token 生成，合在一块用, 隔开
    wecomWebHook: process.env.WeComWebHook, // 企业微信机器人通知 webhook
}

日志配置，建议开启（虽然说要钱，但是也没多少……）。高级配置中，其他不要动，把“执行超时时间”设置为最大 900m，环境变量配置：

字段名	来源	说明
Email	自定义输入	你的邮箱地址，用来申请证书
Tcb_DnspodToken	腾讯云获取	腾讯云 dnspod Token，获取见下文
Tcb_SecretId	腾讯云获取	腾讯云 API SecretId，获取见下文
Tcb_SecretKey	腾讯云获取	腾讯云 API SecretKey，获取见下文
WeComWebHook	企业微信获取	企业微信群机器人的 WebHook 地址，不了解可以 Google 下
domain	自定义输入	你的根域名，比如本站是 guole.fun

上述相关密钥获取方法：

Tcb_DnspodToken：访问 DNSPod - DNSPod Token 手动创建一个；
Tcb_SecretId / Tcb_SecretKey：访问 DNSPod - 腾讯云 API 密钥手动创建一个，获得 SecretId 和 SecretKey；建议在腾讯云 - 访问管理 - 用户列表中，创建一个子用户，添加 QcloudDNSPodFullAccess / QcloudCDNFullAccess / QcloudSSLFullAccess 三个策略组权限，更安全。

创建云函数