Lego (acme go client) bash script for renewals (with SAN lists)

renew-certs.sh

#!/bin/bash

# Likely in a cron job to handle cert renewals.  
# The acme go client is here - https://github.com/go-acme/lego

lego_bin=/etc/goclient/lego/lego
lego_path=/etc/goclient/lego
lego_certs="$lego_path/certificates"
web_root=/var/www/html
our_kid=""
our_hmac=""
account_email=""
key_type=rsa2048
renew_days=30

reload=0

for domain in ` "$lego_bin" --path "$lego_path" list | grep "Certificate Name: " | awk '{print $3}' `; do
	original=$(date -r "$lego_certs/$domain.crt")

	#Create list of domain(s) (SAN List If Required)
	#First domain is the name of the cert - if others they go into the SAN
	sanlist="--domains $domain "
	for sanitem in ` "$lego_bin" --path "$lego_path" list |grep -A3 "Certificate Name: $domain"|grep "Domains: " | sed "s/,/ /g" |awk '{for (i=2; i<=NF; i++) print $i}' `; do
		if [ "$domain" != "$sanitem" ]; then
			sanlist+="--domains $sanitem "
		fi
	done

	"$lego_bin" \
		--server https://acme.sectigo.com/v2/InCommonRSAOV \
		--path "$lego_path" \
		--email "$account_email" --accept-tos \
		$sanlist \
		--eab --kid "$our_kid" \
		--hmac "$our_hmac" \
		--key-type "$key_type" \
		--http \
		--http.webroot "$web_root" \
		--cert.timeout 60 \
		renew --days "$renew_days"

	actual=$(date -r "$lego_certs/$domain.crt")

	if [ "$original" != "$actual" ]; then
		reload=1
	fi

done

if [ $reload -eq 1 ]; then
    echo "reloading httpd"
	/bin/systemctl reload httpd
fi