1 files changed, 36 insertions, 17 deletions

diff --git a/global-functions.rsc b/global-functions.rsc
index b1833b1..26472b8 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -12,7 +12,7 @@
 :local ScriptName [ :jobname ];
 
 # expected configuration version
-:global ExpectedConfigVersion 127;
+:global ExpectedConfigVersion 131;
 
 # global variables not to be changed by user
 :global GlobalFunctionsReady false;
@@ -135,6 +135,7 @@
   :global ScriptUpdatesBaseUrl;
   :global ScriptUpdatesUrlSuffix;
 
+  :global CertificateAvailable;
   :global CertificateNameByCN;
   :global CleanName;
   :global FetchUserAgentStr;
@@ -143,22 +144,40 @@
 
   $LogPrint info $0 ("Downloading and importing certificate with " . \
       "CommonName '" . $CommonName . "'.");
+  :local FileName ([ $CleanName $CommonName ] . ".pem");
   :do {
-    :local FileName ([ $CleanName $CommonName ] . ".pem");
     /tool/fetch check-certificate=yes-without-crl http-header-field=({ [ $FetchUserAgentStr $0 ] }) \
       ($ScriptUpdatesBaseUrl . "certs/" . $FileName . $ScriptUpdatesUrlSuffix) \
       dst-path=$FileName as-value;
     $WaitForFile $FileName;
-    /certificate/import file-name=$FileName passphrase="" as-value;
-    :delay 1s;
-    /file/remove [ find where name=$FileName ];
-
-    :foreach Cert in=[ /certificate/find where name~("^" . $FileName . "_[0-9]+\$") ] do={
-      $CertificateNameByCN [ /certificate/get $Cert common-name ];
-    }
   } on-error={
-    $LogPrint warning $0 ("Failed importing certificate with CommonName '" . $CommonName . "'!");
-    :return false;
+    $LogPrint warning $0 ("Failed downloading certificate with CommonName '" . $CommonName . \
+      "' from repository! Trying fallback to mkcert.org...");
+    :do {
+      :if ([ $CertificateAvailable "ISRG Root X1" ] = false) do={
+        $LogPrint error $0 ("Downloading required certificate failed.");
+        :return false;
+      }
+      /tool/fetch check-certificate=yes-without-crl http-header-field=({ [ $FetchUserAgentStr $0 ] }) \
+        "https://mkcert.org/generate/" http-data=[ :serialize to=json ({ $CommonName }) ] \
+        dst-path=$FileName as-value;
+      $WaitForFile $FileName;
+      :if ([ /file/get $FileName size ] = 0) do={
+        /file/remove $FileName;
+        :error false;
+      }
+    } on-error={
+      $LogPrint warning $0 ("Failed downloading certificate with CommonName '" . $CommonName . "'!");
+      :return false;
+    }
+  }
+
+  /certificate/import file-name=$FileName passphrase="" as-value;
+  :delay 1s;
+  /file/remove [ find where name=$FileName ];
+
+  :foreach Cert in=[ /certificate/find where name~("^" . $FileName . "_[0-9]+\$") ] do={
+    $CertificateNameByCN [ /certificate/get $Cert common-name ];
   }
   :return true;
 }
@@ -229,7 +248,7 @@
 
   :for I from=0 to=([ :len $Input ] - 1) do={
     :local Char [ :pick $Input $I ];
-    :if ([ :typeof [ find "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-" $Char ] ] = "nil") do={
+    :if ([ :typeof [ find "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" $Char ] ] = "nil") do={
       :do {
         :if ([ :len $Return ] = 0) do={
           :error true;
@@ -334,7 +353,7 @@
     :return true;
   }
 
-  :if ([ $CertificateAvailable "R3" ] = false) do={
+  :if ([ $CertificateAvailable "ISRG Root X1" ] = false) do={
     $LogPrint error $0 ("Downloading required certificate failed.");
     :return false;
   }
@@ -509,7 +528,7 @@
   }
 
   :do {
-    :if ([ $CertificateAvailable "GTS CA 1P5" ] = false) do={
+    :if ([ $CertificateAvailable "GTS Root R1" ] = false) do={
       $LogPrint warning $0 ("Downloading required certificate failed.");
       :error false;
     }
@@ -685,10 +704,10 @@
       :return true;
     }
 
+    :local Uptime [ /system/resource/get uptime ];
     :if ([ :typeof $IsTimeSyncResetNtp ] = "nothing") do={
-      :set IsTimeSyncResetNtp 0s;
+      :set IsTimeSyncResetNtp $Uptime;
     }
-    :local Uptime [ /system/resource/get uptime ];
     :if ($Uptime - $IsTimeSyncResetNtp < 3m) do={
       :return false;
     }
@@ -999,7 +1018,7 @@
   :global SymbolForNotification;
   :global ValidateSyntax;
 
-  :if ([ $CertificateAvailable "E1" ] = false) do={
+  :if ([ $CertificateAvailable "ISRG Root X2" ] = false) do={
     $LogPrint warning $0 ("Downloading certificate failed, trying without.");
   }