90 lines
2.7 KiB
Bash
90 lines
2.7 KiB
Bash
|
#!/bin/sh
|
|||
|
|
# Script de renouvellement de certificat buypass go ssl
|
|||
|
|
# Copyright 2021 Alarig Le Lay <alarig@swordarmor.fr>
|
|||
|
|
# Released under the 2-clause BSD license.
|
|||
|
|
|
|||
|
|
# Bootstrap du bordel :
|
|||
|
|
# Création de la clé d’authentification au service ACME
|
|||
|
|
# openssl genrsa -out account.key 4096
|
|||
|
|
# Création du CSR et de la clé privée
|
|||
|
|
# openssl req -nodes -newkey rsa:4096 -sha256 -keyout \
|
|||
|
|
# bulbizarre.swordarmor.fr.key -out bulbizarre.swordarmor.fr.csr
|
|||
|
|
# Génératon du cerificat
|
|||
|
|
# ./acme_tiny.py --account-key ../account.key --csr \
|
|||
|
|
# ../bulbizarre.swordarmor.fr.csr --acme-dir /var/www/le-challenges/ > \
|
|||
|
|
# ../signed.crt
|
|||
|
|
|
|||
|
|
service="$1"
|
|||
|
|
domain="$2"
|
|||
|
|
base_dir='/etc/ssl'
|
|||
|
|
|
|||
|
|
certok=0
|
|||
|
|
|
|||
|
|
_write_err () {
|
|||
|
|
>&2 printf "$1"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if [ $# != 2 ]; then
|
|||
|
|
_write_err "Paramètre manquant\n"
|
|||
|
|
_write_err "$0 \$service \$domain\n"
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# 2592000 secondes correspondent à 30 jour
|
|||
|
|
openssl x509 -checkend 2678400 -noout -in $base_dir/$service/${domain}.crt
|
|||
|
|
if [ $? = 0 ]; then
|
|||
|
|
printf "$base_dir/$service/${domain}.crt est valide pour plus d’un "
|
|||
|
|
printf "mois\n"
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
if [ ! -f "$base_dir/$service/${domain}.csr" ]; then
|
|||
|
|
_write_err ".csr introuvable : $base_dir/$service/${domain}.csr\n"
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# sauvegarde du dossier actuel
|
|||
|
|
cp -r "$base_dir/$service" "$base_dir/$service-$(date +%F)"
|
|||
|
|
if [ $? != 0 ]; then
|
|||
|
|
_write_err "Erreur de sauvegarde du dossier $base_dir/$service\n"
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
mv $base_dir/$service/$domain.crt $base_dir/$service/$domain.crt.bak-$(date +%F)
|
|||
|
|
mv $base_dir/$service/$domain.chained.crt $base_dir/$service/$domain.chained.crt-$(date +%F)
|
|||
|
|
mv $base_dir/$service/$domain.intermediate.crt $base_dir/$service/$domain.intermediate.crt-$(date +%F)
|
|||
|
|
|
|||
|
|
certbot certonly \
|
|||
|
|
--dns-rfc2136 \
|
|||
|
|
--dns-rfc2136-credentials /usr/local/src/renew_cert/rfc2136.conf \
|
|||
|
|
--dns-rfc2136-propagation-seconds 30 \
|
|||
|
|
--csr /etc/ssl/$service/$domain.csr \
|
|||
|
|
--cert-path /etc/ssl/$service/$domain.crt \
|
|||
|
|
--chain-path /etc/ssl/$service/$domain.intermediate.crt
|
|||
|
|
|
|||
|
|
# on peut pas tester le code de retour, il est != 0 même quand ça marche…
|
|||
|
|
mv 0000_chain.pem /etc/ssl/$service/$domain.chained.crt
|
|||
|
|
|
|||
|
|
if [ "${service}" = "inspircd" ]; then
|
|||
|
|
kill -USR1 $(cat /run/inspircd/inspircd.pid)
|
|||
|
|
else
|
|||
|
|
rc-service $service reload
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
if [ $? = 0 ]; then
|
|||
|
|
rm -r "$base_dir/$service-$(date +%F)"
|
|||
|
|
fi
|
|||
|
|
exit 0
|
|||
|
|
|
|||
|
|
# bulbizarre ~ # openssl verify -CAfile /etc/ssl/lets-encrypt-x1-cross-signed.pem
|
|||
|
|
# /etc/ssl/apache2/akilina.swordarmor.fr.crt
|
|||
|
|
# /etc/ssl/apache2/akilina.swordarmor.fr.crt: CN = akilina.swordarmor.fr
|
|||
|
|
# error 20 at 0 depth lookup:unable to get local issuer certificate
|
|||
|
|
# bulbizarre ~ # echo $?
|
|||
|
|
# 2
|
|||
|
|
# bulbizarre ~ # openssl verify -CAfile /etc/ssl/lets-encrypt-x3-cross-signed.pem
|
|||
|
|
# /etc/ssl/apache2/akilina.swordarmor.fr.crt
|
|||
|
|
# /etc/ssl/apache2/akilina.swordarmor.fr.crt: OK
|
|||
|
|
# bulbizarre ~ # echo $?
|
|||
|
|
# 0
|