90 lines
2.7 KiB
Bash
Executable File
90 lines
2.7 KiB
Bash
Executable File
#!/bin/sh
|
||
# Script de renouvellement de certificat buypass go ssl
|
||
# Copyright 2021 Alarig Le Lay <alarig@swordarmor.fr>
|
||
# Released under the 2-clause BSD license.
|
||
|
||
# Bootstrap du bordel :
|
||
# Création de la clé d’authentification au service ACME
|
||
# openssl genrsa -out account.key 4096
|
||
# Création du CSR et de la clé privée
|
||
# openssl req -nodes -newkey rsa:4096 -sha256 -keyout \
|
||
# bulbizarre.swordarmor.fr.key -out bulbizarre.swordarmor.fr.csr
|
||
# Génératon du cerificat
|
||
# ./acme_tiny.py --account-key ../account.key --csr \
|
||
# ../bulbizarre.swordarmor.fr.csr --acme-dir /var/www/le-challenges/ > \
|
||
# ../signed.crt
|
||
|
||
service="$1"
|
||
domain="$2"
|
||
base_dir='/etc/ssl'
|
||
|
||
certok=0
|
||
|
||
_write_err () {
|
||
>&2 printf "$1"
|
||
}
|
||
|
||
if [ $# != 2 ]; then
|
||
_write_err "Paramètre manquant\n"
|
||
_write_err "$0 \$service \$domain\n"
|
||
exit 1
|
||
fi
|
||
|
||
# 2592000 secondes correspondent à 30 jour
|
||
openssl x509 -checkend 2678400 -noout -in $base_dir/$service/${domain}.crt
|
||
if [ $? = 0 ]; then
|
||
printf "$base_dir/$service/${domain}.crt est valide pour plus d’un "
|
||
printf "mois\n"
|
||
exit 1
|
||
fi
|
||
|
||
if [ ! -f "$base_dir/$service/${domain}.csr" ]; then
|
||
_write_err ".csr introuvable : $base_dir/$service/${domain}.csr\n"
|
||
exit 1
|
||
fi
|
||
|
||
# sauvegarde du dossier actuel
|
||
cp -r "$base_dir/$service" "$base_dir/$service-$(date +%F)"
|
||
if [ $? != 0 ]; then
|
||
_write_err "Erreur de sauvegarde du dossier $base_dir/$service\n"
|
||
exit 1
|
||
fi
|
||
|
||
mv $base_dir/$service/$domain.crt $base_dir/$service/$domain.crt.bak-$(date +%F)
|
||
mv $base_dir/$service/$domain.chained.crt $base_dir/$service/$domain.chained.crt-$(date +%F)
|
||
mv $base_dir/$service/$domain.intermediate.crt $base_dir/$service/$domain.intermediate.crt-$(date +%F)
|
||
|
||
certbot certonly \
|
||
--dns-rfc2136 \
|
||
--dns-rfc2136-credentials /usr/local/src/renew_cert/rfc2136.conf \
|
||
--dns-rfc2136-propagation-seconds 30 \
|
||
--csr /etc/ssl/$service/$domain.csr \
|
||
--cert-path /etc/ssl/$service/$domain.crt \
|
||
--chain-path /etc/ssl/$service/$domain.intermediate.crt
|
||
|
||
# on peut pas tester le code de retour, il est != 0 même quand ça marche…
|
||
mv 0000_chain.pem /etc/ssl/$service/$domain.chained.crt
|
||
|
||
if [ "${service}" = "inspircd" ]; then
|
||
kill -USR1 $(cat /run/inspircd/inspircd.pid)
|
||
else
|
||
rc-service $service reload
|
||
fi
|
||
|
||
if [ $? = 0 ]; then
|
||
rm -r "$base_dir/$service-$(date +%F)"
|
||
fi
|
||
exit 0
|
||
|
||
# bulbizarre ~ # openssl verify -CAfile /etc/ssl/lets-encrypt-x1-cross-signed.pem
|
||
# /etc/ssl/apache2/akilina.swordarmor.fr.crt
|
||
# /etc/ssl/apache2/akilina.swordarmor.fr.crt: CN = akilina.swordarmor.fr
|
||
# error 20 at 0 depth lookup:unable to get local issuer certificate
|
||
# bulbizarre ~ # echo $?
|
||
# 2
|
||
# bulbizarre ~ # openssl verify -CAfile /etc/ssl/lets-encrypt-x3-cross-signed.pem
|
||
# /etc/ssl/apache2/akilina.swordarmor.fr.crt
|
||
# /etc/ssl/apache2/akilina.swordarmor.fr.crt: OK
|
||
# bulbizarre ~ # echo $?
|
||
# 0
|