ssl-auto-renew 4.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152
  1. #!/bin/bash -e
  2. # This file aims to be called by a cron task
  3. # and not directly. See ssl-helper.
  4. source /container/run/environment.sh
  5. SSL_HELPER_TOOL=$1
  6. PREFIX=$2
  7. CERT_FILE=$3
  8. KEY_FILE=$4
  9. CA_FILE=$5
  10. IMPACTED_SERVICES=$6
  11. JSONSSL_FILE=$7
  12. FROM_FILES=$8
  13. CERT_FROM_FILE=$9
  14. KEY_FROM_FILE=${10}
  15. CA_CERT_FROM_FILE=${11}
  16. function stop_impacted_services() {
  17. # Stop impacted services
  18. if [ -n "${IMPACTED_SERVICES}" ]; then
  19. log-helper info "Services to stop: ${IMPACTED_SERVICES}"
  20. impacted_services_table=("${IMPACTED_SERVICES}")
  21. for service in "${impacted_services_table[@]}"
  22. do
  23. log-helper info "Stopping ${service}..."
  24. sv stop "/container/run/process/${service}"
  25. done
  26. log-helper info "All services are stopped"
  27. fi
  28. }
  29. function start_impacted_services() {
  30. # restart impacted services
  31. if [ -n "${IMPACTED_SERVICES}" ]; then
  32. impacted_services_table=("${IMPACTED_SERVICES}")
  33. for service in "${impacted_services_table[@]}"
  34. do
  35. log-helper info "Starting ${service}..."
  36. sv start "/container/run/process/${service}"
  37. done
  38. log-helper info "All services are started"
  39. fi
  40. }
  41. # renew from container files
  42. if [ "${FROM_FILES,,}" = "true" ]; then
  43. log-helper info "Check renew from files"
  44. renew=false
  45. # File previous md5
  46. CERT_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CERT_FILE}.md5") || true
  47. KEY_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${KEY_FILE}.md5") || true
  48. CA_CERT_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CA_FILE}.md5") || true
  49. # from file current md5
  50. FROM_CERT_MD5=$(md5sum "${CERT_FROM_FILE}" | awk '{ print $1 }')
  51. FROM_KEY_MD5=$(md5sum "${KEY_FROM_FILE}" | awk '{ print $1 }')
  52. FROM_CA_CERT_MD5=$(md5sum "${CA_CERT_FROM_FILE}" | awk '{ print $1 }')
  53. [[ "$CERT_PREVIOUS_MD5" != "$FROM_CERT_MD5" ]] && renew=true
  54. [[ "$KEY_PREVIOUS_MD5" != "$FROM_KEY_MD5" ]] && renew=true
  55. [[ "$CA_CERT_PREVIOUS_MD5" != "$FROM_CA_CERT_MD5" ]] && renew=true
  56. if ! $renew; then
  57. log-helper info "Certificate files are identicals"
  58. exit 0
  59. fi
  60. log-helper info "Certificate files are differents"
  61. stop_impacted_services
  62. if [ "${CERT_FROM_FILE}" != "${CERT_FILE}" ]; then
  63. log-helper info "Copy ${CERT_FROM_FILE} to ${CERT_FILE}"
  64. cp -f "${CERT_FROM_FILE}" "${CERT_FILE}"
  65. fi
  66. if [ "${KEY_FROM_FILE}" != "${KEY_FILE}" ]; then
  67. log-helper info "Copy ${KEY_FROM_FILE} to ${KEY_FILE}"
  68. cp -f "${KEY_FROM_FILE}" "${KEY_FILE}"
  69. fi
  70. if [ "${CA_CERT_FROM_FILE}" != "${CA_FILE}" ]; then
  71. log-helper info "Copy ${CA_CERT_FROM_FILE} to ${CA_FILE}"
  72. cp -f "${CA_CERT_FROM_FILE}" "${CA_FILE}"
  73. fi
  74. log-helper info "Update file md5 with new values"
  75. echo "${FROM_CERT_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CERT_FILE}.md5"
  76. echo "${FROM_KEY_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${KEY_FILE}.md5"
  77. echo "${FROM_CA_CERT_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CA_FILE}.md5"
  78. start_impacted_services
  79. # renew with cfssl or jsonssl
  80. else
  81. log-helper info "Check renew for cfssl or jsonssl"
  82. cert_ok=false
  83. ca_ok=false
  84. # the certificate will expired in the next day
  85. if openssl x509 -checkend 259200 -noout -in "${CERT_FILE}"; then
  86. log-helper info "The certificate '${CERT_FILE}' is ok for the next 3 days at least."
  87. cert_ok=true
  88. fi
  89. if openssl x509 -checkend 259200 -noout -in "${CA_FILE}"; then
  90. log-helper info "The CA certificate '${CA_FILE}' is ok for the next 3 days at least."
  91. ca_ok=true
  92. fi
  93. if [ "${SSL_HELPER_TOOL}" = "jsonssl-helper" ]; then
  94. log-helper info "Check if ${JSONSSL_FILE} has changed"
  95. JSONSSL_FILE_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${JSONSSL_FILE}.md5") || true
  96. JSONSSL_FILE_MD5=$(md5sum "${JSONSSL_FILE}" | awk '{ print $1 }')
  97. [[ "${JSONSSL_FILE_PREVIOUS_MD5}" != "${JSONSSL_FILE_MD5}" ]] && cert_ok=false
  98. fi
  99. if ${cert_ok} && ${ca_ok}; then
  100. log-helper info "Nothing to do :)"
  101. exit 0
  102. fi
  103. log-helper info "Auto-renew on the way!"
  104. stop_impacted_services
  105. log-helper info "Remove certificate files"
  106. rm -f "${CERT_FILE}" "${KEY_FILE}" "${CA_FILE}"
  107. log-helper info "Regenerate certificate with ${SSL_HELPER_TOOL}"
  108. ${SSL_HELPER_TOOL} "${PREFIX}" "${CERT_FILE}" "${KEY_FILE}" "${CA_FILE}"
  109. start_impacted_services
  110. if [ "${SSL_HELPER_TOOL}" = "jsonssl-helper" ]; then
  111. log-helper info "Update file md5 with new values"
  112. echo "${JSONSSL_FILE_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${JSONSSL_FILE}.md5"
  113. fi
  114. fi
  115. log-helper info "Auto-renew finished! Champagne!"