123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152 |
- #!/bin/bash -e
- # This file aims to be called by a cron task
- # and not directly. See ssl-helper.
- source /container/run/environment.sh
- SSL_HELPER_TOOL=$1
- PREFIX=$2
- CERT_FILE=$3
- KEY_FILE=$4
- CA_FILE=$5
- IMPACTED_SERVICES=$6
- JSONSSL_FILE=$7
- FROM_FILES=$8
- CERT_FROM_FILE=$9
- KEY_FROM_FILE=${10}
- CA_CERT_FROM_FILE=${11}
- function stop_impacted_services() {
- # Stop impacted services
- if [ -n "${IMPACTED_SERVICES}" ]; then
- log-helper info "Services to stop: ${IMPACTED_SERVICES}"
-
- impacted_services_table=("${IMPACTED_SERVICES}")
- for service in "${impacted_services_table[@]}"
- do
- log-helper info "Stopping ${service}..."
- sv stop "/container/run/process/${service}"
- done
-
- log-helper info "All services are stopped"
- fi
- }
- function start_impacted_services() {
- # restart impacted services
- if [ -n "${IMPACTED_SERVICES}" ]; then
-
- impacted_services_table=("${IMPACTED_SERVICES}")
- for service in "${impacted_services_table[@]}"
- do
- log-helper info "Starting ${service}..."
- sv start "/container/run/process/${service}"
- done
-
- log-helper info "All services are started"
- fi
- }
- # renew from container files
- if [ "${FROM_FILES,,}" = "true" ]; then
-
- log-helper info "Check renew from files"
- renew=false
-
- # File previous md5
- CERT_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CERT_FILE}.md5") || true
- KEY_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${KEY_FILE}.md5") || true
- CA_CERT_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CA_FILE}.md5") || true
-
- # from file current md5
- FROM_CERT_MD5=$(md5sum "${CERT_FROM_FILE}" | awk '{ print $1 }')
- FROM_KEY_MD5=$(md5sum "${KEY_FROM_FILE}" | awk '{ print $1 }')
- FROM_CA_CERT_MD5=$(md5sum "${CA_CERT_FROM_FILE}" | awk '{ print $1 }')
-
- [[ "$CERT_PREVIOUS_MD5" != "$FROM_CERT_MD5" ]] && renew=true
- [[ "$KEY_PREVIOUS_MD5" != "$FROM_KEY_MD5" ]] && renew=true
- [[ "$CA_CERT_PREVIOUS_MD5" != "$FROM_CA_CERT_MD5" ]] && renew=true
-
- if ! $renew; then
- log-helper info "Certificate files are identicals"
- exit 0
- fi
-
- log-helper info "Certificate files are differents"
-
- stop_impacted_services
-
- if [ "${CERT_FROM_FILE}" != "${CERT_FILE}" ]; then
- log-helper info "Copy ${CERT_FROM_FILE} to ${CERT_FILE}"
- cp -f "${CERT_FROM_FILE}" "${CERT_FILE}"
- fi
-
- if [ "${KEY_FROM_FILE}" != "${KEY_FILE}" ]; then
- log-helper info "Copy ${KEY_FROM_FILE} to ${KEY_FILE}"
- cp -f "${KEY_FROM_FILE}" "${KEY_FILE}"
- fi
-
- if [ "${CA_CERT_FROM_FILE}" != "${CA_FILE}" ]; then
- log-helper info "Copy ${CA_CERT_FROM_FILE} to ${CA_FILE}"
- cp -f "${CA_CERT_FROM_FILE}" "${CA_FILE}"
- fi
-
- log-helper info "Update file md5 with new values"
- echo "${FROM_CERT_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CERT_FILE}.md5"
- echo "${FROM_KEY_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${KEY_FILE}.md5"
- echo "${FROM_CA_CERT_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${CA_FILE}.md5"
-
- start_impacted_services
-
- # renew with cfssl or jsonssl
- else
- log-helper info "Check renew for cfssl or jsonssl"
-
- cert_ok=false
- ca_ok=false
-
- # the certificate will expired in the next day
- if openssl x509 -checkend 259200 -noout -in "${CERT_FILE}"; then
- log-helper info "The certificate '${CERT_FILE}' is ok for the next 3 days at least."
- cert_ok=true
- fi
-
- if openssl x509 -checkend 259200 -noout -in "${CA_FILE}"; then
- log-helper info "The CA certificate '${CA_FILE}' is ok for the next 3 days at least."
- ca_ok=true
- fi
-
- if [ "${SSL_HELPER_TOOL}" = "jsonssl-helper" ]; then
- log-helper info "Check if ${JSONSSL_FILE} has changed"
- JSONSSL_FILE_PREVIOUS_MD5=$(cat "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${JSONSSL_FILE}.md5") || true
- JSONSSL_FILE_MD5=$(md5sum "${JSONSSL_FILE}" | awk '{ print $1 }')
-
- [[ "${JSONSSL_FILE_PREVIOUS_MD5}" != "${JSONSSL_FILE_MD5}" ]] && cert_ok=false
- fi
-
- if ${cert_ok} && ${ca_ok}; then
- log-helper info "Nothing to do :)"
- exit 0
- fi
-
- log-helper info "Auto-renew on the way!"
-
- stop_impacted_services
-
- log-helper info "Remove certificate files"
- rm -f "${CERT_FILE}" "${KEY_FILE}" "${CA_FILE}"
-
- log-helper info "Regenerate certificate with ${SSL_HELPER_TOOL}"
- ${SSL_HELPER_TOOL} "${PREFIX}" "${CERT_FILE}" "${KEY_FILE}" "${CA_FILE}"
-
- start_impacted_services
-
- if [ "${SSL_HELPER_TOOL}" = "jsonssl-helper" ]; then
- log-helper info "Update file md5 with new values"
- echo "${JSONSSL_FILE_MD5}" > "${CONTAINER_SERVICE_DIR}/:ssl-tools/assets/md5${JSONSSL_FILE}.md5"
- fi
-
- fi
- log-helper info "Auto-renew finished! Champagne!"
|