|
|
@@ -0,0 +1,177 @@
|
|
|
1
|
+#!/bin/bash
|
|
|
2
|
+# A script for renewing SSL/TLS certificates
|
|
|
3
|
+
|
|
|
4
|
+# License
|
|
|
5
|
+# =======
|
|
|
6
|
+#
|
|
|
7
|
+# Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
|
|
|
8
|
+#
|
|
|
9
|
+# This program is free software: you can redistribute it and/or modify
|
|
|
10
|
+# it under the terms of the GNU General Public License as published by
|
|
|
11
|
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
12
|
+# (at your option) any later version.
|
|
|
13
|
+#
|
|
|
14
|
+# This program is distributed in the hope that it will be useful,
|
|
|
15
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
16
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
17
|
+# GNU General Public License for more details.
|
|
|
18
|
+#
|
|
|
19
|
+# You should have received a copy of the GNU General Public License
|
|
|
20
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
21
|
+
|
|
|
22
|
+HOSTNAME=
|
|
|
23
|
+PROVIDER='startssl'
|
|
|
24
|
+
|
|
|
25
|
+function show_help {
|
|
|
26
|
+ echo ''
|
|
|
27
|
+ echo 'freedombone-renew-cert -h [hostname] -p [provider]'
|
|
|
28
|
+ echo ''
|
|
|
29
|
+ echo 'Makes it easier to renew a ssl/tls certificate for a website'
|
|
|
30
|
+ echo ''
|
|
|
31
|
+ echo ' --help Show help'
|
|
|
32
|
+ echo ' -h --hostname [name] Hostname'
|
|
|
33
|
+ echo ' -p --provider [name] eg. startssl'
|
|
|
34
|
+ echo ''
|
|
|
35
|
+ exit 0
|
|
|
36
|
+}
|
|
|
37
|
+
|
|
|
38
|
+function renew_startssl {
|
|
|
39
|
+ echo 'Renewing StartSSL certificate'
|
|
|
40
|
+ if [ -s /etc/ssl/certs/$HOSTNAME.new.crt ]; then
|
|
|
41
|
+ if ! grep -q "-BEGIN CERTIFICATE-" /etc/ssl/certs/$HOSTNAME.new.crt; then
|
|
|
42
|
+ echo '/etc/ssl/certs/$HOSTNAME.new.crt does not contain a public key'
|
|
|
43
|
+ return
|
|
|
44
|
+ fi
|
|
|
45
|
+
|
|
|
46
|
+ cp /etc/ssl/certs/$HOSTNAME.new.crt /etc/ssl/certs/$HOSTNAME.crt
|
|
|
47
|
+
|
|
|
48
|
+ if [ ! -d /etc/ssl/roots ]; then
|
|
|
49
|
+ mkdir /etc/ssl/roots
|
|
|
50
|
+ fi
|
|
|
51
|
+ if [ ! -d /etc/ssl/chains ]; then
|
|
|
52
|
+ mkdir /etc/ssl/chains
|
|
|
53
|
+ fi
|
|
|
54
|
+
|
|
|
55
|
+ # download intermediate certs
|
|
|
56
|
+ wget "http://www.startssl.com/certs/ca.pem" --output-document="/etc/ssl/roots/startssl-root.ca"
|
|
|
57
|
+ wget "http://www.startssl.com/certs/sub.class1.server.ca.pem" --output-document="/etc/ssl/chains/startssl-sub.class1.server.ca.pem"
|
|
|
58
|
+ wget "http://www.startssl.com/certs/sub.class2.server.ca.pem" --output-document="/etc/ssl/chains/startssl-sub.class2.server.ca.pem"
|
|
|
59
|
+ wget "http://www.startssl.com/certs/sub.class3.server.ca.pem" --output-document="/etc/ssl/chains/startssl-sub.class3.server.ca.pem"
|
|
|
60
|
+ ln -s "/etc/ssl/roots/startssl-root.ca" "/etc/ssl/roots/$HOSTNAME-root.ca"
|
|
|
61
|
+ ln -s "/etc/ssl/chains/startssl-sub.class1.server.ca.pem" "/etc/ssl/chains/$HOSTNAME.ca"
|
|
|
62
|
+ cp "/etc/ssl/certs/$HOSTNAME.crt" "/etc/ssl/certs/$HOSTNAME.crt+chain+root"
|
|
|
63
|
+ test -e "/etc/ssl/chains/$HOSTNAME.ca" && cat "/etc/ssl/chains/$HOSTNAME.ca" >> "/etc/ssl/certs/$HOSTNAME.crt+chain+root"
|
|
|
64
|
+ test -e "/etc/ssl/roots/$HOSTNAME-root.ca" && cat "/etc/ssl/roots/$HOSTNAME-root.ca" >> "/etc/ssl/certs/$HOSTNAME.crt+chain+root"
|
|
|
65
|
+
|
|
|
66
|
+ # remove the password from the private cert
|
|
|
67
|
+ openssl rsa -in /etc/ssl/private/$HOSTNAME.key -out /etc/ssl/private/$HOSTNAME.new.key
|
|
|
68
|
+ cp /etc/ssl/private/$HOSTNAME.new.key /etc/ssl/private/$HOSTNAME.key
|
|
|
69
|
+ shred -zu /etc/ssl/private/$HOSTNAME.new.key
|
|
|
70
|
+
|
|
|
71
|
+ # bundle the cert
|
|
|
72
|
+ cat /etc/ssl/certs/$HOSTNAME.crt /etc/ssl/chains/startssl-sub.class1.server.ca.pem > /etc/ssl/certs/$HOSTNAME.bundle.crt
|
|
|
73
|
+
|
|
|
74
|
+ # add it to mycerts
|
|
|
75
|
+ cp /etc/ssl/certs/$HOSTNAME.bundle.crt /etc/ssl/mycerts
|
|
|
76
|
+ cat /etc/ssl/mycerts/*.crt > /etc/ssl/freedombone-bundle.crt
|
|
|
77
|
+ tar -czvf /etc/ssl/freedombone-certs.tar.gz /etc/ssl/mycerts/*.crt
|
|
|
78
|
+
|
|
|
79
|
+ # create backups
|
|
|
80
|
+ if [ ! -d /etc/ssl/backups ]; then
|
|
|
81
|
+ mkdir /etc/ssl/backups
|
|
|
82
|
+ fi
|
|
|
83
|
+ if [ ! -d /etc/ssl/backups/certs ]; then
|
|
|
84
|
+ mkdir /etc/ssl/backups/certs
|
|
|
85
|
+ fi
|
|
|
86
|
+ if [ ! -d /etc/ssl/backups/private ]; then
|
|
|
87
|
+ mkdir /etc/ssl/backups/private
|
|
|
88
|
+ fi
|
|
|
89
|
+ cp /etc/ssl/certs/$HOSTNAME* /etc/ssl/backups/certs/
|
|
|
90
|
+ cp /etc/ssl/private/$HOSTNAME* /etc/ssl/backups/private/
|
|
|
91
|
+ chmod -R 400 /etc/ssl/backups/certs/*
|
|
|
92
|
+ chmod -R 400 /etc/ssl/backups/private/*
|
|
|
93
|
+
|
|
|
94
|
+ rm /etc/ssl/certs/$HOSTNAME.new.crt
|
|
|
95
|
+ rm /etc/ssl/requests/$HOSTNAME.csr
|
|
|
96
|
+ echo 'Certificate installed'
|
|
|
97
|
+ service nginx restart
|
|
|
98
|
+ return
|
|
|
99
|
+ fi
|
|
|
100
|
+
|
|
|
101
|
+ if [ -f /etc/ssl/requests/$HOSTNAME.csr ]; then
|
|
|
102
|
+ echo 'Certificate request already created:'
|
|
|
103
|
+ echo ''
|
|
|
104
|
+ cat /etc/ssl/requests/$HOSTNAME.csr
|
|
|
105
|
+ echo ''
|
|
|
106
|
+ echo "Save the requested public key to /etc/ssl/certs/$HOSTNAME.new.crt"
|
|
|
107
|
+ echo 'then run this command again.'
|
|
|
108
|
+ echo ''
|
|
|
109
|
+ return
|
|
|
110
|
+ fi
|
|
|
111
|
+ openssl genrsa -out /etc/ssl/private/$HOSTNAME.new.key 2048
|
|
|
112
|
+ chown root:ssl-cert /etc/ssl/private/$HOSTNAME.new.key
|
|
|
113
|
+ chmod 440 /etc/ssl/private/$HOSTNAME.new.key
|
|
|
114
|
+ if [ ! -d /etc/ssl/requests ]; then
|
|
|
115
|
+ mkdir /etc/ssl/requests
|
|
|
116
|
+ fi
|
|
|
117
|
+ openssl req -new -sha256 -key /etc/ssl/private/$HOSTNAME.new.key -out /etc/ssl/requests/$HOSTNAME.csr
|
|
|
118
|
+ echo ''
|
|
|
119
|
+ cat /etc/ssl/requests/$HOSTNAME.csr
|
|
|
120
|
+ echo ''
|
|
|
121
|
+ echo 'On the StartSSL site select Certificates Wizard then'
|
|
|
122
|
+ echo 'Web server SSL/TLS Certificate. You can then click on "skip"'
|
|
|
123
|
+ echo 'and then copy and paste the above certificate request into the text'
|
|
|
124
|
+ echo 'entry box. You may now need to wait a few hours for a confirmation'
|
|
|
125
|
+ echo 'email indicating that the new certificate was created.'
|
|
|
126
|
+ echo ''
|
|
|
127
|
+ echo 'Once you have retrieved the new public certificate paste it to:'
|
|
|
128
|
+ echo "/etc/ssl/certs/$HOSTNAME.new.crt then run this command again."
|
|
|
129
|
+ echo ''
|
|
|
130
|
+}
|
|
|
131
|
+
|
|
|
132
|
+while [[ $# > 1 ]]
|
|
|
133
|
+do
|
|
|
134
|
+key="$1"
|
|
|
135
|
+
|
|
|
136
|
+case $key in
|
|
|
137
|
+ --help)
|
|
|
138
|
+ show_help
|
|
|
139
|
+ ;;
|
|
|
140
|
+ -h|--hostname)
|
|
|
141
|
+ shift
|
|
|
142
|
+ HOSTNAME="$1"
|
|
|
143
|
+ ;;
|
|
|
144
|
+ -p|--provider)
|
|
|
145
|
+ shift
|
|
|
146
|
+ PROVIDER="$1"
|
|
|
147
|
+ ;;
|
|
|
148
|
+ *)
|
|
|
149
|
+ # unknown option
|
|
|
150
|
+ ;;
|
|
|
151
|
+esac
|
|
|
152
|
+shift
|
|
|
153
|
+done
|
|
|
154
|
+
|
|
|
155
|
+if [ ! $HOSTNAME ]; then
|
|
|
156
|
+ echo 'No hostname specified'
|
|
|
157
|
+ exit 5748
|
|
|
158
|
+fi
|
|
|
159
|
+
|
|
|
160
|
+if ! which openssl > /dev/null ;then
|
|
|
161
|
+ echo "$0: openssl is not installed, exiting" 1>&2
|
|
|
162
|
+ exit 5689
|
|
|
163
|
+fi
|
|
|
164
|
+
|
|
|
165
|
+# check that the web site exists
|
|
|
166
|
+if [ ! -f /etc/nginx/sites-available/$HOSTNAME ]; then
|
|
|
167
|
+ echo "/etc/nginx/sites-available/$HOSTNAME does not exist"
|
|
|
168
|
+ return 7598
|
|
|
169
|
+fi
|
|
|
170
|
+
|
|
|
171
|
+if [[ $PROVIDER == 'startssl' || $PROVIDER == 'StartSSL' ]]; then
|
|
|
172
|
+ renew_startssl
|
|
|
173
|
+else
|
|
|
174
|
+ echo "$PROVIDER is not currently supported"
|
|
|
175
|
+fi
|
|
|
176
|
+
|
|
|
177
|
+exit 0
|
Bob Mottram
10 年前