freedombone-addcert 11KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Create self-signed or Let's Encrypt certificates on Debian
  12. # License
  13. # =======
  14. #
  15. # Copyright (C) 2015-2018 Bob Mottram <bob@freedombone.net>
  16. #
  17. # This program is free software: you can redistribute it and/or modify
  18. # it under the terms of the GNU Affero General Public License as published by
  19. # the Free Software Foundation, either version 3 of the License, or
  20. # (at your option) any later version.
  21. #
  22. # This program is distributed in the hope that it will be useful,
  23. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  24. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  25. # GNU Affero General Public License for more details.
  26. #
  27. # You should have received a copy of the GNU Affero General Public License
  28. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  29. PROJECT_NAME='freedombone'
  30. export TEXTDOMAIN=${PROJECT_NAME}-addcert
  31. export TEXTDOMAINDIR="/usr/share/locale"
  32. CONFIGURATION_FILE=$HOME/${PROJECT_NAME}.cfg
  33. COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
  34. UTILS_FILES="/usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-*"
  35. for f in $UTILS_FILES
  36. do
  37. source "$f"
  38. done
  39. # Don't pin certs by default
  40. PIN_CERTS=
  41. HOSTNAME=
  42. remove_cert=
  43. LETSENCRYPT_HOSTNAME=
  44. COUNTRY_CODE="US"
  45. AREA="Apparent Free Speech Zone"
  46. LOCATION="Freedomville"
  47. ORGANISATION="Freedombone"
  48. UNIT="Freedombone Unit"
  49. EXTENSIONS=""
  50. NODH=
  51. DH_KEYLENGTH=2048
  52. INSTALL_DIR=/root/build
  53. LETSENCRYPT_SERVER='https://acme-v01.api.letsencrypt.org/directory'
  54. MY_EMAIL_ADDRESS=
  55. function show_help {
  56. echo ''
  57. echo $"${PROJECT_NAME}-addcert -h [hostname] -c [country code] -a [area] -l [location]"
  58. echo $' -o [organisation] -u [unit] --ca "" --nodh ""'
  59. echo ''
  60. echo $'Creates a self-signed certificate for the given hostname'
  61. echo ''
  62. echo $' --help Show help'
  63. echo $' -h --hostname [name] Hostname'
  64. echo $' -e --letsencrypt [hostname] Hostname to use with Lets Encrypt'
  65. echo $' -r --rmletsencrypt [hostname] Remove a Lets Encrypt certificate'
  66. echo $' -s --server [url] Lets Encrypt server URL'
  67. echo $' -c --country [code] Optional country code (eg. US, GB, etc)'
  68. echo $' -a --area [description] Optional area description'
  69. echo $' -l --location [locn] Optional location name'
  70. echo $' -o --organisation [name] Optional organisation name'
  71. echo $' -u --unit [name] Optional unit name'
  72. echo $' --email [address] Email address for letsencrypt'
  73. echo $' --dhkey [bits] DH key length in bits'
  74. echo $' --nodh "" Do not calculate DH params'
  75. echo $' --ca "" Certificate authority cert'
  76. echo ''
  77. exit 0
  78. }
  79. while [ $# -gt 1 ]
  80. do
  81. key="$1"
  82. case $key in
  83. --help)
  84. show_help
  85. ;;
  86. -h|--hostname)
  87. shift
  88. HOSTNAME="$1"
  89. ;;
  90. -e|--letsencrypt)
  91. shift
  92. LETSENCRYPT_HOSTNAME="$1"
  93. ;;
  94. -r|--rmletsencrypt)
  95. shift
  96. LETSENCRYPT_HOSTNAME="$1"
  97. remove_cert=1
  98. ;;
  99. --email)
  100. shift
  101. MY_EMAIL_ADDRESS="$1"
  102. ;;
  103. -s|--server)
  104. shift
  105. LETSENCRYPT_SERVER="$1"
  106. ;;
  107. -c|--country)
  108. shift
  109. COUNTRY_CODE="$1"
  110. ;;
  111. -a|--area)
  112. shift
  113. AREA="$1"
  114. ;;
  115. -l|--location)
  116. shift
  117. LOCATION="$1"
  118. ;;
  119. -o|--organisation)
  120. shift
  121. ORGANISATION="$1"
  122. ;;
  123. -u|--unit)
  124. shift
  125. UNIT="$1"
  126. ;;
  127. --ca)
  128. shift
  129. EXTENSIONS="-extensions v3_ca"
  130. ORGANISATION="Freedombone-CA"
  131. ;;
  132. --nodh)
  133. shift
  134. NODH="true"
  135. ;;
  136. --dhkey)
  137. shift
  138. DH_KEYLENGTH="${1}"
  139. ;;
  140. --pin)
  141. shift
  142. PIN_CERTS="${1}"
  143. ;;
  144. *)
  145. # unknown option
  146. ;;
  147. esac
  148. shift
  149. done
  150. if [ ! "$HOSTNAME" ]; then
  151. if [ ! "$LETSENCRYPT_HOSTNAME" ]; then
  152. echo $'No hostname specified'
  153. exit 5748
  154. fi
  155. fi
  156. if ! which openssl > /dev/null ;then
  157. echo $"$0: openssl is not installed, exiting" 1>&2
  158. exit 5689
  159. fi
  160. if [ ! -d /etc/ssl/mycerts ]; then
  161. mkdir /etc/ssl/mycerts
  162. fi
  163. CERTFILE=$HOSTNAME
  164. function remove_cert_letsencrypt {
  165. CERTFILE=$LETSENCRYPT_HOSTNAME
  166. # disable the site if needed
  167. if [ -f "/etc/nginx/sites-available/${LETSENCRYPT_HOSTNAME}" ]; then
  168. if grep -q "443" "/etc/nginx/sites-available/${LETSENCRYPT_HOSTNAME}"; then
  169. nginx_dissite "${LETSENCRYPT_HOSTNAME}"
  170. fi
  171. fi
  172. # remove the cert
  173. rm -rf "/etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}*"
  174. rm -rf "/etc/letsencrypt/archive/${LETSENCRYPT_HOSTNAME}*"
  175. rm "/etc/letsencrypt/renewal/${LETSENCRYPT_HOSTNAME}.conf"
  176. # restart the web server
  177. systemctl restart nginx
  178. }
  179. function add_cert_letsencrypt {
  180. CERTFILE=$LETSENCRYPT_HOSTNAME
  181. # obtain the email address for the admin user
  182. if [ ! "$MY_EMAIL_ADDRESS" ]; then
  183. if [ -f "$CONFIGURATION_FILE" ]; then
  184. read_config_param MY_EMAIL_ADDRESS
  185. fi
  186. fi
  187. if [ ! "$MY_EMAIL_ADDRESS" ]; then
  188. if [ -f "$COMPLETION_FILE" ]; then
  189. if grep -q "Admin user:" "$COMPLETION_FILE"; then
  190. function_check get_completion_param
  191. ADMIN_USER=$(get_completion_param "Admin user")
  192. if [ ${#ADMIN_USER} -eq 0 ]; then
  193. exit 463732
  194. fi
  195. MY_EMAIL_ADDRESS=$ADMIN_USER@$HOSTNAME
  196. fi
  197. fi
  198. fi
  199. if [ ! -f /usr/bin/certbot ]; then
  200. apt-get -yq -t stretch-backports install certbot
  201. groupadd ssl-cert
  202. if [ ! -f /usr/bin/certbot ]; then
  203. echo $'LetsEncrypt certbot failed to install'
  204. exit 762830
  205. fi
  206. fi
  207. # stop the web server
  208. systemctl stop nginx
  209. chgrp -R root /etc/letsencrypt
  210. chmod -R 777 /etc/letsencrypt
  211. if ! certbot certonly -n --server "$LETSENCRYPT_SERVER" --standalone -d "$LETSENCRYPT_HOSTNAME" --renew-by-default --agree-tos --email "$MY_EMAIL_ADDRESS"; then
  212. echo $"Failed to install letsencrypt for domain $LETSENCRYPT_HOSTNAME"
  213. echo $'Also see https://letsencrypt.status.io to check for any service outages'
  214. chgrp -R ssl-cert /etc/letsencrypt
  215. chmod -R 600 /etc/letsencrypt
  216. chmod -R g=rX /etc/letsencrypt
  217. chown -R root:ssl-cert /etc/letsencrypt
  218. systemctl start nginx
  219. exit 63216
  220. fi
  221. # replace some legacy filenames
  222. if [ -f "/etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt" ]; then
  223. # shellcheck disable=SC2086
  224. mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
  225. fi
  226. if [ -f "/etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt" ]; then
  227. # shellcheck disable=SC2086
  228. mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
  229. fi
  230. sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" "/etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME"
  231. sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" "/etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME"
  232. # link the private key
  233. if [ -f "/etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key" ]; then
  234. if [ ! -f "/etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old" ]; then
  235. # shellcheck disable=SC2086
  236. mv /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old
  237. else
  238. rm -f "/etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key"
  239. fi
  240. fi
  241. if [ -L "/etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key" ]; then
  242. rm "/etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key"
  243. fi
  244. ln -s "/etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/privkey.pem" "/etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key"
  245. # link the public key
  246. if [ -f "/etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem" ]; then
  247. if [ ! -f "/etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old" ]; then
  248. # shellcheck disable=SC2086
  249. mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old
  250. else
  251. rm -f "/etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem"
  252. fi
  253. fi
  254. if [ -L "/etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem" ]; then
  255. rm "/etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem"
  256. fi
  257. ln -s "/etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/fullchain.pem" "/etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem"
  258. cp "/etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/fullchain.pem" "/etc/ssl/mycerts/${LETSENCRYPT_HOSTNAME}.pem"
  259. update_default_domain
  260. # this group can be used to assign read permissions for
  261. # application user accounts
  262. chgrp -R ssl-cert /etc/letsencrypt
  263. chmod -R 600 /etc/letsencrypt
  264. chmod -R g=rX /etc/letsencrypt
  265. chown -R root:ssl-cert /etc/letsencrypt
  266. nginx_ensite "${LETSENCRYPT_HOSTNAME}"
  267. systemctl start nginx
  268. if [ "$PIN_CERTS" ]; then
  269. if ! "${PROJECT_NAME}-pin-cert" "$LETSENCRYPT_HOSTNAME"; then
  270. echo $"Certificate for $LETSENCRYPT_HOSTNAME could not be pinned"
  271. exit 62878
  272. fi
  273. fi
  274. }
  275. function add_cert_selfsigned {
  276. if [[ "$ORGANISATION" == "Freedombone-CA" ]]; then
  277. CERTFILE="ca-$HOSTNAME"
  278. fi
  279. openssl req -x509 "${EXTENSIONS}" -nodes -days 3650 -sha256 \
  280. -subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" \
  281. -newkey rsa:2048 -keyout "/etc/ssl/private/${CERTFILE}.key" \
  282. -out "/etc/ssl/certs/${CERTFILE}.crt"
  283. chmod 400 "/etc/ssl/private/${CERTFILE}.key"
  284. chmod 640 "/etc/ssl/certs/${CERTFILE}.crt"
  285. cp "/etc/ssl/certs/${CERTFILE}.crt" "/etc/ssl/mycerts"
  286. if [ "$PIN_CERTS" ]; then
  287. if ! "${PROJECT_NAME}-pin-cert" "$CERTFILE"; then
  288. echo $"Certificate for $CERTFILE could not be pinned"
  289. exit 62879
  290. fi
  291. fi
  292. }
  293. function generate_dh_params {
  294. if [ ! "$NODH" ]; then
  295. if [ ! -f "/etc/ssl/certs/${CERTFILE}.dhparam" ]; then
  296. "${PROJECT_NAME}-dhparam" -h "${CERTFILE}" --fast yes
  297. fi
  298. fi
  299. }
  300. function restart_web_server {
  301. if [ -f /etc/init.d/nginx ]; then
  302. /etc/init.d/nginx reload
  303. fi
  304. }
  305. function make_cert_bundle {
  306. # Create a bundle of your certificates
  307. cat /etc/ssl/mycerts/*.crt /etc/ssl/mycerts/*.pem > /etc/ssl/${PROJECT_NAME}-bundle.crt
  308. tar -czvf /etc/ssl/${PROJECT_NAME}-certs.tar.gz /etc/ssl/mycerts/*.crt /etc/ssl/mycerts/*.pem
  309. }
  310. function create_cert {
  311. if [ "$remove_cert" ]; then
  312. remove_cert_letsencrypt
  313. return
  314. fi
  315. if [ "$LETSENCRYPT_HOSTNAME" ]; then
  316. add_cert_letsencrypt
  317. else
  318. add_cert_selfsigned
  319. fi
  320. }
  321. create_cert
  322. generate_dh_params
  323. restart_web_server
  324. make_cert_bundle
  325. exit 0