From 91dbbecd114310a6aa9be1a789dc6fa9535eb632 Mon Sep 17 00:00:00 2001
From: "Hahn Axel (hahn)" <axel.hahn@iml.unibe.ch>
Date: Wed, 30 Mar 2022 14:53:34 +0200
Subject: [PATCH] remove usage of csr and generation of key file
---
cm.sh | 122 ++++++++++++++++++++++++++++++++-------------
inc_config.sh.dist | 2 +
2 files changed, 88 insertions(+), 36 deletions(-)
diff --git a/cm.sh b/cm.sh
index a6b1956..d62dc31 100755
--- a/cm.sh
+++ b/cm.sh
@@ -25,6 +25,7 @@
# 2021-09-27 <axel.hahn@iml.unibe.ch> softer behaviour: do not revoke changed certs (add does not stop; ensure does not delete)
# 2021-12-23 <axel.hahn@iml.unibe.ch> added param --trace as 1st param to generate a trace log
# 2022-01-10 <axel.hahn@iml.unibe.ch> _wait_for_free_slot: exclude ssh calls
+# 2022-03-30 <axel.hahn@iml.unibe.ch> remove usage of csr and generation of key file
# ======================================================================
@@ -105,39 +106,45 @@ function _certTransfer(){
test -d ${CM_dircerts} && rm -f "${CM_dircerts}/*" 2>/dev/null
_wd "--- transfer acme.sh files to ${CM_dircerts}/"
- $ACME \
+ if ! $ACME \
--install-cert \
- -d ${CM_fqdn} \
- --cert-file ${CM_outfile_cert} \
- --fullchain-file ${CM_outfile_chain} \
- --ca-file ${CM_outfile_ca}
- if [ $? -ne 0 ]; then
- echo "ERROR occured during transfer. Removing files in ${CM_dircerts} to prevent strange effects..."
+ -d "${CM_fqdn}" \
+ --key-file "${CM_outfile_key}" \
+ --cert-file "${CM_outfile_cert}" \
+ --fullchain-file "${CM_outfile_chain}" \
+ --ca-file "${CM_outfile_ca}"
+ then
+ echo "ERROR occured during acme transfer. Removing files in ${CM_dircerts} to prevent strange effects..."
rm -f "${CM_dircerts}/*"
- exit
+ exit 2
fi
echo "OK."
- _wd "--- copy key to ${CM_dircerts}"
- cp ${CM_filekey} ${CM_outfile_key}
+ # _wd "--- copy key to ${CM_dircerts}"
+ # cp ${CM_filekey} ${CM_outfile_key}
_wd "--- create chained file for haproxy"
- cat ${CM_outfile_chain} ${CM_outfile_key} > ${CM_outfile_haproxy}
+ cat "${CM_outfile_chain}" "${CM_outfile_key}" > "${CM_outfile_haproxy}"
_wd "--- content of output dir $CM_dircerts:"
- ls -l $CM_dircerts/*
+ if ! ls -l "${CM_outfile_cert}" "${CM_outfile_chain}" "${CM_outfile_key}" "${CM_outfile_haproxy}"
+ then
+ echo "ERROR missing a file (or no access?)"
+ rm -f "${CM_dircerts}/*"
+ exit 2
+ fi
}
# internal function; show md5 hashsums for certificate, csr and key
# for visual comparison if the match
function _certMatching(){
- local md5_csr=$( test -f ${CM_filecsr} && openssl req -noout -modulus -in ${CM_filecsr} | openssl md5 | cut -f 2 -d " " )
+ # local md5_csr=$( test -f ${CM_filecsr} && openssl req -noout -modulus -in ${CM_filecsr} | openssl md5 | cut -f 2 -d " " )
local md5_key=$( test -f ${CM_outfile_key} && openssl rsa -noout -modulus -in ${CM_outfile_key} | openssl md5 | cut -f 2 -d " " )
local md5_cert=$( test -f ${CM_outfile_cert} && openssl x509 -noout -modulus -in ${CM_outfile_cert} | openssl md5 | cut -f 2 -d " " )
echo
echo "--- compare hashes"
- echo "csr : $md5_csr (used for creation of cert)"
+ # echo "csr : $md5_csr (used for creation of cert)"
echo "key : $md5_key"
echo "cert : $md5_cert"
if [ "$md5_key" = "$md5_cert" ]; then
@@ -157,15 +164,17 @@ function _certMatching(){
function _checkDig(){
local myfqdn=$1
local _type=${2:-"a"}
- which dig >/dev/null
- if [ $? -eq 0 ]; then
- _wd "CHECK: $myfqdn exists as [$_type] in DNS (using dig) ..."
- dig "${myfqdn}" "${_type}" | grep "^${myfqdn}"
- if [ $? -ne 0 ]; then
- echo "ERROR: not found. Maybe there is a typo in the hostname or it does not exist in DNS."
+ # local _verify=${3:-"."}
+
+ if which dig >/dev/null
+ then
+ # _wd "[$myfqdn] exists as type [$_type] in DNS?"
+ if ! dig "${myfqdn}" "${_type}" | grep "^${myfqdn}" # | grep "${_verify}"
+ then
+ echo "ERROR: [$myfqdn] was not found. Maybe there is a typo in the hostname or it does not exist in DNS."
exit 2
fi
- _wd "OK"
+ _wd "OK: [$myfqdn] exists in DNS."
else
_wd "SKIP: dig was not found"
fi
@@ -173,35 +182,33 @@ function _checkDig(){
}
-# internal function; generate a csr file before creating a new certifcate
-# this function is used in public_add
-function _gencsr(){
-
+function _dnsCheck(){
local altdns=
local _mydomain=
local _subdomain='_acme-challenge'
- # check alt names too
- # _checkDig $CM_fqdn
-
- for _mydomain in $CM_fqdn $*
+ for _mydomain in $*
do
_wd "dig check - domain for cert"
_checkDig "$_mydomain" "a"
- # if [ -n "${CM_challenge_alias}" ] && ! echo "$_mydomain" | grep "${CM_certmatch}"
- if [ -n "${CM_challenge_alias}" ] && echo "$_mydomain" | grep "${CM_certmatch}" >/dev/null
+ if [ -n "${CM_challenge_alias}" ] && ! echo "$_mydomain" | grep "${CM_certmatch}" >/dev/null
then
- _wd "dig check - domain with api access $_subdomain... "
- _checkDig "${_subdomain}.${CM_challenge_alias}" "a"
- _wd "dig check - alias $_subdomain... "
+ # _wd "Host is not matching ${CM_certmatch} ... using dns alias"
+ # _wd "dig check - domain with api access $_subdomain... "
+ # _checkDig "${_subdomain}.${CM_challenge_alias}" "a"
+ _wd "dig check - cname ${_subdomain}.${_mydomain} must point to ${_subdomain}.${CM_challenge_alias}"
_checkDig "${_subdomain}.${_mydomain}" "cname"
fi
done
-echo ABORT in _gencsr Zeile 195
-exit 1
+}
+# internal function; generate a csr file before creating a new certifcate
+# this function is used in public_add
+function _gencsr(){
+
+ local altdns=
for myalt in $*
do
@@ -357,6 +364,49 @@ function _testFqdncount(){
# pulic function ADD certificate
#
function public_add(){
+ local _params=""
+
+ _wait_for_free_slot
+ _requiresFqdn
+ _certMustNotExist
+
+ # _dnsCheck $CM_fqdn $*
+
+ for _mydomain in $CM_fqdn $*
+ do
+ _params+="-d $_mydomain "
+
+ if [ -n "${CM_challenge_alias}" ] && ! echo "$_mydomain" | grep "${CM_certmatch}" >/dev/null
+ then
+ _params+="--challenge-alias ${CM_challenge_alias}"
+ fi
+ done
+
+ _wd "--- create output dir $dircerts"
+ mkdir -p "${CM_dircerts}" 2>/dev/null
+
+ _wd "--- create certificate"
+ # echo $ACME --signcsr --csr $CM_filecsr $ACME_Params
+ # $ACME --signcsr --csr $CM_filecsr $ACME_Params
+
+
+
+ echo $ACME --issue $_params $ACME_Params
+ if ! $ACME --issue $_params $ACME_Params
+ then
+ echo "ERROR: adding cert failed. Trying to delete internal data ..."
+ public_delete $CM_fqdn
+ exit 1
+ fi
+ # $ACME --issue -d $CM_fqdn $ACME_Params || exit 1
+
+ _certTransfer
+ _certMatching
+
+ _update "added $CM_fqdn $*"
+}
+
+function OLD__public_add(){
_wait_for_free_slot
_requiresFqdn
_certMustNotExist
diff --git a/inc_config.sh.dist b/inc_config.sh.dist
index 9b12fcd..3e546ae 100644
--- a/inc_config.sh.dist
+++ b/inc_config.sh.dist
@@ -43,6 +43,8 @@ export ACME=../acme.sh/acme.sh
# have no permission
# export CM_certmatch="\.example\.com"
+# export CM_challenge_alias="example.com"
+
# optional: force a user to execute cm.sh
# this is for a central installation with a software deployment
# like Ansible or puppet; default: none (=any user can run cm.sh)
--
GitLab