Subversion Repositories ALCASAR

Rev

Rev 2295 | Rev 2454 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log

Rev Author Line No. Line
2260 tom.houday 1
#!/bin/bash
2223 tom.houday 2
#
3
# $Id: alcasar-importcert.sh 2309 2017-06-26 14:33:22Z tom.houdayer $
4
#
1710 richard 5
# alcasar-importcert.sh
1736 richard 6
# by Raphaël, Hugo, Clément, Bettyna & rexy
2223 tom.houday 7
#
1710 richard 8
# This script is distributed under the Gnu General Public License (GPL)
2223 tom.houday 9
#
1710 richard 10
# Script permettant
11
# - d'importer des certificats sur Alcasar
1733 richard 12
# - de revenir au certificat par default
2223 tom.houday 13
#
1710 richard 14
# This script allows
1733 richard 15
# - to import a certificate in Alcasar
16
# - to go back to the default certificate
1710 richard 17
 
18
SED="/bin/sed -ri"
19
DIR_CERT="/etc/pki/tls"
1736 richard 20
CONF_FILE="/usr/local/etc/alcasar.conf"
2260 tom.houday 21
PRIVATE_IP_MASK=`grep ^PRIVATE_IP= $CONF_FILE|cut -d"=" -f2`
1736 richard 22
PRIVATE_IP=`echo $PRIVATE_IP_MASK | cut -d"/" -f1`
1710 richard 23
 
2260 tom.houday 24
usage="Usage: alcasar-importcert.sh -i /path/to/certificate.crt -k /path/to/privatekey.key [-c /path/to/serverchain.crt]\n       alcasar-importcert.sh -d (restore default certificate)"
1710 richard 25
nb_args=$#
1733 richard 26
arg1=$1
1710 richard 27
 
1733 richard 28
function defaultNdd()
29
{
1758 richard 30
	$SED "s/^HOSTNAME=.*/HOSTNAME=alcasar/g" /usr/local/etc/alcasar.conf
31
	$SED "s/^DOMAIN=.*/DOMAIN=localdomain/g" /usr/local/etc/alcasar.conf
2309 tom.houday 32
	/usr/local/bin/alcasar-conf.sh --apply
1733 richard 33
}
34
 
35
function defaultCert()
36
{
1740 richard 37
	mv -f $DIR_CERT/certs/alcasar.crt.old $DIR_CERT/certs/alcasar.crt
38
	mv -f $DIR_CERT/private/alcasar.key.old $DIR_CERT/private/alcasar.key
39
	if [ -f $DIR_CERT/certs/server-chain.crt.old ]
1733 richard 40
	then
1740 richard 41
		mv $DIR_CERT/certs/server-chain.crt.old $DIR_CERT/certs/server-chain.crt
1733 richard 42
	fi
43
}
44
 
1710 richard 45
function domainName() # change the domain name in the conf files
46
{
1744 clement.si 47
	fqdn=$(openssl x509 -noout -subject -in $cert | sed -n '/^subject/s/^.*CN=//p' | cut -d'/' -f 1)
1934 raphael.pi 48
 
2260 tom.houday 49
	#check if there is a wildcard in $fqdn
50
	if [[ $fqdn == *"*"* ]];
51
	then
52
		hostname="alcasar"
53
		fqdn=${fqdn/"*"/$hostname}
54
	else
55
		hostname=`echo $fqdn | awk -F'.' '{ print $1 }'`
56
	fi
57
	domain=`echo $fqdn | awk -F'.' '{$1="";OFS=".";print $0}' | sed 's/^.//'`
58
	echo "fqdn=$fqdn hostname=$hostname domain=$domain"
1934 raphael.pi 59
 
2260 tom.houday 60
	#check fqdn format      
2309 tom.houday 61
	if [[ "$fqdn" != "" && "$domain" != "" ]]; then
1758 richard 62
		$SED "s/^HOSTNAME=.*/HOSTNAME=$hostname/g" /usr/local/etc/alcasar.conf
1736 richard 63
		$SED "s/^DOMAIN=.*/DOMAIN=$domain/g" /usr/local/etc/alcasar.conf
2309 tom.houday 64
		/usr/local/bin/alcasar-conf.sh --apply
1710 richard 65
	fi
66
}
67
 
68
function certImport()
69
{
1740 richard 70
	if [ ! -f "$DIR_CERT/certs/alcasar.crt.old" ]
1710 richard 71
	then
72
		echo "Backup of old cert (alcasar.crt)"
1740 richard 73
		mv $DIR_CERT/certs/alcasar.crt $DIR_CERT/certs/alcasar.crt.old
1710 richard 74
	fi
1740 richard 75
	if [ ! -f "$DIR_CERT/private/alcasar.key.old" ]
1710 richard 76
	then
77
		echo "Backup of old private key (alcasar.key)"
1740 richard 78
		mv $DIR_CERT/private/alcasar.key $DIR_CERT/private/alcasar.key.old
1710 richard 79
	fi
2260 tom.houday 80
 
1740 richard 81
	cp $cert $DIR_CERT/certs/alcasar.crt
82
	cp $key $DIR_CERT/private/alcasar.key
1733 richard 83
 
1740 richard 84
	chown root:apache $DIR_CERT/certs/alcasar.crt
85
	chown root:apache $DIR_CERT/private/alcasar.key
1710 richard 86
 
1740 richard 87
	chmod 750 $DIR_CERT/certs/alcasar.crt
88
	chmod 750 $DIR_CERT/private/alcasar.key
2260 tom.houday 89
 
1710 richard 90
	if [ "$sc" != "" ]
91
	then
92
		echo "cert-chain exists"
1740 richard 93
		if [ ! -f "$DIR_CERT/certs/server-chain.crt.old" ]
1710 richard 94
		then
95
			echo "Backup of old cert-chain (server-chain.crt)"
1740 richard 96
			mv $DIR_CERT/certs/server-chain.crt $DIR_CERT/certs/server-chain.crt.old
1710 richard 97
		fi
1740 richard 98
		cp $sc $DIR_CERT/certs/server-chain.crt
99
		chown root:apache $DIR_CERT/certs/server-chain.crt
100
		chmod 750 $DIR_CERT/certs/server-chain.crt
1710 richard 101
	fi
102
}
103
 
1733 richard 104
 
105
if [ $nb_args -eq 0 ]
1710 richard 106
then
2260 tom.houday 107
	echo -e "$usage"
1733 richard 108
	exit 1
1710 richard 109
fi
110
 
1733 richard 111
case $arg1 in
1710 richard 112
	-\? | -h* | --h*)
2260 tom.houday 113
		echo -e "$usage"
1710 richard 114
		exit 0
115
		;;
116
	-i)
1733 richard 117
		arg3=$3
118
		arg5=$5
119
		cert=$2
120
		key=$4
121
		sc=$6
122
 
123
		if [ "$cert" == "" ] || [ "$key" == "" ]
124
		then
2260 tom.houday 125
			echo -e "$usage"
1733 richard 126
			exit 1
127
		fi
128
 
2260 tom.houday 129
		if [ ! -f "$cert" ] || [ ! -f "$key" ]
1733 richard 130
		then
131
			echo "Certificate and/or private key not found"
132
			exit 1
133
		fi
134
 
2261 tom.houday 135
		if [ ${cert: -4} != ".crt" ] && [ ${cert: -4} != ".cer" ]
1733 richard 136
		then
137
			echo "Invalid certificate file"
138
			exit 1
139
		fi
140
 
141
		if [ ${key: -4} != ".key" ]
142
		then
143
			echo "Invalid private key"
144
			exit 1
145
		fi
146
 
2261 tom.houday 147
		if [ "$arg5" != "-c" ] || [ -z "$sc" ]
1733 richard 148
		then
149
			echo "No server-chain given"
150
			echo "Importing certificate $cert with private key $key"
151
			sc=""
152
		else
2261 tom.houday 153
			if [ ! -f "$sc" ]
154
			then
155
				echo "Server-chain certificate not found"
156
				exit 1
157
			fi
158
			if [ ${sc: -4} != ".crt" ] && [ ${sc: -4} != ".cer" ]
159
			then
160
				echo "Invalid server-chain certificate file"
161
				exit 1
162
			fi
1733 richard 163
			echo "Importing certificate $cert with private key $key and server-chain $sc"
164
		fi
165
		domainName $cert
166
		certImport $cert $key $sc
1765 richard 167
		for services in chilli dnsmasq dnsmasq-blackhole dnsmasq-blacklist dnsmasq-whitelist httpd
1740 richard 168
		do
169
			echo "restarting $services"; systemctl restart $services; sleep 1
170
		done
1710 richard 171
		;;
1733 richard 172
	-d)
173
		if [ -f "/etc/pki/tls/certs/alcasar.crt.old" -a -f "/etc/pki/tls/private/alcasar.key.old" ]
174
		then
175
			echo "Restoring default certificate"
176
			defaultCert
177
			defaultNdd
1765 richard 178
			for services in chilli dnsmasq dnsmasq-blackhole dnsmasq-blacklist dnsmasq-whitelist httpd
1740 richard 179
			do
180
				echo "restarting $services"; systemctl restart $services; sleep 1
181
			done
1733 richard 182
		fi
183
		;;
1710 richard 184
	*)
2260 tom.houday 185
		echo -e "$usage"
1710 richard 186
		;;
187
esac