kris/puppet-acme_vault
1
0
Fork 0
mirror of https://github.com/krislamo/puppet-acme_vault synced 2025-01-18 15:30:34 +00:00
Code Issues Releases Wiki Activity

add better checking in check_cert.sh

Browse Source
This commit is contained in:
Bob Belnap 2018-02-27 11:10:51 -05:00
parent b8431548a7
commit ca32b31595
1 changed files with 33 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
files/check_cert.sh
View File

@ -12,6 +12,19 @@ get_enddate() {
date --date="$(openssl x509 -noout -enddate -in <(echo "$1")| awk -F= '{print $2}')" --iso-8601 date --date="$(openssl x509 -noout -enddate -in <(echo "$1")| awk -F= '{print $2}')" --iso-8601
} }
deploy_cert() {
NEWCERT=$1
NEWKEY=$2
EXISTING_CERT_PATH=$3
EXISTING_KEY_PATH=$4
echo "deploying cert to $EXISTING_CERT_PATH"
#mkdir $EXISTING_CERT_DIR || true #TODO MOVE
echo "$NEWCERT" > $EXISTING_CERT_PATH
echo "$NEWKEY" > $EXISTING_KEY_PATH
}
# arguments # arguments
DOMAIN=$1 DOMAIN=$1
CERT_PREFIX=$2 CERT_PREFIX=$2
@ -43,10 +56,23 @@ fi
#echo "new fingerprint: $NEWCERT_FINGERPRINT" #echo "new fingerprint: $NEWCERT_FINGERPRINT"
#echo "new enddate: $NEWCERT_ENDDATE" #echo "new enddate: $NEWCERT_ENDDATE"
# Get existing cert info # Get existing cert info if it exists. if it doesn't exist, we don't need to
# check it, we can just deploy.
if [ -e $EXISTING_CERT_PATH ]
then
EXISTING_CERT=$(cat $EXISTING_CERT_PATH) EXISTING_CERT=$(cat $EXISTING_CERT_PATH)
EXISTING_CERT_FINGERPRINT=$(get_fingerprint "$EXISTING_CERT") EXISTING_CERT_FINGERPRINT=$(get_fingerprint "$EXISTING_CERT")
EXISTING_CERT_ENDDATE=$(get_enddate "$EXISTING_CERT") EXISTING_CERT_ENDDATE=$(get_enddate "$EXISTING_CERT")
else
# create destination dir if needed
if [ ! -d $EXISTING_CERT_DIR ]
then
mkdir -p $EXISTING_CERT_DIR
fi
deploy_cert "$NEWCERT" "$NEWKEY" "$EXISTING_CERT_PATH" "$EXISTING_KEY_PATH"
exit 0
fi
#echo "existing fingerprint: $EXISTING_CERT_FINGERPRINT" #echo "existing fingerprint: $EXISTING_CERT_FINGERPRINT"
#echo "existing enddate: $EXISTING_CERT_ENDDATE" #echo "existing enddate: $EXISTING_CERT_ENDDATE"
@ -74,10 +100,9 @@ then
fi fi
# if we made it this far, the cert looks good, replace it # if we made it this far, the cert looks good, replace it
echo "replacing cert at $EXISTING_CERT_PATH"
mkdir $EXISTING_CERT_DIR || true deploy_cert "$NEWCERT" "$NEWKEY" "$EXISTING_CERT_PATH" "$EXISTING_KEY_PATH"
echo "$NEWCERT" > $EXISTING_CERT_PATH
echo "$NEWKEY" > $EXISTING_KEY_PATH
#openssl x509 -in <(vault read -field=value /secret/apidb.org/cert.pem) -noout -checkend 8640000 #openssl x509 -in <(vault read -field=value /secret/apidb.org/cert.pem) -noout -checkend 8640000