summaryrefslogtreecommitdiffstats
path: root/dehydrated/share
diff options
context:
space:
mode:
Diffstat (limited to 'dehydrated/share')
-rwxr-xr-xdehydrated/share/hooks/deploy_cert.chrony2
-rwxr-xr-xdehydrated/share/hooks/deploy_cert.extra70
-rwxr-xr-xdehydrated/share/hooks/deploy_ocsp.extra9
-rwxr-xr-xdehydrated/share/hooks/exit_hook.extra-cleanup4
-rwxr-xr-xdehydrated/share/hooks/exit_hook.fix-permissions2
-rwxr-xr-xdehydrated/share/hooks/exit_hook.service-reload2
-rw-r--r--dehydrated/share/man/Makefile2
-rw-r--r--dehydrated/share/man/dehydrated-cron.1.rst2
-rw-r--r--dehydrated/share/man/dehydrated-hook.1.rst2
-rw-r--r--dehydrated/share/man/dehydrated-nsupdate.1.rst2
-rw-r--r--dehydrated/share/man/man.in2
11 files changed, 62 insertions, 37 deletions
diff --git a/dehydrated/share/hooks/deploy_cert.chrony b/dehydrated/share/hooks/deploy_cert.chrony
index b6744ff..f79d38f 100755
--- a/dehydrated/share/hooks/deploy_cert.chrony
+++ b/dehydrated/share/hooks/deploy_cert.chrony
@@ -2,7 +2,7 @@
# Open Infrastructure: service-tools
-# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+# Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# SPDX-License-Identifier: GPL-3.0+
#
diff --git a/dehydrated/share/hooks/deploy_cert.extra b/dehydrated/share/hooks/deploy_cert.extra
index cd1d3b9..de57c87 100755
--- a/dehydrated/share/hooks/deploy_cert.extra
+++ b/dehydrated/share/hooks/deploy_cert.extra
@@ -2,7 +2,7 @@
# Open Infrastructure: service-tools
-# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+# Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# SPDX-License-Identifier: GPL-3.0+
#
@@ -27,36 +27,62 @@ DIRECTORY="$(dirname "${CERTFILE}")"
if [ "$(grep -c 'BEGIN CERTIFICATE' ${FULLCHAINFILE})" -ge 3 ]
then
- # long chain
- # - chain.pem: R3 | ISRG Root X1
- # - fullchain.pem: Certificate | R3 | ISRG Root X1
- PEMFILE="${CHAINFILE}"
+ # long chain:
+ # * chain.pem: (R3 | ISRG Root X1)
+ # * fullchain.pem: (Certificate | R3 | ISRG Root X1)
+ CHAIN="long"
else
- # short chain
- # - chain.pem: R3
- # - fullchain.pem: Certificate | R3
- PEMFILE="${FULLCHAINFILE}"
+ # short chain:
+ # * chain.pem: (R3)
+ # * fullchain.pem (Certificate | R3)
+ CHAIN="short"
fi
-# root and intermediate CA
-TMPFILE="$(mktemp -p "${DIRECTORY}" -u ca.XXXXXXXXXX)"
-grep -Ev '^$' "${PEMFILE}" | csplit -f "${TMPFILE}" -s -z - '/-----BEGIN CERTIFICATE-----/' '{*}'
+case "${CHAIN}" in
+ long)
+ # split chain.pem
+ TMPFILE="$(mktemp -p "${DIRECTORY}" -u ca.XXXXXXXXXX)"
+ grep -Ev '^$' "${CHAINFILE}" | csplit -f "${TMPFILE}" -s -z - '/-----BEGIN CERTIFICATE-----/' '{*}'
-mv "${TMPFILE}00" "${DIRECTORY}/intermediate-${TIMESTAMP}.pem"
-ln -sf "${DIRECTORY}/intermediate-${TIMESTAMP}.pem" "${DIRECTORY}/intermediate.pem"
+ # intermediate (R3)
+ mv "${TMPFILE}00" "${DIRECTORY}/intermediate-${TIMESTAMP}.pem"
+ ln -sf "intermediate-${TIMESTAMP}.pem" "${DIRECTORY}/intermediate.pem"
-mv "${TMPFILE}01" "${DIRECTORY}/root-${TIMESTAMP}.pem"
-ln -sf "${DIRECTORY}/root-${TIMESTAMP}.pem" "${DIRECTORY}/root.pem"
+ # root (ISRG Root X1)
+ mv "${TMPFILE}01" "${DIRECTORY}/root-${TIMESTAMP}.pem"
+ ln -sf "root-${TIMESTAMP}.pem" "${DIRECTORY}/root.pem"
+ ;;
+
+ short)
+ # intermediate (R3)
+ grep -Ev '^$' "${DIRECTORY}/chain-${TIMESTAMP}.pem" > "${DIRECTORY}/intermediate-${TIMESTAMP}.pem"
+ ln -sf "intermediate-${TIMESTAMP}.pem" "${DIRECTORY}/intermediate.pem"
+
+ # root (ISRG Root X1)
+ ISSUER_URI="$(openssl x509 -in "${DIRECTORY}/chain-${TIMESTAMP}.pem" -text -noout | grep 'Authority Information Access:' -A1 | awk -FURI: '/http/ { print $2 }')"
+
+ if [ -n "${ISSUER_URI}" ]
+ then
+ wget -q "${ISSUER_URI}" -O - | openssl x509 -outform PEM > "${DIRECTORY}/root-${TIMESTAMP}.pem"
+ ln -sf "root-${TIMESTAMP}.pem" "${DIRECTORY}/root.pem"
+ fi
+ ;;
+esac
# extra certificate permutations:
-# * privkey_fullchain.pem: postfix
-for EXTRA in fullchain_privkey privkey_fullchain
+# * privkey_fullchain.pem: postfix
+# * root_intermediate_cert.pem: redis
+
+for EXTRA in fullchain_privkey privkey_fullchain root_intermediate_cert
do
- EXTRA1="$(echo ${EXTRA} | awk -F_ '{ print $1 }')"
- EXTRA2="$(echo ${EXTRA} | awk -F_ '{ print $2 }')"
+ rm -f "${DIRECTORY}/${EXTRA}-${TIMESTAMP}.pem"
+
+ for FILE in $(echo ${EXTRA} | sed -e 's|_| |g')
+ do
+ cat "${DIRECTORY}/${FILE}-${TIMESTAMP}.pem" >> "${DIRECTORY}/${EXTRA}-${TIMESTAMP}.pem"
+ done
- cat "${DIRECTORY}/${EXTRA1}-${TIMESTAMP}.pem" "${DIRECTORY}/${EXTRA2}-${TIMESTAMP}.pem" > "${DIRECTORY}/${EXTRA1}_${EXTRA2}-${TIMESTAMP}.pem"
- ln -sf "${EXTRA1}_${EXTRA2}-${TIMESTAMP}.pem" "${DIRECTORY}/${EXTRA1}_${EXTRA2}.pem"
+ ln -sf "${EXTRA}-${TIMESTAMP}.pem" "${DIRECTORY}/${EXTRA}.pem"
done
echo " done."
diff --git a/dehydrated/share/hooks/deploy_ocsp.extra b/dehydrated/share/hooks/deploy_ocsp.extra
index 35a13f6..6977a7f 100755
--- a/dehydrated/share/hooks/deploy_ocsp.extra
+++ b/dehydrated/share/hooks/deploy_ocsp.extra
@@ -2,7 +2,7 @@
# Open Infrastructure: service-tools
-# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+# Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# SPDX-License-Identifier: GPL-3.0+
#
@@ -26,12 +26,11 @@ echo " + Creating extra ocsp links..."
DIRECTORY="$(dirname "${OCSPFILE}")"
OCSP="$(readlink "${OCSPFILE}")"
-for EXTRA in fullchain_privkey privkey_fullchain
+for EXTRA in fullchain_privkey privkey_fullchain root_intermediate_cert
do
- EXTRA1="$(echo ${EXTRA} | awk -F_ '{ print $1 }')"
- EXTRA2="$(echo ${EXTRA} | awk -F_ '{ print $2 }')"
+ rm -f "${DIRECTORY}/${EXTRA}-${TIMESTAMP}.pem.ocsp"
- ln -sf "${OCSP}" "${DIRECTORY}/${EXTRA1}_${EXTRA2}.pem.ocsp"
+ ln -sf "${OCSP}" "${DIRECTORY}/${EXTRA}.pem.ocsp"
done
echo " done."
diff --git a/dehydrated/share/hooks/exit_hook.extra-cleanup b/dehydrated/share/hooks/exit_hook.extra-cleanup
index 59e203e..6c5ca5d 100755
--- a/dehydrated/share/hooks/exit_hook.extra-cleanup
+++ b/dehydrated/share/hooks/exit_hook.extra-cleanup
@@ -2,7 +2,7 @@
# Open Infrastructure: service-tools
-# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+# Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# SPDX-License-Identifier: GPL-3.0+
#
@@ -23,7 +23,7 @@ set -e
echo -n " + Cleanup extra certificate files..."
-for EXTRA in root intermediate fullchain_privkey privkey_fullchain
+for EXTRA in root intermediate fullchain_privkey privkey_fullchain root_intermediate_cert
do
for CERTIFICATE in "${CERTDIR}"/*/
do
diff --git a/dehydrated/share/hooks/exit_hook.fix-permissions b/dehydrated/share/hooks/exit_hook.fix-permissions
index aa15553..672dd7b 100755
--- a/dehydrated/share/hooks/exit_hook.fix-permissions
+++ b/dehydrated/share/hooks/exit_hook.fix-permissions
@@ -2,7 +2,7 @@
# Open Infrastructure: service-tools
-# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+# Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# SPDX-License-Identifier: GPL-3.0+
#
diff --git a/dehydrated/share/hooks/exit_hook.service-reload b/dehydrated/share/hooks/exit_hook.service-reload
index 6d20eb9..68bc6ec 100755
--- a/dehydrated/share/hooks/exit_hook.service-reload
+++ b/dehydrated/share/hooks/exit_hook.service-reload
@@ -2,7 +2,7 @@
# Open Infrastructure: service-tools
-# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+# Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# SPDX-License-Identifier: GPL-3.0+
#
diff --git a/dehydrated/share/man/Makefile b/dehydrated/share/man/Makefile
index a6d6bf2..001325f 100644
--- a/dehydrated/share/man/Makefile
+++ b/dehydrated/share/man/Makefile
@@ -1,6 +1,6 @@
# Open Infrastructure: service-tools
-# Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+# Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
#
# SPDX-License-Identifier: GPL-3.0+
#
diff --git a/dehydrated/share/man/dehydrated-cron.1.rst b/dehydrated/share/man/dehydrated-cron.1.rst
index cd93a30..e1193ae 100644
--- a/dehydrated/share/man/dehydrated-cron.1.rst
+++ b/dehydrated/share/man/dehydrated-cron.1.rst
@@ -1,6 +1,6 @@
.. Open Infrastructure: service-tools
-.. Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+.. Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
..
.. SPDX-License-Identifier: GPL-3.0+
..
diff --git a/dehydrated/share/man/dehydrated-hook.1.rst b/dehydrated/share/man/dehydrated-hook.1.rst
index de63127..70a1be8 100644
--- a/dehydrated/share/man/dehydrated-hook.1.rst
+++ b/dehydrated/share/man/dehydrated-hook.1.rst
@@ -1,6 +1,6 @@
.. Open Infrastructure: service-tools
-.. Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+.. Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
..
.. SPDX-License-Identifier: GPL-3.0+
..
diff --git a/dehydrated/share/man/dehydrated-nsupdate.1.rst b/dehydrated/share/man/dehydrated-nsupdate.1.rst
index d4b097b..2068b6e 100644
--- a/dehydrated/share/man/dehydrated-nsupdate.1.rst
+++ b/dehydrated/share/man/dehydrated-nsupdate.1.rst
@@ -1,6 +1,6 @@
.. Open Infrastructure: service-tools
-.. Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+.. Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
..
.. SPDX-License-Identifier: GPL-3.0+
..
diff --git a/dehydrated/share/man/man.in b/dehydrated/share/man/man.in
index f95ca67..1eec258 100644
--- a/dehydrated/share/man/man.in
+++ b/dehydrated/share/man/man.in
@@ -1,6 +1,6 @@
.\" Open Infrastructure: service-tools
.\"
-.\" Copyright (C) 2014-2022 Daniel Baumann <daniel.baumann@open-infrastructure.net>
+.\" Copyright (C) 2014-2024 Daniel Baumann <daniel.baumann@open-infrastructure.net>
.\"
.\" SPDX-License-Identifier: GPL-3.0+
.\"
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-03 13:51:42 +0000