From cab731a71cba0b0e088926847c25388142961ccd Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Tue, 7 Mar 2023 14:21:03 +0100 Subject: Adding preferred chain compatibility in deploy_cert.extra dehydrated hook. Signed-off-by: Daniel Baumann --- dehydrated/share/hooks/.deploy_cert.extra.swp | Bin 0 -> 12288 bytes dehydrated/share/hooks/deploy_cert.extra | 15 ++++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 dehydrated/share/hooks/.deploy_cert.extra.swp diff --git a/dehydrated/share/hooks/.deploy_cert.extra.swp b/dehydrated/share/hooks/.deploy_cert.extra.swp new file mode 100644 index 0000000..3a22538 Binary files /dev/null and b/dehydrated/share/hooks/.deploy_cert.extra.swp differ diff --git a/dehydrated/share/hooks/deploy_cert.extra b/dehydrated/share/hooks/deploy_cert.extra index 56ca2f4..cd1d3b9 100755 --- a/dehydrated/share/hooks/deploy_cert.extra +++ b/dehydrated/share/hooks/deploy_cert.extra @@ -25,9 +25,22 @@ echo -n " + Creating extra certificate files..." DIRECTORY="$(dirname "${CERTFILE}")" +if [ "$(grep -c 'BEGIN CERTIFICATE' ${FULLCHAINFILE})" -ge 3 ] +then + # long chain + # - chain.pem: R3 | ISRG Root X1 + # - fullchain.pem: Certificate | R3 | ISRG Root X1 + PEMFILE="${CHAINFILE}" +else + # short chain + # - chain.pem: R3 + # - fullchain.pem: Certificate | R3 + PEMFILE="${FULLCHAINFILE}" +fi + # root and intermediate CA TMPFILE="$(mktemp -p "${DIRECTORY}" -u ca.XXXXXXXXXX)" -grep -Ev '^$' "${CHAINFILE}" | csplit -f "${TMPFILE}" -s -z - '/-----BEGIN CERTIFICATE-----/' '{*}' +grep -Ev '^$' "${PEMFILE}" | csplit -f "${TMPFILE}" -s -z - '/-----BEGIN CERTIFICATE-----/' '{*}' mv "${TMPFILE}00" "${DIRECTORY}/intermediate-${TIMESTAMP}.pem" ln -sf "${DIRECTORY}/intermediate-${TIMESTAMP}.pem" "${DIRECTORY}/intermediate.pem" -- cgit v1.2.3