Changes between Version 3 and Version 4 of support-team/update-ssl-certificate


Ignore:
Timestamp:
Aug 15, 2016, 9:28:05 AM (3 years ago)
Author:
Jamie McClelland
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • support-team/update-ssl-certificate

    v3 v4  
    11== Script for updating server ssls ==
    2 {{{
    3 #!/bin/bash
    42
    5 # This script copies a PositiveSSL zip file to the specified server
    6 # and installs it.
    7 #
    8 # Usage ./update-ssl-certificate.sh SERVER_NAME /PATH/TO/CERTIFICATE.ZIP
    9 #
    10 # Example ./update-ssl-certificate.sh malcolm /home/ross/malcolm_mayfirst_org.zip
    11 
    12 if [[ $# -lt 2 ]] ; then
    13     echo 'Please supply server name and path to zip file.'
    14     exit 1
    15 fi
    16 
    17 # if anything goes wrong, stop
    18 set -e
    19 
    20 echo "Creating /etc/ssl/temp directory..."
    21 ssh -t root@$1.mayfirst.org "mkdir -p /etc/ssl/temp && rm -rf /etc/ssl/temp/*"
    22 
    23 echo "Copying zip file $2"
    24 scp $2 root@$1.mayfirst.org:/etc/ssl/temp
    25 
    26 echo "Unzipping zip file..."
    27 ssh -t root@$1.mayfirst.org "cd /etc/ssl/temp/ && unzip $1_mayfirst_org.zip -d /etc/ssl/temp"
    28 
    29 echo "Building $1.mayfirst.org.crt.new..."
    30 ssh -t root@$1.mayfirst.org "cat /etc/ssl/temp/COMODORSAAddTrustCA.crt >> /etc/ssl/temp/$1_mayfirst_org.crt && cat /etc/ssl/temp/COMODORSADomainValidationSecureServerCA.crt >> /etc/ssl/temp/$1_mayfirst_org.crt && mv /etc/ssl/temp/$1_mayfirst_org.crt /etc/ssl/$1.mayfirst.org.crt.new"
    31 
    32 echo "Creating $1.mayfirst.org.pem.new"
    33 ssh -t root@$1.mayfirst.org  "cd /etc/ssl/private && umask 177; cat $1.mayfirst.org.safe.key >> $1.mayfirst.org.pem.new && cat ../$1.mayfirst.org.crt.new >> $1.mayfirst.org.pem.new; umask 133"
    34 
    35 # Use this line for brand new servers
    36 # ssh -t root@$1.mayfirst.org  "cd /etc/ssl/private && umask 177; cat $1.mayfirst.org.key.uncertified >> $1.mayfirst.org.pem.new && cat ../$1.mayfirst.org.crt.new >> $1.mayfirst.org.pem.new; umask 133"
    37 
    38 echo "Moving new files into place..."
    39 # ssh -t root@$1.mayfirst.org "mv /etc/ssl/$1.mayfirst.org.crt{,.old} && mv /etc/ssl/$1.mayfirst.org.crt{.new,} && mv /etc/ssl/private/$1.mayfirst.org.pem{,.old} && mv /etc/ssl/private/$1.mayfirst.org.pem{.new,} && [[ -a /etc/ssl/private/$1.mayfirst.org.key ]] && mv /etc/ssl/private/$1.mayfirst.org.key{,.old} || echo 'No old key to move' && mv /etc/ssl/private/$1.mayfirst.org.safe.key /etc/ssl/private/$1.mayfirst.org.key && /usr/local/sbin/freepuppet-run"
    40 
    41 # a variation on the line above, which attempts to cope with missing files
    42 ssh -t root@$1.mayfirst.org "(test ! -f /etc/ssl/$1.mayfirst.org.crt || \
    43        mv -v /etc/ssl/$1.mayfirst.org.crt{,.old}) && \
    44   mv -v /etc/ssl/$1.mayfirst.org.crt{.new,} && \
    45   (test ! -f /etc/ssl/private/$1.mayfirst.org.pem || \
    46        mv -v /etc/ssl/private/$1.mayfirst.org.pem{,.old}) && \
    47   mv -v /etc/ssl/private/$1.mayfirst.org.pem{.new,} && \
    48   (test ! -f /etc/ssl/private/$1.mayfirst.org.key || \
    49        mv -v /etc/ssl/private/$1.mayfirst.org.key{,.old}) && \
    50   mv -v /etc/ssl/private/$1.mayfirst.org.safe.key \
    51      /etc/ssl/private/$1.mayfirst.org.key && \
    52   /usr/local/sbin/freepuppet-run"
    53 
    54 
    55 # Use this line for brand new servers
    56 # ssh -t root@$1.mayfirst.org "mv /etc/ssl/$1.mayfirst.org.crt{,.old} && mv /etc/ssl/$1.mayfirst.org.crt{.new,} && mv /etc/ssl/private/$1.mayfirst.org.pem{,.old} && mv /etc/ssl/private/$1.mayfirst.org.pem{.new,} && /usr/local/sbin/freepuppet-run"
    57 
    58 echo "Restarting services..."
    59 ssh -t root@$1.mayfirst.org "service apache2 restart && service courier-imap-ssl restart && service courier-pop-ssl restart && service postfix restart"
    60 
    61 echo "Verifying $1.mayfirst.org.pem file..."
    62 
    63 a=$(echo "LOGOUT" | gnutls-cli -V --port imaps $1.mayfirst.org | grep "Handshake was completed")
    64 echo "$a";
    65 if [ "$a" = "- Handshake was completed" ];
    66 then
    67     echo "Cleaning up.."
    68     echo "Removing /etc/ssl/temp directory and old files..."
    69     ssh -t root@$1.mayfirst.org "rm -rf /etc/ssl/temp/ && rm -f /etc/ssl/*.old && rm -f /etc/ssl/private/*.old"
    70    
    71 else
    72 
    73     printf "**** Something has gone wrong, please check the server. ****\n\n"
    74     printf "Try running \n\n"
    75     printf "gnutls-cli -V --port imaps $1.mayfirst.org\n\n"
    76     printf "for additional information.\n"
    77 fi
    78 }}}
     3Please see the [wiki:configure-mosh-x509 new instructions for updating x509 certificates].