Changes between Version 3 and Version 4 of support-team/update-ssl-certificate

Timestamp:

Aug 15, 2016, 9:28:05 AM (3 years ago)

Author:

Jamie McClelland

Comment:

--

support-team/update-ssl-certificate

@@ -1 +1 @@
 == Script for updating server ssls ==
-{{{
-#!/bin/bash
 
-# This script copies a PositiveSSL zip file to the specified server
-# and installs it.
-#
-# Usage ./update-ssl-certificate.sh SERVER_NAME /PATH/TO/CERTIFICATE.ZIP
-#
-# Example ./update-ssl-certificate.sh malcolm /home/ross/malcolm_mayfirst_org.zip
-
-if [[ $# -lt 2 ]] ; then
-    echo 'Please supply server name and path to zip file.'
-    exit 1
-fi
-
-# if anything goes wrong, stop
-set -e
-
-echo "Creating /etc/ssl/temp directory..."
-ssh -t root@$1.mayfirst.org "mkdir -p /etc/ssl/temp && rm -rf /etc/ssl/temp/*"
-
-echo "Copying zip file $2"
-scp $2 root@$1.mayfirst.org:/etc/ssl/temp
-
-echo "Unzipping zip file..."
-ssh -t root@$1.mayfirst.org "cd /etc/ssl/temp/ && unzip $1_mayfirst_org.zip -d /etc/ssl/temp"
-
-echo "Building $1.mayfirst.org.crt.new..."
-ssh -t root@$1.mayfirst.org "cat /etc/ssl/temp/COMODORSAAddTrustCA.crt >> /etc/ssl/temp/$1_mayfirst_org.crt && cat /etc/ssl/temp/COMODORSADomainValidationSecureServerCA.crt >> /etc/ssl/temp/$1_mayfirst_org.crt && mv /etc/ssl/temp/$1_mayfirst_org.crt /etc/ssl/$1.mayfirst.org.crt.new"
-
-echo "Creating $1.mayfirst.org.pem.new"
-ssh -t root@$1.mayfirst.org  "cd /etc/ssl/private && umask 177; cat $1.mayfirst.org.safe.key >> $1.mayfirst.org.pem.new && cat ../$1.mayfirst.org.crt.new >> $1.mayfirst.org.pem.new; umask 133"
-
-# Use this line for brand new servers
-# ssh -t root@$1.mayfirst.org  "cd /etc/ssl/private && umask 177; cat $1.mayfirst.org.key.uncertified >> $1.mayfirst.org.pem.new && cat ../$1.mayfirst.org.crt.new >> $1.mayfirst.org.pem.new; umask 133"
-
-echo "Moving new files into place..."
-# ssh -t root@$1.mayfirst.org "mv /etc/ssl/$1.mayfirst.org.crt{,.old} && mv /etc/ssl/$1.mayfirst.org.crt{.new,} && mv /etc/ssl/private/$1.mayfirst.org.pem{,.old} && mv /etc/ssl/private/$1.mayfirst.org.pem{.new,} && [[ -a /etc/ssl/private/$1.mayfirst.org.key ]] && mv /etc/ssl/private/$1.mayfirst.org.key{,.old} || echo 'No old key to move' && mv /etc/ssl/private/$1.mayfirst.org.safe.key /etc/ssl/private/$1.mayfirst.org.key && /usr/local/sbin/freepuppet-run"
-
-# a variation on the line above, which attempts to cope with missing files
-ssh -t root@$1.mayfirst.org "(test ! -f /etc/ssl/$1.mayfirst.org.crt || \
-       mv -v /etc/ssl/$1.mayfirst.org.crt{,.old}) && \
-  mv -v /etc/ssl/$1.mayfirst.org.crt{.new,} && \
-  (test ! -f /etc/ssl/private/$1.mayfirst.org.pem || \
-       mv -v /etc/ssl/private/$1.mayfirst.org.pem{,.old}) && \
-  mv -v /etc/ssl/private/$1.mayfirst.org.pem{.new,} && \
-  (test ! -f /etc/ssl/private/$1.mayfirst.org.key || \
-       mv -v /etc/ssl/private/$1.mayfirst.org.key{,.old}) && \
-  mv -v /etc/ssl/private/$1.mayfirst.org.safe.key \
-     /etc/ssl/private/$1.mayfirst.org.key && \
-  /usr/local/sbin/freepuppet-run"
-
-
-# Use this line for brand new servers
-# ssh -t root@$1.mayfirst.org "mv /etc/ssl/$1.mayfirst.org.crt{,.old} && mv /etc/ssl/$1.mayfirst.org.crt{.new,} && mv /etc/ssl/private/$1.mayfirst.org.pem{,.old} && mv /etc/ssl/private/$1.mayfirst.org.pem{.new,} && /usr/local/sbin/freepuppet-run"
-
-echo "Restarting services..."
-ssh -t root@$1.mayfirst.org "service apache2 restart && service courier-imap-ssl restart && service courier-pop-ssl restart && service postfix restart"
-
-echo "Verifying $1.mayfirst.org.pem file..."
-
-a=$(echo "LOGOUT" | gnutls-cli -V --port imaps $1.mayfirst.org | grep "Handshake was completed")
-echo "$a";
-if [ "$a" = "- Handshake was completed" ];
-then
-    echo "Cleaning up.."
-    echo "Removing /etc/ssl/temp directory and old files..."
-    ssh -t root@$1.mayfirst.org "rm -rf /etc/ssl/temp/ && rm -f /etc/ssl/*.old && rm -f /etc/ssl/private/*.old"
-    
-else
-
-    printf "**** Something has gone wrong, please check the server. ****\n\n"
-    printf "Try running \n\n"
-    printf "gnutls-cli -V --port imaps $1.mayfirst.org\n\n"
-    printf "for additional information.\n"
-fi
-}}}
+Please see the [wiki:configure-mosh-x509 new instructions for updating x509 certificates].