| 5 | | # This script copies a PositiveSSL zip file to the specified server |
| 6 | | # and installs it. |
| 7 | | # |
| 8 | | # Usage ./update-ssl-certificate.sh SERVER_NAME /PATH/TO/CERTIFICATE.ZIP |
| 9 | | # |
| 10 | | # Example ./update-ssl-certificate.sh malcolm /home/ross/malcolm_mayfirst_org.zip |
| 11 | | |
| 12 | | if [[ $# -lt 2 ]] ; then |
| 13 | | echo 'Please supply server name and path to zip file.' |
| 14 | | exit 1 |
| 15 | | fi |
| 16 | | |
| 17 | | # if anything goes wrong, stop |
| 18 | | set -e |
| 19 | | |
| 20 | | echo "Creating /etc/ssl/temp directory..." |
| 21 | | ssh -t root@$1.mayfirst.org "mkdir -p /etc/ssl/temp && rm -rf /etc/ssl/temp/*" |
| 22 | | |
| 23 | | echo "Copying zip file $2" |
| 24 | | scp $2 root@$1.mayfirst.org:/etc/ssl/temp |
| 25 | | |
| 26 | | echo "Unzipping zip file..." |
| 27 | | ssh -t root@$1.mayfirst.org "cd /etc/ssl/temp/ && unzip $1_mayfirst_org.zip -d /etc/ssl/temp" |
| 28 | | |
| 29 | | echo "Building $1.mayfirst.org.crt.new..." |
| 30 | | ssh -t root@$1.mayfirst.org "cat /etc/ssl/temp/COMODORSAAddTrustCA.crt >> /etc/ssl/temp/$1_mayfirst_org.crt && cat /etc/ssl/temp/COMODORSADomainValidationSecureServerCA.crt >> /etc/ssl/temp/$1_mayfirst_org.crt && mv /etc/ssl/temp/$1_mayfirst_org.crt /etc/ssl/$1.mayfirst.org.crt.new" |
| 31 | | |
| 32 | | echo "Creating $1.mayfirst.org.pem.new" |
| 33 | | ssh -t root@$1.mayfirst.org "cd /etc/ssl/private && umask 177; cat $1.mayfirst.org.safe.key >> $1.mayfirst.org.pem.new && cat ../$1.mayfirst.org.crt.new >> $1.mayfirst.org.pem.new; umask 133" |
| 34 | | |
| 35 | | # Use this line for brand new servers |
| 36 | | # ssh -t root@$1.mayfirst.org "cd /etc/ssl/private && umask 177; cat $1.mayfirst.org.key.uncertified >> $1.mayfirst.org.pem.new && cat ../$1.mayfirst.org.crt.new >> $1.mayfirst.org.pem.new; umask 133" |
| 37 | | |
| 38 | | echo "Moving new files into place..." |
| 39 | | # ssh -t root@$1.mayfirst.org "mv /etc/ssl/$1.mayfirst.org.crt{,.old} && mv /etc/ssl/$1.mayfirst.org.crt{.new,} && mv /etc/ssl/private/$1.mayfirst.org.pem{,.old} && mv /etc/ssl/private/$1.mayfirst.org.pem{.new,} && [[ -a /etc/ssl/private/$1.mayfirst.org.key ]] && mv /etc/ssl/private/$1.mayfirst.org.key{,.old} || echo 'No old key to move' && mv /etc/ssl/private/$1.mayfirst.org.safe.key /etc/ssl/private/$1.mayfirst.org.key && /usr/local/sbin/freepuppet-run" |
| 40 | | |
| 41 | | # a variation on the line above, which attempts to cope with missing files |
| 42 | | ssh -t root@$1.mayfirst.org "(test ! -f /etc/ssl/$1.mayfirst.org.crt || \ |
| 43 | | mv -v /etc/ssl/$1.mayfirst.org.crt{,.old}) && \ |
| 44 | | mv -v /etc/ssl/$1.mayfirst.org.crt{.new,} && \ |
| 45 | | (test ! -f /etc/ssl/private/$1.mayfirst.org.pem || \ |
| 46 | | mv -v /etc/ssl/private/$1.mayfirst.org.pem{,.old}) && \ |
| 47 | | mv -v /etc/ssl/private/$1.mayfirst.org.pem{.new,} && \ |
| 48 | | (test ! -f /etc/ssl/private/$1.mayfirst.org.key || \ |
| 49 | | mv -v /etc/ssl/private/$1.mayfirst.org.key{,.old}) && \ |
| 50 | | mv -v /etc/ssl/private/$1.mayfirst.org.safe.key \ |
| 51 | | /etc/ssl/private/$1.mayfirst.org.key && \ |
| 52 | | /usr/local/sbin/freepuppet-run" |
| 53 | | |
| 54 | | |
| 55 | | # Use this line for brand new servers |
| 56 | | # ssh -t root@$1.mayfirst.org "mv /etc/ssl/$1.mayfirst.org.crt{,.old} && mv /etc/ssl/$1.mayfirst.org.crt{.new,} && mv /etc/ssl/private/$1.mayfirst.org.pem{,.old} && mv /etc/ssl/private/$1.mayfirst.org.pem{.new,} && /usr/local/sbin/freepuppet-run" |
| 57 | | |
| 58 | | echo "Restarting services..." |
| 59 | | ssh -t root@$1.mayfirst.org "service apache2 restart && service courier-imap-ssl restart && service courier-pop-ssl restart && service postfix restart" |
| 60 | | |
| 61 | | echo "Verifying $1.mayfirst.org.pem file..." |
| 62 | | |
| 63 | | a=$(echo "LOGOUT" | gnutls-cli -V --port imaps $1.mayfirst.org | grep "Handshake was completed") |
| 64 | | echo "$a"; |
| 65 | | if [ "$a" = "- Handshake was completed" ]; |
| 66 | | then |
| 67 | | echo "Cleaning up.." |
| 68 | | echo "Removing /etc/ssl/temp directory and old files..." |
| 69 | | ssh -t root@$1.mayfirst.org "rm -rf /etc/ssl/temp/ && rm -f /etc/ssl/*.old && rm -f /etc/ssl/private/*.old" |
| 70 | | |
| 71 | | else |
| 72 | | |
| 73 | | printf "**** Something has gone wrong, please check the server. ****\n\n" |
| 74 | | printf "Try running \n\n" |
| 75 | | printf "gnutls-cli -V --port imaps $1.mayfirst.org\n\n" |
| 76 | | printf "for additional information.\n" |
| 77 | | fi |
| 78 | | }}} |
| | 3 | Please see the [wiki:configure-mosh-x509 new instructions for updating x509 certificates]. |
