|
|
#!/bin/bash
# OpenSLX SSL Certificate management
if ! mkdir "/run/openslx-cert-manager"; then
echo "Already in progress."
exit 1
fi
trap 'rm -rf -- /run/openslx-cert-manager' EXIT
declare -rg BASE="/etc/ssl/openslx"
declare -rg PRIV="$BASE/private"
declare -rg CERT="$BASE/cert"
declare -rg LIGHT="$BASE/lighttpd"
mkdir -p "$BASE" "$PRIV" "$CERT"
chown -R root:root "$BASE" || exit 1
chmod u+rwx,go+rx-w "$BASE" "$CERT" || exit 1
chmod u+rwx,go-rwx "$PRIV" || exit 1
# Before doing anything, make sure we have a CA with enough validity left
# File name format for ca is:
# ${PRIV}/ca-FFFFFFFFFF-TTTTTTTTTT.key
# ${CERT}/ca-TTTTTTTTTT.crt
# Where TT is the unix timestamp of "validTo" of that cert
# And FF is the unix timestamp of when we should starting using a CA to
# sign our certificates. This is for a grace period between CA certs.
# We deliver a new CA certificate immediately when it was generated, but
# only start signing server certificates with it after a grace period of
# 180 days. Any client that rebooted within those 180 days will not run
# into any certificate issues, but if you wanted to cover that case too
# you could make it so the client re-downloads trusted CA-certs every
# couple days.
declare -rg NOW="$( date +%s )"
# PROD
declare -rg ca_days="$(( 10 * 365 ))" # 10y
declare -rg ca_min_remain_s="$(( 400 * 86400 ))" # bit more than 1y
declare -rg ca_new_expire_ts="$(( ca_days * 86400 + NOW ))"
declare -rg srv_days=365 # 1y
declare -rg srv_min_remain_s="$(( 180 * 86400 ))" # half a year
declare -rg srv_new_ts="$(( srv_days * 86400 + NOW ))"
# TEST
#declare -rg ca_days=1825 # 5y
#declare -rg ca_min_remain_s="$(( 1260 ))" # bit more than 1y
#declare -rg ca_new_expire_ts="$(( 1320 + NOW ))"
#declare -rg srv_days=365 # 1y
#declare -rg srv_min_remain_s="$(( 1200 ))" # half a year
#declare -rg srv_new_ts="$(( 1230 + NOW ))"
get_ts () {
ts="${1%.*}"
ts="${ts##*/ca-}"
ts="${ts##*/srv-}"
from="${ts%-*}"
if [ "$from" = "$ts" ]; then
from=
else
ts="${ts#*-}"
fi
}
create_conf () {
ca_dir="$( mktemp -d /tmp/bwlp-XXXXXXXX )"
[ -z "$ca_dir" ] && exit 1
mkdir "$ca_dir"/{certs,crl,newcerts,private}
touch "$ca_dir"/index.txt
ca_config="$ca_dir/openssl.cnf"
cp -f "/etc/ssl/openssl.cnf" "$ca_config"
cat >> "$ca_config" <<-MYCA
[ CA_openslx ]
dir = $ca_dir
certs = \$dir/certs
crl_dir = \$dir/crl
database = \$dir/index.txt
new_certs_dir = \$dir/newcerts
serial = \$dir/serial
crl = \$dir/crl.pem
x509_extensions = usr_cert
name_opt = ca_default
cert_opt = ca_default
default_md = default
preserve = no
policy = policy_match
MYCA
}
latest_ca_file=
ca_last=
for i in "${PRIV}"/ca-??????????.key; do
[ -s "$i" ] || continue
get_ts "$i"
if ! [ -s "${CERT}/ca-${ts}.crt" ] \
|| ! [ -s "${CERT}/intermediate-${ts}.crt" ] \
|| ! [ -s "${PRIV}/intermediate.key" ] \
|| (( ts < NOW )); then
# Missing cert, or expired -> delete
rm -f -- "${CERT}/ca-${ts}.crt" "${PRIV}/ca-${ts}.key" "${CERT}/intermediate-${ts}.crt"
continue
fi
ca_last="$ts"
latest_ca_file="${CERT}/ca-${ts}.crt"
done
mknew=
if [ -z "$ca_last" ] || (( NOW + ca_min_remain_s > ca_last )); then
# Make new CA
echo "Creating new CA..."
openssl req -new -newkey rsa:4096 -x509 -days "$ca_days" -extensions v3_ca \
-nodes -subj "/C=DE/ST=PewPew/L=HeyHey/O=bwLehrpool/CN=ca-${NOW}.bwlehrpool" \
-keyout "${PRIV}/ca-${ca_new_expire_ts}.key" -out "${CERT}/ca-${ca_new_expire_ts}.crt" || exit 2
mknew=1
#
# Create new intermediate, sign with all CAs
csr="$( mktemp /tmp/bwlp-XXXXXXX.csr )"
# Create request, CA:TRUE
echo "Generate intermediate key+CSR..."
[ -s "${PRIV}/intermediate.key" ] || openssl genrsa -out "${PRIV}/intermediate.key" 4096
openssl req -new -key "${PRIV}/intermediate.key" \
-nodes -subj "/C=DE/ST=PewPew/L=HeyHey/O=bwLehrpool/CN=intermediate.bwlehrpool" \
-out "$csr" || exit 2
create_conf
# Sign request, CA:TRUE
echo "Sign new intermediate key with CA..."
openssl ca -config "$ca_config" -extensions v3_ca -create_serial \
-policy policy_anything -days "$ca_days" \
-cert "${CERT}/ca-${ca_new_expire_ts}.crt" -keyfile "${PRIV}/ca-${ca_new_expire_ts}.key" \
-notext -name CA_openslx -batch -out "${CERT}/intermediate-${ca_new_expire_ts}.crt" -in "$csr" || exit 2
rm -rf -- "$ca_dir" "$csr"
fi
if [ -n "$mknew" ] || ! [ -s "/opt/openslx/configs/modules/self-signed-ca.tar" ] \
|| [ "/opt/openslx/configs/modules/self-signed-ca.tar" -ot "$latest_ca_file" ]; then
# Rebuild config module for clients
echo "Updating client config module..."
(
tmpdir="$( mktemp -d '/tmp/bwlp-XXXXXXX' )"
cp -a "${CERT}/"ca-*.crt "$tmpdir/"
cd "$tmpdir/" || exit 6
openssl rehash .
tar -c -k -f "/opt/openslx/configs/modules/self-signed-ca.tar" \
--transform 's#^[./][./]*#/opt/openslx/ssl/#' .
cd /tmp || exit 7
rm -rf -- "$tmpdir"
sudo -u www-data -n php /srv/openslx/www/slx-admin/api.php sysconfig --action rebuild
echo "."
)
fi
# Now check the server certificate
declare -a srv_list
srv_list=()
for i in "${PRIV}"/srv-??????????.key; do
[ -s "$i" ] || continue
get_ts "$i"
if (( ts < NOW )) || ! [ -s "${CERT}/srv-${ts}.crt" ]; then
rm -f -- "$i" "${CERT}/srv-${ts}.crt"
continue
fi
srv_list+=( "$ts" )
done
if [ -n "$mknew" ] || [ "${#srv_list[@]}" = 0 ] \
|| [ "$(( NOW + srv_min_remain_s ))" -gt "${srv_list[-1]}" ]; then
# Request ServerCert
csr="$( mktemp /tmp/bwlp-XXXXXXX.csr )"
echo "Generating new Server Certificate. Key+CSR..."
rm -f -- "${CERT}"/srv-*.crt "${PRIV}/srv.key.tmp" "${PRIV}"/srv-*.key
openssl req -new -nodes -keyout "${PRIV}/srv.key.tmp" -out "$csr" \
-subj "/C=DE/ST=PewPew/L=HeyHey/O=bwLehrpool/CN=satellite.bwlehrpool" || exit 4
echo "Signing Server Certificate with intermediate..."
declare -a in_list
in_list=()
for i in "${CERT}"/intermediate-??????????.crt; do
[ -s "$i" ] || continue
get_ts "$i"
if (( ts < NOW )); then
echo "Expired intermediate $i"
rm -f -- "$i"
continue
fi
echo "Have intermediate $i"
in_list+=( "$i" )
done
if [ "${#in_list[@]}" = 0 ]; then
echo "ERROR: Have no intermediate certificate"
exit 11
fi
for in_cert in "${in_list[@]}"; do
get_ts "$in_cert"
(( ts < 30 * 86400 + NOW )) && continue # Expiring in a month, ignore
break # Need only one really
done
echo "Signing with $in_cert"
create_conf
# Need extfile for SAN, chromium doesn't honor CN anymore
cat > "${csr}.cnf" <<-END
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = satellite.bwlehrpool
END
openssl ca -config "$ca_config" -create_serial -policy policy_anything -days "$srv_days" \
-cert "$in_cert" -keyfile "${PRIV}/intermediate.key" -extfile "${csr}.cnf" \
-notext -name CA_openslx -batch -out "${CERT}/srv-${srv_new_ts}.crt" -in "$csr" || exit 4
rm -rf -- "$ca_dir"
rm -f -- "$csr" "${csr}.cnf"
mv "${PRIV}/srv.key.tmp" "${PRIV}/srv-${srv_new_ts}.key" || exit 5
srv_list+=( "$srv_new_ts" )
# Combine and prepare for lighttpd
mkdir -p "$LIGHT" || exit 10
# Combine cert and key, as required by lighttpd
echo "Writing out lighttpd PEMs..."
cat "${CERT}/srv-${srv_new_ts}.crt" "${PRIV}/srv-${srv_new_ts}.key" > "${LIGHT}/server.pem" || exit 10
chmod 0600 "${LIGHT}/server.pem"
# Create ca-chain
cat "${in_list[@]}" > "${LIGHT}/ca-chain.pem"
if [ "$1" = "--restart" ] || [ -t 0 ]; then
echo "Restarting lighttpd..."
systemctl restart lighttpd.service
fi
fi
echo "Done."
exit 0
|
