Import DoD root certificates into linux CA store

add-dod-certs.sh

#!/bin/bash
# Import DoD root certificates into linux CA store
# Version 0.3.0 updated 20240304
# SPDX-License-Identifier: GPL-3.0-or-later

add_dod_certs() {
    local bundle cert certdir file form tmpdir url update
    # Location of bundle from DISA site
    url='https://public.cyber.mil/pki-pke/pkipke-document-library/'
    bundle=$(curl -s $url | awk -F '"' 'tolower($2) ~ /dod.zip/ {print $2}')
    #bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/unclass-certificates_pkcs7_DoD.zip

    # Set cert directory and update command based on OS
    # shellcheck disable=SC1091
    source /etc/os-release
    if [[ $ID      =~ (fedora|rhel|centos) ||
          $ID_LIKE =~ (fedora|rhel|centos) ]]; then
        certdir=/etc/pki/ca-trust/source/anchors
        update='update-ca-trust'
    elif [[ $ID      =~ (debian|ubuntu|mint) ||
            $ID_LIKE =~ (debian|ubuntu|mint) ]]; then
        certdir=/usr/local/share/ca-certificates
        update='update-ca-certificates'
    else
        certdir=$1
        update=$2
    fi

    if [[ -z $certdir || -z $update ]]; then
        printf 'Unable to autodetect OS using /etc/os-release.\n'
        printf 'Please provide CA certificate directory and update command.\n'
        printf 'Example: %s /cert/store/location update-cmd\n' "${0##*/}"
        exit 1
    fi

    # Extract the bundle
    tmpdir=$(mktemp -d)
    wget -qP "$tmpdir" "$bundle"
    unzip -qj "$tmpdir"/"${bundle##*/}" -d "$tmpdir"

    # Check for existence of PEM or DER format p7b.
    for file in "$tmpdir"/*_dod_{pem,der}.p7b; do
        # Iterate over glob instead of testing directly (SC2144)
        if [[ -f $file ]]; then form=${file%.*}; form=${form##*_}; break; fi
    done

    # Convert the PKCS#7 bundle into individual PEM files
    openssl pkcs7 -print_certs -inform "$form" -in "$file" |
        awk -v d="$tmpdir" 'BEGIN {c=0} /subject=/ {c++} {print > d "/cert." c ".pem"}'

    # Rename the files based on the CA name
    for cert in "$tmpdir"/cert.*.pem; do
        mv "$cert" "$certdir"/"$(openssl x509 -noout -subject -in "$cert" |
            awk -F '(=|= )' '{gsub(/ /, "_", $NF); print $NF}')".crt
    done

    # Remove temp files and update certificate stores
    rm -fr "$tmpdir"
    $update
}

# Only execute if not being sourced
[[ ${BASH_SOURCE[0]} == "$0" ]] && add_dod_certs "$@"

I noticed that a current release, 03NOV2023, of the PKI CA Certificate Bundles: PKCS#7 for DoD PKI Only - Version 5.13 provides a CA certificate bundle that is missing the expected "tmp/*_pem.p7b" file. I have modified my version of your file with the following adjustment to support either case.

    ...
    unzip -qj tmp/${bundle##*/} -d tmp

    # Check for existence of PEM format p7b.
    if [ -f "tmp/*_dod_pem.p7b" ]; then
        echo 'Found PEM formatted file, continuing extraction...'
        certform="PEM"
        certfile="*_dod_pem.p7b"
    else
        echo 'Found DER formatted file, continuing extraction and conversion...'
        certform="DER"
        certfile="*_dod_der.p7b"
    fi

    # Convert the PKCS#7 bundle into individual PEM files
    openssl pkcs7 -inform ${certform} -print_certs -in tmp/${certfile} |
        awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'

    # Rename the files based on the CA name
    ...

@senterfd-jrg Thanks for the update. I coincidentally came across the same issue yesterday morning. Appreciate the fix. Tested locally and successfully imported certificates.

Added the above and retested

#!/bin/bash
# Import DoD root certificates into linux CA store
# https://gist.github.com/AfroThundr3007730/ba99753dda66fc4abaf30fb5c0e5d012

main() {
  # Location of bundle from DISA site
  url='https://public.cyber.mil/pki-pke/pkipke-document-library/'
  bundle=$(curl -s $url | awk -F '"' 'tolower($2) ~ /dod.zip/ {print $2}')
  #bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip

  # Set cert directory and update command based on OS
  source /etc/os-release
  if [[ $ID =~ (fedora|rhel|centos) ||
    $ID_LIKE =~ (fedora|rhel|centos) ]]; then
    certdir=/etc/pki/ca-trust/source/anchors
    update=update-ca-trust
  elif [[ $ID =~ (debian|ubuntu|mint) ||
    $ID_LIKE =~ (debian|ubuntu|mint) ]]; then
    certdir=/usr/local/share/ca-certificates
    update=update-ca-certificates
  else
    certdir=$1
    update=$2
  fi

  [[ -n $certdir && -n $update ]] || {
    echo 'Unable to autodetect OS using /etc/os-release.'
    echo 'Please provide CA certificate directory and update command.'
    echo 'Example: add-dod-certs.sh /cert/store/location update-cmd'
    exit 1
  }

  # Extract the bundle
  cd $certdir
  wget -qP tmp $bundle
  unzip -qj tmp/${bundle##*/} -d tmp

  # Check for existence of PEM format p7b.
  if [ -f "tmp/*_dod_pem.p7b" ]; then
    echo 'Found PEM formatted file, continuing extraction...'
    certform="PEM"
    certfile="*_dod_pem.p7b"
  else
    echo 'Found DER formatted file, continuing extraction and conversion...'
    certform="DER"
    certfile="*_dod_der.p7b"
  fi

  # Convert the PKCS#7 bundle into individual PEM files
  openssl pkcs7 -inform ${certform} -print_certs -in tmp/${certfile} |
    awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'

  # Rename the files based on the CA name
  for i in *.pem; do
    name=$(
      openssl x509 -noout -subject -in $i |
        awk -F '(=|= )' '{gsub(/ /, "_", $NF); print $NF}'
    )
    mv $i ${name}.crt
  done

  # Remove temp files and update certificate stores
  rm -fr tmp
  $update
}

# Only execute if not being sourced
[[ ${BASH_SOURCE[0]} == "$0" ]] && main "$@"

what are the args to this script supposed to be?

It doesn’t need any I don’t think

The script uses $1 and $2, are those not 2 arguments that get passed in?

If I recall those reference the tokens that awk produces. I will double check.

@danielcjacobs if you look in the if/else block, you'll see that those args are supposed to be set to the certdir and whatever shellscript/binary is being used to update all the cert bundles. the gist tries to provide good defaults, but you can also overwrite if you so desire.

Will this run on mac?

@senterfd-jrg Thanks for catching that. I've updated the script to incorporate it (and fix various shellcheck warnings).

@njohbillie I haven't researched how a mac imports trusted certificates. If it works similarly to Linux certificate management, then you could adapt the script to make it work, if not then you may need to look at another tool to do it.