QNimbus · May 30, 2020 20:46
diff --git a/deploy_freenas.sh b/deploy_freenas.sh
 #!/usr/bin/env bash
 ##
 ## Title:                     deploy_freenas.sh
 ## Description:               Script to deploy uploaded certificates for use with VMWare ESXi
 ## Author:                    B. van wetten
 ## Created date:              28-01-2020
 ## Updated date:              12-02-2020
 ## Version:                   0.3
 ## GitHub Gist:               https://gist.github.com/QNimbus/08dd3a44cddfc7b8ffc22aad1f012645
 ##
 ## Usage:                     deploy_freenas.sh
 ## Notes:                     For remote use (e.g. SSH) use the following command as example:
 ##                            cat fullchain.cer /var/etc/acme-client/home/lan.besqua.red/lan.besqua.red.key | ssh -oStrictHostKeyChecking=no -T -i <keyfile> data-admin@<freenas host>
 ##
 ##                            You can use this in your 'authorized_keys' file to run this command remotely:
 ##                            command="/bin/cat | /usr/bin/xargs -0 -r -J % /mnt/storage/scripts/certs/deploy_freenas.sh -u <username> -p '<password>' -n <certname> -c % --",no-pty,from="1.2.3.4/32" ssh-rsa <public-key-here>== data-admin

 # Shell utilities
 RM=$(which rm); [[ $? != 0 ]] && echo "Command 'rm' not found" >&2 && exit 1
 CP=$(which cp); [[ $? != 0 ]] && echo "Command 'cp' not found" >&2 && exit 1
 MV=$(which mv); [[ $? != 0 ]] && echo "Command 'mv' not found" >&2 && exit 1
 JQ=$(which jq); [[ $? != 0 ]] && echo "Command 'jq' not found" >&2 && exit 1
 FIND=$(which find); [[ $? != 0 ]] && echo "Command 'find' not found" >&2 && exit 1
 CURL=$(which curl); [[ $? != 0 ]] && echo "Command 'curl' not found" >&2 && exit 1
 XARGS=$(which xargs); [[ $? != 0 ]] && echo "Command 'xargs' not found" >&2 && exit 1
 PYTHON=$(which python); [[ $? != 0 ]] && echo "Command 'python' not found" >&2 && exit 1
 OPENSSL=$(which openssl); [[ $? != 0 ]] && echo "Command 'openssl' not found" >&2 && exit 1
 GETOPT=$(which getopt); [[ $? != 0 ]] && echo "Command 'getopt' not found" >&2 && exit 1

 # Initialize variables
 _PWD="/mnt/storage/scripts/certs"
 _ME=$(basename "${0}")
 _TMPFILE="tmp-${$}-${RANDOM}"

 # Option strings
 SHORT=hu:p:n:
 LONG=help,username:,password:,name:

 ##########################################################################
 # Init                                                                   #
 ##########################################################################

 # Cleanup any temp files after script execution (traps signals: 0, 1, 2, 15)
 trap '${FIND} . -maxdepth 1 -name "${_TMPFILE}*" -type f -print0 | ${XARGS} -I % -0 rm %' INT TERM HUP EXIT

 # Read certificate from command line and remove from positional arguments
 for((i=1; i<=$#; i++))
 do
   _cur=$i
   _next=$(expr $i + 1)

   _param=${!_cur}
   _next_param=${!_next:-}

   if [[ "${_param}" =~ (^-c$) && ! -z "${_next_param}" ]]
   then
      echo -en "${_next_param}" > "${_TMPFILE}.pem"
      set -- "${@:1:_cur-1}" "${@:_cur+2}"
   fi
 done

 # Get command line arguments
 if [[ "${#}" -gt 0 ]]
 then
  getopt -T > /dev/null
  if [ $? -eq 4 ]; then
    # GNU enhanced getopt is available
    _ARGS=$(${GETOPT} --name "$_ME" --long ${LONG} --options ${SHORT} -- "$@")
  else
    # Original getopt is available (no long option names, no whitespace, no sorting)
    _ARGS=$(${GETOPT} ${SHORT} "$@")
  fi
  if [ $? -ne 0 ]; then
    echo "$_ME: usage error (use -h for help)" >&2
    exit 2
  fi
 fi

 ###############################################################################
 # Functions                                                                   #
 ###############################################################################

 # _print_usage()
 #
 # Usage:
 #   _print_usage
 #
 # Print the program usage information.
 _print_usage() {
   cat <<HEREDOC
 ___  ____ ___  _    ____ _   _     ____ ____ ____ ____ _  _ ____ ____ 
 |  \ |___ |__] |    |  |  \_/      |___ |__/ |___ |___ |\ | |__| [__  
 |__/ |___ |    |___ |__|   |   ___ |    |  \ |___ |___ | \| |  | ___]
                                                      
 Usage:
  ${_ME} -u username -p password -n name -c file
  ${_ME} -h

 Options:  
  -h      Show this screen
  -n      Certificate name
  -c      Certificate file
  -u      FreeNAS API access username 
  -p      FreeNAS API access password

 HEREDOC
   exit ${1:-0}
 }

 # _json_escape()
 #
 # Usage:
 #   _json_escape variable value
 #
 # Escape a JSON object (e.g. for use with 'curl')
 _json_escape () {
    printf '%s' "$1" | ${PYTHON} -c 'import json,sys; print(json.dumps(sys.stdin.read()))'
 }

 # _set_variable()
 #
 # Usage:
 #   _set_variable variable value
 #
 # Sets the variable to a value if not already set. Otherwise exits with an error message
 _set_variable()
 {
   local varname="$1"
   shift
   if [ -z "${!varname:-}" ]; then
      # eval="${varname}=${@@Q}"
      eval "$varname=\"$@\""
   else
      echo "Error: $varname already set"
      usage
   fi
 }

 # _parse_commandline_arguments()
 #
 # Usage:
 #   _parse_commandline_arguments
 #
 # Parses and validates commandline arguments and populates appropriate variables.
 _parse_commandline_arguments()
 {
   while true;
   do
      case "${1:-}" in
         -u|--username)
            [[ -z "${2}" || "${2}" == *[[:space:]]* || "${2}" == -* ]] && { echo "$_ME: $1 needs a value" >&2; _print_usage 1; }
            _set_variable USERNAME "${2}"
            shift 2
            ;;
         -p|--password)
            [[ -z "${2}" || "${2}" == *[[:space:]]* || "${2}" == -* ]] && { echo "$_ME: $1 needs a value" >&2; _print_usage 1; }
            _set_variable PASSWORD "${2}"
            shift 2
            ;;
         -n|--name)
            [[ -z "${2}" || "${2}" == *[[:space:]]* || "${2}" == -* ]] && { echo "$_ME: $1 needs a value" >&2; _print_usage 1; }
            _set_variable CERT_NAME "${2}"
            shift 2
            ;;
         \?) echo "$_ME: Unknown option -$1" >&2; 
            exit 1
            ;;
         :) echo "$_ME: -$1 needs a value" >&2; 
            exit 1 
            ;;
         *) shift
            break
            ;;
      esac
   done
 }

 # _validate_parameters()
 #
 # Usage:
 #   _validate_parameters
 #
 # Performs several checks on the supplied command line arguments
 _validate_parameters() {
  # Check if $USERNAME and $PASSWORD are set and not empty
  [[ -z "${USERNAME:-}" || -z "${PASSWORD:-}" ]] && echo -e "$_ME: Username and password are required\n" && _print_usage 1;

  # Check certificates
  [[ ! -f "${_TMPFILE}.pem" || ! $(${OPENSSL} rsa -in "${_TMPFILE}.pem" -check 2> /dev/null) ]] && echo -e "$_ME: Invalid or no certificate supplied\n" && _print_usage 1;

  # Check if $USERNAME and $PASSWORD are set and not empty
  [[ -z "${CERT_NAME:-}" ]] && echo -e "$_ME: Certificate name is required\n" && _print_usage 1;
 }

 ###############################################################################
 # Main                                                                        #
 ###############################################################################

 # _main()
 #
 # Usage:
 #   _main [<options>] [<arguments>]
 #
 # Description:
 #   Entry point for the program, handling basic option parsing and dispatching.
 _main() {
  # Avoid complex option parsing when only one program option is expected.
  if [[ "${@:-}" =~ -h|--help ]]
  then
    _print_usage
  else
    _parse_commandline_arguments "$@"

    _validate_parameters

    # Extract certificate, key and certificate authority chain
    ${OPENSSL} x509 -in "${_TMPFILE}.pem" -outform PEM -out "${_TMPFILE}.cert.pem" || exit 1
    ${OPENSSL} pkey -out "${_TMPFILE}.key.pem" -in "${_TMPFILE}.pem" || exit 1
    ${OPENSSL} crl2pkcs7 -nocrl -certfile "${_TMPFILE}.pem" > "${_TMPFILE}.pkcs7" || exit 1
    ${OPENSSL} pkcs7 -print_certs -out "${_TMPFILE}.chain.pem" -in "${_TMPFILE}.pkcs7" || exit 1

    chain=$(<${_TMPFILE}.chain.pem)
    key=$(<${_TMPFILE}.key.pem)

    chain=$(_json_escape "${chain}")
    key=$(_json_escape "${key}")

    # Check if certificate already exists
    existing_cert_id=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/certificate" -H "accept: */*" --silent --insecure --user "${USERNAME}:${PASSWORD}" | jq ".[] | select(.name == \"${CERT_NAME}\") | .id")

    if [[ -n $existing_cert_id ]]
    then
      # Rename existing certificate to prevent conflict
      rename_job_id=$(curl -X PUT "https://${HOST:-localhost}/api/v2.0/certificate/id/${existing_cert_id}" -H "accept: */*" -H "Content-Type: application/json" --silent --insecure --user "root:tvAQCGWx7aBCAhp&" -d "{\"name\":\"${CERT_NAME}-old\"}")

      # [START] Give FreeNAS time to complete job
      success=false
      for retry in {0..5}
      do
        # Wait for 1 second
        sleep 1

        # Get job result
        result=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/core/get_jobs" -H "accept: */*" --silent --insecure --user "${USERNAME}:${PASSWORD}" | jq ".[] | select(.id == ${rename_job_id}) | .state")

        # Stop looping if job was completed successfully
        [[ "${result}" =~ SUCCESS ]] && success=true && break
      done

      [[ "${success}" = false ]] && echo -e "Failed to rename old certificate\nResult: ${result}\n" && exit 1;
      # [END] Give FreeNAS time to complete job
    fi

    # Upload new certificate
    create_job_id=$(curl -X POST "https://${HOST:-localhost}/api/v2.0/certificate" -H "accept: */*" -H "Content-Type: application/json" --silent --insecure --user "root:tvAQCGWx7aBCAhp&" -d "{\"name\":\"${CERT_NAME}\",\"certificate\":${chain},\"privatekey\":${key},\"create_type\":\"CERTIFICATE_CREATE_IMPORTED\"}")

    # [START] Give FreeNAS time to complete job
    success=false
    for retry in {0..5}
    do
      # Wait for 1 second
      sleep 1

      # Get job result
      result=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/core/get_jobs" -H "accept: */*" --silent --insecure --user "${USERNAME}:${PASSWORD}" | jq ".[] | select(.id == ${create_job_id}) | .state")

      # Stop looping if job was completed successfully
      [[ "${result}" =~ SUCCESS ]] && success=true && break
    done

    [[ "${success}" = false ]] && echo -e "Failed to create new certificate\nResult: ${result}\n" && exit 1;
    # [END] Give FreeNAS time to complete job

    # Get new certificate id
    new_cert_id=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/certificate" -H "accept: */*" --silent --insecure --user "${USERNAME}:${PASSWORD}" | jq ".[] | select(.name == \"${CERT_NAME}\") | .id")
    
    # If certificate was not found, exit (should not happen)
    if [[ -z $new_cert_id ]]
    then
      echo -e "Could not find newly created certificate '${CERT_NAME}'\n" && exit 1;
    fi

    # Set new certificate as active
    result=$(curl -X PUT "https://${HOST:-localhost}/api/v2.0/system/general" -H "accept: */*" -H "Content-Type: application/json" --write-out "%{http_code}" --output /dev/null --silent --insecure --user "root:tvAQCGWx7aBCAhp&" -d "{\"ui_certificate\":\"${new_cert_id}\"}")

    [[ ! "${result}" =~ ^20[0-9]$ ]] && echo -e "Failed to activate new certificate\nResult: ${result}\n" && exit 1;

    # If we found an existing certificate earlier - remove it
    if [[ -n $existing_cert_id ]]
    then
      delete_cert_job_id=$(curl -X DELETE "https://${HOST:-localhost}/api/v2.0/certificate/id/${existing_cert_id}" -H "accept: */*" -H "Content-Type: application/json" --silent --insecure --user "root:tvAQCGWx7aBCAhp&")

      # [START] Give FreeNAS time to complete job
      success=false
      for retry in {0..5}
      do
        # Wait for 1 second
        sleep 1

        # Get job result
        result=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/core/get_jobs" -H "accept: */*" --silent --insecure --user "${USERNAME}:${PASSWORD}" | jq ".[] | select(.id == ${delete_cert_job_id}) | .state")

        # Stop looping if job was completed successfully
        [[ "${result}" =~ SUCCESS ]] && success=true && break
      done

      [[ "${success}" = false ]] && echo -e "Failed to remove old certificate\nResult: ${result}\n" && exit 1;
      # [END] Give FreeNAS time to complete job
    fi

    # Restart web ui (does not return HTTP 200 because web server restarts)
    result=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/system/general/ui_restart" -H "accept: */*" -H "Content-Type: application/json" --write-out "%{http_code}" --output /dev/null --silent --insecure --user "root:tvAQCGWx7aBCAhp&")
  fi
 }

 # Call `_main` after everything has been defined.
 _main "$@"

 exit 0;
	#!/usr/bin/env bash
	##
	## Title: deploy_freenas.sh
	## Description: Script to deploy uploaded certificates for use with VMWare ESXi
	## Author: B. van wetten
	## Created date: 28-01-2020
	## Updated date: 12-02-2020
	## Version: 0.3
	## GitHub Gist: https://gist.github.com/QNimbus/08dd3a44cddfc7b8ffc22aad1f012645
	##
	## Usage: deploy_freenas.sh
	## Notes: For remote use (e.g. SSH) use the following command as example:
	## cat fullchain.cer /var/etc/acme-client/home/lan.besqua.red/lan.besqua.red.key \| ssh -oStrictHostKeyChecking=no -T -i <keyfile> data-admin@<freenas host>
	##
	## You can use this in your 'authorized_keys' file to run this command remotely:
	## command="/bin/cat \| /usr/bin/xargs -0 -r -J % /mnt/storage/scripts/certs/deploy_freenas.sh -u <username> -p '<password>' -n <certname> -c % --",no-pty,from="1.2.3.4/32" ssh-rsa <public-key-here>== data-admin

	# Shell utilities
	RM=$(which rm); [[ $? != 0 ]] && echo "Command 'rm' not found" >&2 && exit 1
	CP=$(which cp); [[ $? != 0 ]] && echo "Command 'cp' not found" >&2 && exit 1
	MV=$(which mv); [[ $? != 0 ]] && echo "Command 'mv' not found" >&2 && exit 1
	JQ=$(which jq); [[ $? != 0 ]] && echo "Command 'jq' not found" >&2 && exit 1
	FIND=$(which find); [[ $? != 0 ]] && echo "Command 'find' not found" >&2 && exit 1
	CURL=$(which curl); [[ $? != 0 ]] && echo "Command 'curl' not found" >&2 && exit 1
	XARGS=$(which xargs); [[ $? != 0 ]] && echo "Command 'xargs' not found" >&2 && exit 1
	PYTHON=$(which python); [[ $? != 0 ]] && echo "Command 'python' not found" >&2 && exit 1
	OPENSSL=$(which openssl); [[ $? != 0 ]] && echo "Command 'openssl' not found" >&2 && exit 1
	GETOPT=$(which getopt); [[ $? != 0 ]] && echo "Command 'getopt' not found" >&2 && exit 1

	# Initialize variables
	_PWD="/mnt/storage/scripts/certs"
	_ME=$(basename "${0}")
	_TMPFILE="tmp-${$}-${RANDOM}"

	# Option strings
	SHORT=hu:p:n:
	LONG=help,username:,password:,name:

	##########################################################################
	# Init #
	##########################################################################

	# Cleanup any temp files after script execution (traps signals: 0, 1, 2, 15)
	trap '${FIND} . -maxdepth 1 -name "${_TMPFILE}*" -type f -print0 \| ${XARGS} -I % -0 rm %' INT TERM HUP EXIT

	# Read certificate from command line and remove from positional arguments
	for((i=1; i<=$#; i++))
	do
	_cur=$i
	_next=$(expr $i + 1)

	_param=${!_cur}
	_next_param=${!_next:-}

	if [[ "${_param}" =~ (^-c$) && ! -z "${_next_param}" ]]
	then
	echo -en "${_next_param}" > "${_TMPFILE}.pem"
	set -- "${@:1:_cur-1}" "${@:_cur+2}"
	fi
	done

	# Get command line arguments
	if [[ "${#}" -gt 0 ]]
	then
	getopt -T > /dev/null
	if [ $? -eq 4 ]; then
	# GNU enhanced getopt is available
	_ARGS=$(${GETOPT} --name "$_ME" --long ${LONG} --options ${SHORT} -- "$@")
	else
	# Original getopt is available (no long option names, no whitespace, no sorting)
	_ARGS=$(${GETOPT} ${SHORT} "$@")
	fi
	if [ $? -ne 0 ]; then
	echo "$_ME: usage error (use -h for help)" >&2
	exit 2
	fi
	fi

	###############################################################################
	# Functions #
	###############################################################################

	# _print_usage()
	#
	# Usage:
	# _print_usage
	#
	# Print the program usage information.
	_print_usage() {
	cat <<HEREDOC
	___ ____ ___ _ ____ _ _ ____ ____ ____ ____ _ _ ____ ____
	\| \ \|___ \|__] \| \| \| \_/ \|___ \|__/ \|___ \|___ \|\ \| \|__\| [__
	\|__/ \|___ \| \|___ \|__\| \| ___ \| \| \ \|___ \|___ \| \\| \| \| ___]

	Usage:
	${_ME} -u username -p password -n name -c file
	${_ME} -h

	Options:
	-h Show this screen
	-n Certificate name
	-c Certificate file
	-u FreeNAS API access username
	-p FreeNAS API access password

	HEREDOC
	exit ${1:-0}
	}

	# _json_escape()
	#
	# Usage:
	# _json_escape variable value
	#
	# Escape a JSON object (e.g. for use with 'curl')
	_json_escape () {
	printf '%s' "$1" \| ${PYTHON} -c 'import json,sys; print(json.dumps(sys.stdin.read()))'
	}

	# _set_variable()
	#
	# Usage:
	# _set_variable variable value
	#
	# Sets the variable to a value if not already set. Otherwise exits with an error message
	_set_variable()
	{
	local varname="$1"
	shift
	if [ -z "${!varname:-}" ]; then
	# eval="${varname}=${@@Q}"
	eval "$varname=\"$@\""
	else
	echo "Error: $varname already set"
	usage
	fi
	}

	# _parse_commandline_arguments()
	#
	# Usage:
	# _parse_commandline_arguments
	#
	# Parses and validates commandline arguments and populates appropriate variables.
	_parse_commandline_arguments()
	{
	while true;
	do
	case "${1:-}" in
	-u\|--username)
	[[ -z "${2}" \|\| "${2}" == [[:space:]] \|\| "${2}" == -* ]] && { echo "$_ME: $1 needs a value" >&2; _print_usage 1; }
	_set_variable USERNAME "${2}"
	shift 2
	;;
	-p\|--password)
	[[ -z "${2}" \|\| "${2}" == [[:space:]] \|\| "${2}" == -* ]] && { echo "$_ME: $1 needs a value" >&2; _print_usage 1; }
	_set_variable PASSWORD "${2}"
	shift 2
	;;
	-n\|--name)
	[[ -z "${2}" \|\| "${2}" == [[:space:]] \|\| "${2}" == -* ]] && { echo "$_ME: $1 needs a value" >&2; _print_usage 1; }
	_set_variable CERT_NAME "${2}"
	shift 2
	;;
	\?) echo "$_ME: Unknown option -$1" >&2;
	exit 1
	;;
	:) echo "$_ME: -$1 needs a value" >&2;
	exit 1
	;;
	*) shift
	break
	;;
	esac
	done
	}

	# _validate_parameters()
	#
	# Usage:
	# _validate_parameters
	#
	# Performs several checks on the supplied command line arguments
	_validate_parameters() {
	# Check if $USERNAME and $PASSWORD are set and not empty
	[[ -z "${USERNAME:-}" \|\| -z "${PASSWORD:-}" ]] && echo -e "$_ME: Username and password are required\n" && _print_usage 1;

	# Check certificates
	[[ ! -f "${_TMPFILE}.pem" \|\| ! $(${OPENSSL} rsa -in "${_TMPFILE}.pem" -check 2> /dev/null) ]] && echo -e "$_ME: Invalid or no certificate supplied\n" && _print_usage 1;

	# Check if $USERNAME and $PASSWORD are set and not empty
	[[ -z "${CERT_NAME:-}" ]] && echo -e "$_ME: Certificate name is required\n" && _print_usage 1;
	}

	###############################################################################
	# Main #
	###############################################################################

	# _main()
	#
	# Usage:
	# _main [<options>] [<arguments>]
	#
	# Description:
	# Entry point for the program, handling basic option parsing and dispatching.
	_main() {
	# Avoid complex option parsing when only one program option is expected.
	if [[ "${@:-}" =~ -h\|--help ]]
	then
	_print_usage
	else
	_parse_commandline_arguments "$@"

	_validate_parameters

	# Extract certificate, key and certificate authority chain
	${OPENSSL} x509 -in "${_TMPFILE}.pem" -outform PEM -out "${_TMPFILE}.cert.pem" \|\| exit 1
	${OPENSSL} pkey -out "${_TMPFILE}.key.pem" -in "${_TMPFILE}.pem" \|\| exit 1
	${OPENSSL} crl2pkcs7 -nocrl -certfile "${_TMPFILE}.pem" > "${_TMPFILE}.pkcs7" \|\| exit 1
	${OPENSSL} pkcs7 -print_certs -out "${_TMPFILE}.chain.pem" -in "${_TMPFILE}.pkcs7" \|\| exit 1

	chain=$(<${_TMPFILE}.chain.pem)
	key=$(<${_TMPFILE}.key.pem)

	chain=$(_json_escape "${chain}")
	key=$(_json_escape "${key}")

	# Check if certificate already exists
	existing_cert_id=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/certificate" -H "accept: /" --silent --insecure --user "${USERNAME}:${PASSWORD}" \| jq ".[] \| select(.name == \"${CERT_NAME}\") \| .id")

	if [[ -n $existing_cert_id ]]
	then
	# Rename existing certificate to prevent conflict
	rename_job_id=$(curl -X PUT "https://${HOST:-localhost}/api/v2.0/certificate/id/${existing_cert_id}" -H "accept: /" -H "Content-Type: application/json" --silent --insecure --user "root:tvAQCGWx7aBCAhp&" -d "{\"name\":\"${CERT_NAME}-old\"}")

	# [START] Give FreeNAS time to complete job
	success=false
	for retry in {0..5}
	do
	# Wait for 1 second
	sleep 1

	# Get job result
	result=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/core/get_jobs" -H "accept: /" --silent --insecure --user "${USERNAME}:${PASSWORD}" \| jq ".[] \| select(.id == ${rename_job_id}) \| .state")

	# Stop looping if job was completed successfully
	[[ "${result}" =~ SUCCESS ]] && success=true && break
	done

	[[ "${success}" = false ]] && echo -e "Failed to rename old certificate\nResult: ${result}\n" && exit 1;
	# [END] Give FreeNAS time to complete job
	fi

	# Upload new certificate
	create_job_id=$(curl -X POST "https://${HOST:-localhost}/api/v2.0/certificate" -H "accept: /" -H "Content-Type: application/json" --silent --insecure --user "root:tvAQCGWx7aBCAhp&" -d "{\"name\":\"${CERT_NAME}\",\"certificate\":${chain},\"privatekey\":${key},\"create_type\":\"CERTIFICATE_CREATE_IMPORTED\"}")

	# [START] Give FreeNAS time to complete job
	success=false
	for retry in {0..5}
	do
	# Wait for 1 second
	sleep 1

	# Get job result
	result=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/core/get_jobs" -H "accept: /" --silent --insecure --user "${USERNAME}:${PASSWORD}" \| jq ".[] \| select(.id == ${create_job_id}) \| .state")

	# Stop looping if job was completed successfully
	[[ "${result}" =~ SUCCESS ]] && success=true && break
	done

	[[ "${success}" = false ]] && echo -e "Failed to create new certificate\nResult: ${result}\n" && exit 1;
	# [END] Give FreeNAS time to complete job

	# Get new certificate id
	new_cert_id=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/certificate" -H "accept: /" --silent --insecure --user "${USERNAME}:${PASSWORD}" \| jq ".[] \| select(.name == \"${CERT_NAME}\") \| .id")

	# If certificate was not found, exit (should not happen)
	if [[ -z $new_cert_id ]]
	then
	echo -e "Could not find newly created certificate '${CERT_NAME}'\n" && exit 1;
	fi

	# Set new certificate as active
	result=$(curl -X PUT "https://${HOST:-localhost}/api/v2.0/system/general" -H "accept: /" -H "Content-Type: application/json" --write-out "%{http_code}" --output /dev/null --silent --insecure --user "root:tvAQCGWx7aBCAhp&" -d "{\"ui_certificate\":\"${new_cert_id}\"}")

	[[ ! "${result}" =~ ^20[0-9]$ ]] && echo -e "Failed to activate new certificate\nResult: ${result}\n" && exit 1;

	# If we found an existing certificate earlier - remove it
	if [[ -n $existing_cert_id ]]
	then
	delete_cert_job_id=$(curl -X DELETE "https://${HOST:-localhost}/api/v2.0/certificate/id/${existing_cert_id}" -H "accept: /" -H "Content-Type: application/json" --silent --insecure --user "root:tvAQCGWx7aBCAhp&")

	# [START] Give FreeNAS time to complete job
	success=false
	for retry in {0..5}
	do
	# Wait for 1 second
	sleep 1

	# Get job result
	result=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/core/get_jobs" -H "accept: /" --silent --insecure --user "${USERNAME}:${PASSWORD}" \| jq ".[] \| select(.id == ${delete_cert_job_id}) \| .state")

	# Stop looping if job was completed successfully
	[[ "${result}" =~ SUCCESS ]] && success=true && break
	done

	[[ "${success}" = false ]] && echo -e "Failed to remove old certificate\nResult: ${result}\n" && exit 1;
	# [END] Give FreeNAS time to complete job
	fi

	# Restart web ui (does not return HTTP 200 because web server restarts)
	result=$(curl -X GET "https://${HOST:-localhost}/api/v2.0/system/general/ui_restart" -H "accept: /" -H "Content-Type: application/json" --write-out "%{http_code}" --output /dev/null --silent --insecure --user "root:tvAQCGWx7aBCAhp&")
	fi
	}

	# Call `_main` after everything has been defined.
	_main "$@"

	exit 0;