check_quad9_keys: A script that checks for changes in Quad9 key used in stubby.yml

check_quad9_keys.sh

#!/bin/bash

# This script checks for changes in  Quad9 key used in stubby.yml
# If it's the same = OK
# If changed, fetch the new key and update

# Replace with stubby location
PATH="/opt/getdns/etc/stubby"
cd $path

# Fetch the key
newkey=$(echo | openssl s_client -connect '9.9.9.9:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64)

# Update the key in stubby
oldkey=$(yq r stubby.yml upstream_recursive_servers[0].tls_pubkey_pinset[0].value)
echo "Old key: $oldkey"
echo "New key: $newkey"

yaml_array="upstream_recursive_servers"

if [ "$newkey" != "$oldkey" ]
then
        for i in $yaml_array; do
                yq w -i stubby.yml $yaml_array[$i].tls_pubkey_pinset[0].value $newkey
        done
fi