AWS CA import script for JDK keystore

aws-cert-import.sh

#!/bin/bash -e

# create a temp dir in which to work
OLDDIR="$PWD"
TMPDIR="/tmp/_aws-ca"

mkdir "${TMPDIR}" && cd "${TMPDIR}"

AWS_CERTS=(
AmazonRootCA1.pem
AmazonRootCA2.pem
AmazonRootCA3.pem
AmazonRootCA4.pem
)

# download the bundle(s)
for cert in ${AWS_CERTS[*]}; do
    wget "https://www.amazontrust.com/repository/${cert}" -O "${TMPDIR}/${cert}"

    # extract a human-readable alias from the cert
    ALIAS=$(openssl x509 -noout -text -in "${TMPDIR}/${cert}" |
        perl -ne 'next unless /Subject:/; s/.*CN=//; print')
    echo "importing $ALIAS"
    # import the cert into the default java keystore
    keytool -import \
        -keystore /etc/ssl/certs/java/cacerts \
        -storepass changeit -noprompt \
        -alias "$ALIAS" -file "${TMPDIR}/${cert}"
done

# back out of the temp dir and delete the temp folder
cd "$OLDDIR"
rm -r "${TMPDIR}"

# list the imported certs as a sanity check
keytool -list \
    -keystore /etc/ssl/certs/java/cacerts -storepass changeit -noprompt |
    grep -i Amazon