collect_certs.sh

#!/bin/sh
if [ -d /opt/rke/etc/kubernetes ];
then
        K8S_DIR="/opt/rke/etc/kubernetes"
else
        K8S_DIR="/etc/kubernetes"
fi

for cert in `find "${K8S_DIR}/ssl" -type f -name *.pem | grep -v "\-key\.pem$" | grep -v kube-admin | sort`; do
        md5sum $cert
done

if [ -d "${K8S_DIR}/.tmp" ]; then
        for cert in `find "${K8S_DIR}/.tmp" -type f -name *.pem | grep -v "\-key\.pem$" | grep -v kube-admin | sort`; do md5sum $cert; done
fi

if command -v openssl >/dev/null 2>&1; then
        if [ -f "${K8S_DIR}/ssl/kube-ca.pem" ]; then
                for cert in `find "${K8S_DIR}/ssl" -type f -name *.pem | grep -v "\-key\.pem$" | grep -v kube-admin | sort`; do
                        if  [ "$(basename $cert)" = "kube-apiserver-proxy-client.pem" ] || [ "$(basename $cert)" = "kube-apiserver-requestheader-ca.pem" ] || [ "$(basename $cert)" = "kube-ca.pem" ]; then
                                continue
                        fi
                        SSL_CERT_DIR=/dummy
                        SSL_CERT_FILE=/dummy
                        openssl verify -CAfile "${K8S_DIR}/ssl/kube-ca.pem" $cert
                done
        fi
fi

find "${K8S_DIR}/ssl" -type f -name *.pem -exec ls -la {} \; | sort