manuale-renew.sh

manuale-renew.sh

#!/bin/bash
# # ManuaLE wrapper
# Copyright 2016-2017 Gentoo Foundation Inc
# Robin H. Johnson <robbat2@gentoo.org>
#
# This should be run IN the target directory, e.g.:
# cd ..../etc/ssl/example.com/ && /usr/local/bin/manuale-renew.sh
#
# Your OpenSSL CNF should already exist.
SCRIPTBASE="$(dirname $0)"
CNF="$(ls *.cnf)"
KEY="$(ls *.key 2>/dev/null)"
CSR="$(ls *.csr 2>/dev/null)"
[ -z "${KEY}" ] && KEY=${CNF%.cnf}.key
[ -z "${CSR}" ] && CSR=${CNF%.cnf}.csr
TS=$(date +%s)

die() {
    echo "$*" 1>&2
    exit 1
}

unique_with_order() {
    # This is like 'sort | uniq', but preserves the order of elements.
    perl -ne 'print if ++$k{$_}==1'
}

x509-expand() {
    # REMOVED
    # This is a Gentoo-specific script not needed for usage of the wrapper.
}

ACCOUNT="${SCRIPTBASE}/LE_mykey_example_com.json"
NAMES="$(awk -F '=' '/(^DNS|^commonName)(_default|.[0-9]+)/{print $2}' "${CNF}" |grep -e '[^[:space:]]' | unique_with_order)"

#set -x
# Generate an SSL key
if [ ! -e "${KEY}" ]; then
    openssl genrsa -out "${KEY}" 4096 || die "Failed to regenerate RSA key"
fi
# Generate a SSL CSR from a OpenSSL .cnf
if [ ! -e "${CSR}" ]; then
    openssl req -new -batch -config "${CNF}" -key "${KEY}" -out "${CSR}" || die "Failed to update CSR"
fi
[ -z "${NAMES}" ] && die "Did not find any hostnames in $CNF"
manuale --account "${ACCOUNT}" authorize -m dns $NAMES || die "Failed to authorize: $NAMES"
manuale --account "${ACCOUNT}" issue  --key-file "${KEY}" --csr-file "${CSR}" $NAMES || die "Failed to issue: $NAMES"
rm -f *.{chain.crt,intermediate.crt,pem} # We don't use these in our deployment.
x509-expand *crt *ca *pem *key *csr || die "Failed to expand some SSL file"
echo "# Renewed @$(date -u +%s -d @$TS) / $(date -uR -d @$TS)" >>"$CNF"