diff options
Diffstat (limited to 'certificate-renew-issued.rsc')
-rw-r--r-- | certificate-renew-issued.rsc | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/certificate-renew-issued.rsc b/certificate-renew-issued.rsc new file mode 100644 index 0000000..7815443 --- /dev/null +++ b/certificate-renew-issued.rsc @@ -0,0 +1,48 @@ +#!rsc by RouterOS +# RouterOS script: certificate-renew-issued +# Copyright (c) 2019-2024 Christian Hesse <mail@eworm.de> +# https://git.eworm.de/cgit/routeros-scripts/about/COPYING.md +# +# requires RouterOS, version=7.13 +# +# renew locally issued certificates +# https://git.eworm.de/cgit/routeros-scripts/about/doc/certificate-renew-issued.md + +:global GlobalFunctionsReady; +:while ($GlobalFunctionsReady != true) do={ :delay 500ms; } + +:do { + :local ScriptName [ :jobname ]; + + :global CertIssuedExportPass; + + :global LogPrint; + :global MkDir; + :global ScriptLock; + + :if ([ $ScriptLock $ScriptName ] = false) do={ + :error false; + } + + :foreach Cert in=[ /certificate/find where issued expires-after<3w ] do={ + :local CertVal [ /certificate/get $Cert ]; + /certificate/issued-revoke $Cert; + /certificate/set name=($CertVal->"name" . "-revoked-" . [ /system/clock/get date ]) $Cert; + /certificate/add name=($CertVal->"name") common-name=($CertVal->"common-name") \ + key-usage=($CertVal->"key-usage") subject-alt-name=($CertVal->"subject-alt-name"); + /certificate/sign ($CertVal->"name") ca=($CertVal->"ca"); + :if ([ :typeof ($CertIssuedExportPass->($CertVal->"common-name")) ] = "str") do={ + :if ([ $MkDir "cert-issued" ] = true) do={ + /certificate/export-certificate ($CertVal->"name") type=pkcs12 \ + file-name=("cert-issued/" . $CertVal->"common-name") \ + export-passphrase=($CertIssuedExportPass->($CertVal->"common-name")); + $LogPrint info $ScriptName ("Issued a new certificate for '" . $CertVal->"common-name" . \ + "', exported to 'cert-issued/" . $CertVal->"common-name" . ".p12'."); + } else={ + $LogPrint warning $ScriptName ("Failed creating directory, not exporting certificate."); + } + } else={ + $LogPrint info $ScriptName ("Issued a new certificate for '" . $CertVal->"common-name" . "'."); + } + } +} on-error={ } |