From a263fcdec2da2360cebea137085a60c7a67c4198 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 6 Apr 2023 10:16:55 +0200 Subject: check-certificates: format information in a local function --- check-certificates.rsc | 44 ++++++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 20 deletions(-) diff --git a/check-certificates.rsc b/check-certificates.rsc index 8a06f8b..ed50eea 100644 --- a/check-certificates.rsc +++ b/check-certificates.rsc @@ -27,9 +27,25 @@ :global WaitForFile; :global WaitFullyConnected; -:local FormatExpire do={ - :global CharacterReplace; - :return [ $CharacterReplace [ $CharacterReplace [ :tostr $1 ] "w" "w " ] "d" "d " ]; +:local FormatInfo do={ + :local CertVal $1; + + :global IfThenElse; + :global ParseKeyValueStore; + + :local FormatExpire do={ + :global CharacterReplace; + :return [ $CharacterReplace [ $CharacterReplace [ :tostr $1 ] "w" "w " ] "d" "d " ]; + } + + :return ( \ + "Name: " . ($CertVal->"name") . "\n" . \ + "CommonName: " . ($CertVal->"common-name") . "\n" . \ + "Private key: " . [ $IfThenElse (($CertVal->"private-key") = true) "available" "missing" ] . "\n" . \ + "Fingerprint: " . ($CertVal->"fingerprint") . "\n" . \ + "Issuer: " . ($CertVal->"ca") . ([ $ParseKeyValueStore ($CertVal->"issuer") ]->"CN") . "\n" . \ + "Validity: " . ($CertVal->"invalid-before") . " to " . ($CertVal->"invalid-after") . "\n" . \ + "Expires in: " . [ $IfThenElse (($CertVal->"expired") = true) "expired" [ $FormatExpire ($CertVal->"expires-after") ] ]); } $WaitFullyConnected; @@ -95,18 +111,13 @@ $WaitFullyConnected; /certificate/remove $Cert; /certificate/set $CertNew name=($CertVal->"name"); + :set CertNewVal; + :set CertVal [ /certificate/get $CertNew ];; } - $SendNotification2 ({ origin=$0; \ + $SendNotification2 ({ origin=$0; silent=true; \ subject=([ $SymbolForNotification "lock-with-ink-pen" ] . "Certificate renewed"); \ - message=("A certificate on " . $Identity . " has been renewed.\n\n" . \ - "Name: " . ($CertVal->"name") . "\n" . \ - "CommonName: " . ($CertNewVal->"common-name") . "\n" . \ - "Private key: " . [ $IfThenElse (($CertNewVal->"private-key") = true) "available" "missing" ] . "\n" . \ - "Fingerprint: " . ($CertNewVal->"fingerprint") . "\n" . \ - "Issuer: " . ([ $ParseKeyValueStore ($CertNewVal->"issuer") ]->"CN") . "\n" . \ - "Validity: " . ($CertNewVal->"invalid-before") . " to " . ($CertNewVal->"invalid-after") . "\n" . \ - "Expires in: " . [ $FormatExpire ($CertNewVal->"expires-after") ]); silent=true }); + message=("A certificate on " . $Identity . " has been renewed.\n\n" . [ $FormatInfo $CertVal ]) }); $LogPrintExit2 info $0 ("The certificate " . ($CertVal->"name") . " has been renewed.") false; } on-error={ $LogPrintExit2 debug $0 ("Could not renew certificate " . ($CertVal->"name") . ".") false; @@ -124,14 +135,7 @@ $WaitFullyConnected; $SendNotification2 ({ origin=$0; \ subject=([ $SymbolForNotification "warning-sign" ] . "Certificate warning!"); \ - message=("A certificate on " . $Identity . " " . $State . ".\n\n" . \ - "Name: " . ($CertVal->"name") . "\n" . \ - "CommonName: " . ($CertVal->"common-name") . "\n" . \ - "Private key: " . [ $IfThenElse (($CertVal->"private-key") = true) "available" "missing" ] . "\n" . \ - "Fingerprint: " . ($CertVal->"fingerprint") . "\n" . \ - "Issuer: " . ($CertVal->"ca") . ([ $ParseKeyValueStore ($CertVal->"issuer") ]->"CN") . "\n" . \ - "Validity: " . ($CertVal->"invalid-before") . " to " . ($CertVal->"invalid-after") . "\n" . \ - "Expires in: " . [ $IfThenElse (($CertVal->"expired") = true) "expired" [ $FormatExpire ($CertVal->"expires-after") ] ]) }); + message=("A certificate on " . $Identity . " " . $State . ".\n\n" . [ $FormatInfo $CertVal ]) }); $LogPrintExit2 info $0 ("The certificate " . ($CertVal->"name") . " " . $State . \ ", it is invalid after " . ($CertVal->"invalid-after") . ".") false; } -- cgit v1.2.3-70-g09d2 From 706e4de6d1ed218ca689885621183ba42a9d62cf Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 6 Apr 2023 10:18:41 +0200 Subject: check-certificates: show CommonName only if available --- check-certificates.rsc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/check-certificates.rsc b/check-certificates.rsc index ed50eea..704ea15 100644 --- a/check-certificates.rsc +++ b/check-certificates.rsc @@ -40,7 +40,7 @@ :return ( \ "Name: " . ($CertVal->"name") . "\n" . \ - "CommonName: " . ($CertVal->"common-name") . "\n" . \ + [ $IfThenElse ([ :len ($CertVal->"common-name") ] > 0) ("CommonName: " . ($CertVal->"common-name") . "\n") ] . \ "Private key: " . [ $IfThenElse (($CertVal->"private-key") = true) "available" "missing" ] . "\n" . \ "Fingerprint: " . ($CertVal->"fingerprint") . "\n" . \ "Issuer: " . ($CertVal->"ca") . ([ $ParseKeyValueStore ($CertVal->"issuer") ]->"CN") . "\n" . \ -- cgit v1.2.3-70-g09d2 From 4073daa13990076c695a2d9c32208faf7415617b Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 6 Apr 2023 10:26:24 +0200 Subject: check-certificates: include SANs in information --- check-certificates.rsc | 11 +++++++++++ doc/check-certificates.d/notification.avif | Bin 13088 -> 25274 bytes 2 files changed, 11 insertions(+) diff --git a/check-certificates.rsc b/check-certificates.rsc index 704ea15..6b35cbf 100644 --- a/check-certificates.rsc +++ b/check-certificates.rsc @@ -38,9 +38,20 @@ :return [ $CharacterReplace [ $CharacterReplace [ :tostr $1 ] "w" "w " ] "d" "d " ]; } + :local FormatSANs do={ + :local SANs $1; + :local Return ""; + + :foreach SAN in=$SANs do={ + :set Return ($Return . "\n " . $SAN); + } + :return $Return; + } + :return ( \ "Name: " . ($CertVal->"name") . "\n" . \ [ $IfThenElse ([ :len ($CertVal->"common-name") ] > 0) ("CommonName: " . ($CertVal->"common-name") . "\n") ] . \ + [ $IfThenElse ([ :len ($CertVal->"subject-alt-name") ] > 0) ("SubjectAltNames:" . [ $FormatSANs ($CertVal->"subject-alt-name") ] . "\n") ] . \ "Private key: " . [ $IfThenElse (($CertVal->"private-key") = true) "available" "missing" ] . "\n" . \ "Fingerprint: " . ($CertVal->"fingerprint") . "\n" . \ "Issuer: " . ($CertVal->"ca") . ([ $ParseKeyValueStore ($CertVal->"issuer") ]->"CN") . "\n" . \ diff --git a/doc/check-certificates.d/notification.avif b/doc/check-certificates.d/notification.avif index d7e9e84..7c250da 100644 Binary files a/doc/check-certificates.d/notification.avif and b/doc/check-certificates.d/notification.avif differ -- cgit v1.2.3-70-g09d2 From 11093045f30eb289c17c9d08a80de69798ad942d Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 6 Apr 2023 14:56:36 +0200 Subject: check-certificates: download and import in a local function --- check-certificates.rsc | 72 ++++++++++++++++++++++++++++---------------------- 1 file changed, 41 insertions(+), 31 deletions(-) diff --git a/check-certificates.rsc b/check-certificates.rsc index 6b35cbf..8250269 100644 --- a/check-certificates.rsc +++ b/check-certificates.rsc @@ -10,23 +10,59 @@ :global GlobalFunctionsReady; :while ($GlobalFunctionsReady != true) do={ :delay 500ms; } -:global CertRenewPass; :global CertRenewTime; :global CertRenewUrl; :global CertWarnTime; :global Identity; :global CertificateAvailable -:global CertificateNameByCN; :global IfThenElse; :global LogPrintExit2; :global ParseKeyValueStore; :global SendNotification2; :global SymbolForNotification; -:global UrlEncode; -:global WaitForFile; :global WaitFullyConnected; +:local CheckCertificatesDownloadImport do={ + :local Name [ :tostr $1 ]; + + :global CertRenewUrl; + :global CertRenewPass; + + :global CertificateNameByCN; + :global LogPrintExit2; + :global UrlEncode; + :global WaitForFile; + + :foreach Type in={ ".pem"; ".p12" } do={ + :local CertFileName ([ $UrlEncode $Name ] . $Type); + :do { + /tool/fetch check-certificate=yes-without-crl \ + ($CertRenewUrl . $CertFileName) dst-path=$CertFileName as-value; + $WaitForFile $CertFileName; + + :local DecryptionFailed true; + :foreach PassPhrase in=$CertRenewPass do={ + :local Result [ /certificate/import file-name=$CertFileName passphrase=$PassPhrase as-value ]; + :if ($Result->"decryption-failures" = 0) do={ + :set DecryptionFailed false; + } + } + /file/remove [ find where name=$CertFileName ]; + + :if ($DecryptionFailed = true) do={ + $LogPrintExit2 warning $0 ("Decryption failed for certificate file " . $CertFileName) false; + } + + :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=$Name ] do={ + $CertificateNameByCN [ /certificate/get $CertInChain common-name ]; + } + } on-error={ + $LogPrintExit2 debug $0 ("Could not download certificate file " . $CertFileName) false; + } + } +} + :local FormatInfo do={ :local CertVal $1; @@ -70,33 +106,7 @@ $WaitFullyConnected; } $LogPrintExit2 info $0 ("Attempting to renew certificate " . ($CertVal->"name") . ".") false; - :foreach Type in={ ".pem"; ".p12" } do={ - :local CertFileName ([ $UrlEncode ($CertVal->"common-name") ] . $Type); - :do { - /tool/fetch check-certificate=yes-without-crl \ - ($CertRenewUrl . $CertFileName) dst-path=$CertFileName as-value; - $WaitForFile $CertFileName; - - :local DecryptionFailed true; - :foreach PassPhrase in=$CertRenewPass do={ - :local Result [ /certificate/import file-name=$CertFileName passphrase=$PassPhrase as-value ]; - :if ($Result->"decryption-failures" = 0) do={ - :set DecryptionFailed false; - } - } - /file/remove [ find where name=$CertFileName ]; - - :if ($DecryptionFailed = true) do={ - $LogPrintExit2 warning $0 ("Decryption failed for certificate file " . $CertFileName) false; - } - - :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=($CertVal->"common-name") ] do={ - $CertificateNameByCN [ /certificate/get $CertInChain common-name ]; - } - } on-error={ - $LogPrintExit2 debug $0 ("Could not download certificate file " . $CertFileName) false; - } - } + $CheckCertificatesDownloadImport ($CertVal->"common-name"); :local CertNew [ /certificate/find where common-name=($CertVal->"common-name") fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ]; :local CertNewVal [ /certificate/get $CertNew ]; -- cgit v1.2.3-70-g09d2 From 46110661e07095b3504cbef5e9a66317146c05ce Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 6 Apr 2023 15:05:43 +0200 Subject: check-certificates: do not rename certificates without common-name --- check-certificates.rsc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/check-certificates.rsc b/check-certificates.rsc index 8250269..fa0963f 100644 --- a/check-certificates.rsc +++ b/check-certificates.rsc @@ -54,7 +54,7 @@ $LogPrintExit2 warning $0 ("Decryption failed for certificate file " . $CertFileName) false; } - :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=$Name ] do={ + :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=$Name !(common-name=[]) ] do={ $CertificateNameByCN [ /certificate/get $CertInChain common-name ]; } } on-error={ -- cgit v1.2.3-70-g09d2 From 922dde3ff0ebaab70df8a8bfa402c1d19b624f51 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 6 Apr 2023 15:11:28 +0200 Subject: check-certificates: make the function return a status --- check-certificates.rsc | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/check-certificates.rsc b/check-certificates.rsc index fa0963f..db1127c 100644 --- a/check-certificates.rsc +++ b/check-certificates.rsc @@ -34,6 +34,8 @@ :global UrlEncode; :global WaitForFile; + :local Return false; + :foreach Type in={ ".pem"; ".p12" } do={ :local CertFileName ([ $UrlEncode $Name ] . $Type); :do { @@ -57,10 +59,14 @@ :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=$Name !(common-name=[]) ] do={ $CertificateNameByCN [ /certificate/get $CertInChain common-name ]; } + + :set Return true; } on-error={ $LogPrintExit2 debug $0 ("Could not download certificate file " . $CertFileName) false; } } + + :return $Return; } :local FormatInfo do={ @@ -106,7 +112,8 @@ $WaitFullyConnected; } $LogPrintExit2 info $0 ("Attempting to renew certificate " . ($CertVal->"name") . ".") false; - $CheckCertificatesDownloadImport ($CertVal->"common-name"); + :local ImportSuccess false; + :set ImportSuccess [ $CheckCertificatesDownloadImport ($CertVal->"common-name") ]; :local CertNew [ /certificate/find where common-name=($CertVal->"common-name") fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ]; :local CertNewVal [ /certificate/get $CertNew ]; -- cgit v1.2.3-70-g09d2 From 96170950222dd4e63b7bd01c3db3298b902c4c87 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 6 Apr 2023 15:19:23 +0200 Subject: check-certificates: try all SANs for download --- check-certificates.rsc | 19 ++++++++++++++++--- doc/check-certificates.md | 5 +++-- global-functions.rsc | 2 +- news-and-changes.rsc | 1 + 4 files changed, 21 insertions(+), 6 deletions(-) diff --git a/check-certificates.rsc b/check-certificates.rsc index db1127c..1a984bc 100644 --- a/check-certificates.rsc +++ b/check-certificates.rsc @@ -16,11 +16,13 @@ :global Identity; :global CertificateAvailable +:global EscapeForRegEx; :global IfThenElse; :global LogPrintExit2; :global ParseKeyValueStore; :global SendNotification2; :global SymbolForNotification; +:global UrlEncode; :global WaitFullyConnected; :local CheckCertificatesDownloadImport do={ @@ -56,7 +58,8 @@ $LogPrintExit2 warning $0 ("Decryption failed for certificate file " . $CertFileName) false; } - :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=$Name !(common-name=[]) ] do={ + :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") \ + common-name!=$Name !(subject-alt-name~("(^|\\W)(DNS|IP):" . [ $EscapeForRegEx $Name ] . "(\\W|\$)")) !(common-name=[]) ] do={ $CertificateNameByCN [ /certificate/get $CertInChain common-name ]; } @@ -105,6 +108,7 @@ $WaitFullyConnected; :foreach Cert in=[ /certificate/find where !revoked !ca !scep-url expires-after<$CertRenewTime ] do={ :local CertVal [ /certificate/get $Cert ]; + :local LastName; :do { :if ([ :len $CertRenewUrl ] = 0) do={ @@ -113,9 +117,18 @@ $WaitFullyConnected; $LogPrintExit2 info $0 ("Attempting to renew certificate " . ($CertVal->"name") . ".") false; :local ImportSuccess false; - :set ImportSuccess [ $CheckCertificatesDownloadImport ($CertVal->"common-name") ]; + :set LastName ($CertVal->"common-name"); + :set ImportSuccess [ $CheckCertificatesDownloadImport $LastName ]; + :foreach SAN in=($CertVal->"subject-alt-name") do={ + :if ($ImportSuccess = false) do={ + :set LastName [ :pick $SAN ([ :find $SAN ":" ] + 1) [ :len $SAN ] ]; + :set ImportSuccess [ $CheckCertificatesDownloadImport $LastName ]; + } + } - :local CertNew [ /certificate/find where common-name=($CertVal->"common-name") fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ]; + :local CertNew [ /certificate/find where name~("^" . [ $EscapeForRegEx [ $UrlEncode $LastName ] ] . "\\.(p12|pem)_[0-9]+\$") \ + (common-name=($CertVal->"common-name") or subject-alt-name~("(^|\\W)(DNS|IP):" . [ $EscapeForRegEx $LastName ] . "(\\W|\$)")) \ + fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ]; :local CertNewVal [ /certificate/get $CertNew ]; :if ([ $CertificateAvailable ([ $ParseKeyValueStore ($CertNewVal->"issuer") ]->"CN") ] = false) do={ diff --git a/doc/check-certificates.md b/doc/check-certificates.md index 80f6aee..f295117 100644 --- a/doc/check-certificates.md +++ b/doc/check-certificates.md @@ -34,8 +34,9 @@ in `global-config-overlay`, these are the parameters: * `CertRenewUrl`: the url to download certificates from * `CertWarnTime`: on what remaining time to warn via notification -Certificates on the web server should be named `CN.pem` (`PEM` format) or -`CN.p12` (`PKCS#12` format). +Certificates on the web server should be named by their common name, like +`CN.pem` (`PEM` format) or`CN.p12` (`PKCS#12` format). Alternatively any +subject alternative name (aka *Subject Alt Name* or *SAN*) can be used. Also notification settings are required for [e-mail](mod/notification-email.md), diff --git a/global-functions.rsc b/global-functions.rsc index f75ed54..e682edc 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -12,7 +12,7 @@ :local 0 "global-functions"; # expected configuration version -:global ExpectedConfigVersion 97; +:global ExpectedConfigVersion 98; # global variables not to be changed by user :global GlobalFunctionsReady false; diff --git a/news-and-changes.rsc b/news-and-changes.rsc index d21ea6b..08ff3fb 100644 --- a/news-and-changes.rsc +++ b/news-and-changes.rsc @@ -11,6 +11,7 @@ :global GlobalConfigChanges { 96="Added support for notes in 'netwatch-notify', these are included verbatim into the notification."; 97="Modified 'dhcp-to-dns' to always add A records for names with mac address, and optionally add CNAME records if the host name is available."; + 98="Extended 'check-certificates' to download new certificate by SubjectAltNames if download by CommonName fails."; }; # Migration steps to be applied on script updates -- cgit v1.2.3-70-g09d2 From f14788a10444022ae0f7d0bea7839facf36128f1 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Thu, 6 Apr 2023 22:38:17 +0200 Subject: check-certificates: properly escape the name for regex --- check-certificates.rsc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/check-certificates.rsc b/check-certificates.rsc index 1a984bc..98a6cab 100644 --- a/check-certificates.rsc +++ b/check-certificates.rsc @@ -32,6 +32,7 @@ :global CertRenewPass; :global CertificateNameByCN; + :global EscapeForRegEx; :global LogPrintExit2; :global UrlEncode; :global WaitForFile; @@ -58,7 +59,7 @@ $LogPrintExit2 warning $0 ("Decryption failed for certificate file " . $CertFileName) false; } - :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") \ + :foreach CertInChain in=[ /certificate/find where name~("^" . [ $EscapeForRegEx $CertFileName ] . "_[0-9]+\$") \ common-name!=$Name !(subject-alt-name~("(^|\\W)(DNS|IP):" . [ $EscapeForRegEx $Name ] . "(\\W|\$)")) !(common-name=[]) ] do={ $CertificateNameByCN [ /certificate/get $CertInChain common-name ]; } -- cgit v1.2.3-70-g09d2