From 96170950222dd4e63b7bd01c3db3298b902c4c87 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 6 Apr 2023 15:19:23 +0200
Subject: check-certificates: try all SANs for download

---
 check-certificates.rsc    | 19 ++++++++++++++++---
 doc/check-certificates.md |  5 +++--
 global-functions.rsc      |  2 +-
 news-and-changes.rsc      |  1 +
 4 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/check-certificates.rsc b/check-certificates.rsc
index db1127c..1a984bc 100644
--- a/check-certificates.rsc
+++ b/check-certificates.rsc
@@ -16,11 +16,13 @@
 :global Identity;
 
 :global CertificateAvailable
+:global EscapeForRegEx;
 :global IfThenElse;
 :global LogPrintExit2;
 :global ParseKeyValueStore;
 :global SendNotification2;
 :global SymbolForNotification;
+:global UrlEncode;
 :global WaitFullyConnected;
 
 :local CheckCertificatesDownloadImport do={
@@ -56,7 +58,8 @@
         $LogPrintExit2 warning $0 ("Decryption failed for certificate file " . $CertFileName) false;
       }
 
-      :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=$Name !(common-name=[]) ] do={
+      :foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") \
+          common-name!=$Name !(subject-alt-name~("(^|\\W)(DNS|IP):" . [ $EscapeForRegEx $Name ] . "(\\W|\$)")) !(common-name=[]) ] do={
         $CertificateNameByCN [ /certificate/get $CertInChain common-name ];
       }
 
@@ -105,6 +108,7 @@ $WaitFullyConnected;
 
 :foreach Cert in=[ /certificate/find where !revoked !ca !scep-url expires-after<$CertRenewTime ] do={
   :local CertVal [ /certificate/get $Cert ];
+  :local LastName;
 
   :do {
     :if ([ :len $CertRenewUrl ] = 0) do={
@@ -113,9 +117,18 @@ $WaitFullyConnected;
     $LogPrintExit2 info $0 ("Attempting to renew certificate " . ($CertVal->"name") . ".") false;
 
     :local ImportSuccess false;
-    :set ImportSuccess [ $CheckCertificatesDownloadImport ($CertVal->"common-name") ];
+    :set LastName ($CertVal->"common-name");
+    :set ImportSuccess [ $CheckCertificatesDownloadImport $LastName ];
+    :foreach SAN in=($CertVal->"subject-alt-name") do={
+      :if ($ImportSuccess = false) do={
+        :set LastName [ :pick $SAN ([ :find $SAN ":" ] + 1) [ :len $SAN ] ];
+        :set ImportSuccess [ $CheckCertificatesDownloadImport $LastName ];
+      }
+    }
 
-    :local CertNew [ /certificate/find where common-name=($CertVal->"common-name") fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ];
+    :local CertNew [ /certificate/find where name~("^" . [ $EscapeForRegEx [ $UrlEncode $LastName ] ] . "\\.(p12|pem)_[0-9]+\$") \
+      (common-name=($CertVal->"common-name") or subject-alt-name~("(^|\\W)(DNS|IP):" . [ $EscapeForRegEx $LastName ] . "(\\W|\$)")) \
+      fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ];
     :local CertNewVal [ /certificate/get $CertNew ];
 
     :if ([ $CertificateAvailable ([ $ParseKeyValueStore ($CertNewVal->"issuer") ]->"CN") ] = false) do={
diff --git a/doc/check-certificates.md b/doc/check-certificates.md
index 80f6aee..f295117 100644
--- a/doc/check-certificates.md
+++ b/doc/check-certificates.md
@@ -34,8 +34,9 @@ in `global-config-overlay`, these are the parameters:
 * `CertRenewUrl`: the url to download certificates from
 * `CertWarnTime`: on what remaining time to warn via notification
 
-Certificates on the web server should be named `CN.pem` (`PEM` format) or
-`CN.p12` (`PKCS#12` format).
+Certificates on the web server should be named by their common name, like
+`CN.pem` (`PEM` format) or`CN.p12` (`PKCS#12` format). Alternatively any
+subject alternative name (aka *Subject Alt Name* or *SAN*) can be used.
 
 Also notification settings are required for
 [e-mail](mod/notification-email.md),
diff --git a/global-functions.rsc b/global-functions.rsc
index f75ed54..e682edc 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -12,7 +12,7 @@
 :local 0 "global-functions";
 
 # expected configuration version
-:global ExpectedConfigVersion 97;
+:global ExpectedConfigVersion 98;
 
 # global variables not to be changed by user
 :global GlobalFunctionsReady false;
diff --git a/news-and-changes.rsc b/news-and-changes.rsc
index d21ea6b..08ff3fb 100644
--- a/news-and-changes.rsc
+++ b/news-and-changes.rsc
@@ -11,6 +11,7 @@
 :global GlobalConfigChanges {
   96="Added support for notes in 'netwatch-notify', these are included verbatim into the notification.";
   97="Modified 'dhcp-to-dns' to always add A records for names with mac address, and optionally add CNAME records if the host name is available.";
+  98="Extended 'check-certificates' to download new certificate by SubjectAltNames if download by CommonName fails.";
 };
 
 # Migration steps to be applied on script updates
-- 
cgit v1.2.3-54-g00ecf