Вы не можете выбрать более 25 тем Темы должны начинаться с буквы или цифры, могут содержать дефисы(-) и должны содержать не более 35 символов.

import_cert 3.9KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495
  1. #!/usr/bin/env bash
  2. PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  3. . /usr/unifi/functions
  4. if [[ ! -d "${CERTDIR}" || ! -f "${CERTDIR}/${CERTNAME}" ]]; then
  5. exit 0
  6. fi
  7. log 'Cert directory found. Checking Certs'
  8. if `md5sum -c "${CERTDIR}/${CERTNAME}.md5" &>/dev/null`; then
  9. log "Cert has not changed, not updating controller."
  10. exit 0
  11. else
  12. if [ ! -e "${DATADIR}/keystore" ]; then
  13. log "WARN: Missing keystore, creating a new one"
  14. if [ ! -d "${DATADIR}" ]; then
  15. log "Missing data directory, creating..."
  16. mkdir "${DATADIR}"
  17. fi
  18. keytool -genkey -keyalg RSA -alias unifi -keystore "${DATADIR}/keystore" \
  19. -storepass aircontrolenterprise -keypass aircontrolenterprise -validity 1825 \
  20. -keysize 4096 -dname "cn=UniFi"
  21. fi
  22. TEMPFILE=$(mktemp)
  23. TMPLIST="${TEMPFILE}"
  24. CERTTEMPFILE=$(mktemp)
  25. TMPLIST+=" ${CERTTEMPFILE}"
  26. CERTURI=$(openssl x509 -noout -ocsp_uri -in "${CERTDIR}/${CERTNAME}")
  27. # Identrust cross-signed CA cert needed by the java keystore for import.
  28. # Can get original here: https://www.identrust.com/certificates/trustid/root-download-x3.html
  29. cat > "${CERTTEMPFILE}" <<'_EOF'
  30. -----BEGIN CERTIFICATE-----
  31. MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/
  32. MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
  33. DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow
  34. PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD
  35. Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
  36. AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O
  37. rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq
  38. OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b
  39. xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw
  40. 7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD
  41. aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
  42. HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG
  43. SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69
  44. ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr
  45. AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz
  46. R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5
  47. JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo
  48. Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ
  49. -----END CERTIFICATE-----
  50. _EOF
  51. log "Cert has changed, updating controller..."
  52. md5sum "${CERTDIR}/${CERTNAME}" > "${CERTDIR}/${CERTNAME}.md5"
  53. log "Using openssl to prepare certificate..."
  54. CHAIN=$(mktemp)
  55. TMPLIST+=" ${CHAIN}"
  56. if [[ "${CERTURI}" == *"letsencrypt"* && "$CERT_IS_CHAIN" == "true" ]]; then
  57. awk 1 "${CERTTEMPFILE}" "${CERTDIR}/${CERTNAME}" >> "${CHAIN}"
  58. elif [[ "${CERTURI}" == *"letsencrypt"* ]]; then
  59. awk 1 "${CERTTEMPFILE}" "${CERTDIR}/chain.pem" "${CERTDIR}/${CERTNAME}" >> "${CHAIN}"
  60. elif [[ -f "${CERTDIR}/ca.pem" ]]; then
  61. awk 1 "${CERTDIR}/ca.pem" "${CERTDIR}/chain.pem" "${CERTDIR}/${CERTNAME}" >> "${CHAIN}"
  62. else
  63. awk 1 "${CERTDIR}/chain.pem" "${CERTDIR}/${CERTNAME}" >> "${CHAIN}"
  64. fi
  65. openssl pkcs12 -export -passout pass:aircontrolenterprise \
  66. -in "${CHAIN}" \
  67. -inkey "${CERTDIR}/${CERT_PRIVATE_NAME}" \
  68. -out "${TEMPFILE}" -name unifi
  69. log "Removing existing certificate from Unifi protected keystore..."
  70. keytool -delete -alias unifi -keystore "${DATADIR}/keystore" \
  71. -deststorepass aircontrolenterprise
  72. log "Inserting certificate into Unifi keystore..."
  73. keytool -trustcacerts -importkeystore \
  74. -deststorepass aircontrolenterprise \
  75. -destkeypass aircontrolenterprise \
  76. -destkeystore "${DATADIR}/keystore" \
  77. -srckeystore "${TEMPFILE}" -srcstoretype PKCS12 \
  78. -srcstorepass aircontrolenterprise \
  79. -alias unifi
  80. log "Cleaning up temp files"
  81. for file in ${TMPLIST}; do
  82. rm -f "${file}"
  83. done
  84. log "Done!"
  85. fi