47 lines
1.8 KiB
Bash
47 lines
1.8 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
CERT_DIR="/etc/fc-signage-player"
|
|
NODE_JSON="/etc/flowercore/signage-node.json"
|
|
SIGNAGE_URL="${FC_SIGNAGE_URL:-https://signage.iamworkin.lan}"
|
|
|
|
[[ -s "$CERT_DIR/client.crt" ]] || { echo "no cert to renew"; exit 0; }
|
|
|
|
if openssl x509 -in "$CERT_DIR/client.crt" -checkend $((30*24*3600)) -noout; then
|
|
exit 0
|
|
fi
|
|
|
|
NODE_ID=$(jq -r '.nodeId' "$NODE_JSON")
|
|
NEW_KEY="$CERT_DIR/client.key.new"
|
|
NEW_CSR="$CERT_DIR/client.csr.new"
|
|
|
|
openssl ecparam -genkey -name prime256v1 -out "$NEW_KEY"
|
|
openssl req -new -key "$NEW_KEY" -out "$NEW_CSR" \
|
|
-subj "/CN=${NODE_ID}/O=FlowerCore/OU=SignagePlayer-Pi"
|
|
|
|
HTTP_STATUS=$(curl -sk -o /tmp/renew-response.json -w "%{http_code}" \
|
|
--cert "$CERT_DIR/client.crt" --key "$CERT_DIR/client.key" \
|
|
-X POST "${SIGNAGE_URL}/api/v1/nodes/${NODE_ID}/renew" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$(jq -n --arg csr "$(cat "$NEW_CSR")" '{certificateSigningRequest: $csr}')")
|
|
|
|
if [[ "$HTTP_STATUS" != "200" && "$HTTP_STATUS" != "201" ]]; then
|
|
echo "[$(date -Is)] renew: failed HTTP $HTTP_STATUS; leaving old cert in place" >&2
|
|
exit 5
|
|
fi
|
|
|
|
jq -r '.clientCertificatePem // .signedCertificatePem' /tmp/renew-response.json > "$CERT_DIR/client.crt.new"
|
|
jq -r '.caCertificatePem' /tmp/renew-response.json > "$CERT_DIR/ca-chain.pem.new"
|
|
P12_PASS=$(cat "$CERT_DIR/client.p12.pass")
|
|
openssl pkcs12 -export -inkey "$NEW_KEY" -in "$CERT_DIR/client.crt.new" \
|
|
-certfile "$CERT_DIR/ca-chain.pem.new" \
|
|
-out "$CERT_DIR/client.p12.new" -password "pass:${P12_PASS}"
|
|
|
|
mv "$CERT_DIR/client.key.new" "$CERT_DIR/client.key"
|
|
mv "$CERT_DIR/client.crt.new" "$CERT_DIR/client.crt"
|
|
mv "$CERT_DIR/ca-chain.pem.new" "$CERT_DIR/ca-chain.pem"
|
|
mv "$CERT_DIR/client.p12.new" "$CERT_DIR/client.p12"
|
|
|
|
chown fc-signage:fc-signage "$CERT_DIR"/client.*
|
|
systemctl restart flowercore-signage-player-pi.service
|