Busk: Created page with "# Simple example using pure bash .env ``` export PASSIN="" export AD_USER="" export AD_PASS="Your AD user pa..."

2023-04-14T15:08:14Z

Created page with "# Simple example using pure bash .env ``` export PASSIN="<Your venafi PKCS#12 download pfx file password>" export AD_USER="<Your AD username>" export AD_PASS="Your AD user pa..."

New page

# Simple example using pure bash

.env
```
export PASSIN="<Your venafi PKCS#12 download pfx file password>"
export AD_USER="<Your AD username>"
export AD_PASS="Your AD user password"
```

updateCerts.sh
```
#!/bin/bash
set -eu
ca_crt_file="~/ca.crt"
entity_crt_file="~/entity.crt"
entity_key_file="~/entity.key"

hosts=(
"foo.example.com"
)
# cn=$1

ssh_cmd(){
cmd=$1
sshpass -p "${AD_PASS}" ssh -l "${AD_USER}" $cn "${cmd}"
}

ssh_cmd_sudo(){
cmd=$1
sshpass -p "${AD_PASS}" ssh -l "${AD_USER}" $cn "echo ${AD_PASS} | sudo -S ${cmd}"
}

view_cmds=(
"openssl x509 -text -in ${entity_key_file}"
"openssl x509 -text -in ${entity_crt_file}"
"openssl x509 -text -in ${ca_crt_file}"
"openssl verify -verbose -CAfile ${ca_crt_file} ${entity_crt_file}"
)

extract_crts_keys_from_pfx(){
cn=$1
openssl pkcs12 -passin env:PASSIN -in ${cn}.pfx -nocerts -nodes > ${cn}.key.pem
openssl pkcs12 -passin env:PASSIN -in ${cn}.pfx -clcerts -nokeys > ${cn}.crt.pem
openssl pkcs12 -passin env:PASSIN -in ${cn}.pfx -cacerts -nokeys -chain > ${cn}.ca.crt.pem
}

update_certs(){
cn=$1

extract_crts_keys_from_pfx "${cn}"

ts=$(date "+%Y%m%d-%H%M")
echo "Updating host with cn: $cn"; sleep 1
sshpass -p "${AD_PASS}" scp ca.chains.crt $cn.* $cn:~/
# ssh_cmd_sudo "cp ${cn}.ca.crt.pem ${ca_crt_file}"
ssh_cmd_sudo "cp ca.chains.crt ${ca_crt_file}"
ssh_cmd_sudo "cp ${ca_crt_file} ${ca_crt_file}.bkp.${ts}"
ssh_cmd_sudo "cp ${entity_crt_file} ${entity_crt_file}.bkp.${ts}"
ssh_cmd_sudo "cp ${entity_key_file} ${entity_key_file}.bkp.${ts}"
ssh_cmd_sudo "cp ${cn}.key.pem ${entity_key_file}"
ssh_cmd_sudo "cp ${cn}.crt.pem ${entity_crt_file}"
}

main(){
for host in "${hosts[@]}"; do
echo updating "$host"; sleep 1
update_certs "${host}"
done
}

main
```

Cert extraction from pfx - Revision history

Busk: Created page with "# Simple example using pure bash .env ``` export PASSIN="" export AD_USER="" export AD_PASS="Your AD user pa..."