22

✏️ Editing: gen_fallback_cert

#!/bin/sh
#
# Generates the self-signed certificate at
# /etc/imunify360-webshield/ssl_certs/dummy.pem.
#
# The file is written only when it is absent or holds a certificate this script
# issued. Any other certificate found there is left untouched.
#
# Run from the packaging scriptlets of both package formats.

set -e

CERTS_DIR=/etc/imunify360-webshield/ssl_certs
DUMMY_PEM=$CERTS_DIR/dummy.pem
TEMP_DUMMY_PEM=$CERTS_DIR/dummy_.pem
OPENSSL_BIN=/opt/imunify360-webshield/openssl/bin/openssl

# ours reports whether the certificate at $DUMMY_PEM is one this script issued:
# self-signed, so subject and issuer match, and carrying the subject this script
# generates, a lone CN holding the host name.
ours() {
    subject=$("$OPENSSL_BIN" x509 -noout -subject -nameopt RFC2253 -in "$DUMMY_PEM" 2>/dev/null) || return 1
    issuer=$("$OPENSSL_BIN" x509 -noout -issuer -nameopt RFC2253 -in "$DUMMY_PEM" 2>/dev/null) || return 1

# OpenSSL pads the prefix before 1.1.0 ("subject= CN=host") and not after.
    subject=${subject#subject=}; subject=${subject# }
    issuer=${issuer#issuer=}; issuer=${issuer# }

[ "$subject" = "$issuer" ] || return 1
    [ "$subject" = "CN=$(uname -n)" ]
}

if [ -e "$DUMMY_PEM" ] && ! ours; then
    exit 0
fi

if "$OPENSSL_BIN" req -x509 -newkey rsa:4096 -keyout "$TEMP_DUMMY_PEM" -out "$TEMP_DUMMY_PEM" -days 365 -subj "/CN=$(uname -n)" -nodes >/dev/null 2>&1 \
   && "$OPENSSL_BIN" x509 -noout -in "$TEMP_DUMMY_PEM" >/dev/null 2>&1; then
    chmod 0600 "$TEMP_DUMMY_PEM"
    mv "$TEMP_DUMMY_PEM" "$DUMMY_PEM"
else
    echo "imunify360-webshield-bundle: failed to generate dummy.pem" >&2
    rm -f "$TEMP_DUMMY_PEM"
fi

exit 0

MR SKB