­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ #!/bin/sh # # Generates the self-signed certificate at # /etc/imunify360-webshield/ssl_certs/dummy.pem. # # The file is written only when it is absent or holds a certificate this script # issued. Any other certificate found there is left untouched. # # Run from the packaging scriptlets of both package formats. set -e CERTS_DIR=/etc/imunify360-webshield/ssl_certs DUMMY_PEM=$CERTS_DIR/dummy.pem TEMP_DUMMY_PEM=$CERTS_DIR/dummy_.pem OPENSSL_BIN=/opt/imunify360-webshield/openssl/bin/openssl # ours reports whether the certificate at $DUMMY_PEM is one this script issued: # self-signed, so subject and issuer match, and carrying the subject this script # generates, a lone CN holding the host name. ours() { subject=$("$OPENSSL_BIN" x509 -noout -subject -nameopt RFC2253 -in "$DUMMY_PEM" 2>/dev/null) || return 1 issuer=$("$OPENSSL_BIN" x509 -noout -issuer -nameopt RFC2253 -in "$DUMMY_PEM" 2>/dev/null) || return 1 # OpenSSL pads the prefix before 1.1.0 ("subject= CN=host") and not after. subject=${subject#subject=}; subject=${subject# } issuer=${issuer#issuer=}; issuer=${issuer# } [ "$subject" = "$issuer" ] || return 1 [ "$subject" = "CN=$(uname -n)" ] } if [ -e "$DUMMY_PEM" ] && ! ours; then exit 0 fi if "$OPENSSL_BIN" req -x509 -newkey rsa:4096 -keyout "$TEMP_DUMMY_PEM" -out "$TEMP_DUMMY_PEM" -days 365 -subj "/CN=$(uname -n)" -nodes >/dev/null 2>&1 \ && "$OPENSSL_BIN" x509 -noout -in "$TEMP_DUMMY_PEM" >/dev/null 2>&1; then chmod 0600 "$TEMP_DUMMY_PEM" mv "$TEMP_DUMMY_PEM" "$DUMMY_PEM" else echo "imunify360-webshield-bundle: failed to generate dummy.pem" >&2 rm -f "$TEMP_DUMMY_PEM" fi exit 0