path: root/lets-ca.sh

#!/bin/bash
set -euo pipefail
IFS=$'\n\t'
#############

# This script creates a key and csr, and uses acme-tiny to have the csr signed
# with lets encrypt.

# by Dennis Eriksen, dennis@eriksen.im, 2015-12-16

#############




################################################################################

# TODO

################################################################################

# Handling of getopts. If you trigger -b after -r, -b doesn't count. Also, you
# don't want to be able to trigger -s and -r, etc.

# There should probably be a file indicating which domains each cert is valid 
# for.. Like $domain/SAN, with an entry for each domain.


################################################################################

# Config 

################################################################################

readonly CERTDIR="/etc/letsencrypt/certs"
readonly CERTDEST="/etc/ssl/letsencrypt"
readonly OPENSSLCONF="/etc/letsencrypt/openssl.cnf"
readonly ACCOUNTKEY="/etc/letsencrypt/account.key"
readonly -a ARGS=("$@")

readonly LETSCAUSER="letsencrypt"
readonly LETSCAGROUP="letsencrypt"

readonly CERTKEYOWNER="root"
readonly CERTGROUP="ssl-cert"



readonly INTERMEDIATE="/etc/ssl/lets-encrypt-x3-cross-signed.pem"


readonly ACMETINY="/usr/local/sbin/acme_tiny.py"

readonly CHALLENGEDIR="/var/www/letsencrypt-challenges"

readonly NGINXCONFSUFFIX=""

BATCHMODE=FALSE

QUIET=FALSE

################################################################################

# Usage

################################################################################

usage() {
  echo "Yes. This is Usage. Hello."
}



################################################################################

# say

################################################################################

echo() {
  if [[ ! "$QUIET" == TRUE ]]; then
    builtin echo $1
  fi
}



################################################################################

# cmdline

################################################################################

cmdline() {

  local bflag=FALSE
  local dflag=FALSE
  local qflag=FALSE
  local rflag=FALSE
  local sflag=FALSE

  while getopts "xqhbr:s:d:" OPTION
  do
    case ${OPTION} in
      b)
        bflag=TRUE
        BATCHMODE=TRUE
        ;;
      h)
        usage
        exit 0
        ;;
      x)
        readonly DEBUG='-x'
        echo "-x was triggered"
        echo "\${ARGS{[@]} = ${ARGS[@]}"
        set -x
        ;;
      s)
        sflag=TRUE
        sign ${OPTARG}
        ;;
      d)
        dflag=TRUE
        deploy ${OPTARG}
        ;;
      q)
        QUIET=TRUE
        ;;
      r)
        rflag=TRUE
        req ${OPTARG} 
        ;;
      \?)
        usage && exit 1
        ;;
      :)
        usage && exit 1
        ;;
    esac
  done
  shift $((OPTIND-1))

  if [[ "$bflag" == TRUE ]] && [[ ! "$rflag" == TRUE ]]; then
    echo "-b is only used with -r."
    echo ""
    usage && exit 1
  fi

  return 0
}


################################################################################

# deploy

################################################################################

deploy() {
  local domain=""

  # Domains are provided separated by spaces.
  IFS=' ' read -r -a domain <<< $1

  if [[ ! ${#domain[@]} == 1 ]]; then
    echo "-d only takes one domain."
    exit 1
  elif [[ ! -d "$CERTDIR/${domain[0]}" ]]; then
    echo "\"${domain[0]}\" does not exist in $CERTDIR"
    exit 1
  elif [[ ! -f "$CERTDIR/${domain[0]}/${domain[0]}.key" ]]; then
    echo "${domain[0]}.key seems to be missing."
    exit 1
  elif [[ ! -f "$CERTDIR/${domain[0]}/${domain[0]}.crt" ]]; then
    echo "${domain[0]}.crt seems to be missing."
    echo "Are you sure you've signed the CSR?"
    exit 1
  fi

  if [[ ! -d "$CERTDEST" ]]; then
    mkdir -p $CERTDEST
    chgrp $CERTGROUP $CERTDEST
  fi


  # Lets's copy!
  echo "Copying ${domain[0]}.crt and ${domain[0]}.key to $CERTDEST"
  cp --preserve=all $CERTDIR/${domain[0]}/${domain[0]}.{crt,key} $CERTDEST

  # If the certificate is meant for nginx, we want to combine the cert and the
  # intermediary certificate.
  if [[ -f "/etc/nginx/sites-enabled/${domain[0]}$NGINXCONFSUFFIX" ]] || \
     [[ -f "$CERTDEST/${domain[0]}.pem" ]]; then
    echo "Detected nginx-config for ${domain[0]}, or existing pem-file."
    echo "Moving crt to pem, and appending intermediate certificate."
    mv $CERTDEST/${domain[0]}.crt $CERTDEST/${domain[0]}.pem
    cat $INTERMEDIATE >> $CERTDEST/${domain[0]}.pem
  fi

  echo ""
  echo "Deployment finished. You should probably reload your configuration."


  exit 0


}


################################################################################

# req

################################################################################

req() {
  local domain=""
  local i=0
  local batch=""

  # Domains are provided separated by spaces.
  IFS=' ' read -r -a domain <<< $1

  # Is batchmode triggered?
  [[ "$BATCHMODE" == TRUE ]] && batch="-batch"

  if [[ -z "$CERTDIR" ]] || [[ -z "${domain[0]}" ]]; then
    echo "\$CERTDIR and/or \${domain[0]} is empty. Something is wrong."
    exit 1
  fi

  if [[ ! -d $CERTDIR ]]; then
    mkdir -p $CERTDIR
    chmod 750 $CERTDIR
    chown $LETSCAUSER:$CERTGROUP $CERTDIR
  fi

  if [[ -d "$CERTDIR/${domain[0]}" ]]; then
    echo "The directory $CERTDIR/${domain[0]} already exists."
    echo "If you continue, it will be deleted."
    echo ""
    read -p "Press Y to continue, or any other button to abort." -n 1 -r

      if [[ ! "$REPLY" =~ ^[Yy]$ ]]; then
        echo "Okay then. Live long and prosper."
        exit 1
      else
        echo ""
        rm -r "$CERTDIR/${domain[0]}" && mkdir -p "$CERTDIR/${domain[0]}"
      fi

  else
    mkdir -p "$CERTDIR/${domain[0]}"
  fi

  # if there is only one domain
  if [[ ${#domain[@]} == 1 ]]; then
    echo "Only one domain - ${domain[0]}"
    openssl req -new -sha256 -nodes -out $CERTDIR/${domain[0]}/${domain[0]}.csr\
      -keyout $CERTDIR/${domain[0]}/${domain[0]}.key -config <(cat $OPENSSLCONF\
      | sed -r "s/REPLACE/${domain[0]}/") $batch

  # if there is more than one domain
  else
    echo "Several domains: "

    SANtext="[SAN]\nsubjectAltName="

    for SAN in "${domain[@]}"; do

      # Echo both to stdout and to SAN-file in cert-dir.
      echo "$SAN" | tee -a "$CERTDIR/${domain[0]}/SAN"

      if [[ ! "$SAN" == "${domain[0]}" ]]; then
        ((i+=1)) && [[ $i > 1 ]] && SANtext+=","
        SANtext+="DNS:$SAN"
      fi
    done
    echo "Common Name will be ${domain[0]}"
    echo $SANtext

    openssl req -new -sha256 -nodes -out $CERTDIR/${domain[0]}/${domain[0]}.csr\
      -keyout $CERTDIR/${domain[0]}/${domain[0]}.key -reqexts SAN -config <(cat\
      $OPENSSLCONF <(printf "$SANtext") | sed -r "s/REPLACE/${domain[0]}/") \
      $batch

  fi

  chown -R $LETSCAUSER:$CERTGROUP $CERTDIR/${domain[0]}
  chmod 750 $CERTDIR/${domain[0]}

  chown $CERTKEYOWNER:$CERTGROUP $CERTDIR/${domain[0]}/${domain[0]}.key
  chmod 440 $CERTDIR/${domain[0]}/${domain[0]}.{csr,key}

  exit 0

}



################################################################################

# sign

################################################################################

sign() {
  local domain=""

  # Domains are provided separated by spaces.
  IFS=' ' read -r -a domain <<< $1

  if [[ ! ${#domain[@]} == 1 ]]; then
    echo "-s only takes one domain."
    exit 1
  elif [[ ! -d "$CERTDIR/${domain[0]}" ]]; then
    echo "\"${domain[0]}\" does not exist in $CERTDIR"
    exit 1
  elif [[ ! -f "$CERTDIR/${domain[0]}/${domain[0]}.key" ]] || \
       [[ ! -f "$CERTDIR/${domain[0]}/${domain[0]}.csr" ]]; then
    echo "The CSR or KEY for ${domain[0]} seems to be missing."
    echo "Are you sure you've created the request?"
    exit 1
  fi

  if [[ ! "$QUIET" == TRUE ]]; then
    echo "Have you remembered to point the address"
    echo ""
    echo "${domain[0]}/.well-known/acme-challenge/"
    echo ""
    echo "to your challenges-directory? - $CHALLENGEDIR"
    echo "See https://github.com/diafygi/acme-tiny#step-3-make-your-website-host"\
         "-challenge-files for more info."
    echo ""
    echo "If the directory isn't available at the above address, "\
         "the signing will fail."
    echo ""

    read -p "Press Y to continue, or any other button to abort." -n 1 -r
    if [[ ! "$REPLY" =~ ^[Yy]$ ]]; then
      echo "Okay then. Live long and prosper."
      exit 1
    fi
  fi

  sudo -u $LETSCAUSER -H python $ACMETINY --account-key $ACCOUNTKEY \
    --csr $CERTDIR/${domain[0]}/${domain[0]}.csr --acme-dir $CHALLENGEDIR \
    > $CERTDIR/${domain[0]}/${domain[0]}.crt

  chown $LETSCAUSER:$CERTGROUP $CERTDIR/${domain[0]}/${domain[0]}.crt 


  exit 0

}



################################################################################

# main

################################################################################

main() {

cmdline ${ARGS[@]}

}



main
exit 0