mirror.MikroTik/eworm.routeros-scripts
1
0
Fork 0
mirror of https://git.eworm.de/cgit/routeros-scripts synced 2025-06-21 09:25:42 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

check-certificates: download and import in a local function

Browse source
This commit is contained in:
Christian Hesse 2023-04-06 14:56:36 +02:00
parent 4073daa139
commit 11093045f3
1 changed files with 41 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

70
check-certificates.rsc
View file

@ -10,22 +10,58 @@
:global GlobalFunctionsReady; :global GlobalFunctionsReady;
:while ($GlobalFunctionsReady != true) do={ :delay 500ms; } :while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
:global CertRenewPass;
:global CertRenewTime; :global CertRenewTime;
:global CertRenewUrl; :global CertRenewUrl;
:global CertWarnTime; :global CertWarnTime;
:global Identity; :global Identity;
:global CertificateAvailable :global CertificateAvailable
:global CertificateNameByCN;
:global IfThenElse; :global IfThenElse;
:global LogPrintExit2; :global LogPrintExit2;
:global ParseKeyValueStore; :global ParseKeyValueStore;
:global SendNotification2; :global SendNotification2;
:global SymbolForNotification; :global SymbolForNotification;
:global WaitFullyConnected;
:local CheckCertificatesDownloadImport do={
:local Name [ :tostr $1 ];
:global CertRenewUrl;
:global CertRenewPass;
:global CertificateNameByCN;
:global LogPrintExit2;
:global UrlEncode; :global UrlEncode;
:global WaitForFile; :global WaitForFile;
:global WaitFullyConnected;
:foreach Type in={ ".pem"; ".p12" } do={
:local CertFileName ([ $UrlEncode $Name ] . $Type);
:do {
/tool/fetch check-certificate=yes-without-crl \
($CertRenewUrl . $CertFileName) dst-path=$CertFileName as-value;
$WaitForFile $CertFileName;
:local DecryptionFailed true;
:foreach PassPhrase in=$CertRenewPass do={
:local Result [ /certificate/import file-name=$CertFileName passphrase=$PassPhrase as-value ];
:if ($Result->"decryption-failures" = 0) do={
:set DecryptionFailed false;
}
}
/file/remove [ find where name=$CertFileName ];
:if ($DecryptionFailed = true) do={
$LogPrintExit2 warning $0 ("Decryption failed for certificate file " . $CertFileName) false;
}
:foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=$Name ] do={
$CertificateNameByCN [ /certificate/get $CertInChain common-name ];
}
} on-error={
$LogPrintExit2 debug $0 ("Could not download certificate file " . $CertFileName) false;
}
}
}
:local FormatInfo do={ :local FormatInfo do={
:local CertVal $1; :local CertVal $1;
@ -70,33 +106,7 @@ $WaitFullyConnected;
} }
$LogPrintExit2 info $0 ("Attempting to renew certificate " . ($CertVal->"name") . ".") false; $LogPrintExit2 info $0 ("Attempting to renew certificate " . ($CertVal->"name") . ".") false;
:foreach Type in={ ".pem"; ".p12" } do={ $CheckCertificatesDownloadImport ($CertVal->"common-name");
:local CertFileName ([ $UrlEncode ($CertVal->"common-name") ] . $Type);
:do {
/tool/fetch check-certificate=yes-without-crl \
($CertRenewUrl . $CertFileName) dst-path=$CertFileName as-value;
$WaitForFile $CertFileName;
:local DecryptionFailed true;
:foreach PassPhrase in=$CertRenewPass do={
:local Result [ /certificate/import file-name=$CertFileName passphrase=$PassPhrase as-value ];
:if ($Result->"decryption-failures" = 0) do={
:set DecryptionFailed false;
}
}
/file/remove [ find where name=$CertFileName ];
:if ($DecryptionFailed = true) do={
$LogPrintExit2 warning $0 ("Decryption failed for certificate file " . $CertFileName) false;
}
:foreach CertInChain in=[ /certificate/find where name~("^" . $CertFileName . "_[0-9]+\$") common-name!=($CertVal->"common-name") ] do={
$CertificateNameByCN [ /certificate/get $CertInChain common-name ];
}
} on-error={
$LogPrintExit2 debug $0 ("Could not download certificate file " . $CertFileName) false;
}
}
:local CertNew [ /certificate/find where common-name=($CertVal->"common-name") fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ]; :local CertNew [ /certificate/find where common-name=($CertVal->"common-name") fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ];
:local CertNewVal [ /certificate/get $CertNew ]; :local CertNewVal [ /certificate/get $CertNew ];