mirror.MikroTik/eworm.routeros-scripts
1
0
Fork 0
mirror of https://git.eworm.de/cgit/routeros-scripts synced 2025-06-23 18:18:38 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

global-functions: $CertificateDownload: try fallback to mkcert.org

Browse source 
There's a nice API that allows to download certificate by exact common
name. Let's use that, as a fallback at least.

https://mkcert.org/
This commit is contained in:
Christian Hesse 2024-06-20 12:25:26 +02:00
parent b35c7b6703
commit cdb553d39b
2 changed files with 31 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

41
global-functions.rsc
View file

@ -12,7 +12,7 @@
:local ScriptName [ :jobname ]; :local ScriptName [ :jobname ];
# expected configuration version # expected configuration version
:global ExpectedConfigVersion 130; :global ExpectedConfigVersion 131;
# global variables not to be changed by user # global variables not to be changed by user
:global GlobalFunctionsReady false; :global GlobalFunctionsReady false;
@ -135,6 +135,7 @@
:global ScriptUpdatesBaseUrl; :global ScriptUpdatesBaseUrl;
:global ScriptUpdatesUrlSuffix; :global ScriptUpdatesUrlSuffix;
:global CertificateAvailable;
:global CertificateNameByCN; :global CertificateNameByCN;
:global CleanName; :global CleanName;
:global FetchUserAgentStr; :global FetchUserAgentStr;
@ -143,22 +144,40 @@
$LogPrint info $0 ("Downloading and importing certificate with " . \ $LogPrint info $0 ("Downloading and importing certificate with " . \
"CommonName '" . $CommonName . "'."); "CommonName '" . $CommonName . "'.");
:local FileName ([ $CleanName $CommonName ] . ".pem");
:do { :do {
:local FileName ([ $CleanName $CommonName ] . ".pem");
/tool/fetch check-certificate=yes-without-crl http-header-field=({ [ $FetchUserAgentStr $0 ] }) \ /tool/fetch check-certificate=yes-without-crl http-header-field=({ [ $FetchUserAgentStr $0 ] }) \
($ScriptUpdatesBaseUrl . "certs/" . $FileName . $ScriptUpdatesUrlSuffix) \ ($ScriptUpdatesBaseUrl . "certs/" . $FileName . $ScriptUpdatesUrlSuffix) \
dst-path=$FileName as-value; dst-path=$FileName as-value;
$WaitForFile $FileName; $WaitForFile $FileName;
/certificate/import file-name=$FileName passphrase="" as-value;
:delay 1s;
/file/remove [ find where name=$FileName ];
:foreach Cert in=[ /certificate/find where name~("^" . $FileName . "_[0-9]+\$") ] do={
$CertificateNameByCN [ /certificate/get $Cert common-name ];
}
} on-error={ } on-error={
$LogPrint warning $0 ("Failed importing certificate with CommonName '" . $CommonName . "'!"); $LogPrint warning $0 ("Failed downloading certificate with CommonName '" . $CommonName . \
:return false; "' from repository! Trying fallback to mkcert.org...");
:do {
:if ([ $CertificateAvailable "ISRG Root X1" ] = false) do={
$LogPrint error $0 ("Downloading required certificate failed.");
:return false;
}
/tool/fetch check-certificate=yes-without-crl http-header-field=({ [ $FetchUserAgentStr $0 ] }) \
"https://mkcert.org/generate/" http-data=[ :serialize to=json ({ $CommonName }) ] \
dst-path=$FileName as-value;
$WaitForFile $FileName;
:if ([ /file/get $FileName size ] = 0) do={
/file/remove $FileName;
:error false;
}
} on-error={
$LogPrint warning $0 ("Failed downloading certificate with CommonName '" . $CommonName . "'!");
:return false;
}
}
/certificate/import file-name=$FileName passphrase="" as-value;
:delay 1s;
/file/remove [ find where name=$FileName ];
:foreach Cert in=[ /certificate/find where name~("^" . $FileName . "_[0-9]+\$") ] do={
$CertificateNameByCN [ /certificate/get $Cert common-name ];
} }
:return true; :return true;
} }

1
news-and-changes.rsc
View file

@ -55,6 +55,7 @@
128="Added another list from blocklist.de to default configuration for 'fw-addr-lists'."; 128="Added another list from blocklist.de to default configuration for 'fw-addr-lists'.";
129="Extended 'backup-partition' to support RouterOS copy-over - interactively or before feature update."; 129="Extended 'backup-partition' to support RouterOS copy-over - interactively or before feature update.";
130="Dropped intermediate certificates, depending on just root certificates now."; 130="Dropped intermediate certificates, depending on just root certificates now.";
131="Enhanced certificate download to fallback to mkcert.org, so all (commonly trusted) root certificates are available now.";
}; };
# Migration steps to be applied on script updates # Migration steps to be applied on script updates