mirror.MikroTik/eworm.routeros-scripts
1
0
Fork 0
mirror of https://git.eworm.de/cgit/routeros-scripts synced 2025-06-21 09:25:42 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

check-certificates: pass real and modified name into function

Browse source
This commit is contained in:
Christian Hesse 2025-01-31 21:33:57 +01:00
parent 75e5ddec52
commit eabe3f6e95
1 changed files with 13 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

22
check-certificates.rsc
View file

@ -34,7 +34,8 @@
:local CheckCertificatesDownloadImport do={ :local CheckCertificatesDownloadImport do={
:local ScriptName [ :tostr $1 ]; :local ScriptName [ :tostr $1 ];
:local Name [ :tostr $2 ]; :local CertName [ :tostr $2 ];
:local FetchName [ :tostr $3 ];
:global CertRenewUrl; :global CertRenewUrl;
:global CertRenewPass; :global CertRenewPass;
@ -49,7 +50,7 @@
:local Return false; :local Return false;
:foreach Type in={ ".pem"; ".p12" } do={ :foreach Type in={ ".pem"; ".p12" } do={
:local CertFileName ([ $UrlEncode $Name ] . $Type); :local CertFileName ([ $UrlEncode $FetchName ] . $Type);
:do { :do {
/tool/fetch check-certificate=yes-without-crl http-header-field=({ [ $FetchUserAgentStr $ScriptName ] }) \ /tool/fetch check-certificate=yes-without-crl http-header-field=({ [ $FetchUserAgentStr $ScriptName ] }) \
($CertRenewUrl . $CertFileName) dst-path=$CertFileName as-value; ($CertRenewUrl . $CertFileName) dst-path=$CertFileName as-value;
@ -68,9 +69,9 @@
$LogPrint warning $ScriptName ("Decryption failed for certificate file '" . $CertFileName . "'."); $LogPrint warning $ScriptName ("Decryption failed for certificate file '" . $CertFileName . "'.");
} }
:foreach CertInChain in=[ /certificate/find where common-name!=$Name !private-key \ :foreach CertInChain in=[ /certificate/find where common-name!=$CertName !private-key \
name~("^" . [ $EscapeForRegEx $CertFileName ] . "_[0-9]+\$") \ name~("^" . [ $EscapeForRegEx $CertFileName ] . "_[0-9]+\$") \
!(subject-alt-name~("(^|\\W)(DNS|IP):" . [ $EscapeForRegEx $Name ] . "(\\W|\$)")) \ !(subject-alt-name~("(^|\\W)(DNS|IP):" . [ $EscapeForRegEx $CertName ] . "(\\W|\$)")) \
!(common-name=[]) ] do={ !(common-name=[]) ] do={
$CertificateNameByCN [ /certificate/get $CertInChain common-name ]; $CertificateNameByCN [ /certificate/get $CertInChain common-name ];
} }
@ -145,6 +146,7 @@
:foreach Cert in=[ /certificate/find where !revoked !ca !scep-url expires-after<$CertRenewTime ] do={ :foreach Cert in=[ /certificate/find where !revoked !ca !scep-url expires-after<$CertRenewTime ] do={
:local CertVal [ /certificate/get $Cert ]; :local CertVal [ /certificate/get $Cert ];
:local LastName; :local LastName;
:local FetchName;
:do { :do {
:if ([ :len $CertRenewUrl ] = 0) do={ :if ([ :len $CertRenewUrl ] = 0) do={
@ -155,14 +157,16 @@
:local ImportSuccess false; :local ImportSuccess false;
:set LastName ($CertVal->"common-name"); :set LastName ($CertVal->"common-name");
:set ImportSuccess [ $CheckCertificatesDownloadImport $ScriptName $LastName ]; :set FetchName $LastName;
:set ImportSuccess [ $CheckCertificatesDownloadImport $ScriptName $LastName $FetchName ];
:foreach SAN in=($CertVal->"subject-alt-name") do={ :foreach SAN in=($CertVal->"subject-alt-name") do={
:if ($ImportSuccess = false) do={ :if ($ImportSuccess = false) do={
:set LastName [ :pick $SAN ([ :find $SAN ":" ] + 1) [ :len $SAN ] ]; :set LastName [ :pick $SAN ([ :find $SAN ":" ] + 1) [ :len $SAN ] ];
:set ImportSuccess [ $CheckCertificatesDownloadImport $ScriptName $LastName ]; :set FetchName $LastName;
:set ImportSuccess [ $CheckCertificatesDownloadImport $ScriptName $LastName $FetchName ];
:if ($ImportSuccess = false && [ :pick $LastName 0 ] = "*") do={ :if ($ImportSuccess = false && [ :pick $LastName 0 ] = "*") do={
:set LastName ("star." . [ :pick $LastName 2 [ :len $LastName ] ]); :set FetchName ("star." . [ :pick $LastName 2 [ :len $LastName ] ]);
:set ImportSuccess [ $CheckCertificatesDownloadImport $ScriptName $LastName ]; :set ImportSuccess [ $CheckCertificatesDownloadImport $ScriptName $LastName $FetchName ];
} }
} }
} }
@ -174,7 +178,7 @@
} else={ } else={
$LogPrint debug $ScriptName ("Certificate '" . $CertVal->"name" . "' was not updated, but replaced."); $LogPrint debug $ScriptName ("Certificate '" . $CertVal->"name" . "' was not updated, but replaced.");
:local CertNew [ /certificate/find where name~("^" . [ $EscapeForRegEx [ $UrlEncode $LastName ] ] . "\\.(p12|pem)_[0-9]+\$") \ :local CertNew [ /certificate/find where name~("^" . [ $EscapeForRegEx [ $UrlEncode $FetchName ] ] . "\\.(p12|pem)_[0-9]+\$") \
(common-name=($CertVal->"common-name") or subject-alt-name~("(^|\\W)(DNS|IP):" . [ $EscapeForRegEx $LastName ] . "(\\W|\$)")) \ (common-name=($CertVal->"common-name") or subject-alt-name~("(^|\\W)(DNS|IP):" . [ $EscapeForRegEx $LastName ] . "(\\W|\$)")) \
fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ]; fingerprint!=[ :tostr ($CertVal->"fingerprint") ] expires-after>$CertRenewTime ];
:local CertNewVal [ /certificate/get $CertNew ]; :local CertNewVal [ /certificate/get $CertNew ];