50 lines
1.4 KiB
Bash
50 lines
1.4 KiB
Bash
#!/bin/bash
|
|
|
|
LE_DOMAIN="DOMAIN"
|
|
LDAP_SHORTNAME="HOSTNAME"
|
|
UPDATE_MIKROTIK=0
|
|
MIKROTIK_HOST="mikrotik"
|
|
|
|
# Re-add the private key in LDAP *IMPORTANT*
|
|
|
|
/usr/sbin/dsctl "${LDAP_SHORTNAME}" tls import-server-key-cert /etc/letsencrypt/live/"${LE_DOMAIN}"/fullchain.pem \
|
|
/etc/letsencrypt/live/"${LE_DOMAIN}"/privkey.pem
|
|
|
|
# Re-import the certificate in the LDAP store
|
|
|
|
/usr/sbin/dsconf -v -D "cn=Directory Manager" "${LDAP_SHORTNAME}" security certificate add \
|
|
--file /etc/letsencrypt/live/"${LE_DOMAIN}"/cert.pem \
|
|
--primary-cert \
|
|
--name "LE"
|
|
|
|
systemctl restart dirsrv@${LDAP_SHORTNAME}
|
|
|
|
# Reload services
|
|
|
|
systemctl reload nginx
|
|
systemctl restart sssd
|
|
|
|
# Push the certificates to a Mikrotik AP
|
|
#NOTE: This assumes you have set up SSH for a user with public key auth
|
|
|
|
if [[ $UPDATE_MIKROTIK ]];
|
|
then
|
|
|
|
scp "/etc/letsencrypt/${LE_DOMAIN}/privkey.pem" "${MIKROTIK_HOST}":
|
|
scp "/etc/letsencrypt/${LE_DOMAIN}/fullchain.pem" "${MIKROTIK_HOST}":
|
|
|
|
ssh mikrotik -T <<EOF
|
|
/certificate remove fullchain.pem_0
|
|
/certificate import file-name=fullchain.pem passphrase=""
|
|
/certificate import file-name=privkey.pem passphrase=""
|
|
/file remove fullchain.pem
|
|
/file remove privkey.pem
|
|
EOF
|
|
|
|
# Do it twice or somehow the installation of the certificates goes wonky
|
|
ssh mikrotik -T <<EOF
|
|
/ip service set www-ssl certificate=fullchain.pem_0
|
|
/ip service set api-ssl certificate=fullchain.pem_0
|
|
EOF
|
|
|
|
fi
|