plc.d/ssl

   1 #!/bin/bash
   2 #
   3 # priority: 400
   4 #
   5 # Generate SSL certificates
   6 #
   7 # Mark Huang <mlhuang@cs.princeton.edu>
   8 # Copyright (C) 2006 The Trustees of Princeton University
   9 #
  10 # $Id: ssl,v 1.3 2006/04/07 04:28:16 mlhuang Exp $
  11 #
  12
  13 # Source function library and configuration
  14 . /etc/plc.d/functions
  15 . /etc/planetlab/plc_config
  16
  17 case "$1" in
  18     start)
  19         MESSAGE=$"Generating SSL certificates"
  20         dialog "$MESSAGE"
  21
  22         # Generate self-signed SSL certificate(s). These nice
  23         # commands come from the mod_ssl spec file for Fedora Core
  24         # 2. We generate a certificate for each enabled server
  25         # with a different hostname. These self-signed
  26         # certificates may be overridden later.
  27         for server in WWW API BOOT ; do
  28             ssl_key=PLC_${server}_SSL_KEY
  29             ssl_crt=PLC_${server}_SSL_CRT
  30             hostname=PLC_${server}_HOST
  31
  32             # Check if we have already generated a certificate for
  33             # the same hostname.
  34             for previous_server in WWW API BOOT ; do
  35                 if [ "$server" = "$previous_server" ] ; then
  36                     break
  37                 fi
  38                 previous_ssl_key=PLC_${previous_server}_SSL_KEY
  39                 previous_ssl_crt=PLC_${previous_server}_SSL_CRT
  40                 previous_hostname=PLC_${previous_server}_HOST
  41
  42                 if [ -f ${!previous_ssl_crt} ] && \
  43                     [ "$(ssl_cname ${!previous_ssl_crt})" = "${!hostname}" ] ; then
  44                     cp -a ${!previous_ssl_key} ${!ssl_key}
  45                     cp -a ${!previous_ssl_crt} ${!ssl_crt}
  46                     break
  47                 fi
  48             done
  49
  50             # Check if self signed certificate is valid
  51             if [ -f ${!ssl_crt} ] ; then
  52                 verify=$(openssl verify ${!ssl_crt})
  53                 # If self signed
  54                 if grep -q "self signed certificate" <<<$verify ; then
  55                     # Delete if expired or hostname changed
  56                     if grep -q "expired" <<<$verify || \
  57                         [ "$(ssl_cname ${!ssl_crt})" != "${!hostname}" ] ; then
  58                         rm -f ${!ssl_crt}
  59                     fi
  60                 else
  61                     echo "$verify" >&2
  62                 fi
  63             fi
  64
  65             # Generate new self signed certificate
  66             if [ ! -f ${!ssl_crt} ] ; then
  67                 mkdir -p $(dirname ${!ssl_crt})
  68                 openssl req -new -x509 -days 365 -set_serial $RANDOM \
  69                     -batch -subj "/CN=${!hostname}" \
  70                     -nodes -keyout ${!ssl_key} -out ${!ssl_crt}
  71                 check
  72                 chmod 644 ${!ssl_crt}
  73             fi
  74         done
  75
  76         # API requires a public key for slice ticket verification
  77         if [ ! -f $PLC_API_SSL_KEY_PUB ] ; then
  78             openssl rsa -pubout <$PLC_API_SSL_KEY >$PLC_API_SSL_KEY_PUB
  79             check
  80         fi
  81
  82         # Install into both /etc/pki (Fedora Core 4) and
  83         # /etc/httpd/conf (Fedora Core 2). If the API, boot, and
  84         # web servers are all running on the same machine, the web
  85         # server certificate takes precedence.
  86         for server in API BOOT WWW ; do
  87             enabled=PLC_${server}_ENABLED
  88             if [ "${!enabled}" != "1" ] ; then
  89                 continue
  90             fi
  91             ssl_key=PLC_${server}_SSL_KEY
  92             ssl_crt=PLC_${server}_SSL_CRT
  93
  94             symlink ${!ssl_crt} /etc/pki/tls/certs/localhost.crt
  95             symlink ${!ssl_key} /etc/pki/tls/private/localhost.key
  96             symlink ${!ssl_crt} /etc/httpd/conf/ssl.crt/server.crt
  97             symlink ${!ssl_key} /etc/httpd/conf/ssl.key/server.key
  98         done
  99
 100         result "$MESSAGE"
 101         ;;
 102 esac
 103
 104 exit $ERRORS