Setting tag myplc-5.3-5

[myplc.git] / plc.d / ssl

diff --git a/plc.d/ssl b/plc.d/ssl
index a9d22c7..f09294a 100755 (executable)
--- a/plc.d/ssl
+++ b/plc.d/ssl
@@ -1,14 +1,12 @@
 #!/bin/bash
 #
-# priority: 400
+# priority: 300
 #
 # Generate SSL certificates
 #
 # Mark Huang <mlhuang@cs.princeton.edu>
 # Copyright (C) 2006 The Trustees of Princeton University
 #
-# $Id$
-#
 
 # Source function library and configuration
 . /etc/plc.d/functions
@@ -21,10 +19,18 @@ set -x
 ssl_cname ()
 {
     openssl x509 -noout -in $1 -subject | \
-       sed -n -e 's@.*/CN=\([^/]*\).*@\1@p' | \
+       sed -e 's|.*CN *= *\([-_a-zA-Z0-9.]*\).*|\1|' | \
        lower
 }
 
+backup_file ()
+{
+    filepath=$1
+    filename=$(basename ${filepath})
+    dir=$(dirname ${filepath})
+    mv -f ${filepath} ${dir}/${filename}-`date +%Y-%m-%d-%H-%M-%S`.bak
+}
+
 # Verify a certificate. If invalid, generate a new self-signed
 # certificate.
 verify_or_generate_certificate() {
@@ -41,11 +47,12 @@ verify_or_generate_certificate() {
 
     if [ -f $crt ] ; then
        # Check if certificate is valid
-       verify=$(openssl verify -CAfile $ca $crt)
-       # Delete if invalid or if the subject has changed
-       if grep -q "error" <<<$verify || \
+       # Backup if invalid or if the subject has changed
+       if openssl verify -CAfile $ca $crt | grep -q "error" || \
            [ "$(ssl_cname $crt)" != "$cname" ] ; then
-           rm -f $crt $ca
+            backup_file $crt
+            backup_file $ca
+            backup_file $key
        fi
     fi
 
@@ -73,22 +80,30 @@ verify_or_generate_certificate() {
 
 case "$1" in
     start)
-       MESSAGE=$"Generating SSL certificates"
-       dialog "$MESSAGE"
 
        # Generate HTTPS certificates if necessary. We generate a
        # certificate for each enabled server with a different
        # hostname. These self-signed certificates may be overridden
        # later.
-       for server in WWW API BOOT ; do
-           ssl_key=PLC_${server}_SSL_KEY
+        MESSAGE=$"Generating SSL certificates for"
+        dialog "$MESSAGE"
+
+       for server in WWW API BOOT MONITOR; do
+           eval "a=\$PLC_${server}_ENABLED"
+            echo $a
+            if [ "$a" -ne 1 ] ; then
+               echo "Skipping"
+                continue
+            fi
+           dialog "$server"
+            ssl_key=PLC_${server}_SSL_KEY
            ssl_crt=PLC_${server}_SSL_CRT
            ca_ssl_crt=PLC_${server}_CA_SSL_CRT
            hostname=PLC_${server}_HOST
 
            # Check if we have already generated a certificate for
            # the same hostname.
-           for previous_server in WWW API BOOT ; do
+           for previous_server in WWW API BOOT MONITOR; do
                if [ "$server" = "$previous_server" ] ; then
                    break
                fi
@@ -115,20 +130,27 @@ case "$1" in
        # 4) and /etc/httpd/conf (Fedora Core 2). If the API, boot,
        # and web servers are all running on the same machine, the web
        # server certificate takes precedence.
-       for server in API BOOT WWW ; do
+       for server in API BOOT MONITOR WWW; do
            enabled=PLC_${server}_ENABLED
            if [ "${!enabled}" != "1" ] ; then
                continue
            fi
            ssl_key=PLC_${server}_SSL_KEY
            ssl_crt=PLC_${server}_SSL_CRT
+           ssl_ca_crt=PLC_${server}_CA_SSL_CRT
 
            symlink ${!ssl_crt} /etc/pki/tls/certs/localhost.crt
            symlink ${!ssl_key} /etc/pki/tls/private/localhost.key
+           symlink ${!ssl_ca_crt} /etc/pki/tls/certs/server-chain.crt
            symlink ${!ssl_crt} /etc/httpd/conf/ssl.crt/server.crt
            symlink ${!ssl_key} /etc/httpd/conf/ssl.key/server.key
        done
 
+       # Ensure that the server-chain gets used, as it is off by
+       # default.
+       sed -i -e 's/^#SSLCertificateChainFile /SSLCertificateChainFile /' \
+           /etc/httpd/conf.d/ssl.conf
+
        result "$MESSAGE"
        ;;
 esac