#!/bin/bash
while getopts d OPTION
do
case $OPTION in
d) DEBUG=true;;
?) printf "Usage: %s: $0 [-d]\n" $0
exit 2;;
esac
done
shift $(($OPTIND - 1))
HEADLESS=
tty >/dev/null || HEADLESS=true
if nginx -t 2>/dev/null ; then
[ ${HEADLESS} ] || echo "Nginx says everything's alright, so nothing to do" >&2
exit
fi
TMPDIR=`mktemp -t -d ${0//*\/}.XXXXXXXXXX`
TMPLOG=${TMPDIR}/log
echo "`date` start of script $0" >>${TMPLOG}
THISSCRIPT="`readlink -f $0`"
SCRIPTNAME=${THISSCRIPT##*/}
[ -z "${SCRIPTNAME}" ] && SCRIPTNAME=${0##*/}
LOG=/var/log/${SCRIPTNAME}.log
NGINX_FOLDER=/etc/nginx/conf.d
SYSTEM_FOLDER=/var/www/vhosts/system
CERT_FOLDER=/opt/psa/var/certificates
# Parse all the certificates and remember their CN's and filedates
find ${CERT_FOLDER} -maxdepth 1 -type f >${TMPDIR}/certfiles
while read CERTFILE ; do
CN="`openssl x509 -inform pem -in ${CERTFILE} -noout -text | grep -i 'Subject: CN=' | awk -F= '{print $2}'`"
[ -n "${CN}" ] && echo "${CN} ${CERTFILE}" >>${TMPDIR}/host_and_cert
echo "`date +%s -r ${CERTFILE}` ${CERTFILE}" >>${TMPDIR}/date_and_cert
done<${TMPDIR}/certfiles
alternate_repair() {
# get the server name out of the custom nginx config file
SERVER_NAME="`grep '^\s*server_name' ${TMPDIR}/configfile | head -n1 | awk '{print $2}' | sed 's/;//g'`"
MATCHING_CERT="`grep "^${SERVER_NAME} " ${TMPDIR}/host_and_cert | head -n1 | awk '{print $2}'`"
DATE_CERT="`grep ${MATCHING_CERT} ${TMPDIR}/date_and_cert | head -n1 | awk '{print $1}'`"
CLIENT_CERT="`grep "^${DATE_CERT} " ${TMPDIR}/date_and_cert | grep -v ${MATCHING_CERT} | head -n1 | awk '{print $2}'`"
echo "Found this cert to ${MATCHING_CERT} matching ${SERVER_NAME} using openssl" | tee -a ${TMPLOG} >&2
echo "Found this clientcert ${CLIENT_CERT} as it has the same filedate as ${MATCHING_CERT}" | tee -a ${TMPLOG} >&2
CN="`grep "${CLIENT_CERT}" ${TMPDIR}/host_and_cert | head -n1 | awk '{print $2}' | sed 's/;//g'`"
if [ -n "${CN}" ] ; then
echo "I'm undecisive as I have found the CN \"${CN}\" in the client certificate ${CLIENT_CERT}, which should not contain one" | tee -a ${TMPLOG} >&2
echo "I will therefore do nothing... nginx will probably stay broken" | tee -a ${TMPLOG} >&2
else
MATCH_C="${MATCHING_CERT##*/}"
CLIENT_C="${CLIENT_CERT##*/}"
if [ -z "${MATCH_C}" ] || [ -z "${CLIENT_C}" ] ; then
echo "Something wrong here with parsing the found certificates cert=\"${MATCH_C}\" clientcert=\"${CLIENT_C}\"" | tee -a ${TMPLOG} >&2
else
echo "Replace ${CERTFILE} with ${MATCH_C} in ${NGINX_CONF}" | tee -a ${TMPLOG} >&2
echo "Replace ${CLIENTFILE} with ${CLIENT_C} in ${NGINX_CONF}" | tee -a ${TMPLOG} >&2
sed -i "s/${CERTFILE}/${MATCH_C}/g" ${NGINX_CONF}
sed -i "s/${CLIENTFILE}/${CLIENT_C}/g" ${NGINX_CONF}
fi
fi
}
get_certfile() {
# Get the port 443 part of the custom nginx config file
grep -A30 ':443' ${NGINX_CONF} >${TMPDIR}/configfile
CERTFILE="`grep "^\s*ssl_certificate_key.*${CERT_FOLDER}" ${TMPDIR}/configfile | head -n1 | grep -o 'cert-.*' | sed 's/;//g'`"
CLIENTFILE="`grep "^\s*ssl_client_certificate.*${CERT_FOLDER}" ${TMPDIR}/configfile | head -n1 | grep -o 'cert-.*' | sed 's/;//g'`"
if [ -z "${CERTFILE}" ] ; then
echo "Parsing ${NGINX_CONF} gave no valid ssl_certificate_key, abort!!" | tee -a ${TMPLOG} >&2
return 1
fi
if [ -z "${CLIENTFILE}" ] ; then
echo "Parsing ${NGINX_CONF} gave no valid ssl_client_certificate, abort!!" | tee -a ${TMPLOG} >&2
return 1
fi
}
# Parse all the nginx.conf files in /var/www/vhosts/system and remember the ssl_cerficate_key
find ${SYSTEM_FOLDER} -type f -name nginx.conf -exec grep -l "${CERT_FOLDER}" {} \; >${TMPDIR}/nginxfiles
while read NGINX_CONF ; do
CERTFILE=
CLIENTFILE=
if get_certfile ; then
if [ ! -f "${CERTFILE}" ] ; then
echo "${CERTFILE} is missing in ${NGINX_CONF}"
echo "I will first let plesk try and repair it!"
SYSTEM_FOLDER="`echo "${NGINX_CONF}" | sed 's/.*system\///g;s/\/conf\/.*//g'`"
plesk repair web ${SYSTEM_FOLDER} -y -v
if nginx -t 2>/dev/null ; then
echo "Nginx says everything's alright, so I guess it was fixed by \"plesk repair web ${SYSTEM_FOLDER} -y -v\"" >&2
break
else
echo "Nginx still complains... The repair failed, or it's another host" | tee -a ${TMPLOG} >&2
if get_certfile ; then
if [ -f "${CERTFILE}" ] ; then
echo "The file ${CERTFILE} exists, so it's probably another host" | tee -a ${TMPLOG} >&2
else
echo "Plesk repair failed, so I will do my own method" | tee -a ${TMPLOG} >&2
alternate_repair
if nginx -t ; then
echo "Alternate repair succeeded, I can stop now" | tee -a ${TMPLOG} >&2
break
fi
fi
fi
fi
fi
fi
done<${TMPDIR}/nginxfiles
# Parse all the nginx.conf files in /etc/nginx/conf.d that start with ww* and remember the ssl_cerficate_key
find ${NGINX_FOLDER} -type f -name ww\*.conf -exec grep -l "${CERT_FOLDER}" {} \; >${TMPDIR}/nginxfiles
while read NGINX_CONF ; do
CERTFILE=
CLIENTFILE=
if get_certfile ; then
[ ${HEADLESS} ] || echo "${NGINX_CONF} ${CERTFILE} ${CLIENTFILE}"
if [ ! -f "${CERTFILE}" ] ; then
alternate_repair
if nginx -t 2>/dev/null ; then
echo "Alternate repair succeeded, I can stop now" | tee -a ${TMPLOG} >&2
break
else
echo "still wrong, maybe there are more..." | tee -a ${TMPLOG} >&2
fi
fi
fi
done<${TMPDIR}/nginxfiles
echo "`date` end of script $0" >>${TMPLOG}
cat ${TMPLOG} >>${LOG}
rm -rf ${TMPDIR}
Facebook
Twitter
