You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

245 lines
10 KiB

  1. #!/usr/bin/env sh
  2. # Here is a script to deploy cert on a Unifi Controller or Cloud Key device.
  3. # It supports:
  4. # - self-hosted Unifi Controller
  5. # - Unifi Cloud Key (Gen1/2/2+)
  6. # - Unifi Cloud Key running UnifiOS (v2.0.0+, Gen2/2+ only)
  7. # See below regarding keytool. Not tested.
  8. # - Unifi Dream Machine
  9. # This has not been tested on other "all-in-one" devices such as
  10. # UDM Pro or Unifi Express.
  11. #
  12. # OS Version v2.0.0+
  13. # Network Application version 7.0.0+
  14. # OS version ~3.1 removed java and keytool from the UnifiOS.
  15. # Using PKCS12 format keystore appears to work fine.
  16. #
  17. # Please report bugs to https://github.com/acmesh-official/acme.sh/issues/3359
  18. #returns 0 means success, otherwise error.
  19. # The deploy-hook automatically detects standard Unifi installations
  20. # for each of the supported environments. Most users should not need
  21. # to set any of these variables, but if you are running a self-hosted
  22. # Controller with custom locations, set these as necessary before running
  23. # the deploy hook. (Defaults shown below.)
  24. #
  25. # Settings for Unifi Controller:
  26. # Location of Java keystore or unifi.keystore.jks file:
  27. #DEPLOY_UNIFI_KEYSTORE="/usr/lib/unifi/data/keystore"
  28. # Keystore password (built into Unifi Controller, not a user-set password):
  29. #DEPLOY_UNIFI_KEYPASS="aircontrolenterprise"
  30. # Command to restart Unifi Controller:
  31. #DEPLOY_UNIFI_RELOAD="service unifi restart"
  32. #
  33. # Settings for Unifi Cloud Key Gen1 (nginx admin pages):
  34. # Directory where cloudkey.crt and cloudkey.key live:
  35. #DEPLOY_UNIFI_CLOUDKEY_CERTDIR="/etc/ssl/private"
  36. # Command to restart maintenance pages and Controller
  37. # (same setting as above, default is updated when running on Cloud Key Gen1):
  38. #DEPLOY_UNIFI_RELOAD="service nginx restart && service unifi restart"
  39. #
  40. # Settings for UnifiOS (Cloud Key Gen2):
  41. # Directory where unifi-core.crt and unifi-core.key live:
  42. #DEPLOY_UNIFI_CORE_CONFIG="/data/unifi-core/config/"
  43. # Command to restart unifi-core:
  44. #DEPLOY_UNIFI_RELOAD="systemctl restart unifi-core"
  45. #
  46. # At least one of DEPLOY_UNIFI_KEYSTORE, DEPLOY_UNIFI_CLOUDKEY_CERTDIR,
  47. # or DEPLOY_UNIFI_CORE_CONFIG must exist to receive the deployed certs.
  48. ######## Public functions #####################
  49. #domain keyfile certfile cafile fullchain
  50. unifi_deploy() {
  51. _cdomain="$1"
  52. _ckey="$2"
  53. _ccert="$3"
  54. _cca="$4"
  55. _cfullchain="$5"
  56. _debug _cdomain "$_cdomain"
  57. _debug _ckey "$_ckey"
  58. _debug _ccert "$_ccert"
  59. _debug _cca "$_cca"
  60. _debug _cfullchain "$_cfullchain"
  61. _getdeployconf DEPLOY_UNIFI_KEYSTORE
  62. _getdeployconf DEPLOY_UNIFI_KEYPASS
  63. _getdeployconf DEPLOY_UNIFI_CLOUDKEY_CERTDIR
  64. _getdeployconf DEPLOY_UNIFI_CORE_CONFIG
  65. _getdeployconf DEPLOY_UNIFI_RELOAD
  66. _debug2 DEPLOY_UNIFI_KEYSTORE "$DEPLOY_UNIFI_KEYSTORE"
  67. _debug2 DEPLOY_UNIFI_KEYPASS "$DEPLOY_UNIFI_KEYPASS"
  68. _debug2 DEPLOY_UNIFI_CLOUDKEY_CERTDIR "$DEPLOY_UNIFI_CLOUDKEY_CERTDIR"
  69. _debug2 DEPLOY_UNIFI_CORE_CONFIG "$DEPLOY_UNIFI_CORE_CONFIG"
  70. _debug2 DEPLOY_UNIFI_RELOAD "$DEPLOY_UNIFI_RELOAD"
  71. # Space-separated list of environments detected and installed:
  72. _services_updated=""
  73. # Default reload commands accumulated as we auto-detect environments:
  74. _reload_cmd=""
  75. # Unifi Controller environment (self hosted or any Cloud Key) --
  76. # auto-detect by file /usr/lib/unifi/data/keystore
  77. _unifi_keystore="${DEPLOY_UNIFI_KEYSTORE:-/usr/lib/unifi/data/keystore}"
  78. if [ -f "$_unifi_keystore" ]; then
  79. _debug _unifi_keystore "$_unifi_keystore"
  80. _info "Installing certificate for Unifi Controller (PKCS12 keystore)."
  81. if [ ! -w "$_unifi_keystore" ]; then
  82. _err "The file $_unifi_keystore is not writable, please change the permission."
  83. return 1
  84. fi
  85. _unifi_keypass="${DEPLOY_UNIFI_KEYPASS:-aircontrolenterprise}"
  86. _debug "Generate import pkcs12"
  87. _import_pkcs12="$(_mktemp)"
  88. _debug "_toPkcs $_import_pkcs12 $_ckey $_ccert $_cca $_unifi_keypass unifi root"
  89. _toPkcs "$_import_pkcs12" "$_ckey" "$_ccert" "$_cca" "$_unifi_keypass" unifi root
  90. # shellcheck disable=SC2181
  91. if [ "$?" != "0" ]; then
  92. _err "Error generating pkcs12. Please re-run with --debug and report a bug."
  93. return 1
  94. fi
  95. # Save the existing keystore in case something goes wrong.
  96. mv -f "${_unifi_keystore}" "${_unifi_keystore}"_original
  97. _info "Previous keystore saved to ${_unifi_keystore}_original."
  98. _debug "Copying new keystore to $_unifi_keystore"
  99. cp -f "$_import_pkcs12" "$_unifi_keystore"
  100. # Update unifi service for certificate cipher compatibility
  101. if ${ACME_OPENSSL_BIN:-openssl} pkcs12 \
  102. -in "$_import_pkcs12" \
  103. -password pass:aircontrolenterprise \
  104. -nokeys | ${ACME_OPENSSL_BIN:-openssl} x509 -text \
  105. -noout | grep -i "signature" | grep -iq ecdsa >/dev/null 2>&1; then
  106. cp -f /usr/lib/unifi/data/system.properties /usr/lib/unifi/data/system.properties_original
  107. _info "Updating system configuration for cipher compatibility."
  108. _info "Saved original system config to /usr/lib/unifi/data/system.properties_original"
  109. sed -i '/unifi\.https\.ciphers/d' /usr/lib/unifi/data/system.properties
  110. echo "unifi.https.ciphers=ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES128-GCM-SHA256" >>/usr/lib/unifi/data/system.properties
  111. sed -i '/unifi\.https\.sslEnabledProtocols/d' /usr/lib/unifi/data/system.properties
  112. echo "unifi.https.sslEnabledProtocols=TLSv1.3,TLSv1.2" >>/usr/lib/unifi/data/system.properties
  113. _info "System configuration updated."
  114. fi
  115. rm "$_import_pkcs12"
  116. # Restarting unifi-core will bring up unifi, doing it out of order results in
  117. # a certificate error.
  118. # Restart if we aren't doing unifi-core, otherwise stop for later restart.
  119. if systemctl -q is-active unifi; then
  120. if [ ! -f "${DEPLOY_UNIFI_CORE_CONFIG:-/data/unifi-core/config}/unifi-core.key" ]; then
  121. _reload_cmd="${_reload_cmd:+$_reload_cmd && }systemctl restart unifi"
  122. else
  123. _reload_cmd="${_reload_cmd:+$_reload_cmd && }systemctl stop unifi"
  124. fi
  125. fi
  126. _services_updated="${_services_updated} unifi"
  127. _info "Install Unifi Controller certificate success!"
  128. elif [ "$DEPLOY_UNIFI_KEYSTORE" ]; then
  129. _err "The specified DEPLOY_UNIFI_KEYSTORE='$DEPLOY_UNIFI_KEYSTORE' is not valid, please check."
  130. return 1
  131. fi
  132. # Cloud Key environment (non-UnifiOS -- nginx serves admin pages) --
  133. # auto-detect by file /etc/ssl/private/cloudkey.key:
  134. _cloudkey_certdir="${DEPLOY_UNIFI_CLOUDKEY_CERTDIR:-/etc/ssl/private}"
  135. if [ -f "${_cloudkey_certdir}/cloudkey.key" ]; then
  136. _info "Installing certificate for Cloud Key Gen1 (nginx admin pages)"
  137. _debug _cloudkey_certdir "$_cloudkey_certdir"
  138. if [ ! -w "$_cloudkey_certdir" ]; then
  139. _err "The directory $_cloudkey_certdir is not writable; please check permissions."
  140. return 1
  141. fi
  142. # Cloud Key expects to load the keystore from /etc/ssl/private/unifi.keystore.jks.
  143. # Normally /usr/lib/unifi/data/keystore is a symlink there (so the keystore was
  144. # updated above), but if not, we don't know how to handle this installation:
  145. if ! cmp -s "$_unifi_keystore" "${_cloudkey_certdir}/unifi.keystore.jks"; then
  146. _err "Unsupported Cloud Key configuration: keystore not found at '${_cloudkey_certdir}/unifi.keystore.jks'"
  147. return 1
  148. fi
  149. cat "$_cfullchain" >"${_cloudkey_certdir}/cloudkey.crt"
  150. cat "$_ckey" >"${_cloudkey_certdir}/cloudkey.key"
  151. (cd "$_cloudkey_certdir" && tar -cf cert.tar cloudkey.crt cloudkey.key unifi.keystore.jks)
  152. if systemctl -q is-active nginx; then
  153. _reload_cmd="${_reload_cmd:+$_reload_cmd && }service nginx restart"
  154. fi
  155. _info "Install Cloud Key Gen1 certificate success!"
  156. _services_updated="${_services_updated} nginx"
  157. elif [ "$DEPLOY_UNIFI_CLOUDKEY_CERTDIR" ]; then
  158. _err "The specified DEPLOY_UNIFI_CLOUDKEY_CERTDIR='$DEPLOY_UNIFI_CLOUDKEY_CERTDIR' is not valid, please check."
  159. return 1
  160. fi
  161. # UnifiOS environment -- auto-detect by /data/unifi-core/config/unifi-core.key:
  162. _unifi_core_config="${DEPLOY_UNIFI_CORE_CONFIG:-/data/unifi-core/config}"
  163. if [ -f "${_unifi_core_config}/unifi-core.key" ]; then
  164. _info "Installing certificate for UnifiOS"
  165. _debug _unifi_core_config "$_unifi_core_config"
  166. if [ ! -w "$_unifi_core_config" ]; then
  167. _err "The directory $_unifi_core_config is not writable; please check permissions."
  168. return 1
  169. fi
  170. # Save the existing certs in case something goes wrong.
  171. cp -f "${_unifi_core_config}"/unifi-core.crt "${_unifi_core_config}"/unifi-core_original.crt
  172. cp -f "${_unifi_core_config}"/unifi-core.key "${_unifi_core_config}"/unifi-core_original.key
  173. _info "Previous certificate and key saved to ${_unifi_core_config}/unifi-core_original.crt/key."
  174. cat "$_cfullchain" >"${_unifi_core_config}/unifi-core.crt"
  175. cat "$_ckey" >"${_unifi_core_config}/unifi-core.key"
  176. if systemctl -q is-active unifi-core; then
  177. _reload_cmd="${_reload_cmd:+$_reload_cmd && }systemctl restart unifi-core"
  178. fi
  179. _info "Install UnifiOS certificate success!"
  180. _services_updated="${_services_updated} unifi-core"
  181. elif [ "$DEPLOY_UNIFI_CORE_CONFIG" ]; then
  182. _err "The specified DEPLOY_UNIFI_CORE_CONFIG='$DEPLOY_UNIFI_CORE_CONFIG' is not valid, please check."
  183. return 1
  184. fi
  185. if [ -z "$_services_updated" ]; then
  186. # None of the Unifi environments were auto-detected, so no deployment has occurred
  187. # (and none of DEPLOY_UNIFI_{KEYSTORE,CLOUDKEY_CERTDIR,CORE_CONFIG} were set).
  188. _err "Unable to detect Unifi environment in standard location."
  189. _err "(This deploy hook must be run on the Unifi device, not a remote machine.)"
  190. _err "For non-standard Unifi installations, set DEPLOY_UNIFI_KEYSTORE,"
  191. _err "DEPLOY_UNIFI_CLOUDKEY_CERTDIR, and/or DEPLOY_UNIFI_CORE_CONFIG as appropriate."
  192. return 1
  193. fi
  194. _reload_cmd="${DEPLOY_UNIFI_RELOAD:-$_reload_cmd}"
  195. if [ -z "$_reload_cmd" ]; then
  196. _err "Certificates were installed for services:${_services_updated},"
  197. _err "but none appear to be active. Please set DEPLOY_UNIFI_RELOAD"
  198. _err "to a command that will restart the necessary services."
  199. return 1
  200. fi
  201. _info "Reload services (this may take some time): $_reload_cmd"
  202. if eval "$_reload_cmd"; then
  203. _info "Reload success!"
  204. else
  205. _err "Reload error"
  206. return 1
  207. fi
  208. # Successful, so save all (non-default) config:
  209. _savedeployconf DEPLOY_UNIFI_KEYSTORE "$DEPLOY_UNIFI_KEYSTORE"
  210. _savedeployconf DEPLOY_UNIFI_KEYPASS "$DEPLOY_UNIFI_KEYPASS"
  211. _savedeployconf DEPLOY_UNIFI_CLOUDKEY_CERTDIR "$DEPLOY_UNIFI_CLOUDKEY_CERTDIR"
  212. _savedeployconf DEPLOY_UNIFI_CORE_CONFIG "$DEPLOY_UNIFI_CORE_CONFIG"
  213. _savedeployconf DEPLOY_UNIFI_RELOAD "$DEPLOY_UNIFI_RELOAD"
  214. return 0
  215. }