You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
95 lines
3.1 KiB
95 lines
3.1 KiB
#!/usr/bin/bash
|
|
# Deploys a certificate to the XAPI service of the XCP-ng hypervisor.
|
|
# Further documentation: https://xcp-ng.org/docs/guides.html#tls-certificate-for-xcp-ng
|
|
|
|
XAPI_SSL_PATH="/etc/xensource/xapi-ssl.pem"
|
|
XCP_NG_BACKUP_DIR="/tmp/$(uuidgen)"
|
|
|
|
# xcp-ng_deploy deploys the new certificate to XCP-ng.
|
|
xcp-ng_deploy() {
|
|
_cdomain="$1"
|
|
_ckey="$2"
|
|
_ccert="$3"
|
|
_cca="$4"
|
|
_cfullchain="$5"
|
|
|
|
_debug _cdomain "$_cdomain"
|
|
_debug _ckey "$_ckey"
|
|
_debug _ccert "$_ccert"
|
|
_debug _cca "$_cca"
|
|
_debug _cfullchain "$_cfullchain"
|
|
|
|
if [[ $(_xcp-ng_backup_certificate) -ne 0 ]]; then
|
|
return 1
|
|
fi
|
|
_debug "Deploying certificate with 'xe host-server-certificate-install'"
|
|
|
|
if [[ $(sudo xe host-server-certificate-install certificate="${_ccert}" private-key="${_ckey}" certificate-chain="${_cca}") -ne 0 ]]; then
|
|
if [[ $(_xcp-ng_backup_restore) -eq 0 ]]; then
|
|
xcp-ng_backup_delete 2>&1
|
|
fi
|
|
return 1
|
|
fi
|
|
_info "Certificate was deployed successfully."
|
|
_xcp-ng_backup_delete 2>&1
|
|
return 0
|
|
}
|
|
|
|
# _xcp-ng_backup_certificate saves the current certificate to a temporary folder.
|
|
# The folder can be read/ written by the current user only (chmod 600).
|
|
_xcp-ng_backup_certificate() {
|
|
if [[ $(whoami) != "root" ]]; then
|
|
_debug "Running as non-root user. Certificate backup not supported."
|
|
exit 0
|
|
fi
|
|
_debug "Setting up temporary directory for backing up current certificate in '${XCP_NG_BACKUP_DIR}'"
|
|
if [[ $(mkdir -m 600 "${XCP_NG_BACKUP_DIR}") -ne 0 ]]; then
|
|
_err "Could not create temporary directory to backup the current key."
|
|
return 1
|
|
fi
|
|
_debug "Moving current certificate to backup directory."
|
|
if [[ $(mv ${XAPI_SSL_PATH} "${XCP_NG_BACKUP_DIR}") -ne 0 ]]; then
|
|
_err "Could not move current certificate to backup directory."
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
# _xcp-ng_backup_restore restores the backup made by _xcp-ng_backup_certificate.
|
|
# It is called when something went wrong deploying the certificate.
|
|
_xcp-ng_backup_restore() {
|
|
if [[ $(mv "${XCP_NG_BACKUP_DIR}/xapi-ssl.pem" "${XAPI_SSL_PATH}") -eq 0 ]]; then
|
|
_info "Certificate restoration successful."
|
|
return 0
|
|
else
|
|
_err "Certificate restoration from '${XCP-NG_BACKUP_DIR}' not possible."
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
# _xcp-ng_backup_delete deletes the backup folder.
|
|
_xcp-ng_backup_delete() {
|
|
if [[ $(rm -rf "${XCP_NG_BACKUP_DIR}") -eq 0 ]]; then
|
|
_debug "Certificate backup deleted."
|
|
else
|
|
_err "Could not delete Backup in '${XCP_NG_BACKUP_DIR}'. Please remove it manually."
|
|
fi
|
|
}
|
|
|
|
# _xcp-ng_xapi_restart restarts the XAPI service the certificate was deployed to.
|
|
# This is only neeeded when the old certificate had to be restored.
|
|
_xcp-ng_xapi_restart() {
|
|
if [[ $(systemctl restart xapi) -ne 0 ]]; then
|
|
_err "XAPI did not restart properly after deployment. Restoring old certificate for now."
|
|
if [[ $(_xcp-ng_backup_restore) -ne 0 ]]; then
|
|
_err "Could not restore the old certificate!!!"
|
|
fi
|
|
if [[ $(systemctl restart xapi) -ne 0 ]]; then
|
|
_err "XAPI did not start after restoring the old certifiate!!!"
|
|
fi
|
|
return 1
|
|
else
|
|
_debug "XAPI was restarted successfully."
|
|
return 0
|
|
fi
|
|
}
|