1

We have an HaProxy setup in our company, and this works with SSL (certbot / crt-list.txt). We want an automated task that reads the file crt-list.txt and takes out the Domain Name as a variable. What we will do with this variable? The variable is needed for requesting automated Certificate renewal. HaProxy needs an specific PEM file for this, so we can't use the auto renewal from certbot.

The text file is in this Format

/etc/haproxy/certs/domainname.pem www.domainname.de  
/etc/haproxy/certs/domainname2.pem domainname2.de  
/etc/haproxy/certs/domainname3.pem www.domainname3.com

with multiple lines.

The script should read each line, and extract the Domainname in the 2nd column and create a variable named $Domain. This $Domain Variable is used for the autorenewal feature, so it can go line by line and renews the Certificate for every known Domain in crt-list.txt

I'm new to shell Programming, so how we can realize this? I've already created a script for Certificate request and transformation into .pem files. That was simple, but this script is a little bit complicated for me because I'm not familiar in variables and so on.

The original script is like this:

#!/bin/bash
#Script for Certificate Creation & Renewal v1.2
#Written by Nicolay Braetter - VRS Media

#Frage nach dem Domainnamen

clear

    echo "======================================================================================================================================"
    echo "===                                   CERTBOT - SSL ZERTIFIKATSERSTELLUNG MITTELS LETSENCRYPT                                      ==="
    echo "======================================================================================================================================"
    echo "======================================================================================================================================"
    echo "===                                  ERSTELLT VON NICOLAY BRAETTER - VRS - MEDIA GMBH & CO. KG                                     ==="
    echo "======================================================================================================================================"
    echo "======================================================================================================================================"
    echo -e "\033[31m===                           Z E R T S T A R T . S H === V 1 . 2 === N O   S Y N C   T O   S L A V E                              ===\033[0m"
    echo "======================================================================================================================================"
    echo " "
    echo " "

read -p "Wie lautet der Domain Name ? " dom

sleep 1

#Lösche alle vorhandenen Domain Daten

echo " "
echo " "
echo -e "\033[31mLoesche eventuell vorhandene Zertifikats Daten !!!\033[0m"
echo "=================================================="
echo " "
echo " "

sleep 1

rm /etc/haproxy/certs/$dom.pem
rm -r /etc/letsencrypt/archive/$dom
rm -r /etc/letsencrypt/live/$dom
rm /etc/letsencrypt/renewal/$dom.conf
echo " "
echo " "
echo " "
echo " "

#Starte den Zertifikatsabruf

/etc/haproxy/plugins/certbot-auto certonly --account ea8c0fffa25109ed61530312a8bb5384 --text --webroot --webroot-path /var/lib/haproxy -d $dom --renew-by-default --agree-tos --email serveradmin@vrsmedia.com

#Schreibe das Zertifikat ins /etc/haproxy/certs Verzeichnis

cat /etc/letsencrypt/live/$dom/privkey.pem /etc/letsencrypt/live/$dom/fullchain.pem | tee /etc/haproxy/certs/$dom.pem >/dev/null

echo " "
echo " "
echo -e "\033[31m=== E I N E N   K L E I N E N   A U G E N B L I C K   B I T T E   !!! ===\033[0m"
echo "========================================================================="

sleep 2

#Prüft ob die Zertifikatsdatei vorhanden ist und mindestens 1 byte grösse besitzt

if [ -s /etc/haproxy/certs/$dom.pem ] ; then

echo " "
echo " "
echo "=== P R U E F E   O B   E R S T E L L T E S   Z E R T I F I K A T   F U N K T I O N A L   I S T   !!! ==="
echo "========================================================================================================="

sleep 2

#AUSGABE ZERTIFIKAT OK MIT EINTRAG IN /ETC/HAPROXY/CRT-LIST.TXT

    clear

    echo " "
    echo " "
    echo "Das Zertifikat für die Domain" $dom "wurde erstellt"
    echo "======================================================================================================================================"
    echo "Der Eintrag für die Domain" $dom "wird in der Datei /etc/haproxy/crt-list.txt angelegt !!!"
    echo " "
    echo "======================================================================================================================================"
    echo " "
    echo " "
    echo "EINTRAG WIRD IN CRT-LIST.TXT GESUCHT UND ENTFERNT !!!"

#Umschreiben der crt-list.txt Datei
grep -v "/etc/haproxy/certs/$dom.pem $dom" /etc/haproxy/crt-list.txt > /etc/haproxy/crt_list_read.txt

sleep 1

cp /etc/haproxy/crt_list_read.txt /etc/haproxy/crt-list.txt

sleep 1

#Löschen der Temporären crt-list_read.txt

rm /etc/haproxy/crt_list_read.txt

#Anlegen des Domaineintrags in crt-list.txt

    echo " "
    echo " "
    echo "DOMAINEINTRAG WIRD ANGELEGT !!!"
    echo "/etc/haproxy/certs/$dom.pem" $dom >> /etc/haproxy/crt-list.txt
    echo " "
    echo " "
    sleep 1
    echo "======================================================================================================================================"
    echo "Die Domain" $dom "wurde der Datei /etc/haproxy/crt-list.txt hinzugefuegt !!!"
    echo "Zeilencode: /etc/haproxy/certs/$dom.pem $dom"
    echo " "
    echo "Bitte Ueberpruefen sie dies noch einmal manuell und entfernen evtl. Dubletten aus der .txt Datei"
    echo ". . . . . ."
    echo "Vielen Dank fuer das erstellen des Zertifikates !"
    echo " "
    echo " "
    echo "Ein neustart von HaProxy ist zwingend erforderlich !!! >> service haproxy restart"
    sleep 1
    echo " "
    echo "======================================================================================================================================"
    echo "===== D I E S E R   W I R D   J E T Z T   D U R C H G E F U E H R T   ! ! !"
    echo "======================================================================================================================================"

    sleep 1

#Neustart des HaProxy

service haproxy reload

    echo " "
    echo " "
    echo -e "                  \033[31mH  a  P  r  o  x  y     w  u  r  d  e    n  e  u    g  e  s  t  a  r  t  e  t    ! ! !\033[0m                              "
    echo " "
    echo "======================================================================================================================================"
    echo "=====                     ALLES NOTWENDIGE FUER DIE ERSTELLUNG DES ZERTIFIKATES IST ABGESCHLOSSEN                                ====="
    echo "======================================================================================================================================"

#Synchronisation zum Slave PROXY

    sleep 2

    echo "===== VERZEICHNISSE WERDEN JETZT ZUM SLAVE PROXY UEBERTRAGEN ! ! !"
    echo "======================================================================================================================================"
    echo " "

#rsync --delete --stats -arpve  "ssh -i /home/admin/.ssh/id_rsa -p 2255" /etc/letsencrypt admin@10.14.206.11:/etc
#rsync --delete --stats -arpve  "ssh -i /home/admin/.ssh/id_rsa -p 2255" /etc/haproxy admin@10.14.206.11:/etc

#bash /root/scripts/sync_lencrypt.sh &
bash /root/scripts/sync_proxy.sh &

    sleep 2

    echo " "
    echo "===== DIE UEBERTRAGUNG IST ABGESCHLOSSEN - DER SLAVE PROXY MUSS NUN NOCH EINEN RESTART ERHALTEN !!!"
    echo "======================================================================================================================================"

else

#AUSGABE ZERTIFIKAT NICHT OK

    clear
    echo -e "\033[31m=====================================================================================================================================\033[0m"
    echo -e "\033[31m===  F E H L E R === F E H L E R === F E H L E R === F E H L E R === F E H L E R === F E H L E R === F E H L E R === F E H L E R  ===\033[0m"
    echo -e "\033[31m=====================================================================================================================================\033[0m"
    echo " "
    echo " "
    echo "====================================================================================================================================="
    echo "Das abrufen des Zertifikates fuer die Domain" $dom "ist f e h l g e s c h l a g e n   ! ! !"
    echo " "
    echo "Versuchen Sie es erneut, und Ueberpruefen Sie ob die Domain" $dom "auch auf den Loadbalancer geroutet ist !!!"
    echo " "
    echo " "
    echo -e "\033[31mE s   w u r d e n   k e i n e   D a t e i e n   v e r a e n d e r t   ! ! !\033[0m"
    echo 


  "===============================================================================
  ======================================================"

  fi
0
while read X Domain
do
  echo $Domain | gencertreq
done < crt-list.txt

gencertreq is your script.

  • And This little Part reads it line by Line, and creates for every Domain an new request !? – Nicolay Braetter Jan 23 '18 at 14:40
  • It does. Do you want one call for all the domains? – Gerard H. Pille Jan 23 '18 at 14:42
  • Yes. One Call. It should work later on in an Cronjob for automatic renewal. I will add above the original script. Just a moment. – Nicolay Braetter Jan 23 '18 at 14:43
  • How does your script accept multiple domains? Read input or commandline parameters? – Gerard H. Pille Jan 23 '18 at 14:44
  • Your script can only handle one domain, but reads input. I'll change mine. So it's not "One Call", your script needs to be called for each domain. My script performs the loop. – Gerard H. Pille Jan 23 '18 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.