diff --git a/README.md b/README.md index 81e53541071a2c398a3d6ded43fed032bbebfa11..c340b79d390e1e3331f56d5fe4e1581ca7ad758a 100644 --- a/README.md +++ b/README.md @@ -33,7 +33,7 @@ Usage: Options: -h --help Show this screen - -v --version Print version exit + -v --version Print version and exit -b --build Print version and build information and exit --redis-token=REDISTOKEN Redis access token --vault-token=VAULTTOKEN Vault access token diff --git a/main.go b/main.go index 9fca71574cb58d43acf500e6be0c1c10eb560036..ad17bad0e3d52b6fb8dbf30eeecfe108c2e438e2 100644 --- a/main.go +++ b/main.go @@ -1,13 +1,13 @@ package main import ( + "crypto/tls" "crypto/x509" "encoding/pem" "fmt" "io/ioutil" "net/http" "os" - "os/exec" "os/user" "path/filepath" "runtime" @@ -172,74 +172,17 @@ func checkCertificates(dnsname string, certificate string, fullchain string, ca return true } -// check if priv key matches the publick key -func checkPrivkey(privkey string, pubcert string, opensslbinary string, fail bool, silent bool) bool { - _, errOpenssl := exec.Command(opensslbinary, "help").Output() - if errOpenssl != nil { - fmt.Printf("[WARN] skipping private key matching check: please install OpenSSL: %v\n", errOpenssl) - } else { - certPubKey, errCertPubKey := exec.Command(opensslbinary, "x509", "-noout", "-pubkey", "-in", pubcert).Output() - if errCertPubKey != nil { - if fail == true { - fmt.Printf("[ERR] running openssl against %s: %s\n", pubcert, errCertPubKey) - appExit(255) - } else { - return false - } - } - certPrivKey, errCertPrivKey := exec.Command(opensslbinary, "pkey", "-pubout", "-in", privkey).Output() - if errCertPrivKey != nil { - if fail == true { - fmt.Printf("[ERR] running openssl against %s: %s\n", privkey, errCertPrivKey) - appExit(255) - } else { - return false - } - } - pubkeyOutput := string(certPubKey[:]) - privkeyOutput := string(certPrivKey[:]) - if pubkeyOutput != privkeyOutput { - if fail == true { - fmt.Printf("[ERR] the private key %v does not match the the public certificate %v\n", privkey, pubcert) - appExit(255) - } - } - } - return true -} - -// check if priv key matches the publick key -/* +// check if the private key matches the publick key func checkPrivkey(privkey string, pubkey string, fail bool) bool { - // extract data from public key - pubkeyByte, errpubkey := ioutil.ReadFile(pubkey) - if errpubkey != nil { - fmt.Printf("[ERR] reading private key %v: %v\n", pubkey, errpubkey) + _, errFileExist := os.Stat(privkey) + if os.IsNotExist(errFileExist) { + fmt.Printf("[ERR] could not access the private key %v\n", privkey) appExit(255) } - block, _ := pem.Decode(pubkeyByte) - cert, _ = x509.ParseCertificate(block.Bytes) - rsaPublicKey := cert.PublicKey.(*rsa.PublicKey) - rsaPublicKeyString := fmt.Sprintf(rsaPublicKey.N.String()) - - // extract data from private key - privkeyByte, errprivkey := ioutil.ReadFile(privkey) - if errprivkey != nil { - fmt.Printf("[ERR] reading private key %v: %v\n", privkey, errprivkey) - appExit(255) - } - fmt.Printf("primo passaggio\n") - - keyBlock, _ := pem.Decode(privkeyByte) - key, _ = x509.ParseCertificate(keyBlock.Bytes) - rsaPrivateKey := key.PublicKey.(*rsa.PrivateKey) - rsaPrivateKeyString := fmt.Sprintf(rsaPrivateKey.N.String()) - - fmt.Printf("primo passaggio") - - if rsaPublicKeyString != rsaPrivateKeyString { - if fail == true { - fmt.Printf("[ERR] the private key %v does not match the the public key %v\n", privkey, pubkey) + _, err := tls.LoadX509KeyPair(pubkey, privkey) + if fail == true { + if err != nil { + fmt.Printf("[ERR] the private key %v does not match the the public certificate %v\n", privkey, pubkey) appExit(255) } else { return false @@ -247,7 +190,6 @@ func checkPrivkey(privkey string, pubkey string, fail bool) bool { } return true } -*/ // get redis key func GetRedisKey(redisurl string, redistoken string) string { @@ -385,9 +327,8 @@ Usage: Options: -h --help Show this screen - -v --version Print version exit + -v --version Print version and exit -b --build Print version and build information and exit - -s --silent Suppress warnings --redis-token=REDISTOKEN Redis access token --vault-token=VAULTTOKEN Vault access token --cert-name=CERTNAME Certificate name @@ -407,10 +348,6 @@ Options: fmt.Printf("acme-downloader version: %v, built on: %v\n", appVersion, buildTime) appExit(0) } - silent := false - if arguments["--silent"] == true { - silent = true - } if runtime.GOOS == "windows" { opensslBinary = "openssl.exe" @@ -482,8 +419,7 @@ Options: // check if there is a certificate installed and it is valid existingCert := checkCertificates(CertName, certificateDestination, fullchainDestination, caDestination, keyDestination, Days, false) - // existingKey := checkPrivkey(keyDestination, certificateDestination, false) - existingKey := checkPrivkey(keyDestination, certificateDestination, opensslBinary, false, silent) + existingKey := checkPrivkey(keyDestination, certificateDestination, false) if existingCert == true && existingKey == true { fmt.Printf("[INFO] the certificate is still valid\n") appExit(0) @@ -500,8 +436,7 @@ Options: WriteToFile(privKey, tmpKeyDestination, 0640) checkCertificates(CertName, tmpCertificateDestination, tmpFullchainDestination, tmpCaDestination, tmpKeyDestination, Days, true) - //checkPrivkey(tmpKeyDestination, tmpCertificateDestination, true) - checkPrivkey(tmpKeyDestination, tmpCertificateDestination, opensslBinary, true, silent) + checkPrivkey(tmpKeyDestination, tmpCertificateDestination, true) // move certificates in place moveFile(tmpCertificateDestination, certificateDestination, GroupID, 0644, 0755) @@ -509,7 +444,8 @@ Options: moveFile(tmpCaDestination, caDestination, GroupID, 0644, 0755) moveFile(tmpKeyDestination, keyDestination, GroupID, 0640, 0750) - // Exit 64 means application needs to be reloaded + // Exit 64: it means that the certificate was replaced + // in this case you can reloaded the application to read the new certificate appExit(64) }