Page MenuHomeDevCentral
Files F49748157

D4216.id11063.diff
No OneTemporary
Actions

D4216.id11063.diff
View Options

diff --git a/utils/vault/pki-intermediate-regenerate.sh b/utils/vault/pki-intermediate-regenerate.sh
--- a/utils/vault/pki-intermediate-regenerate.sh
+++ b/utils/vault/pki-intermediate-regenerate.sh
@@ -1,36 +1,56 @@
#!/bin/sh
-set -e
+# -------------------------------------------------------------
+# Renew Vault intermediate CA :: pki_vault
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: BSD-2-Clause
+# -------------------------------------------------------------
-export VAULT_SKIP_VERIFY=1
+set -e
PKI_ROOT=pki_root
PKI_INTERMEDIATE=pki_vault
-WORKDIR=$(mktemp -d -t vault-intermediate)
+ROLE=nasqueron-drake
+VAULT=vault
+
+# -------------------------------------------------------------
+# Issuers
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+# Root CA issuer (from DRP bootstrap script: root-<YEAR>, but not yet active)
+ROOT_ISSUER=default
+
+# Intermediate CA issuer
+ROLE_JSON=$($VAULT read -tls-skip-verify -format=json $PKI_INTERMEDIATE/roles/$ROLE)
+CURRENT_ISSUER=$(echo "$ROLE_JSON" | jq -r .data.issuer_ref)
+NEW_ISSUER="drake-nasqueron-intermediate-$(date +%Y%m%d)"
+
+# -------------------------------------------------------------
+# Reissue the intermediate certificate
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+$VAULT pki reissue -tls-skip-verify \
+ -issuer_name="$NEW_ISSUER" \
+ /$PKI_ROOT/issuer/$ROOT_ISSUER \
+ /$PKI_INTERMEDIATE/issuer/$CURRENT_ISSUER \
+ /$PKI_INTERMEDIATE/ \
+ common_name="nasqueron.drake Intermediate Authority" \
+ organization="Nasqueron" \
+ ou="Nasqueron Operations SIG" \
+ country="BE" \
+ ttl="8760h"
-cd "$WORKDIR"
+# -------------------------------------------------------------
+# Update role with new issuer
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-vault write -format=json $PKI_INTERMEDIATE/intermediate/generate/internal \
- common_name="nasqueron.drake Intermediate Authority" \
- issuer_name="drake-nasqueron-intermediate" \
- | jq -r '.data.csr' > cert_intermediate.csr
-
-vault write -format=json $PKI_ROOT/root/sign-intermediate \
- issuer_ref="root-2022" \
- csr=@cert_intermediate.csr \
- format=pem_bundle ttl="8760h" \
- | jq -r '.data.certificate' > cert_intermediate.pem
-
-ISSUER=$(vault write -format=json $PKI_INTERMEDIATE/intermediate/set-signed \
- certificate=@cert_intermediate.pem \
- | jq -r '.data.imported_issuers[0]')
-
-vault write $PKI_INTERMEDIATE/roles/nasqueron-drake \
- issuer_ref="$ISSUER" \
- allowed_domains="nasqueron.drake" \
- allow_subdomains=true \
- max_ttl="2160h"
-
-cd /tmp
-rm "$WORKDIR"/cert*
-rmdir "$WORKDIR"
+role_file=$(mktemp /tmp/role.old.XXXX)
+updated_role_file=$(mktemp /tmp/role.new.XXXX)
+trap 'rm -f "$role_file" "$updated_role_file"' EXIT
+
+$VAULT read -tls-skip-verify -format=json $PKI_INTERMEDIATE/roles/$ROLE > "$role_file"
+jq --arg issuer "$NEW_ISSUER" '.data.issuer_ref = $issuer | .data' "$role_file" > "$updated_role_file"
+$VAULT write -tls-skip-verify $PKI_INTERMEDIATE/roles/$ROLE @"$updated_role_file"
+
+echo "✅ Intermediate CA renewed and role '$ROLE' updated to use '$NEW_ISSUER'."

File Metadata

Mime Type
text/plain
Expires
Tue, Sep 15, 09:08 (21 h, 41 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
4089237
Default Alt Text
D4216.id11063.diff (3 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator