unifi_ssl_import.sh didn't import the intermediate cert
Opened this issue · 0 comments
haraldhh commented
I tried to verify the SSL certificate via openssl (icinga/nagios) but it failed with missing certificates.
It turns out that unifi_ssl_import.sh doesn't include the intermediate cert in the bundle.
I modified the script to concatenate the $SIGNED_CERT and $CHAIN_FILE to another temporary file, and then included that. Now the SSL certificate is verifyable via openssl.
--- unifi_ssl_import.sh.dist 2023-03-29 11:24:55.970766471 +0300
+++ unifi_ssl_import.sh 2023-03-29 11:21:02.437590249 +0300
@@ -92,6 +92,7 @@
printf "\nImporting the following files:\n"
printf "Private Key: %s\n" "$PRIV_KEY"
printf "CA File: %s\n" "$CHAIN_FILE"
+ printf "Certificate File: %s\n" "$SIGNED_CERT"
fi
# Create temp files
@@ -126,9 +127,19 @@
#If there is a signed crt we should include this in the export
if [[ -f ${SIGNED_CRT} ]]; then
+
+ # 2023-03-29 Harald
+ tmpfile="/tmp/$(mcookie)"
+ if [ -f "${tmpfile}" ] ; then
+ echo "tmpfile $tmpfile exists, exiting"
+ exit 1
+ else # create a file containing cert + intermediate cert;
+ cat "${SIGNED_CRT}" "${CHAIN_FILE}" > "${tmpfile}"
+ fi
+
+# -in "${CHAIN_FILE}" \
openssl pkcs12 -export \
- -in "${CHAIN_FILE}" \
- -in "${SIGNED_CRT}" \
+ -in "${tmpfile}" \
-inkey "${PRIV_KEY}" \
-out "${P12_TEMP}" -passout pass:"${PASSWORD}" \
-name "${ALIAS}"
@@ -156,7 +167,7 @@
# Clean up temp files
printf "\nRemoving temporary files...\n"
-rm -f "${P12_TEMP}"
+rm -f "${P12_TEMP}" "${tmpfile}"
# Restart the UniFi Controller to pick up the updated keystore
printf "\nRestarting UniFi Controller to apply new Let's Encrypt SSL certificate...\n"