tools/arvbox/lib/arvbox/docker/service/certificate/run

   1 #!/bin/bash
   2 # Copyright (C) The Arvados Authors. All rights reserved.
   3 #
   4 # SPDX-License-Identifier: AGPL-3.0
   5
   6 exec 2>&1
   7 set -ex -o pipefail
   8
   9 . /usr/local/lib/arvbox/common.sh
  10
  11 /usr/local/lib/arvbox/runsu.sh flock $ARVADOS_CONTAINER_PATH/cluster_config.yml.lock /usr/local/lib/arvbox/cluster-config.sh
  12
  13 uuid_prefix=$(cat $ARVADOS_CONTAINER_PATH/api_uuid_prefix)
  14
  15 if ! openssl verify -CAfile $root_cert $root_cert ; then
  16     # req           signing request sub-command
  17     # -new          new certificate request
  18     # -nodes        "no des" don't encrypt key
  19     # -sha256       include sha256 fingerprint
  20     # -x509         generate self-signed certificate
  21     # -subj         certificate subject
  22     # -reqexts      certificate request extension for subjectAltName
  23     # -extensions   certificate request extension for subjectAltName
  24     # -config       certificate generation configuration plus subjectAltName
  25     # -out          certificate output
  26     # -keyout       private key output
  27     # -days         certificate lifetime
  28     openssl req \
  29             -new \
  30             -nodes \
  31             -sha256 \
  32             -x509 \
  33             -subj "/C=US/ST=MA/O=Arvados testing/OU=arvbox/CN=test root CA for ${uuid_prefix} generated $(date --rfc-3339=seconds)" \
  34             -extensions x509_ext \
  35             -config <(cat /etc/ssl/openssl.cnf \
  36                           <(printf "\n[x509_ext]\nbasicConstraints=critical,CA:true,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign")) \
  37             -out $root_cert \
  38             -keyout $root_cert_key \
  39             -days 365
  40     chown arvbox:arvbox $root_cert $root_cert_key
  41     rm -f $server_cert $server_cert_key
  42 fi
  43
  44 cp $root_cert /usr/local/share/ca-certificates/arvados-testing-cert.crt
  45 update-ca-certificates
  46
  47 if ! openssl verify -CAfile $root_cert $server_cert ; then
  48
  49     rm -f $server_cert $server_cert_key
  50
  51     if [[ $localip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
  52         san=IP:$localip
  53     else
  54         san=DNS:$localip
  55     fi
  56
  57     # req           signing request sub-command
  58     # -new          new certificate request
  59     # -nodes        "no des" don't encrypt key
  60     # -sha256       include sha256 fingerprint
  61     # -subj         certificate subject
  62     # -reqexts      certificate request extension for subjectAltName
  63     # -extensions   certificate request extension for subjectAltName
  64     # -config       certificate generation configuration plus subjectAltName
  65     # -out          certificate output
  66     # -keyout       private key output
  67     # -days         certificate lifetime
  68     openssl req \
  69             -new \
  70             -nodes \
  71             -sha256 \
  72             -subj "/C=US/ST=MA/O=Arvados testing/OU=arvbox/CN=test server cert for ${uuid_prefix} generated $(date --rfc-3339=seconds)" \
  73             -reqexts x509_ext \
  74             -extensions x509_ext \
  75             -config <(cat /etc/ssl/openssl.cnf \
  76                           <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,$san")) \
  77             -out $ARVADOS_CONTAINER_PATH/server-cert-${localip}.csr \
  78             -keyout $server_cert_key \
  79             -days 365
  80
  81     openssl x509 \
  82             -req \
  83             -in $ARVADOS_CONTAINER_PATH/server-cert-${localip}.csr \
  84             -CA $root_cert \
  85             -CAkey $root_cert_key \
  86             -out $server_cert \
  87             -set_serial $RANDOM$RANDOM \
  88             -extfile <(cat /etc/ssl/openssl.cnf \
  89                           <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,$san")) \
  90             -extensions x509_ext \
  91             -days 365
  92
  93     chown arvbox:arvbox $server_cert $server_cert_key
  94 fi
  95
  96 sv stop certificate