Merge branch '15453-default-is-not-a-remote'

[arvados.git] / tools / arvbox / lib / arvbox / docker / service / certificate / run

diff --git a/tools/arvbox/lib/arvbox/docker/service/certificate/run b/tools/arvbox/lib/arvbox/docker/service/certificate/run
index 2b802f2ab09c0be2b4aa43c934970f0e6706dd92..6443b01793dd61aaa56e717aff71ec839a26c2c3 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/service/certificate/run
+++ b/tools/arvbox/lib/arvbox/docker/service/certificate/run
@@ -8,7 +8,11 @@ set -ex -o pipefail
 
 . /usr/local/lib/arvbox/common.sh
 
-if test ! -s /var/lib/arvados/root-cert.pem ; then
+/usr/local/lib/arvbox/runsu.sh flock /var/lib/arvados/cluster_config.yml.lock /usr/local/lib/arvbox/cluster-config.sh
+
+uuid_prefix=$(cat /var/lib/arvados/api_uuid_prefix)
+
+if ! openssl verify -CAfile $root_cert $root_cert ; then
     # req           signing request sub-command
     # -new          new certificate request
     # -nodes        "no des" don't encrypt key
@@ -26,17 +30,30 @@ if test ! -s /var/lib/arvados/root-cert.pem ; then
            -nodes \
            -sha256 \
            -x509 \
-           -subj "/C=US/ST=MA/O=Arvados testing/OU=arvbox/CN=arvbox testing root CA for ${uuid_prefix}" \
+           -subj "/C=US/ST=MA/O=Arvados testing/OU=arvbox/CN=test root CA for ${uuid_prefix} generated $(date --rfc-3339=seconds)" \
            -extensions x509_ext \
            -config <(cat /etc/ssl/openssl.cnf \
                          <(printf "\n[x509_ext]\nbasicConstraints=critical,CA:true,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign")) \
-            -out /var/lib/arvados/root-cert.pem \
-            -keyout /var/lib/arvados/root-cert.key \
+            -out $root_cert \
+            -keyout $root_cert_key \
             -days 365
-    chown arvbox:arvbox /var/lib/arvados/root-cert.*
+    chown arvbox:arvbox $root_cert $root_cert_key
+    rm -f $server_cert $server_cert_key
 fi
 
-if test ! -s /var/lib/arvados/server-cert-${localip}.pem ; then
+cp $root_cert /usr/local/share/ca-certificates/arvados-testing-cert.crt
+update-ca-certificates
+
+if ! openssl verify -CAfile $root_cert $server_cert ; then
+
+    rm -f $server_cert $server_cert_key
+
+    if [[ $localip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
+       san=IP:$localip
+    else
+       san=DNS:$localip
+    fi
+
     # req           signing request sub-command
     # -new          new certificate request
     # -nodes        "no des" don't encrypt key
@@ -52,30 +69,28 @@ if test ! -s /var/lib/arvados/server-cert-${localip}.pem ; then
            -new \
            -nodes \
            -sha256 \
-           -subj "/C=US/ST=MA/O=Arvados testing for ${uuid_prefix}/OU=arvbox/CN=localhost" \
+           -subj "/C=US/ST=MA/O=Arvados testing/OU=arvbox/CN=test server cert for ${uuid_prefix} generated $(date --rfc-3339=seconds)" \
            -reqexts x509_ext \
            -extensions x509_ext \
            -config <(cat /etc/ssl/openssl.cnf \
-                         <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,IP:$localip")) \
+                         <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,$san")) \
             -out /var/lib/arvados/server-cert-${localip}.csr \
-            -keyout /var/lib/arvados/server-cert-${localip}.key \
+            -keyout $server_cert_key \
             -days 365
 
     openssl x509 \
            -req \
            -in /var/lib/arvados/server-cert-${localip}.csr \
-           -CA /var/lib/arvados/root-cert.pem \
-           -CAkey /var/lib/arvados/root-cert.key \
-           -out /var/lib/arvados/server-cert-${localip}.pem \
+           -CA $root_cert \
+           -CAkey $root_cert_key \
+           -out $server_cert \
            -set_serial $RANDOM$RANDOM \
            -extfile <(cat /etc/ssl/openssl.cnf \
-                         <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,IP:$localip")) \
-           -extensions x509_ext
+                         <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,$san")) \
+           -extensions x509_ext \
+           -days 365
 
-    chown arvbox:arvbox /var/lib/arvados/server-cert-${localip}.*
+    chown arvbox:arvbox $server_cert $server_cert_key
 fi
 
-cp /var/lib/arvados/root-cert.pem /usr/local/share/ca-certificates/arvados-testing-cert.crt
-update-ca-certificates
-
-sv stop certificate
\ No newline at end of file
+sv stop certificate