2020-03-27 20:41:18 +00:00
|
|
|
|
Renew certificates and notify on expiration
|
|
|
|
|
|
===========================================
|
|
|
|
|
|
|
2023-01-10 13:45:27 +00:00
|
|
|
|
[⬅️ Go back to main README](../README.md)
|
2020-03-27 20:41:18 +00:00
|
|
|
|
|
2022-02-12 12:05:56 +00:00
|
|
|
|
> ℹ️ **Info**: This script can not be used on its own but requires the base
|
2022-02-11 22:34:39 +00:00
|
|
|
|
> installation. See [main README](../README.md) for details.
|
2021-05-03 13:07:50 +00:00
|
|
|
|
|
2020-03-27 20:41:18 +00:00
|
|
|
|
Description
|
|
|
|
|
|
-----------
|
|
|
|
|
|
|
|
|
|
|
|
This script tries to download and renew certificates, then notifies about
|
|
|
|
|
|
certificates that are still about to expire.
|
|
|
|
|
|
|
2021-06-17 13:23:51 +00:00
|
|
|
|
### Sample notification
|
|
|
|
|
|
|
2022-10-20 08:18:05 +00:00
|
|
|
|
|
2021-06-17 13:23:51 +00:00
|
|
|
|
|
2020-03-27 20:41:18 +00:00
|
|
|
|
Requirements and installation
|
|
|
|
|
|
-----------------------------
|
|
|
|
|
|
|
|
|
|
|
|
Just install the script:
|
|
|
|
|
|
|
|
|
|
|
|
$ScriptInstallUpdate check-certificates;
|
|
|
|
|
|
|
|
|
|
|
|
Configuration
|
|
|
|
|
|
-------------
|
|
|
|
|
|
|
|
|
|
|
|
For automatic download and renewal of certificates you need configuration
|
|
|
|
|
|
in `global-config-overlay`, these are the parameters:
|
|
|
|
|
|
|
|
|
|
|
|
* `CertRenewPass`: an array of passphrases to try
|
2023-01-23 16:42:49 +00:00
|
|
|
|
* `CertRenewTime`: on what remaining time to try a renew
|
2020-03-27 20:41:18 +00:00
|
|
|
|
* `CertRenewUrl`: the url to download certificates from
|
2023-01-23 16:27:34 +00:00
|
|
|
|
* `CertWarnTime`: on what remaining time to warn via notification
|
2020-03-27 20:41:18 +00:00
|
|
|
|
|
2023-06-07 11:34:50 +00:00
|
|
|
|
> ℹ️ **Info**: Copy relevant configuration from
|
|
|
|
|
|
> [`global-config`](../global-config.rsc) (the one without `-overlay`) to
|
|
|
|
|
|
> your local `global-config-overlay` and modify it to your specific needs.
|
|
|
|
|
|
|
2023-04-06 13:19:23 +00:00
|
|
|
|
Certificates on the web server should be named by their common name, like
|
|
|
|
|
|
`CN.pem` (`PEM` format) or`CN.p12` (`PKCS#12` format). Alternatively any
|
|
|
|
|
|
subject alternative name (aka *Subject Alt Name* or *SAN*) can be used.
|
2020-03-27 20:41:18 +00:00
|
|
|
|
|
2022-09-23 13:07:30 +00:00
|
|
|
|
Also notification settings are required for
|
|
|
|
|
|
[e-mail](mod/notification-email.md),
|
2023-10-11 05:40:55 +00:00
|
|
|
|
[matrix](mod/notification-matrix.md),
|
|
|
|
|
|
[ntfy](mod/notification-ntfy.md) and/or
|
2022-09-23 13:07:30 +00:00
|
|
|
|
[telegram](mod/notification-telegram.md).
|
|
|
|
|
|
|
2020-03-27 20:41:18 +00:00
|
|
|
|
Usage and invocation
|
|
|
|
|
|
--------------------
|
|
|
|
|
|
|
|
|
|
|
|
Just run the script:
|
|
|
|
|
|
|
2022-05-11 07:56:21 +00:00
|
|
|
|
/system/script/run check-certificates;
|
2020-03-27 20:41:18 +00:00
|
|
|
|
|
|
|
|
|
|
... or create a scheduler for periodic execution:
|
|
|
|
|
|
|
2022-05-11 07:56:21 +00:00
|
|
|
|
/system/scheduler/add interval=1d name=check-certificates on-event="/system/script/run check-certificates;" start-time=startup;
|
2020-03-27 20:41:18 +00:00
|
|
|
|
|
2020-09-03 11:06:20 +00:00
|
|
|
|
|
2023-05-31 13:58:21 +00:00
|
|
|
|
Tips & Tricks
|
|
|
|
|
|
-------------
|
|
|
|
|
|
|
2024-01-24 16:14:25 +00:00
|
|
|
|
### Schedule at startup
|
|
|
|
|
|
|
2023-05-31 13:58:21 +00:00
|
|
|
|
The script checks for full connectivity before acting, so scheduling at
|
|
|
|
|
|
startup is perfectly valid:
|
|
|
|
|
|
|
|
|
|
|
|
/system/scheduler/add name=check-certificates@startup on-event="/system/script/run check-certificates;" start-time=startup;
|
2020-09-03 11:06:20 +00:00
|
|
|
|
|
2024-01-24 16:22:13 +00:00
|
|
|
|
### Initial import
|
|
|
|
|
|
|
|
|
|
|
|
Given you have a certificate on you server, you can use `check-certificates`
|
|
|
|
|
|
for the initial import. Just create a *dummy* certificate with short lifetime
|
|
|
|
|
|
that matches criteria to be renewed:
|
|
|
|
|
|
|
|
|
|
|
|
/certificate/add name=example.com common-name=example.com days-valid=1;
|
|
|
|
|
|
/certificate/sign example.com;
|
|
|
|
|
|
/system/script/run check-certificates;
|
|
|
|
|
|
|
2020-03-27 20:41:18 +00:00
|
|
|
|
See also
|
|
|
|
|
|
--------
|
|
|
|
|
|
|
|
|
|
|
|
* [Renew locally issued certificates](certificate-renew-issued.md)
|
|
|
|
|
|
|
|
|
|
|
|
---
|
2023-01-10 13:45:27 +00:00
|
|
|
|
[⬅️ Go back to main README](../README.md)
|
|
|
|
|
|
[⬆️ Go back to top](#top)
|
