forked from ISTI-ansible-roles/ansible-roles
library/roles/haproxy: Support OCSP stapling.
This commit is contained in:
Andrea Dell'Amico
parent
6b8a448c00
commit
fd14293f39
|
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
- block:
|
||||
- name: Install the socat binary needed to talk to the haproxy socket
|
||||
apt: name=socat state=latest update_cache=yes cache_valid_time=3600
|
||||
|
||||
- name: Install a script that refreshes the OCSP configuration and reloads haproxy if needed
|
||||
template: src=hapos-upd.j2 dest=/usr/local/bin/hapos-upd owner=root group=root mode=0755
|
||||
|
||||
- name: Install a cron job that refreshes the OCSP configuration
|
||||
cron:
|
||||
name: "Refresh haproxy OCSP information"
|
||||
user: root
|
||||
special_time: daily
|
||||
job: "/usr/local/bin/hapos-upd --cert {{ haproxy_cert_dir }}/haproxy.pem -v {{ letsencrypt_acme_certs_dir }}/fullchain -s {{ haproxy_admin_socket }} >/var/log/hapos-upd.log 2>&1"
|
||||
|
||||
tags: [ 'haproxy', 'letsencrypt', 'ssl', 'ssl_ocsp' ]
|
||||
|
||||
|
|
@ -8,6 +8,9 @@
|
|||
when:
|
||||
- haproxy_letsencrypt_managed
|
||||
- letsencrypt_acme_install is defined
|
||||
- include: haproxy-ssl.yml
|
||||
when:
|
||||
- haproxy_letsencrypt_managed
|
||||
|
||||
- include: haproxy-nagios.yml
|
||||
when:
|
||||
|
|
|
|||
|
|
@ -0,0 +1,571 @@
|
|||
#!/bin/bash
|
||||
|
||||
# HAProxy OCSP Stapling Updater
|
||||
# Copyright (c) 2015 Pier Carlo Chiodi - http://www.pierky.com
|
||||
#
|
||||
# https://github.com/pierky/haproxy-ocsp-stapling-updater
|
||||
|
||||
set -o nounset
|
||||
|
||||
VERSION="0.4.1-pre1"
|
||||
|
||||
PROGNAME="hapos-upd"
|
||||
|
||||
if [ -z ${OPENSSL_BIN+x} ]; then
|
||||
OPENSSL_BIN="openssl"
|
||||
fi
|
||||
|
||||
SOCAT_BIN="socat"
|
||||
|
||||
CERT=""
|
||||
VAFILE=""
|
||||
HAPROXY_ADMIN_SOCKET_DEFAULT="/run/haproxy/admin.sock"
|
||||
HAPROXY_ADMIN_SOCKET="$HAPROXY_ADMIN_SOCKET_DEFAULT"
|
||||
GOOD_ONLY=0
|
||||
SYSLOG_PRIO=""
|
||||
DEBUG=0
|
||||
KEEP_TEMP=0
|
||||
OCSP_URL=""
|
||||
OCSP_HOST=""
|
||||
VERIFY=1
|
||||
TMP=""
|
||||
SKIP_UPDATE=0
|
||||
PARTIAL_CHAIN=""
|
||||
|
||||
function Quit() {
|
||||
if [ $KEEP_TEMP -eq 0 ]; then
|
||||
if [ -n "$TMP" ]; then
|
||||
rm -r $TMP &>/dev/null
|
||||
fi
|
||||
fi
|
||||
exit $1
|
||||
}
|
||||
|
||||
function LogError() {
|
||||
MSG="$1"
|
||||
|
||||
if [ -z "$SYSLOG_PRIO" ]; then
|
||||
echo "$MSG" >&2
|
||||
else
|
||||
logger -p "$SYSLOG_PRIO" -s -- "$PROGNAME - $MSG"
|
||||
fi
|
||||
|
||||
echo "$MSG" >>$TMP/log
|
||||
}
|
||||
|
||||
function Error() {
|
||||
if [ $1 -eq 9 ]; then
|
||||
MSG="Error: $2"
|
||||
else
|
||||
MSG="Error processing '$CERT': $2"
|
||||
fi
|
||||
|
||||
LogError "$MSG"
|
||||
|
||||
if [ $1 -eq 9 ]; then
|
||||
echo "Run $PROGNAME -h for help" >&2
|
||||
fi
|
||||
|
||||
Quit $1
|
||||
}
|
||||
|
||||
function Debug() {
|
||||
if [ $DEBUG -eq 1 ]; then
|
||||
echo "$1"
|
||||
fi
|
||||
echo "$1" >>$TMP/log
|
||||
}
|
||||
|
||||
function Trap() {
|
||||
Debug "Aborting"
|
||||
Quit 9
|
||||
}
|
||||
|
||||
function Usage() {
|
||||
echo "
|
||||
HAProxy OCSP Stapling Updater - $VERSION
|
||||
Copyright (c) 2015 Pier Carlo Chiodi - http://www.pierky.com
|
||||
|
||||
https://github.com/pierky/haproxy-ocsp-stapling-updater
|
||||
|
||||
Usage:
|
||||
$PROGNAME [options] --cert crt_full_path
|
||||
|
||||
This script extracts and queries the OCSP server present in a
|
||||
certificate to obtain its revocation status, then updates HAProxy by
|
||||
writing the '.issuer' and the '.ocsp' files and by sending it the
|
||||
'set ssl ocsp-response' command through the local UNIX admin socket.
|
||||
|
||||
The crt_full_path argument is the full path to the certificate bundle
|
||||
used in haproxy 'crt' setting. End-entity (EE) certificate plus any
|
||||
intermediate CA certificates must be concatenated there.
|
||||
An OCSP query is sent to the OCSP server given on the command line
|
||||
(--ocsp-url and --ocsp-host argument); if these arguments are missing,
|
||||
URL and Host header values are automatically extracted from the
|
||||
certificate.
|
||||
If the '.issuer' file already exists it's used to build the OCSP
|
||||
request, otherwise the chain is extracted from crt_full_path and used
|
||||
to identify the issuer.
|
||||
Finally, it writes the related '.issuer' and .'ocsp' files and updates
|
||||
haproxy, using 'socat' and the local UNIX socket (--socket argument,
|
||||
default $HAPROXY_ADMIN_SOCKET_DEFAULT).
|
||||
|
||||
Exit codes:
|
||||
0 OK
|
||||
1 openssl certificates handling error
|
||||
2 OCSP server URL not found
|
||||
3 string parsing / PEM manipulation error
|
||||
4 OCSP error
|
||||
5 haproxy management error
|
||||
9 program error (wrong arguments, missing dependencies)
|
||||
|
||||
Options:
|
||||
|
||||
-d, --debug : don't do anything, print debug messages only.
|
||||
|
||||
--keep-temp : keep temporary directory after exiting (for
|
||||
debug purposes).
|
||||
|
||||
-g, --good-only : do not update haproxy if OCSP response
|
||||
certificate status value is not 'good'.
|
||||
|
||||
-l, --syslog priority : log errors to syslog system log module.
|
||||
The priority may be specified numerically
|
||||
or as a facility.level pair (e.g.
|
||||
local7.error).
|
||||
|
||||
--ocsp-url url : OCSP server URL; use this instead of the
|
||||
one in the EE certificate.
|
||||
|
||||
--ocsp-host host : OCSP server hostname to be used in the
|
||||
'Host:' header; use this instead of the one
|
||||
extracted from the OCSP server URL.
|
||||
|
||||
--partial-chain : Allow partial certificate chain if at least one certificate
|
||||
is in trusted store. Useful when validating an intermediate
|
||||
certificate without the root CA.
|
||||
|
||||
-s, --socket file : haproxy admin socket. If omitted,
|
||||
$HAPROXY_ADMIN_SOCKET_DEFAULT is used by default.
|
||||
This script is distributed with only one
|
||||
method to update haproxy: using 'socat'
|
||||
with a local admin-level UNIX socket.
|
||||
Feel free to implement other mechanisms as
|
||||
needed! The right section in the code is
|
||||
\"UPDATE HAPROXY\", at the end of the script.
|
||||
|
||||
-v, --VAfile file : same as the openssl ocsp -VAfile option
|
||||
with 'file' as argument. For more details:
|
||||
'man ocsp'.
|
||||
If file = \"-\" then the chain extracted
|
||||
from the certificate's bundle (or .issuer
|
||||
file) is used (useful for OCSP responses
|
||||
that don't include the signer certificate).
|
||||
|
||||
--noverify : Do not verify OCSP response.
|
||||
|
||||
-S, --skip-update : Do not notify haproxy of the new OCSP response.
|
||||
|
||||
-h, --help : this help."
|
||||
}
|
||||
|
||||
trap Trap INT TERM
|
||||
|
||||
TMP="`mktemp -d -q -t $PROGNAME.XXXXXXXXXX`"
|
||||
|
||||
# COMMAND LINE PROCESSING
|
||||
# ----------------------------------
|
||||
|
||||
while [[ $# > 0 ]]
|
||||
do
|
||||
|
||||
case "$1" in
|
||||
-h|--help)
|
||||
Usage
|
||||
Quit 0
|
||||
;;
|
||||
|
||||
-d|--debug)
|
||||
DEBUG=1
|
||||
;;
|
||||
|
||||
--keep-temp)
|
||||
KEEP_TEMP=1
|
||||
;;
|
||||
|
||||
-g|--good-only)
|
||||
GOOD_ONLY=1
|
||||
;;
|
||||
|
||||
--noverify)
|
||||
VERIFY=0
|
||||
;;
|
||||
|
||||
--partial-chain)
|
||||
PARTIAL_CHAIN="-partial_chain"
|
||||
;;
|
||||
|
||||
-l|--syslog)
|
||||
if [ $# -le 1 ]; then
|
||||
Error 9 "mandatory value is missing for $1 argument"
|
||||
fi
|
||||
SYSLOG_PRIO="$2"
|
||||
shift
|
||||
;;
|
||||
|
||||
--ocsp-url)
|
||||
if [ $# -le 1 ]; then
|
||||
Error 9 "mandatory value is missing for $1 argument"
|
||||
fi
|
||||
OCSP_URL="$2"
|
||||
shift
|
||||
;;
|
||||
|
||||
--ocsp-host)
|
||||
if [ $# -le 1 ]; then
|
||||
Error 9 "mandatory value is missing for $1 argument"
|
||||
fi
|
||||
OCSP_HOST="$2"
|
||||
shift
|
||||
;;
|
||||
|
||||
-c|--cert)
|
||||
if [ $# -le 1 ]; then
|
||||
Error 9 "mandatory value is missing for $1 argument"
|
||||
fi
|
||||
CERT="$2"
|
||||
shift
|
||||
;;
|
||||
|
||||
-v|--VAfile)
|
||||
if [ $# -le 1 ]; then
|
||||
Error 9 "mandatory value is missing for $1 argument"
|
||||
fi
|
||||
VAFILE="$2"
|
||||
if [ "$VAFILE" == "-" ]; then
|
||||
VAFILE="$TMP/chain.pem"
|
||||
else
|
||||
if [ ! -e "$VAFILE" ]; then
|
||||
Error 9 "VAfile does not exists: $VAFILE"
|
||||
fi
|
||||
fi
|
||||
shift
|
||||
;;
|
||||
|
||||
-s|--socket)
|
||||
if [ $# -le 1 ]; then
|
||||
Error 9 "mandatory value is missing for $1 argument"
|
||||
fi
|
||||
HAPROXY_ADMIN_SOCKET="$2"
|
||||
shift
|
||||
;;
|
||||
|
||||
-S|--skip-update)
|
||||
SKIP_UPDATE=1
|
||||
;;
|
||||
|
||||
*)
|
||||
Error 9 "unknown option: $1"
|
||||
esac
|
||||
|
||||
shift
|
||||
done
|
||||
|
||||
Debug "Temporary directory: $TMP"
|
||||
|
||||
$OPENSSL_BIN version | grep OpenSSL &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 9 "openssl binary not found; adjust OPENSSL_BIN variable in the script"
|
||||
fi
|
||||
|
||||
$SOCAT_BIN -V | grep socat &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 9 "socat binary not found; adjust SOCAT_BIN variable in the script"
|
||||
fi
|
||||
|
||||
if [ -z "$CERT" ]; then
|
||||
Error 9 "certificate not provided (--cert argument)"
|
||||
fi
|
||||
|
||||
# CURRENT RESPONSE EXPIRED?
|
||||
# ----------------------------------
|
||||
|
||||
ISNEW=1
|
||||
if [ -e $CERT.ocsp ]; then
|
||||
ISNEW=0
|
||||
Debug "An OCSP response already exists: checking its expiration."
|
||||
|
||||
$OPENSSL_BIN ocsp -respin $CERT.ocsp -text -noverify | \
|
||||
grep "Next Update:" &>>$TMP/log
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
CURR_EXP=`$OPENSSL_BIN ocsp -respin $CERT.ocsp -text -noverify | grep "Next Update:" | cut -d ':' -f 2-`
|
||||
CURR_EXP_EPOCH=`date --date="$CURR_EXP" +%s`
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 3 "can't parse Next Update from current OCSP response"
|
||||
fi
|
||||
|
||||
if [ $CURR_EXP_EPOCH -lt `date +%s` ]; then
|
||||
Debug "Current OCSP response expiration: $CURR_EXP - expired"
|
||||
LogError "current OCSP response is expired: please consider running this script more frequently"
|
||||
else
|
||||
Debug "Current OCSP response expiration: $CURR_EXP - NOT expired"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# EXTRACT EE CERTIFICATE INFO
|
||||
# ----------------------------------
|
||||
|
||||
# extract EE certificate
|
||||
$OPENSSL_BIN x509 -in $CERT -outform PEM -out $TMP/ee.pem &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 1 "can't extract EE certificate from $CERT"
|
||||
fi
|
||||
|
||||
# get OCSP server URL
|
||||
if [ -z "$OCSP_URL" ]; then
|
||||
OCSP_URL="`$OPENSSL_BIN x509 -in $TMP/ee.pem -ocsp_uri -noout`"
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 1 "can't obtain OCSP server URL from $CERT"
|
||||
fi
|
||||
|
||||
if [ -z "$OCSP_URL" ]; then
|
||||
Error 2 "OCSP server URL not found in the EE certificate"
|
||||
fi
|
||||
|
||||
Debug "OCSP server URL found: $OCSP_URL"
|
||||
else
|
||||
Debug "Using OCSP server URL from command line: $OCSP_URL"
|
||||
fi
|
||||
|
||||
# check OCSP server URL format (http:// or https://)
|
||||
echo "$OCSP_URL" | egrep -i "(http://|https://)" &>/dev/null
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 3 "OCSP server URL not in http[s]:// format"
|
||||
fi
|
||||
|
||||
# get OCSP server URL host name
|
||||
if [ -z "$OCSP_HOST" ]; then
|
||||
OCSP_HOST="`echo "$OCSP_URL" | egrep -i "(http://|https://)" | cut -d'/' -f 3`"
|
||||
|
||||
if [ $? -ne 0 -o -z "$OCSP_HOST" ]; then
|
||||
Error 3 "can't extract hostname from OCSP server URL $OCSP_URL"
|
||||
fi
|
||||
|
||||
Debug "OCSP server hostname: $OCSP_HOST"
|
||||
else
|
||||
Debug "Using OCSP server hostname from command line: $OCSP_HOST"
|
||||
fi
|
||||
|
||||
# EXTRACT CHAIN INFO
|
||||
# ----------------------------------
|
||||
|
||||
if [ -e $CERT.issuer ]; then
|
||||
Debug "Using existing chain ($CERT.issuer)"
|
||||
|
||||
# copy .issuer file to temporary chain.pem
|
||||
cp $CERT.issuer $TMP/chain.pem &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 3 "can't copy current chain from $CERT.issuer"
|
||||
fi
|
||||
else
|
||||
Debug "Extracting chain from certificates bundle"
|
||||
|
||||
# get EE certificate's fingerprint
|
||||
FP_EE="`$OPENSSL_BIN x509 -fingerprint -noout -in $TMP/ee.pem`"
|
||||
|
||||
if [ $? -ne 0 -o -z "$FP_EE" ]; then
|
||||
Error 1 "can't obtain EE certificate's fingerprint"
|
||||
fi
|
||||
|
||||
Debug "EE certificate's fingerprint: $FP_EE"
|
||||
|
||||
# get BEGIN CERTIFICATE and END CERTIFICATE separators
|
||||
PEM_BEGIN_CERT="`head $TMP/ee.pem -n 1`"
|
||||
PEM_END_CERT="`tail $TMP/ee.pem -n 1`"
|
||||
|
||||
# get number of certificates in the bundle file
|
||||
NUM_OF_CERTS=`cat $CERT | grep -e "$PEM_BEGIN_CERT" | wc -l`
|
||||
|
||||
if [ $NUM_OF_CERTS -le 1 ]; then
|
||||
Error 3 "can't obtain the number of certificates in the chain"
|
||||
fi
|
||||
|
||||
Debug "$NUM_OF_CERTS certificates found in the bundle"
|
||||
|
||||
# save each certificate in the bundle into $TMP/chain-X.pem
|
||||
cat $CERT | \
|
||||
sed -n -e "/$PEM_BEGIN_CERT/,/$PEM_END_CERT/p" | \
|
||||
awk "/$PEM_BEGIN_CERT/{x=\"$TMP/chain-\" ++i \".pem\";}{print > x;}" &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 3 "can't extract certificates from bundle"
|
||||
fi
|
||||
|
||||
# for each certificate that is extracted from the bundle check if
|
||||
# it's the EE certificate, otherwise uses it to build the chain file
|
||||
for c in `seq 1 $NUM_OF_CERTS`;
|
||||
do
|
||||
# check fingerprint of current and EE certificates
|
||||
FP="`$OPENSSL_BIN x509 -fingerprint -noout -in $TMP/chain-$c.pem`"
|
||||
if [ $? -ne 0 -o -z "$FP" ]; then
|
||||
Error 1 "can't obtain the fingerprint of the certificate n. $c in the bundle"
|
||||
else
|
||||
if [ ! "$FP" == "$FP_EE" ]; then
|
||||
Debug "Bundle certificate n. $c fingerprint: $FP - it's part of the chain"
|
||||
|
||||
# current certificate is not the same as the EE; append to the chain
|
||||
cat $TMP/chain-$c.pem >> $TMP/chain.pem
|
||||
else
|
||||
Debug "Bundle certificate n. $c fingerprint: $FP - EE certificate"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
# check if the EE certificate validates against the chain
|
||||
$OPENSSL_BIN verify $PARTIAL_CHAIN -CAfile $TMP/chain.pem $TMP/ee.pem &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
if [ -e $CERT.issuer ]; then
|
||||
Error 1 "can't validate the EE certificate against the existing chain; if it has been changed recently consider removing the current $CERT.issuer file and let this script to figure out a new one"
|
||||
else
|
||||
Error 1 "can't validate the EE certificate against the extracted chain"
|
||||
fi
|
||||
fi
|
||||
|
||||
# OCSP
|
||||
# ----------------------------------
|
||||
|
||||
# query the OCSP server and save its response
|
||||
|
||||
$OPENSSL_BIN version | grep "OpenSSL 1.0" &>/dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
# OpenSSL 1.0.x
|
||||
|
||||
$OPENSSL_BIN ocsp $PARTIAL_CHAIN -issuer $TMP/chain.pem -cert $TMP/ee.pem \
|
||||
-respout $TMP/ocsp.der -noverify \
|
||||
-no_nonce -url $OCSP_URL -header "Host" "$OCSP_HOST" &>>$TMP/log
|
||||
else
|
||||
$OPENSSL_BIN ocsp $PARTIAL_CHAIN -issuer $TMP/chain.pem -cert $TMP/ee.pem \
|
||||
-respout $TMP/ocsp.der -noverify \
|
||||
-no_nonce -url $OCSP_URL -header "Host=$OCSP_HOST" &>>$TMP/log
|
||||
fi
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 1 "can't receive the OCSP server response"
|
||||
fi
|
||||
|
||||
# process the OCSP response
|
||||
VERIFYOPT=""
|
||||
if [ $VERIFY -eq 0 ]; then
|
||||
VERIFYOPT="-noverify"
|
||||
fi
|
||||
if [ -z "$VAFILE" ]; then
|
||||
$OPENSSL_BIN ocsp $PARTIAL_CHAIN $VERIFYOPT -issuer $TMP/chain.pem -cert $TMP/ee.pem \
|
||||
-respin $TMP/ocsp.der -no_nonce -CAfile $TMP/chain.pem \
|
||||
-out $TMP/ocsp.txt &>>$TMP/ocsp-verify.txt
|
||||
else
|
||||
$OPENSSL_BIN ocsp $PARTIAL_CHAIN $VERIFYOPT -issuer $TMP/chain.pem -cert $TMP/ee.pem \
|
||||
-respin $TMP/ocsp.der -no_nonce -CAfile $TMP/chain.pem \
|
||||
-VAfile $VAFILE \
|
||||
-out $TMP/ocsp.txt &>>$TMP/ocsp-verify.txt
|
||||
fi
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 1 "can't receive OCSP response"
|
||||
fi
|
||||
|
||||
if [ $VERIFY -eq 1 ]; then
|
||||
Debug "OCSP response verification results: `cat $TMP/ocsp-verify.txt`"
|
||||
|
||||
cat $TMP/ocsp-verify.txt | grep "Response verify OK" &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
grep "signer certificate not found" $TMP/ocsp-verify.txt &>/dev/null
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
Error 4 "OCSP response verification failure: signer certificate not found; try with '--VAfile -' or '--VAfile OCSP-response-signing-certificate-file' arguments"
|
||||
else
|
||||
Error 4 "OCSP response verification failure."
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
Debug "OCSP response: `cat $TMP/ocsp.txt`"
|
||||
|
||||
if [ $GOOD_ONLY -eq 1 ]; then
|
||||
cat $TMP/ocsp.txt | head -n 1 | grep ": good" &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 4 "OCSP response, certificate status not good"
|
||||
fi
|
||||
fi
|
||||
|
||||
# UPDATE HAPROXY
|
||||
# ----------------------------------
|
||||
|
||||
# Status:
|
||||
# - $TMP/ocsp.der contains the OCSP response, DER format
|
||||
# - $TMP/ocsp.txt contains the textual OCSP response as produced
|
||||
# by openssl
|
||||
# - the OCSP response has been verified against the chain or
|
||||
# the --VAfile
|
||||
|
||||
if [ $DEBUG -eq 0 ]; then
|
||||
# update .ocsp and .issuer files
|
||||
|
||||
cp $TMP/ocsp.der $CERT.ocsp &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 5 "can't update $CERT.ocsp file"
|
||||
fi
|
||||
|
||||
if [ ! -e $CERT.issuer ]; then
|
||||
cp $TMP/chain.pem $CERT.issuer &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 5 "can't update $CERT.issuer file"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ $SKIP_UPDATE -eq 0 ]; then
|
||||
if [ $ISNEW -eq 1 ]; then
|
||||
# no .ocsp file found, maybe it's an initial run
|
||||
Debug "Reloading haproxy."
|
||||
|
||||
service haproxy reload
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 5 "can't reload haproxy with 'service haproxy reload'"
|
||||
fi
|
||||
else
|
||||
# update haproxy via local UNIX socket
|
||||
Debug "Updating haproxy."
|
||||
|
||||
echo "set ssl ocsp-response `base64 -w 0 $TMP/ocsp.der`" | $SOCAT_BIN stdio $HAPROXY_ADMIN_SOCKET &>>$TMP/log
|
||||
|
||||
if [ $? -ne 0 ]; then
|
||||
Error 5 "can't update haproxy ssl ocsp-response using $HAPROXY_ADMIN_SOCKET socket"
|
||||
fi
|
||||
fi
|
||||
else
|
||||
Debug "Not notifying haproxy because skip-update is set."
|
||||
fi
|
||||
|
||||
else
|
||||
Debug "Debug mode: haproxy update skipped."
|
||||
fi
|
||||
|
||||
# remove temporary files and quit with success
|
||||
Quit 0
|
||||
|
||||
# vim: set tabstop=4 shiftwidth=4 expandtab:
|
||||
Loading…
Reference in New Issue