zydronium/internetee-registry
1
0
Fork 0
mirror of https://github.com/internetee/registry.git synced 2025-07-22 18:56:05 +02:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1662 from internetee/crlupdate

Browse source 
CRL Update decoupiling
This commit is contained in:
Timo Võhmar 2020-09-04 14:31:58 +03:00 • committed by GitHub
commit 1da707747f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

75
app/models/certificate.rb
View file

@ -127,77 +127,20 @@ class Certificate < ApplicationRecord
return false
end
self.class.update_registry_crl
self.class.reload_apache
self.class.update_crl
self
end
class << self
def tostdout(message)
time = Time.zone.now.utc
STDOUT << "#{time} - #{message}\n" unless Rails.env.test?
end
def update_crl
update_id_crl
update_registry_crl
reload_apache
end
def update_id_crl
STDOUT << "#{Time.zone.now.utc} - Updating ID CRL\n" unless Rails.env.test?
_out, _err, _st = Open3.capture3("
mkdir -p #{ENV['crl_dir']}/crl-id-temp
cd #{ENV['crl_dir']}/crl-id-temp
wget https://sk.ee/crls/esteid/esteid2007.crl
wget https://sk.ee/crls/juur/crl.crl
wget https://sk.ee/crls/eeccrca/eeccrca.crl
wget https://sk.ee/repository/crls/esteid2011.crl
openssl crl -in esteid2007.crl -out esteid2007.crl -inform DER
openssl crl -in crl.crl -out crl.crl -inform DER
openssl crl -in eeccrca.crl -out eeccrca.crl -inform DER
openssl crl -in esteid2011.crl -out esteid2011.crl -inform DER
ln -s crl.crl `openssl crl -hash -noout -in crl.crl`.r0
ln -s esteid2007.crl `openssl crl -hash -noout -in esteid2007.crl`.r0
ln -s eeccrca.crl `openssl crl -hash -noout -in eeccrca.crl`.r0
ln -s esteid2011.crl `openssl crl -hash -noout -in esteid2011.crl`.r0
rm -rf #{ENV['crl_dir']}/*.crl #{ENV['crl_dir']}/*.r0
mv #{ENV['crl_dir']}/crl-id-temp/* #{ENV['crl_dir']}
rm -rf #{ENV['crl_dir']}/crl-id-temp
")
STDOUT << "#{Time.zone.now.utc} - ID CRL updated\n" unless Rails.env.test?
end
def update_registry_crl
STDOUT << "#{Time.zone.now.utc} - Updating registry CRL\n" unless Rails.env.test?
_out, _err, _st = Open3.capture3("
mkdir -p #{ENV['crl_dir']}/crl-temp
cd #{ENV['crl_dir']}/crl-temp
openssl ca -config #{ENV['openssl_config_path']} -keyfile #{ENV['ca_key_path']} -cert \
#{ENV['ca_cert_path']} -gencrl -out #{ENV['crl_dir']}/crl-temp/crl.pem -key \
'#{ENV['ca_key_password']}' -batch
ln -s crl.pem `openssl crl -hash -noout -in crl.pem`.r1
rm -rf #{ENV['crl_dir']}/*.pem #{ENV['crl_dir']}/*.r1
mv #{ENV['crl_dir']}/crl-temp/* #{ENV['crl_dir']}
rm -rf #{ENV['crl_dir']}/crl-temp
")
STDOUT << "#{Time.zone.now.utc} - Registry CRL updated\n" unless Rails.env.test?
end
def reload_apache
STDOUT << "#{Time.zone.now.utc} - Reloading apache\n" unless Rails.env.test?
_out, _err, _st = Open3.capture3("sudo /etc/init.d/apache2 reload")
STDOUT << "#{Time.zone.now.utc} - Apache reloaded\n" unless Rails.env.test?
tostdout('Running crlupdater')
system('/bin/bash', ENV['crl_updater_path'].to_s)
tostdout('Finished running crlupdater')
end
def parse_md_from_string(crt)

1
config/application.yml.sample
View file

@ -34,6 +34,7 @@ time_zone: 'Tallinn' # more zones by rake time:zones:all
openssl_config_path: '/etc/ssl/openssl.cnf'
crl_dir: '/home/registry/registry/shared/ca/crl'
crl_path: '/home/registry/registry/shared/ca/crl/crl.pem'
crl_updater_path: '/home/registry/registry/shared/ca/crl/crlupdater.sh'
ca_cert_path: '/home/registry/registry/shared/ca/certs/ca.crt.pem'
ca_key_path: '/home/registry/registry/shared/ca/private/ca.key.pem'
ca_key_password: 'your-root-key-password'