SSL Certificate update commande line

antipiot · Dec 8th 2018

Hi everybody!

I'm looking for the command line that may let me import ssl certificate without using the GUI:

At the moment my Firewall generate my SSL certificate. I already have a working script running on OMV to import this certificate and put it everywhere i need it to be (dockers mainyl)

I dont want to struggle changing the ssl cerificate used by OMV services (as omv web GUI, nginx) every 3 month

i see 2 options:

1: theres an OMV command line to import certificates using whatever format, create the UUID as documantation want it, restart the web GUI

2: I import the certificate as the existing UUID (overwriting the existanting SSL certificates)

Thanks in advance for your help!

ryecoaaron · Dec 8th 2018

Here is a method to update an existing cert:

Get the UUID for an existing cert with:
sudo omv-confdbadm read "conf.system.certificate.ssl" | jq -r '.[] | "\(.uuid) \(.comment)"'

Once you have that, the following script should update it in the database. You will just need to adjust the four variables at the top of the script.

Bash

#!/bin/bash


. /usr/share/openmediavault/scripts/helper-functions


certificateFile="/etc/letsencrypt/live/test/cert.pem"
privateKeyFile="/etc/letsencrypt/live/test/privkey.pem"
certUuid="757f842e-faf0-11e8-a284-3a6331353066"
comment="test"


function json_escape()
{
  echo -n "$1" | python -c 'import json,sys; print json.dumps(sys.stdin.read())'
}


# read and format cert
certkey=$(cat ${certificateFile})
certkey=$(json_escape "${certkey}")


# read and format private key
privkey=$(cat ${privateKeyFile})
privkey=$(json_escape "${privkey}")


# change config
rpcparams={"\"uuid\":\"${certUuid}\", \"certificate\":${certkey}, \"privatekey\":${privkey}, \"comment\":\"${comment}\""}
omv-rpc "CertificateMgmt" "set" "${rpcparams}"


# apply configuration changes
omv_exec_rpc "Config" "applyChanges" "{\"modules\":[\"certificatemgmt\"],\"force\":false}"
omv_exec_rpc "Config" "applyChanges" "{\"modules\":[],\"force\":false}"


exit 0

Display More

antipiot · Dec 9th 2018

Thanks Ryecoaaron!

Sorry but im getting an error:

root@nas:~# sudo bash /root/crtrenewtest.sh
/root/crtrenewtest.sh: ligne 3: /usr/share/openmediavault/scripts/helper-functions: Aucun fic hier ou dossier de ce type
{"uuid":"xxxxxxxxxxxxxxxxxxxx","certificate":"-----BEGIN CERTIFICATE---------END CERTIFICATE-----","privatekey":"-----BEGIN RSA PRIVATE KEY--- ------END RSA PRIVATE KEY-----","comment":"let's encrypt ssl "}
/root/crtrenewtest.sh: ligne 28: omv_exec_rpc : commande introuvable
/root/crtrenewtest.sh: ligne 29: omv_exec_rpc : commande introuvable

Am i doing something wrong?

EDIT: Indeed working :Script encoding Format problem :-/

sebasb · Apr 28th 2020

Thanks, testing your script now!

christiscarborough · May 2nd 2020

This script was just what I needed, thanks. Have now purged the old and somewhat unreliable letsencrypt plugin from my system and moved to using dehydrated for certificate requests.

Swaziboy · Nov 12th 2020

Hey folks, been using a form of this script for some time. Recently upgraded to OMV5 and I think something broke and cannot figure out where it's not working. What's interesting is if I run this script and then check the info section of the cert via the WebGui, it seems like the cert has in fact been updated, but the browser is showing the old cert. Very odd.

I was doing some amateur sleuthing and noted that this command doesn't seem to exist: omv_exec_rpc so I replaced these commands in my script with omv-rpc

Here's my modified version of the script - if anyone can point me in a direction to troubleshoot I would appreciate it:

Bash

#!/bin/bash

. /usr/share/openmediavault/scripts/helper-functions

# Set up some core variables
dateupdated=$(date '+%Y-%m-%d %T')
certificateFile="./cert.pem"
privateKeyFile="./priv.key"
certUuid=$(omv-confdbadm read "conf.system.certificate.ssl" | jq -r '.[] | "\(.uuid)"')
comment="LetsEncrypt - Updated ${dateupdated}"

function json_escape()
{
  echo -n "$1" | python -c 'import json,sys; print json.dumps(sys.stdin.read())'
}

# read and format cert
echo "Formatting certificate..."
certkey=$(cat ${certificateFile})
certkey=$(json_escape "${certkey}")

# read and format private key
echo "Formatting private key..."
privkey=$(cat ${privateKeyFile})
privkey=$(json_escape "${privkey}")

# change config
echo "Changing OMV config through RPC..."
rpcparams={"\"uuid\":\"${certUuid}\", \"certificate\":${certkey}, \"privatekey\":${privkey}, \"comment\":\"${comment}\""}
omv-rpc "CertificateMgmt" "set" "${rpcparams}" 

# apply configuration changes
echo "Applying OMV config through RPC..."
omv-rpc "Config" "applyChanges" "{\"modules\":[\"certificatemgmt\"],\"force\":false}"
omv-rpc "Config" "applyChanges" "{\"modules\":[],\"force\":false}"

echo "Done!"

Display More

If I turn on bash debugging in the script, I note that the following two commands output "null" after execution

Code

omv-rpc "Config" "applyChanges" "{\"modules\":[\"certificatemgmt\"],\"force\":false}"
omv-rpc "Config" "applyChanges" "{\"modules\":[],\"force\":false}"

tiranor · Sep 12th 2022

Quote from Swaziboy
Hey folks, been using a form of this script for some time. Recently upgraded to OMV5 and I think something broke and cannot figure out where it's not working. What's interesting is if I run this script and then check the info section of the cert via the WebGui, it seems like the cert has in fact been updated, but the browser is showing the old cert. Very odd.

I was doing some amateur sleuthing and noted that this command doesn't seem to exist: omv_exec_rpc so I replaced these commands in my script with omv-rpc

Here's my modified version of the script - if anyone can point me in a direction to troubleshoot I would appreciate it:
Bash
#!/bin/bash

. /usr/share/openmediavault/scripts/helper-functions

# Set up some core variables
dateupdated=$(date '+%Y-%m-%d %T')
certificateFile="./cert.pem"
privateKeyFile="./priv.key"
certUuid=$(omv-confdbadm read "conf.system.certificate.ssl" | jq -r '.[] | "\(.uuid)"')
comment="LetsEncrypt - Updated ${dateupdated}"

function json_escape()
{
  echo -n "$1" | python -c 'import json,sys; print json.dumps(sys.stdin.read())'
}

# read and format cert
echo "Formatting certificate..."
certkey=$(cat ${certificateFile})
certkey=$(json_escape "${certkey}")

# read and format private key
echo "Formatting private key..."
privkey=$(cat ${privateKeyFile})
privkey=$(json_escape "${privkey}")

# change config
echo "Changing OMV config through RPC..."
rpcparams={"\"uuid\":\"${certUuid}\", \"certificate\":${certkey}, \"privatekey\":${privkey}, \"comment\":\"${comment}\""}
omv-rpc "CertificateMgmt" "set" "${rpcparams}" 

# apply configuration changes
echo "Applying OMV config through RPC..."
omv-rpc "Config" "applyChanges" "{\"modules\":[\"certificatemgmt\"],\"force\":false}"
omv-rpc "Config" "applyChanges" "{\"modules\":[],\"force\":false}"

echo "Done!"
Display More
If I turn on bash debugging in the script, I note that the following two commands output "null" after execution
Code
omv-rpc "Config" "applyChanges" "{\"modules\":[\"certificatemgmt\"],\"force\":false}"
omv-rpc "Config" "applyChanges" "{\"modules\":[],\"force\":false}"
Display More

I don't know if you managed to debug your issue.

I had the same issue (certificate was updated in the GUI, but wasn't recognized by the browser).

I managed to make it work, with manually changing the certificate to the self created one in the user interface menu, and then back to the let's encrypt one.

After that, it worked perfectly...

... Until my upgrade to OMV 6, the json_escape function can't be created :

Code

  File "<string>", line 1
    import json,sys ; print json.dumps(sys.stdin.read())
                            ^
SyntaxError: invalid syntax
  File "<string>", line 1
    import json,sys ; print json.dumps(sys.stdin.read())
                            ^
SyntaxError: invalid syntax
ERROR: The params argument is no valid JSON

END OF LINE
█

Display More

ryecoaaron · Sep 12th 2022

Quote from tiranor

After that, it worked perfectly...

... Until my upgrade to OMV 6, the json_escape function can't be created :

Did you try my script? https://github.com/ryecoaaron/…/blob/main/update_cert.sh

tiranor · Sep 12th 2022

Quote from ryecoaaron

Did you try my script? https://github.com/ryecoaaron/…/blob/main/update_cert.sh

No, i'll take a look when i'll be on the computer, thanks in advance.

As said, for a couple years the script worked well, i just noticed the issue with omv 6 today, my certificate expired last night.

I guess i'll dive more thoroughtly in your github, feels like i missed many things 🙂

ryecoaaron · Sep 12th 2022

Quote from tiranor

As said, for a couple years the script worked well, i just noticed the issue with omv 6 today

If it worked on omv 4, then it wouldn't work on omv 5 or 6. Mine works on 5 and 6 and I use it often.

tiranor · Sep 13th 2022

I didn't use it when i still had OMV 4, but it worked on OMV 5, and got the previous error with OMV 6 (directly upgraded from OMV5).

With your latest script, it worked perfectly, thanks.

Swaziboy · Sep 20th 2022

Checking out the linked script, how does one capture the correct UUID?

ryecoaaron · Sep 20th 2022

Quote from Swaziboy

Checking out the linked script, how does one capture the correct UUID?

Get the uuid from the appropriate entry in the certificates section. sudo omv-showkey sslcertificate will help.

Swaziboy · Sep 21st 2022

Quote from ryecoaaron

sudo omv-showkey sslcertificate

I tried this and get a command not found. Is this available in 6.x?

[EDIT] I use this to grab the UUID of the SSL cert

Code

omv-confdbadm read "conf.system.certificate.ssl" | jq -r '.[] | "\(.uuid)"'

ryecoaaron · Sep 21st 2022

Quote from Swaziboy

Is this available in 6.x?

It is included in omv-extras. So, you evidently don't have omv-extras installed.

SSL Certificate update commande line

Participate now!

Tags