mirror of
https://github.com/dokku/dokku.git
synced 2026-08-29 10:08:53 +02:00
5496029e07
The `certs` plugin extracted a certificate's Common Name and formatted its subject using string assumptions that only held for pre-3.x OpenSSL output, so a certificate with only a Common Name and no Subject Alternative Name reported no hostnames from `certs:report` and was not recognized during nginx config generation, while the subject report retained the `subject=` prefix and used the wrong separators. Normalizing the subject with `-nameopt` before parsing makes the extraction version independent across OpenSSL and LibreSSL.
33 lines
1.1 KiB
Bash
Executable File
33 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eo pipefail
|
|
[[ $DOKKU_TRACE ]] && set -x
|
|
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
|
|
|
|
is_ssl_enabled() {
|
|
declare desc="returns 0 if ssl is enabled for given app"
|
|
local APP=$1
|
|
local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
|
|
|
|
if [[ -e "$APP_SSL_PATH/server.crt" ]] && [[ -e "$APP_SSL_PATH/server.key" ]]; then
|
|
return 0
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
get_ssl_hostnames() {
|
|
declare desc="returns a string of ssl hostnames extracted from an app's ssl certificate"
|
|
local APP=$1
|
|
local SSL_PATH="$DOKKU_ROOT/$APP/tls"
|
|
|
|
local SSL_HOSTNAME=$(openssl x509 -in "$SSL_PATH/server.crt" -noout -subject -nameopt RFC2253 | sed -n 's/.*CN=\([^,]*\).*/\1/p')
|
|
local SSL_HOSTNAME_ALT=$(openssl x509 -in "$SSL_PATH/server.crt" -noout -text | grep --after-context=1 '509v3 Subject Alternative Name:' | tail -n 1 | sed -e "s/[[:space:]]*DNS://g" | tr ',' '\n' || true)
|
|
if [[ -n "$SSL_HOSTNAME_ALT" ]]; then
|
|
local SSL_HOSTNAMES="${SSL_HOSTNAME}\n${SSL_HOSTNAME_ALT}"
|
|
else
|
|
local SSL_HOSTNAMES=$SSL_HOSTNAME
|
|
fi
|
|
echo -e "$SSL_HOSTNAMES" | sort -u
|
|
return 0
|
|
}
|