Skyfritt/certman
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Add error handling for fingerprint extraction failures

Browse source 
Improve certificate and key fingerprint comparison logic

Add validation for PEM file fingerprint extraction
This commit is contained in:
Ruben 2026-02-20 23:04:09 +01:00
parent f16871a0fd
commit 8d3291e01d
1 changed files with 17 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
certman.sh
View file

@ -125,13 +125,17 @@ download_and_verify_cert() {
fi
# Validate certificate and key match
local cert_fingerprint
local cert_fingerprint key_fingerprint
cert_fingerprint=$(openssl x509 -in "$temp_cert" -noout -pubkey |
openssl pkey -pubin -outform DER 2>/dev/null |
openssl dgst -sha256)
local key_fingerprint
key_fingerprint=$(openssl pkey -in "$temp_key" -pubout -outform DER 2>/dev/null |
openssl dgst -sha256)
openssl pkey -pubin -outform DER |
openssl dgst -sha256) || true
key_fingerprint=$(openssl pkey -in "$temp_key" -pubout -outform DER |
openssl dgst -sha256) || true
if [ -z "$cert_fingerprint" ] || [ -z "$key_fingerprint" ]; then
echo -e "${RED}Failed to extract fingerprints for $domain${NC}"
return 1
fi
if [ "$cert_fingerprint" != "$key_fingerprint" ]; then
echo -e "${RED}Certificate and key do not match for $domain${NC}"
@ -141,9 +145,13 @@ download_and_verify_cert() {
if [ "$FULLCHAIN_PEM" = "true" ]; then
local pem_fingerprint
pem_fingerprint=$(openssl x509 -in "$temp_pem" -noout -pubkey |
openssl pkey -pubin -outform DER 2>/dev/null |
openssl dgst -sha256)
if [[ "$cert_fingerprint" != "$pem_fingerprint" ]]; then
openssl pkey -pubin -outform DER |
openssl dgst -sha256) || true
if [ -z "$pem_fingerprint" ]; then
echo -e "${RED}Failed to extract PEM fingerprint for $domain${NC}"
return 1
fi
if [ "$cert_fingerprint" != "$pem_fingerprint" ]; then
echo -e "${RED}Certificate and PEM file do not match for $domain${NC}"
return 1
fi