Skyfritt/certman
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Add error handling for fingerprint extraction failures

Browse source 
Improve certificate and key fingerprint comparison logic

Add validation for PEM file fingerprint extraction
This commit is contained in:
Ruben 2026-02-20 23:04:09 +01:00
parent f16871a0fd
commit 8d3291e01d
1 changed files with 17 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
certman.sh
View file

@ -125,13 +125,17 @@ download_and_verify_cert() {
fi fi
# Validate certificate and key match # Validate certificate and key match
local cert_fingerprint local cert_fingerprint key_fingerprint
cert_fingerprint=$(openssl x509 -in "$temp_cert" -noout -pubkey | cert_fingerprint=$(openssl x509 -in "$temp_cert" -noout -pubkey |
openssl pkey -pubin -outform DER 2>/dev/null | openssl pkey -pubin -outform DER |
openssl dgst -sha256) openssl dgst -sha256) || true
local key_fingerprint key_fingerprint=$(openssl pkey -in "$temp_key" -pubout -outform DER |
key_fingerprint=$(openssl pkey -in "$temp_key" -pubout -outform DER 2>/dev/null | openssl dgst -sha256) || true
openssl dgst -sha256)
if [ -z "$cert_fingerprint" ] || [ -z "$key_fingerprint" ]; then
echo -e "${RED}Failed to extract fingerprints for $domain${NC}"
return 1
fi
if [ "$cert_fingerprint" != "$key_fingerprint" ]; then if [ "$cert_fingerprint" != "$key_fingerprint" ]; then
echo -e "${RED}Certificate and key do not match for $domain${NC}" echo -e "${RED}Certificate and key do not match for $domain${NC}"
@ -141,9 +145,13 @@ download_and_verify_cert() {
if [ "$FULLCHAIN_PEM" = "true" ]; then if [ "$FULLCHAIN_PEM" = "true" ]; then
local pem_fingerprint local pem_fingerprint
pem_fingerprint=$(openssl x509 -in "$temp_pem" -noout -pubkey | pem_fingerprint=$(openssl x509 -in "$temp_pem" -noout -pubkey |
openssl pkey -pubin -outform DER 2>/dev/null | openssl pkey -pubin -outform DER |
openssl dgst -sha256) openssl dgst -sha256) || true
if [[ "$cert_fingerprint" != "$pem_fingerprint" ]]; then if [ -z "$pem_fingerprint" ]; then
echo -e "${RED}Failed to extract PEM fingerprint for $domain${NC}"
return 1
fi
if [ "$cert_fingerprint" != "$pem_fingerprint" ]; then
echo -e "${RED}Certificate and PEM file do not match for $domain${NC}" echo -e "${RED}Certificate and PEM file do not match for $domain${NC}"
return 1 return 1
fi fi