Skyfritt/certman
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add fullchain PEM support and improve permissions handling

Browse source 
The changes add support for combining certificates and private keys into a
single PEM file, while also refactoring the permissions handling logic to
be more robust and consistent.
This commit is contained in:
Ruben Solvang 2025-04-08 14:59:21 +02:00
parent f73342e8ae
commit e526c98d37
2 changed files with 37 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
README.md
View file

@ -96,6 +96,11 @@ Flags can be combined:
./certman.sh --silent --force
```
### Fullchain PEM
Use the `--fullchain-pem` flag to combine certificate and private key into a single PEM file:
```bash
./certman.sh --fullchain-pem
### Cron Configuration
Add these lines to your crontab for automated certificate management:
```cron
@ -111,6 +116,7 @@ Add these lines to your crontab for automated certificate management:
| CERT_PATH | Directory for certificate storage | Yes |
| KEY_PATH | Directory for private key storage | Yes |
| TEMP_PATH | Temporary directory for downloads | Yes |
| FULLCHAIN_PEM | Optional: Combine cert and key into single PEM file | No |
| SERVICE_NAME | Service to reload after certificate updates | Yes |
| CERT_OWNER | User owner for certificate files | Yes |
| CERT_GROUP | Group owner for certificate files | Yes |

37
certman.sh
View file

@ -26,6 +26,8 @@ load_env || exit 1
AUTO_MODE="false"
FORCE_UPDATE="false"
FULLCHAIN_PEM="${FULLCHAIN_PEM:-false}"
while [[ $# -gt 0 ]]; do
case $1 in
--silent)
@ -36,6 +38,10 @@ while [[ $# -gt 0 ]]; do
FORCE_UPDATE="true"
shift
;;
--fullchain-pem)
FULLCHAIN_PEM="true"
shift
;;
*)
shift
;;
@ -81,6 +87,7 @@ download_and_verify_cert() {
local key_api_key=$3
local temp_cert="$TEMP_DIR/$domain.crt"
local temp_key="$TEMP_DIR/$domain.key"
local temp_fullchain="$TEMP_DIR/$domain.pem"
echo -e "${BLUE}Processing certificate for $domain${NC}"
@ -104,6 +111,11 @@ download_and_verify_cert() {
return 1
fi
# Create fullchain PEM if requested
if [ "$FULLCHAIN_PEM" = "true" ]; then
cat "$temp_cert" "$temp_key" > "$temp_fullchain"
fi
# Validate certificate and key match
local cert_fingerprint
cert_fingerprint=$(openssl x509 -in "$temp_cert" -noout -pubkey |
@ -125,8 +137,10 @@ install_certificate() {
local domain=$1
local final_cert="$CERT_PATH/$domain.crt"
local final_key="$KEY_PATH/$domain.key"
local final_fullchain="$CERT_PATH/$domain.pem"
local temp_cert="$TEMP_DIR/$domain.crt"
local temp_key="$TEMP_DIR/$domain.key"
local temp_fullchain="$TEMP_DIR/$domain.pem"
local needs_reload=0
# Check if certificate needs updating
@ -147,14 +161,25 @@ install_certificate() {
return 1
fi
# Set permissions and ownership
if ! chown "$CERT_OWNER:$CERT_GROUP" "$final_cert" "$final_key" || \
! chmod "$CERT_PERMISSIONS" "$final_cert" || \
! chmod "$KEY_PERMISSIONS" "$final_key"; then
echo -e "${RED}Failed to set permissions for $domain${NC}"
return 1
if [ "$FULLCHAIN_PEM" = "true" ]; then
if ! cp -f "$temp_fullchain" "$final_fullchain"; then
echo -e "${RED}Failed to install fullchain PEM for $domain${NC}"
return 1
fi
fi
# Set permissions and ownership
local files=("$final_cert" "$final_key")
[ "$FULLCHAIN_PEM" = "true" ] && files+=("$final_fullchain")
for file in "${files[@]}"; do
if ! chown "$CERT_OWNER:$CERT_GROUP" "$file" || \
! chmod "$CERT_PERMISSIONS" "$file"; then
echo -e "${RED}Failed to set permissions for $file${NC}"
return 1
fi
done
echo -e "${GREEN}Certificate updated for $domain${NC}"
return 0
fi