Приветствую!
Нужно переписать скрипт работающий с https/ssl сертификатами на устройствах микротик. Скрипт работает в среде linux, выполняет задачу - получить(обновить) сертификаты (в частности у letsencript), авторизоваться на микротике по ssh ключу, добавить сертификаты в микротик(удалить старые, добавить новые), дальше удаляет сертификаты у себя. Скрипт работает с отдельным файлом конфигурации. Сейчас скрипт работает с одним устройством микротик(одним файлом конфигурации). Скрипт: letsencrypt-routeros.sh
#!/bin/bash
CONFIG_FILE=letsencrypt-routeros.settings
if [[ -z $1 ]] || [[ -z $2 ]] || [[ -z $3 ]] || [[ -z $4 ]] || [[ -z $5 ]]; then
echo -e "Usage: $0 or $0 [RouterOS User] [RouterOS Host] [SSH Port] [SSH Private Key] [Domain]\n"
source $CONFIG_FILE
else
ROUTEROS_USER=$1
ROUTEROS_HOST=$2
ROUTEROS_SSH_PORT=$3
ROUTEROS_PRIVATE_KEY=$4
DOMAIN=$5
fi
if [[ -z $ROUTEROS_USER ]] || [[ -z $ROUTEROS_HOST ]] || [[ -z $ROUTEROS_SSH_PORT ]] || [[ -z $ROUTEROS_PRIVATE_KEY ]] || [[ -z $DOMAIN ]]; then
echo "Check the config file $CONFIG_FILE or start with params: $0 [RouterOS User] [RouterOS Host] [SSH Port] [SSH Private Key] [Domain]"
echo "Please avoid spaces"
exit 1
fi
CERTIFICATE=/etc/letsencrypt/live/$DOMAIN/cert.pem
KEY=/etc/letsencrypt/live/$DOMAIN/privkey.pem
CHAIN=/etc/letsencrypt/live/$DOMAIN/chain.pem
#Create alias for RouterOS command
routeros="ssh -i $ROUTEROS_PRIVATE_KEY $ROUTEROS_USER@$ROUTEROS_HOST -p $ROUTEROS_SSH_PORT"
#Check connection to RouterOS
$routeros /system resource print
RESULT=$?
if [[ ! $RESULT == 0 ]]; then
echo -e "\nError in: $routeros"
echo "More info: https://wiki.mikrotik.com/wiki/Use_SSH_ ... key_login)"
exit 1
else
echo -e "\nConnection to RouterOS Successful!\n"
fi
if [ ! -f $CERTIFICATE ] && [ ! -f $KEY ]; then
echo -e "\nFile(s) not found:\n$CERTIFICATE\n$KEY\n"
echo -e "Please use CertBot Let'sEncrypt:"
echo "============================"
echo "certbot certonly --preferred-challenges=dns --manual -d $DOMAIN --manual-public-ip-logging-ok"
echo "or (for wildcard certificate):"
echo "certbot certonly --preferred-challenges=dns --manual -d *.$DOMAIN --manual-public-ip-logging-ok --server https://acme-v02.api.letsencrypt.org/directory"
echo "==========================="
echo -e "and follow instructions from CertBot\n"
exit 1
fi
# Remove previous certificate
$routeros /certificate remove [find name=$DOMAIN.pem_0]
# Create Certificate
# Delete Certificate file if the file exist on RouterOS
$routeros /file remove $DOMAIN.pem > /dev/null
# Upload Certificate to RouterOS
scp -q -P $ROUTEROS_SSH_PORT -i "$ROUTEROS_PRIVATE_KEY" "$CERTIFICATE" "$ROUTEROS_USER"@"$ROUTEROS_HOST":"$DOMAIN.pem"
sleep 2
# Import Certificate file
$routeros /certificate import file-name=$DOMAIN.pem passphrase=\"\"
# Delete Certificate file after import
$routeros /file remove $DOMAIN.pem
# Create Key
# Delete Certificate file if the file exist on RouterOS
$routeros /file remove $KEY.key > /dev/null
# Upload Key to RouterOS
scp -q -P $ROUTEROS_SSH_PORT -i "$ROUTEROS_PRIVATE_KEY" "$KEY" "$ROUTEROS_USER"@"$ROUTEROS_HOST":"$DOMAIN.key"
sleep 2
# Import Key file
$routeros /certificate import file-name=$DOMAIN.key passphrase=\"\"
# Delete Certificate file after import
$routeros /file remove $DOMAIN.key
# Create Chain
# Delete Chain file if the file exist on RouterOS
$routeros /file remove $DOMAIN-chain.pem> /dev/null
# Upload Chain to RouterOS
scp -q -P $ROUTEROS_SSH_PORT -i "$ROUTEROS_PRIVATE_KEY" "$CHAIN" "$ROUTEROS_USER"@"$ROUTEROS_HOST":"$DOMAIN-chain.pem"
sleep 2
# Import Chain file
$routeros /certificate import file-name=$DOMAIN-chain.pem passphrase=\"\"
# Delete Chain file after import
$routeros /file remove $DOMAIN-chain.pem
# Setup Certificate to SSTP Server
#$routeros /interface sstp-server server set certificate=$DOMAIN.pem_0
$routeros /ip service set www-ssl certificate=$DOMAIN.pem_0
$routeros /ip hotspot profile set hsprof1 login-by=https ssl-certificate=$DOMAIN.pem_0
exit 0
ROUTEROS_USER=admin
ROUTEROS_HOST=10.0.254.254
ROUTEROS_SSH_PORT=22
ROUTEROS_PRIVATE_KEY=/opt/letsencrypt-routeros/id_dsa
DOMAIN=vpnserver.yourdomain.com
uptime: 6w6d22h11m15s
version: 6.44 (stable)
build-time: Feb/25/2019 14:11:04
factory-software: 6.36.1
free-memory: 202.0MiB
total-memory: 256.0MiB
cpu: MIPS 1004Kc V2.15
cpu-count: 4
cpu-frequency: 880MHz
cpu-load: 6%
free-hdd-space: 4848.0KiB
total-hdd-space: 16.3MiB
write-sect-since-reboot: 19348
write-sect-total: 41673
bad-blocks: 0%
architecture-name: mmips
board-name: hEX
platform: MikroTik
Connection to RouterOS Successful!
certificates-imported: 1
private-keys-imported: 0
files-imported: 1
decryption-failures: 0
keys-with-no-certificate: 0
certificates-imported: 0
private-keys-imported: 1
files-imported: 1
decryption-failures: 0
keys-with-no-certificate: 0
certificates-imported: 0
private-keys-imported: 0
files-imported: 0
decryption-failures: 0
keys-with-no-certificate: 0
