From ec9395fcec311e896c7ed42d88ae1e27bc24141a Mon Sep 17 00:00:00 2001
From: Bob Mottram <bob@robotics.uk.to>
Date: Mon, 8 Aug 2016 20:23:27 +0100
Subject: [PATCH] Include backup pin for certificates
---
src/freedombone-pin-cert | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/freedombone-pin-cert b/src/freedombone-pin-cert
index 42f14a66f..a8ffa4876 100755
--- a/src/freedombone-pin-cert
+++ b/src/freedombone-pin-cert
@@ -35,10 +35,16 @@ export TEXTDOMAINDIR="/usr/share/locale"
DOMAIN_NAME=$1
KEY_FILENAME=/etc/ssl/private/${DOMAIN_NAME}.key
+BACKUP_KEY_FILENAME=/etc/ssl/certs/${DOMAIN_NAME}.pem
SITE_FILENAME=/etc/nginx/sites-available/${DOMAIN_NAME}
if [ ! -f "$KEY_FILENAME" ]; then
- echo $"No certificate found for $DOMAIN_NAME"
+ echo $"No private key certificate found for $DOMAIN_NAME"
+ exit 1
+fi
+
+if [ ! -f "$BACKUP_KEY_FILENAME" ]; then
+ echo $"No fullchain certificate found for $DOMAIN_NAME"
exit 1
fi
@@ -47,8 +53,9 @@ if [ ! -f "$SITE_FILENAME" ]; then
fi
KEY_HASH=$(openssl rsa -in $KEY_FILENAME -outform der -pubout | openssl dgst -sha256 -binary | openssl enc -base64)
+BACKUP_KEY_HASH=$(openssl rsa -in $BACKUP_KEY_FILENAME -outform der -pubout | openssl dgst -sha256 -binary | openssl enc -base64)
-PIN_HEADER="add_header Public-Key-Pins 'pin-sha256=\"${KEY_HASH}\"; max-age=5184000; includeSubDomains';"
+PIN_HEADER="add_header Public-Key-Pins 'pin-sha256=\"${KEY_HASH}\"; pin-sha256=\"${BACKUP_KEY_HASH}\"; max-age=5184000; includeSubDomains';"
if ! grep -q "add_header Public-Key-Pins" $SITE_FILENAME; then
sed -i "/ssl_ciphers.*/a $PIN_HEADER" $SITE_FILENAME
else
--
GitLab