53 lines
1.7 KiB
Bash
53 lines
1.7 KiB
Bash
#!/bin/bash
|
||
# git.xpcool.com 证书更新（2026-09-13）
|
||
# 自适应：从 nginx 配置里读出实际引用的证书路径，覆盖该路径，避免文件名不一致踩空
|
||
set -e
|
||
|
||
DOMAIN=git.xpcool.com
|
||
CONF=/data/nginx/conf.d/$DOMAIN.conf
|
||
|
||
echo "=== conf ssl lines ==="
|
||
grep -n "listen\|server_name\|ssl_certificate" "$CONF"
|
||
|
||
echo "=== ssl dir (before) ==="
|
||
sudo ls -l /data/nginx/ssl/$DOMAIN/
|
||
|
||
# 从配置解析真实路径（ssl_certificate\s 不会误匹配 ssl_certificate_key）
|
||
CRT=$(grep -oP "ssl_certificate\s+\K[^;]+" "$CONF" | head -1 | tr -d ' \r')
|
||
KEY=$(grep -oP "ssl_certificate_key\s+\K[^;]+" "$CONF" | head -1 | tr -d ' \r')
|
||
echo "target crt = $CRT"
|
||
echo "target key = $KEY"
|
||
|
||
echo "=== old cert ==="
|
||
sudo openssl x509 -in "$CRT" -noout -subject -enddate
|
||
echo -n "old sha="; sudo sha256sum "$CRT" | cut -c1-16
|
||
|
||
# 备份旧证书（可回滚）
|
||
STAMP=$(date +%Y%m%d%H%M)
|
||
sudo cp -a "$CRT" "${CRT}.bak.$STAMP"
|
||
sudo cp -a "$KEY" "${KEY}.bak.$STAMP"
|
||
echo "backup -> ${CRT}.bak.$STAMP"
|
||
|
||
# 覆盖为新证书
|
||
sudo cp /tmp/${DOMAIN}_bundle.crt "$CRT"
|
||
sudo cp /tmp/${DOMAIN}.key "$KEY"
|
||
sudo chmod 644 "$CRT"
|
||
sudo chmod 600 "$KEY"
|
||
|
||
echo "=== key/cert match check ==="
|
||
c=$(sudo openssl x509 -in "$CRT" -noout -pubkey | openssl md5)
|
||
k=$(sudo openssl pkey -in "$KEY" -pubout 2>/dev/null | openssl md5)
|
||
echo "cert=$c"
|
||
echo "key =$k"
|
||
if [ "$c" = "$k" ]; then echo "MATCH_OK"; else echo "MATCH_FAIL"; exit 1; fi
|
||
|
||
echo "=== new cert ==="
|
||
sudo openssl x509 -in "$CRT" -noout -subject -enddate
|
||
|
||
sudo nginx -t
|
||
sudo systemctl reload nginx
|
||
|
||
echo "=== verify served cert ==="
|
||
echo | openssl s_client -connect 127.0.0.1:443 -servername $DOMAIN 2>/dev/null | openssl x509 -noout -subject -enddate
|
||
echo "DONE"
|