Skip to content

Instantly share code, notes, and snippets.

@rac3rx

rac3rx/add-dod-certs.sh

Forked from AfroThundr3007730/add-dod-certs.sh
Last active April 14, 2022 01:28
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save rac3rx/2dc93fe5033a97f982b6e8a0461d60e4 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save rac3rx/2dc93fe5033a97f982b6e8a0461d60e4 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. rac3rx revised this gist Apr 14, 2022. 1 changed file with 8 additions and 1 deletion.
    9 changes: 8 additions & 1 deletion add-dod-certs.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -29,7 +29,14 @@ main() {
    exit 1
    }

    # Extract the bundle
    # Verify if CA TRUST is EMPTY if not BACKUP
    if [ -d /etc/pki/ca-trust/source/anchors/ ] && [ -n "$(ls -A /etc/pki/ca-trust/source/anchors/)" ]; then
    echo "NOT-EMPTY"; find /etc/pki/ca-trust/source/anchors/ -type f -iregex '.*\.p7b$' -exec echo {} {}.BACKUP-`date +%s` \;;
    else
    echo "EMPTY";
    fi

    # Download and extract the bundle
    cd $certdir
    wget -qP tmp $bundle
    unzip -qj tmp/${bundle##*/} -d tmp
  2. rac3rx revised this gist Apr 13, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion add-dod-certs.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -4,7 +4,7 @@
    main() {
    # Location of bundle from DISA site
    url='https://public.cyber.mil/pki-pke/pkipke-document-library/'
    bundle=$(curl -s $url | awk -F '"' 'tolower($2) ~ /dod.zip/ {print $2}')
    bundle=$(curl -s $url | awk -F '"' 'tolower($2) ~ /dod\.zip/ {print $2}')
    #bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip

    # Set cert directory and update command based on OS
  3. @AfroThundr3007730 AfroThundr3007730 revised this gist Jul 28, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion add-dod-certs.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -4,7 +4,7 @@
    main() {
    # Location of bundle from DISA site
    url='https://public.cyber.mil/pki-pke/pkipke-document-library/'
    bundle=$(curl -s $url | awk -F '"' '/dod.zip/ {print $2}')
    bundle=$(curl -s $url | awk -F '"' 'tolower($2) ~ /dod.zip/ {print $2}')
    #bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip

    # Set cert directory and update command based on OS
  4. @AfroThundr3007730 AfroThundr3007730 revised this gist Apr 23, 2020. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion add-dod-certs.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -3,7 +3,9 @@

    main() {
    # Location of bundle from DISA site
    bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip
    url='https://public.cyber.mil/pki-pke/pkipke-document-library/'
    bundle=$(curl -s $url | awk -F '"' '/dod.zip/ {print $2}')
    #bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip

    # Set cert directory and update command based on OS
    source /etc/os-release
  5. @AfroThundr3007730 AfroThundr3007730 revised this gist Apr 23, 2020. 1 changed file with 49 additions and 39 deletions.
    88 changes: 49 additions & 39 deletions add-dod-certs.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -1,43 +1,53 @@
    #!/bin/bash
    # Import DoD root certificates into linux CA store

    # Set cert directory and update command based on OS
    source /etc/os-release
    if [[ $ID =~ (fedora|rhel|centos) ||
    $ID_LIKE =~ (fedora|rhel|centos) ]]; then
    certdir=/etc/pki/ca-trust/source/anchors
    update=update-ca-trust
    elif [[ $ID =~ (debian|ubuntu|mint) ||
    $ID_LIKE =~ (debian|ubuntu|mint) ]]; then
    certdir=/usr/local/share/ca-certificates
    update=update-ca-certificates
    else
    certdir=$1
    update=$2
    fi
    [[ -n $certdir && -n $update ]] || {
    echo 'Unable to autodetect OS using /etc/os-release.'
    echo 'Please provide CA certificate directory and update command.'
    echo 'Example: add-dod-certs.sh /etc/cert/location update-cmd'
    exit 1
    main() {
    # Location of bundle from DISA site
    bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip

    # Set cert directory and update command based on OS
    source /etc/os-release
    if [[ $ID =~ (fedora|rhel|centos) ||
    $ID_LIKE =~ (fedora|rhel|centos) ]]; then
    certdir=/etc/pki/ca-trust/source/anchors
    update=update-ca-trust
    elif [[ $ID =~ (debian|ubuntu|mint) ||
    $ID_LIKE =~ (debian|ubuntu|mint) ]]; then
    certdir=/usr/local/share/ca-certificates
    update=update-ca-certificates
    else
    certdir=$1
    update=$2
    fi

    [[ -n $certdir && -n $update ]] || {
    echo 'Unable to autodetect OS using /etc/os-release.'
    echo 'Please provide CA certificate directory and update command.'
    echo 'Example: add-dod-certs.sh /cert/store/location update-cmd'
    exit 1
    }

    # Extract the bundle
    cd $certdir
    wget -qP tmp $bundle
    unzip -qj tmp/${bundle##*/} -d tmp

    # Convert the PKCS#7 bundle into individual PEM files
    openssl pkcs7 -print_certs -in tmp/*.pem.p7b |
    awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'

    # Rename the files based on the CA name
    for i in *.pem; do
    name=$(openssl x509 -noout -subject -in $i |
    awk -F '(=|= )' '{gsub(/ /, "_", $NF); print $NF}'
    )
    mv $i ${name}.crt
    done

    # Remove temp files and update certificate stores
    rm -fr tmp
    $update
    }
    # Location of bundle from DISA site
    bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip
    # Extract the bundle
    cd $certdir
    wget -qP tmp $bundle
    unzip -qj tmp/${bundle##*/} -d tmp
    # Convert the PKCS#7 bundle into individual PEM files
    openssl pkcs7 -print_certs -in tmp/*.pem.p7b |
    awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'
    # Rename the files based on the CA name
    for i in *.pem; do
    name=$(openssl x509 -noout -subject -in $i |
    awk -F '(=|= )' '{gsub(/ /, "_", $NF); print $NF}'
    )
    mv $i ${name}.crt
    done
    # Remove temp files
    rm -fr tmp
    # Update the certificate stores
    $update

    # Only execute if not being sourced
    [[ ${BASH_SOURCE[0]} == "$0" ]] && main "$@"
  6. @AfroThundr3007730 AfroThundr3007730 revised this gist Apr 23, 2020. 1 changed file with 24 additions and 4 deletions.
    28 changes: 24 additions & 4 deletions add-dod-certs.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -1,8 +1,26 @@
    #!/bin/bash
    # Import DoD root certificates into linux CA store

    # Directory where locally added CA certs go
    certdir=/usr/local/share/ca-certificates
    # Set cert directory and update command based on OS
    source /etc/os-release
    if [[ $ID =~ (fedora|rhel|centos) ||
    $ID_LIKE =~ (fedora|rhel|centos) ]]; then
    certdir=/etc/pki/ca-trust/source/anchors
    update=update-ca-trust
    elif [[ $ID =~ (debian|ubuntu|mint) ||
    $ID_LIKE =~ (debian|ubuntu|mint) ]]; then
    certdir=/usr/local/share/ca-certificates
    update=update-ca-certificates
    else
    certdir=$1
    update=$2
    fi
    [[ -n $certdir && -n $update ]] || {
    echo 'Unable to autodetect OS using /etc/os-release.'
    echo 'Please provide CA certificate directory and update command.'
    echo 'Example: add-dod-certs.sh /etc/cert/location update-cmd'
    exit 1
    }
    # Location of bundle from DISA site
    bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip
    # Extract the bundle
    @@ -14,10 +32,12 @@ openssl pkcs7 -print_certs -in tmp/*.pem.p7b |
    awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'
    # Rename the files based on the CA name
    for i in *.pem; do
    name=$(awk -F 'CN = ' 'NR==1 {gsub(/ /, "_", $2); print $2}' $i)
    name=$(openssl x509 -noout -subject -in $i |
    awk -F '(=|= )' '{gsub(/ /, "_", $NF); print $NF}'
    )
    mv $i ${name}.crt
    done
    # Remove temp files
    rm -fr tmp
    # Update the certificate stores
    update-ca-certificates
    $update
  7. @AfroThundr3007730 AfroThundr3007730 revised this gist Apr 4, 2020. 1 changed file with 3 additions and 2 deletions.
    5 changes: 3 additions & 2 deletions add-dod-certs.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,5 @@
    #!/bin/bash
    # Import DoD root certificates into linux CA store

    # Directory where locally added CA certs go
    certdir=/usr/local/share/ca-certificates
    @@ -10,10 +11,10 @@ wget -qP tmp $bundle
    unzip -qj tmp/${bundle##*/} -d tmp
    # Convert the PKCS#7 bundle into individual PEM files
    openssl pkcs7 -print_certs -in tmp/*.pem.p7b |
    awk 'BEGIN {c=0;} /subject=/{c++} { print > "cert." c ".pem"}'
    awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'
    # Rename the files based on the CA name
    for i in *.pem; do
    name=$(head -1 $i | awk -F'CN = ' '{print $2}' | tr ' ' '_')
    name=$(awk -F 'CN = ' 'NR==1 {gsub(/ /, "_", $2); print $2}' $i)
    mv $i ${name}.crt
    done
    # Remove temp files
  8. @AfroThundr3007730 AfroThundr3007730 created this gist Apr 4, 2020.
    22 changes: 22 additions & 0 deletions add-dod-certs.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,22 @@
    #!/bin/bash

    # Directory where locally added CA certs go
    certdir=/usr/local/share/ca-certificates
    # Location of bundle from DISA site
    bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip
    # Extract the bundle
    cd $certdir
    wget -qP tmp $bundle
    unzip -qj tmp/${bundle##*/} -d tmp
    # Convert the PKCS#7 bundle into individual PEM files
    openssl pkcs7 -print_certs -in tmp/*.pem.p7b |
    awk 'BEGIN {c=0;} /subject=/{c++} { print > "cert." c ".pem"}'
    # Rename the files based on the CA name
    for i in *.pem; do
    name=$(head -1 $i | awk -F'CN = ' '{print $2}' | tr ' ' '_')
    mv $i ${name}.crt
    done
    # Remove temp files
    rm -fr tmp
    # Update the certificate stores
    update-ca-certificates