Using Python to validate the Certbot expiration date.
This commit is contained in:
Joao Gilberto Magalhaes
parent
b26d13cd75
commit
55888752c9
2 changed files with 58 additions and 43 deletions
|
|
@ -6,12 +6,14 @@ import time
|
|||
import os
|
||||
import re
|
||||
import time
|
||||
from OpenSSL import crypto
|
||||
|
||||
|
||||
class Functions:
|
||||
HAPROXY_LOG="HAPROXY"
|
||||
EASYHAPROXY_LOG="EASYHAPROXY"
|
||||
CERTBOT_LOG="CERTBOT"
|
||||
INIT_LOG="INIT"
|
||||
HAPROXY_LOG = "HAPROXY"
|
||||
EASYHAPROXY_LOG = "EASYHAPROXY"
|
||||
CERTBOT_LOG = "CERTBOT"
|
||||
INIT_LOG = "INIT"
|
||||
|
||||
TRACE = "TRACE"
|
||||
DEBUG = "DEBUG"
|
||||
|
|
@ -94,7 +96,7 @@ class Functions:
|
|||
|
||||
return output
|
||||
except Exception as e:
|
||||
Functions.log(source, Functions.ERROR, "%s" % (e))
|
||||
Functions.log(source, Functions.ERROR, "%s" % e)
|
||||
|
||||
|
||||
class Consts:
|
||||
|
|
@ -103,6 +105,7 @@ class Consts:
|
|||
certs_letsencrypt = "/certs/letsencrypt"
|
||||
certs_haproxy = "/certs/haproxy"
|
||||
|
||||
|
||||
class DaemonizeHAProxy:
|
||||
def __init__(self):
|
||||
self.process = None
|
||||
|
|
@ -111,10 +114,13 @@ class DaemonizeHAProxy:
|
|||
|
||||
def haproxy(self, action):
|
||||
if action == "start":
|
||||
self.__prepare("/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock")
|
||||
self.__prepare(
|
||||
"/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock")
|
||||
else:
|
||||
pid = "".join(Functions().run_bash(Functions.HAPROXY_LOG, "cat /run/haproxy.pid", log_output=False))
|
||||
self.__prepare("/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -x /var/run/haproxy.sock -sf %s" % (pid))
|
||||
self.__prepare(
|
||||
"/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -x /var/run/haproxy.sock -sf %s" % (
|
||||
pid))
|
||||
|
||||
if self.process is None:
|
||||
return
|
||||
|
|
@ -136,8 +142,7 @@ class DaemonizeHAProxy:
|
|||
universal_newlines=True)
|
||||
|
||||
except Exception as e:
|
||||
Functions.log(source, Functions.ERROR, "%s" % (e))
|
||||
|
||||
Functions.log(source, Functions.ERROR, "%s" % e)
|
||||
|
||||
def __start(self):
|
||||
source = Functions.HAPROXY_LOG
|
||||
|
|
@ -150,7 +155,7 @@ class DaemonizeHAProxy:
|
|||
Functions.log(source, Functions.DEBUG, "Return code %s" % (returncode))
|
||||
|
||||
except Exception as e:
|
||||
Functions.log(source, Functions.ERROR, "%s" % (e))
|
||||
Functions.log(source, Functions.ERROR, "%s" % e)
|
||||
|
||||
def is_alive(self):
|
||||
return self.thread.is_alive()
|
||||
|
|
@ -197,18 +202,27 @@ class Certbot:
|
|||
current_time = time.time()
|
||||
for host in hosts:
|
||||
filename = "%s/%s.pem" % (self.certs, host)
|
||||
host_arg = '-d %s' % (host)
|
||||
host_arg = '-d %s' % host
|
||||
if not os.path.exists(filename):
|
||||
Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Request new certificate for %s" % (host))
|
||||
Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Request new certificate for %s" % host)
|
||||
request_certs.append(host_arg)
|
||||
else:
|
||||
creation_time = os.path.getctime(filename)
|
||||
if (current_time - creation_time) // (24 * 3600) > 90:
|
||||
Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Request expired certificate for %s" % (host))
|
||||
try:
|
||||
with open(filename, 'r') as file:
|
||||
certificate_str = file.read()
|
||||
certificate = crypto.load_certificate(crypto.FILETYPE_PEM, certificate_str)
|
||||
expiration_after = datetime.strptime(certificate.get_notAfter().decode()[:-1],
|
||||
'%Y%m%d%H%M%S').timestamp()
|
||||
|
||||
if current_time >= expiration_after:
|
||||
Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG,
|
||||
"Request expired certificate for %s" % host)
|
||||
request_certs.append(host_arg)
|
||||
if (current_time - creation_time) // (24 * 3600) >= 45:
|
||||
Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Renew certificate for %s" % (host))
|
||||
if (expiration_after - current_time) // (24 * 3600) >= 15:
|
||||
Functions.log(Functions.CERTBOT_LOG, Functions.DEBUG, "Renew certificate for %s" % host)
|
||||
renew_certs.append(host_arg)
|
||||
except Exception as e:
|
||||
Functions.log(Functions.CERTBOT_LOG, Functions.ERROR, "Certificate %s error %s" % (host, e))
|
||||
|
||||
certbot_certonly = ('/usr/bin/certbot certonly {test_server}'
|
||||
' --standalone'
|
||||
|
|
@ -219,9 +233,9 @@ class Certbot:
|
|||
' --no-eff-email'
|
||||
' --non-interactive'
|
||||
' --max-log-backups=0'
|
||||
' {certs} --email {email}'.format(certs = ' '.join(request_certs),
|
||||
email = self.email,
|
||||
test_server = self.test_server)
|
||||
' {certs} --email {email}'.format(certs=' '.join(request_certs),
|
||||
email=self.email,
|
||||
test_server=self.test_server)
|
||||
)
|
||||
|
||||
ret_reload = False
|
||||
|
|
@ -230,7 +244,7 @@ class Certbot:
|
|||
ret_reload = True
|
||||
|
||||
if len(renew_certs) > 0:
|
||||
Functions.run_bash(Functions.CERTBOT_LOG, "/usb/bin/certbot renew", return_result=False)
|
||||
Functions.run_bash(Functions.CERTBOT_LOG, "/usr/bin/certbot renew", return_result=False)
|
||||
ret_reload = True
|
||||
|
||||
if ret_reload:
|
||||
|
|
@ -238,7 +252,7 @@ class Certbot:
|
|||
|
||||
return ret_reload
|
||||
except Exception as e:
|
||||
Functions.log(Functions.CERTBOT_LOG, Functions.ERROR, "%s" % (e))
|
||||
Functions.log(Functions.CERTBOT_LOG, Functions.ERROR, "%s" % e)
|
||||
return False
|
||||
|
||||
def merge_certificate(self, cert, key, filename):
|
||||
|
|
|
|||
|
|
@ -5,3 +5,4 @@ pytest
|
|||
docker
|
||||
kubernetes
|
||||
deepdiff
|
||||
pyopenssl
|
||||
Loading…
Add table
Add a link
Reference in a new issue