diff --git a/docs/configuration/ssl.md b/docs/configuration/ssl.md index 8e574562b..4c9b25e8f 100644 --- a/docs/configuration/ssl.md +++ b/docs/configuration/ssl.md @@ -7,7 +7,6 @@ Dokku supports SSL/TLS certificate inspection and CSR/Self-signed certificate ge ``` certs:add CRT KEY # Add an ssl endpoint to an app. Can also import from a tarball on stdin. certs:generate DOMAIN # Generate a key and certificate signing request (and self-signed certificate) -certs:info # Show certificate information for an ssl endpoint. certs:remove # Remove an SSL Endpoint from an app. certs:report [] [] # Displays an ssl report for one or more apps certs:update CRT KEY # Update an SSL Endpoint on an app. Can also import from a tarball on stdin @@ -53,31 +52,11 @@ The `certs:generate` command will walk you through the correct `openssl` command If you decide to obtain a CA signed certificate, you can import that certificate using the aforementioned `dokku certs:add` command. -### Certificate information - -The `certs:info` command will simply inspect the install SSL cert and print out details. NOTE: The server-wide certificate will be inspect if installed and no app-specific certificate exists. - -```shell -dokku certs:info node-js-app -``` - -``` ------> Fetching SSL Endpoint info for node-js-app... ------> Certificate details: -=====> Common Name(s): -=====> test.dokku.me -=====> Expires At: Aug 24 23:32:59 2016 GMT -=====> Issuer: C=US, ST=California, L=San Francisco, O=dokku.me, CN=test.dokku.me -=====> Starts At: Aug 25 23:32:59 2015 GMT -=====> Subject: C=US; ST=California; L=San Francisco; O=dokku.me; CN=test.dokku.me -=====> SSL certificate is self signed. -``` - ### Certificate removal The `certs:remove` command only works on app-specific certificates. It will `rm` the app-specific tls directory, rebuild the nginx configuration, and reload nginx. -### Displaying ssl reports about an app +### Displaying certificate reports about an app > New as of 0.8.1 diff --git a/plugins/certs/functions b/plugins/certs/functions index 55c0ea953..a130c993e 100755 --- a/plugins/certs/functions +++ b/plugins/certs/functions @@ -2,39 +2,6 @@ set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions" -certs_info_cmd() { - # This is here because it's used in both the info and the default - declare desc="prints SSL certificate info for app" - local cmd="certs:info" - [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on" - verify_app_name "$2" - local APP="$2"; local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls" - - if [[ -n "$APP_SSL_PATH" ]]; then - dokku_log_info1 "Fetching SSL Endpoint info for $APP..." - dokku_log_info1 "Certificate details:" - dokku_log_info2 "Common Name(s): " - - for domain in $(get_ssl_hostnames "$APP" | xargs); do - dokku_log_info2 " $domain" - done - - dokku_log_info2 "Expires At: $(openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -text | grep "Not After :" | awk -F " : " '{ print $2 }')" - dokku_log_info2 "Issuer: $(openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -text | grep "Issuer:" | xargs | sed -e "s/Issuer: //g")" - dokku_log_info2 "Starts At: $(openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -text | grep "Not Before:" | awk -F ": " '{ print $2 }')" - dokku_log_info2 "Subject: $(openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -subject | sed -e "s:subject= ::g"| sed -e "s:^/::g" | sed -e "s:/:; :g")" - local SSL_VERIFY_OUTPUT="$(openssl verify -verbose -purpose sslserver "$APP_SSL_PATH/server.crt" | awk -F ':' '{ print $2 }' | tail -1 | xargs || true)" - if [[ "$SSL_VERIFY_OUTPUT" == "OK" ]]; then - local SSL_SELF_SIGNED="verified by a certificate authority." - else - local SSL_SELF_SIGNED="self signed." - fi - dokku_log_info2 "SSL certificate is $SSL_SELF_SIGNED" - else - dokku_log_info1 "$APP does not have an SSL endpoint" - fi -} - is_ssl_enabled() { declare desc="returns 0 if ssl is enabled for given app" local APP=$1; verify_app_name "$APP" diff --git a/plugins/certs/internal-functions b/plugins/certs/internal-functions new file mode 100755 index 000000000..3e319812b --- /dev/null +++ b/plugins/certs/internal-functions @@ -0,0 +1,38 @@ +#!/usr/bin/env bash +set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x +source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions" +source "$PLUGIN_AVAILABLE_PATH/certs/functions" + +certs_info_cmd() { + # This is here because it's used in both the info and the default + declare desc="prints SSL certificate info for app" + local cmd="certs:info" + [[ -z $2 ]] && dokku_log_fail "Please specify an app to run the command on" + verify_app_name "$2" + local APP="$2" + local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls" + + if [[ -n "$APP_SSL_PATH" ]]; then + dokku_log_info1 "Fetching SSL Endpoint info for $APP..." + dokku_log_info1 "Certificate details:" + dokku_log_info2 "Common Name(s): " + + for domain in $(get_ssl_hostnames "$APP" | xargs); do + dokku_log_info2 " $domain" + done + + dokku_log_info2 "Expires At: $(openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -text | grep "Not After :" | awk -F " : " '{ print $2 }')" + dokku_log_info2 "Issuer: $(openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -text | grep "Issuer:" | xargs | sed -e "s/Issuer: //g")" + dokku_log_info2 "Starts At: $(openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -text | grep "Not Before:" | awk -F ": " '{ print $2 }')" + dokku_log_info2 "Subject: $(openssl x509 -in "$APP_SSL_PATH/server.crt" -noout -subject | sed -e "s:subject= ::g"| sed -e "s:^/::g" | sed -e "s:/:; :g")" + local SSL_VERIFY_OUTPUT="$(openssl verify -verbose -purpose sslserver "$APP_SSL_PATH/server.crt" | awk -F ':' '{ print $2 }' | tail -1 | xargs || true)" + if [[ "$SSL_VERIFY_OUTPUT" == "OK" ]]; then + local SSL_SELF_SIGNED="verified by a certificate authority." + else + local SSL_SELF_SIGNED="self signed." + fi + dokku_log_info2 "SSL certificate is $SSL_SELF_SIGNED" + else + dokku_log_info1 "$APP does not have an SSL endpoint" + fi +} diff --git a/plugins/certs/subcommands/default b/plugins/certs/subcommands/default old mode 100644 new mode 100755 index 5eabd33b8..9591bedae --- a/plugins/certs/subcommands/default +++ b/plugins/certs/subcommands/default @@ -1,12 +1,6 @@ #!/usr/bin/env bash set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x -source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions" -source "$PLUGIN_AVAILABLE_PATH/certs/functions" +source "$PLUGIN_AVAILABLE_PATH/certs/internal-functions" -certs_main_cmd() { - declare desc="an alias for certs:info" - local cmd="certs" - certs_info_cmd "$@" -} - -certs_main_cmd "$@" +dokku_log_warn "Deprecated: Please use certs:report" +certs_info_cmd "$@" diff --git a/plugins/certs/subcommands/info b/plugins/certs/subcommands/info index 77fd90b7c..9591bedae 100755 --- a/plugins/certs/subcommands/info +++ b/plugins/certs/subcommands/info @@ -1,6 +1,6 @@ #!/usr/bin/env bash set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x -source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions" -source "$PLUGIN_AVAILABLE_PATH/certs/functions" +source "$PLUGIN_AVAILABLE_PATH/certs/internal-functions" +dokku_log_warn "Deprecated: Please use certs:report" certs_info_cmd "$@"