Beth
1d44d8380b
Reviewed-on: #3 Co-authored-by: Beth <ejparker@actcur.com> Co-committed-by: Beth <ejparker@actcur.com>
42 lines
No EOL
1.4 KiB
Bash
42 lines
No EOL
1.4 KiB
Bash
#! /bin/bash
|
|
function reload() {
|
|
#reload/restart relevant services
|
|
if [ -d /etc/nginx/certs/ ]
|
|
then
|
|
systemctl reload nginx
|
|
fi
|
|
}
|
|
|
|
dom=`date +%d`
|
|
today=`date +%Y%m%d`
|
|
log=/var/log/certbot-renewal.log
|
|
echo Renewal attempt for $today >> $log
|
|
#rotate log file every month
|
|
if [[ $dom = 1 ]];then mv $log $log.bak;fi
|
|
for f in `ls /etc/letsencrypt/live/ --ignore "README"`
|
|
do
|
|
echo Checking $f >> $log
|
|
#check if cert has already expired or will expire within the next two days and renew if applicable
|
|
expires=$(echo `openssl x509 -enddate -noout -in /etc/letsencrypt/live/$f/cert.pem` " - 2 day" | grep -Po "(?<=notAfter=).*" | date +%Y%m%d -f -)
|
|
if [[ $today > $expires ]]
|
|
then
|
|
echo Certificate for $f is expired, renewing >> $log
|
|
certbot renew --cert-name $f >> /var/log/certbot-renewal.log
|
|
reload()
|
|
continue
|
|
fi
|
|
#convert hostname into day of month between 0 and 28 to renew on specific day of month (reduce chance of running out of cert renewals)
|
|
hash=$(echo $f| md5sum)
|
|
num=$((0x${hash%% *}))
|
|
for d in {0..2}
|
|
do
|
|
rdate=$(((${num#-}+$d)%28+1))
|
|
if [[ $dom -eq $rdate ]]
|
|
then
|
|
echo Date falls within renewal window for $f, attempting renewal >> $log
|
|
certbot renew --cert-name $f >> $log
|
|
reload()
|
|
break
|
|
fi
|
|
done
|
|
done |