Import DoD root certificates into linux CA store

add-dod-certs.sh

#!/bin/bash
# Imports DoD root certificates into Linux CA store
# Version 0.4.1 updated 20241216 by AfroThundr
# SPDX-License-Identifier: GPL-3.0-or-later

# For issues or updated versions of this script, browse to the following URL:
# https://gist.github.com/AfroThundr3007730/ba99753dda66fc4abaf30fb5c0e5d012

# Dependencies: curl gawk openssl unzip wget

set -euo pipefail
shopt -s extdebug nullglob

add_dod_certs() {
    local bundle cert certdir file form tmpdir url update
    trap '[[ -d ${tmpdir:-} ]] && rm -fr $tmpdir' EXIT INT TERM

    # Location of bundle from DISA site
    url='https://public.cyber.mil/pki-pke/pkipke-document-library/'
    bundle=$(curl -s $url | awk -F '"' 'tolower($2) ~ /dod.zip/ {print $2}')

    # Set cert directory and update command based on OS
    [[ -f /etc/os-release ]] && source /etc/os-release
    if [[ ${ID:-} =~ (fedora|rhel|centos) ||
        ${ID_LIKE:-} =~ (fedora|rhel|centos) ]]; then
        certdir=/etc/pki/ca-trust/source/anchors
        update='update-ca-trust'
    elif [[ ${ID:-} =~ (debian|ubuntu|mint) ||
        ${ID_LIKE:-} =~ (debian|ubuntu|mint) ]]; then
        certdir=/usr/local/share/ca-certificates
        update='update-ca-certificates'
    else
        certdir=${1:-} && update=${2:-}
    fi

    [[ ${certdir:-} && ${update:-} ]] || {
        printf 'Unable to autodetect OS using /etc/os-release.\n'
        printf 'Please provide CA certificate directory and update command.\n'
        printf 'Example: %s /cert/store/location update-cmd\n' "${0##*/}"
        exit 1
    }

    # Extract the bundle
    wget -qP "${tmpdir:=$(mktemp -d)}" "$bundle"
    unzip -qj "$tmpdir"/"${bundle##*/}" -d "$tmpdir"

    # Check for existence of PEM or DER format p7b.
    for file in "$tmpdir"/*_dod_{pem,der}.p7b; do
        # Iterate over glob instead of testing directly (SC2144)
        [[ -f ${file:-} ]] && form=${file%.*} && form=${form##*_} && break
    done
    [[ ${form:-} && ${file:-} ]] || { printf 'No bundles found!\n' && exit 1; }

    # Convert the PKCS#7 bundle into individual PEM files
    openssl pkcs7 -print_certs -inform "$form" -in "$file" |
        awk -v d="$tmpdir" \
            'BEGIN {c=0} /subject=/ {c++} {print > d "/cert." c ".pem"}'

    # Rename the files based on the CA name
    for cert in "$tmpdir"/cert.*.pem; do
        mv "$cert" "$certdir"/"$(
            openssl x509 -noout -subject -in "$cert" |
                awk -F '(=|= )' '{print gensub(/ /, "_", 1, $NF)}'
        )".crt
    done

    # Remove temp files and update certificate stores
    rm -fr "$tmpdir" && $update
}

# Only execute if not being sourced
[[ ${BASH_SOURCE[0]} == "$0" ]] || return 0 && add_dod_certs "$@"

Script is broken due to a reconfiguration on DISA's part related to where the files are downloaded from. The new URL is
https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip

The updated URL from Kurlee is no longer working. Things have changed once again.

wget tmp https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip --2021-07-08 16:17:13-- http://tmp/ Resolving tmp (tmp)... failed: Name or service not known. wget: unable to resolve host address ‘tmp’ --2021-07-08 16:17:15-- https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip Resolving dl.dod.cyber.mil (dl.dod.cyber.mil)... 65.8.239.129, 65.8.239.4, 65.8.239.13, ... Connecting to dl.dod.cyber.mil (dl.dod.cyber.mil)|65.8.239.129|:443... connected. HTTP request sent, awaiting response... 403 Forbidden 2021-07-08 16:17:16 ERROR 403: Forbidden.

Fixed them changing the case of the filename.

Clever script; should change the awk regex expression within the url variable to a literal dot by escaping the period with a forward slash /dod.zip/

For some reason my escaped period doesn't show-up (unless you click edit)

Looks like an unversioned url that is updated to point at the latest version is available here: https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_DoD.zip

The format of the pem.7b file has changed with the latest PKI certificates. Update line 38 to
openssl pkcs7 -print_certs -in tmp/*pem.p7b | and script will execute without issue. For newer dev environments, it might be good to check for unzip as well.
Thanks for the script. Makes life nice and easy.

Broken for Ubuntu. I had to make the following changes.

Replace

# Convert the PKCS#7 bundle into individual PEM files
openssl pkcs7 -print_certs -in tmp/*.pem.p7b |
    awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'

with

for i in tmp/*_der.p7b; do
    openssl pkcs7 -print_certs -inform DER -in $i >> certs.txt
done

for i in tmp/*_pem.p7b; do
    openssl pkcs7 -print_certs -inform PEM -in $i >> certs.txt
done

cat certs.txt | awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'

The openssl command didn't like file globbing for the -in argument, and required me to tell it what type of cert with -inform. On top of that, 5 of the 6 certificates downloaded were in DER format with the last in PEM format with a different file naming standard.

@BennieCopeland The main _der.p7b bundle has the same content as the main _pem.p7b bundle, but in DER format. The ca_X_der.p7b bundles have the same content as the main DER bundle but split by issuing CA. So the only bundle needed from the zip file is the PEM format bundle. Since OpenSSL assumes PEM format by default, adding -inform X isn't necessary in this case. Your set of commands will just end up extracting the same certs several times.

Updated the wildcard file match to account for the underscore. Since they keep renaming the zip, I don't want to use a direct URL here still.

Thanks for the update on the file name format. I'll try it out and drop a note if I run into any issues.

Script is all good now. Gave it a test run today. Thank you for updating.

@AfroThundr3007730 Thanks for the information. I wasn't aware of all the duplication in the certificate files. The implementation makes a lot more sense now.

I noticed that a current release, 03NOV2023, of the PKI CA Certificate Bundles: PKCS#7 for DoD PKI Only - Version 5.13 provides a CA certificate bundle that is missing the expected "tmp/*_pem.p7b" file. I have modified my version of your file with the following adjustment to support either case.

    ...
    unzip -qj tmp/${bundle##*/} -d tmp

    # Check for existence of PEM format p7b.
    if [ -f "tmp/*_dod_pem.p7b" ]; then
        echo 'Found PEM formatted file, continuing extraction...'
        certform="PEM"
        certfile="*_dod_pem.p7b"
    else
        echo 'Found DER formatted file, continuing extraction and conversion...'
        certform="DER"
        certfile="*_dod_der.p7b"
    fi

    # Convert the PKCS#7 bundle into individual PEM files
    openssl pkcs7 -inform ${certform} -print_certs -in tmp/${certfile} |
        awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'

    # Rename the files based on the CA name
    ...

@senterfd-jrg Thanks for the update. I coincidentally came across the same issue yesterday morning. Appreciate the fix. Tested locally and successfully imported certificates.

Added the above and retested

#!/bin/bash
# Import DoD root certificates into linux CA store
# https://gist.github.com/AfroThundr3007730/ba99753dda66fc4abaf30fb5c0e5d012

main() {
  # Location of bundle from DISA site
  url='https://public.cyber.mil/pki-pke/pkipke-document-library/'
  bundle=$(curl -s $url | awk -F '"' 'tolower($2) ~ /dod.zip/ {print $2}')
  #bundle=https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/certificates_pkcs7_v5-6_dod.zip

  # Set cert directory and update command based on OS
  source /etc/os-release
  if [[ $ID =~ (fedora|rhel|centos) ||
    $ID_LIKE =~ (fedora|rhel|centos) ]]; then
    certdir=/etc/pki/ca-trust/source/anchors
    update=update-ca-trust
  elif [[ $ID =~ (debian|ubuntu|mint) ||
    $ID_LIKE =~ (debian|ubuntu|mint) ]]; then
    certdir=/usr/local/share/ca-certificates
    update=update-ca-certificates
  else
    certdir=$1
    update=$2
  fi

  [[ -n $certdir && -n $update ]] || {
    echo 'Unable to autodetect OS using /etc/os-release.'
    echo 'Please provide CA certificate directory and update command.'
    echo 'Example: add-dod-certs.sh /cert/store/location update-cmd'
    exit 1
  }

  # Extract the bundle
  cd $certdir
  wget -qP tmp $bundle
  unzip -qj tmp/${bundle##*/} -d tmp

  # Check for existence of PEM format p7b.
  if [ -f "tmp/*_dod_pem.p7b" ]; then
    echo 'Found PEM formatted file, continuing extraction...'
    certform="PEM"
    certfile="*_dod_pem.p7b"
  else
    echo 'Found DER formatted file, continuing extraction and conversion...'
    certform="DER"
    certfile="*_dod_der.p7b"
  fi

  # Convert the PKCS#7 bundle into individual PEM files
  openssl pkcs7 -inform ${certform} -print_certs -in tmp/${certfile} |
    awk 'BEGIN {c=0} /subject=/ {c++} {print > "cert." c ".pem"}'

  # Rename the files based on the CA name
  for i in *.pem; do
    name=$(
      openssl x509 -noout -subject -in $i |
        awk -F '(=|= )' '{gsub(/ /, "_", $NF); print $NF}'
    )
    mv $i ${name}.crt
  done

  # Remove temp files and update certificate stores
  rm -fr tmp
  $update
}

# Only execute if not being sourced
[[ ${BASH_SOURCE[0]} == "$0" ]] && main "$@"

what are the args to this script supposed to be?

It doesn’t need any I don’t think

The script uses $1 and $2, are those not 2 arguments that get passed in?

If I recall those reference the tokens that awk produces. I will double check.

@danielcjacobs if you look in the if/else block, you'll see that those args are supposed to be set to the certdir and whatever shellscript/binary is being used to update all the cert bundles. the gist tries to provide good defaults, but you can also overwrite if you so desire.

Will this run on mac?

@senterfd-jrg Thanks for catching that. I've updated the script to incorporate it (and fix various shellcheck warnings).

@njohbillie I haven't researched how a mac imports trusted certificates. If it works similarly to Linux certificate management, then you could adapt the script to make it work, if not then you may need to look at another tool to do it.