Propagate Renewed Certificate between Servers

recert.sh

#!/bin/bash

# ./recert.sh [host] [certificate file] [private key file] [reload command]

tmp=$(mktemp)
log () {
    echo $(date) "$@"
    if [[ "$@" == *! ]]; then
        rm $tmp
        exit
    fi
}

log Retriving certificate from $1...
openssl s_client \
    -showcerts -verify_return_error -servername $1 -verify_hostname $1 \
    -connect $1:443 </dev/null >$tmp 2>/dev/null \
    || log Failed retriving or verifying certitficate!
sed -nie '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' $tmp

diff $2 $tmp >/dev/null \
    && log Current certificate is latest!

openssl x509 -in $tmp -text

diff <(openssl x509 -in $tmp -noout -modulus) \
    <(openssl rsa -in $3 -noout -modulus)  >/dev/null \
    || log The certificate mismatches the private key!

log Updating the cerificate...
cp $tmp $2
$4
log Done!