extracts pem certificate and key with $hostname nick from certutil database

ssl-extract-from-certutil-db.sh

#!/bin/bash

db=./ssl
nick=$(hostname -f)
rand=$(< /dev/urandom tr -dc "A-Za-z0-9" | head -c32;echo;)

# remove any previous
rm server.{p12,key,crt} 2>/dev/null

# extract server
certutil -d "$db" -L -a -n "$nick" > server.crt
pk12util -d "$db" -o server.p12 -n "$nick" -W "$rand"
openssl pkcs12 -in server.p12 -out server.key -nodes -passin "pass:$rand"
rm server.p12

# extract ca
certutil -d "$db" -L -a -n 'Certificate Authority' > ca.crt

# permissions
chown postgres:postgres server.{crt,key} ca.crt
chmod 0400 server.{key,crt} ca.crt