Download HTTP SSL certificates into JKS keystore

download_ssl_cert.sh

#!/bin/bash

set +e

CMD=${0##*/}
CMDDIR=$(cd ${0%/*}>/dev/null; pwd -P)
STOREPASS='changeit'
OPENSSL=openssl


usage() {
    cat <<EOU
usage: $CMD -h <host1:port1>[,<host2:port2>... ] [-o <keystore_file>] [-f]
EOU
}

warn() {
    msg="$@"
    echo "WARN: $msg" >&2
}

err() {
    msg="$@"
    echo "ERROR: $msg" >&2
}

confirm() {
    msg=${1:-'Are you sure to continue'}
    if [[ $force -eq 1 ]]
    then
        echo "${msg}?[n] - enforced by -f"
        return 0
    fi
    read -p "${msg}?[n]" a
    [[ ${a:0:1} == 'y' || ${a:0:1} == 'Y' ]] \
        && return 0 || return 1
}

gen_jks() {
    cert_url=$1
    port=${cert_url##*:}
    cert_host=${cert_url%%:*}
    cert_jks=${2:-"${cert_host}.jks"}
    cert_pem=${cert_host}.pem
    cert_der=${cert_host}.der

    echo processing $cert_url

    # get a cert file from given hostname
    $OPENSSL s_client -connect $cert_url -showcerts -certform DER </dev/null > $cert_pem

    # for all DNS aliases from downloaded cert file
    for cert_host_alias in $(echo $cert_host; $OPENSSL x509 -in $cert_pem -text | grep DNS: | tr ',' '\n'|awk -F: '{print $2}')
    do
        echo "  host: $cert_host_alias"
        rm -f tmpcert*.pem tmpcert*.der
        # download certs for given host alias in a list of files
        nc -vzw3 $cert_host_alias $port || continue
        $OPENSSL s_client -connect $cert_host_alias:$port -showcerts </dev/null 2>/dev/null | csplit -s -f tmpcert -b %d.pem - '% s:%' '/ s:/' '{*}'
        for tmpcert_pem in tmpcert*.pem; do
            tmpcert_alias=$(awk -F= '/ s:/ {print $NF}' $tmpcert_pem | tr ' ' '_')
            echo "    adding $tmpcert_alias in $tmpcert_pem" 
            tmpcert_der=${tmpcert_pem/.pem/.der}
            # convert PEM to DER
            $OPENSSL x509 -outform DER -in $tmpcert_pem -out $tmpcert_der
            # save it in JKS
            keytool -import -noprompt -file $tmpcert_der -alias $cert_host_alias-$tmpcert_alias -keystore $cert_jks -storepass $STOREPASS -trustcacerts || true
        done
    done
}


# generate

force=0
hosts=
outfile=jssecacerts
while getopts ":fo:h:" opt
do
    case $opt in
        f) force=1;;
        o) outfile=$OPTARG;;
        h) hosts=$OPTARG;;
    esac
done

[[ -n "$hosts" ]] || {
    usage
    exit 1
}

[[ -e $outfile ]] && {
    warn "output file '$outfile' already exists"
    confirm "Are you sure to add certificate in it(yes=add/no=del)" || rm -f $outfile
}

for h in $(echo $hosts|tr ',' ' ')
do
    gen_jks $h $outfile
done