Forked from catchdave/replace_synology_ssl_certs.sh
Created
December 2, 2021 20:42
-
-
Save killerbees19/26c643821296c025f23a32624ae2a3b3 to your computer and use it in GitHub Desktop.
CLI script to programmatically replace SSL certs on Synology NAS
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/sh | |
# How to use this script: | |
# 1. Get your 3 PEM files ready to copy over from your local machine/update server (privkey.pem, fullchain.pem, cert.pem) | |
# and put into a directory (this will be $CERT_DIRECTORY). | |
# 2. Ensure you have a user setup on synology that has ssh access (and ssh access is setup). | |
# This user will need to be able to sudo as root (i.e. add this line to sudoers, <USER> is the user you create): | |
# <USER> ALL=(ALL) NOPASSWD: /var/services/homes/<USER>/replace_certs.sh | |
# 3. Call this script as follows: | |
# sudo scp ${CERT_DIRECTORY}/{privkey,fullchain,cert}.pem $USER@$SYNOLOGY_SERVER:/tmp/ \ | |
# && sudo scp replace_synology_ssl_certs.sh $USER@$SYNOLOGY_SERVER:~/ \ | |
# && ssh $USER@$SYNOLOGY_SERVER 'sudo ./replace_synology_ssl_certs.sh' | |
# Script start. | |
# Move certs from /tmp to install directory | |
mv /tmp/{privkey,fullchain,cert}.pem /usr/syno/etc/certificate/system/default/ | |
if [ "$?" != 0 ]; then | |
echo "Halting because of error moving files" | |
exit 1 | |
fi | |
# Ensure correct permissions | |
chown root:root /usr/syno/etc/certificate/system/default/{privkey,fullchain,cert}.pem | |
if [ "$?" != 0 ]; then | |
echo "Halting because of error chowning files" | |
exit 1 | |
fi | |
echo "Certs moved from /tmp & chowned." | |
# If you're using a custom domain name, replace the FQDN certs too | |
if [ -d "/usr/syno/etc/certificate/system/FQDN/" ]; then | |
echo "Found FQDN directory, copying certificates to 'certificate/system/FQDN' as well..." | |
cp /usr/syno/etc/certificate/system/default/{privkey,fullchain,cert}.pem /usr/syno/etc/certificate/system/FQDN/ | |
chown root:root /usr/syno/etc/certificate/system/FQDN/{privkey,fullchain,cert}.pem | |
fi | |
# Reboot synology services | |
echo -n "Rebooting all the things..." | |
/usr/syno/sbin/synoservice --restart nginx | |
/usr/syno/sbin/synoservice --restart nmbd | |
/usr/syno/sbin/synoservice --restart avahi | |
/usr/syno/sbin/synoservice --reload ldap-server | |
echo " done" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment