Verify if host will have Let's encrypt certificate validation problems

README.md

Running the script inside a docker container

If you wish to test whether your docker container won't have issues when the old Root certificate expires, you can run the script inside the container itself.

In order to do this, follow these steps:

1. Download the verify-lets-encrypt.sh script from the gist
2. Bring up your application container as you usually do - with docker-compose up, docker run, via VS Code etc
3. Run docker ps, and look for any application containers that are up; the NAMES column is the easiest for that
4. From the same folder where you've downloaded the script, run docker exec -i <CONTAINER_NAME_OR_ID> /bin/sh < verify-lets-encrypt.sh; this will run the script inside the container
5. Then, you should be able to see the script output in the same terminal

verify-lets-encrypt.sh

#!/bin/sh

set -eu

CERTS_DIR="$(openssl version -d | sed -E 's/OPENSSLDIR: "([^"]*)"/\1/')"

CERTS_FIFO="$(mktemp -u)"
mkfifo "$CERTS_FIFO"

trap 'rm -f $CERTS_FIFO' EXIT

(
  [ -r "${CERTS_DIR}/cert.pem" ] && echo "${CERTS_DIR}/cert.pem"
  [ -d "${CERTS_DIR}/certs" ] && find -L "${CERTS_DIR}/certs" -type f -name '*.pem'
) | \
  xargs sed \
    -n \
    -e '/^-*BEGIN CERTIFICATE-*$/{:I; N; /END CERTIFICATE-*$/!bI; s/\n/\\n/g; p}' \
    >"$CERTS_FIFO" &

NEW_ROOT_PRESENT=false
OLD_ROOT_PRESENT=false

while IFS= read -r cert; do
  if [ -z "$cert" ]; then
    continue
  fi

  FINGERPRINT="$(printf "%b" "$cert" | openssl x509 -fingerprint -sha1 -noout | sed -e 's/SHA1 Fingerprint=//')"

  if [ "$FINGERPRINT" = "CA:BD:2A:79:A1:07:6A:31:F2:1D:25:36:35:CB:03:9D:43:29:A5:E8" ]; then
    NEW_ROOT_PRESENT=true
  fi

  if [ "$FINGERPRINT" = "DA:C9:02:4F:54:D8:F6:DF:94:93:5F:B1:73:26:38:CA:6A:D7:7C:13" ]; then
    OLD_ROOT_PRESENT=true
  fi
done < "$CERTS_FIFO"

OPENSSL_VERSION="$(openssl version | sed -e 's/OpenSSL \([0-9]*\)\.\([0-9]*\)\.\([0-9]*\)[^0-9].*/\1:\2:\3/')"
OPENSSL_MAJOR="$(echo "$OPENSSL_VERSION" | cut -d ':' -f 1)"
OPENSSL_MINOR="$(echo "$OPENSSL_VERSION" | cut -d ':' -f 2)"
OPENSSL_PATCH="$(echo "$OPENSSL_VERSION" | cut -d ':' -f 3)"

OLD_OPENSSL=false
if [ "$OPENSSL_MAJOR" -eq 0 ] || [ "$OPENSSL_MINOR" -eq 0 ] && [ "$OPENSSL_PATCH" -le 2 ]; then
  OLD_OPENSSL=true
fi

if [ "$NEW_ROOT_PRESENT" = "true" ]; then
  echo "New ISRG Root X1 already present ✓"
else
  echo "New ISRG Root X1 not present ❌"
  echo "    -> Try updating the ca-certifiates package"
fi

echo

if [ "$OLD_ROOT_PRESENT" = "true" ] && [ "$OLD_OPENSSL" = "true" ]; then
  echo "Old OpenSSL version, and IdentTrust DST Root CA X3 is present ❌"
  echo "    -> Manual removal of old IdentTrust root is required"
else
  if [ "$OLD_OPENSSL" = "false" ]; then
    echo "OpenSSL newer than 1.0.2 ✓"
  fi

  if [ "$OLD_ROOT_PRESENT" = "false" ]; then
    echo "Old IdentTrust DST Root CA X3 is not present ✓"
  fi
fi

Great script @renato-zannon.
We can also run directly the script in our pod (for example in dev or staging environments)

Retrieving pod names:
kubectl -n <application-name> get pods

Example:
kubectl -n ninjas get pods

Running script:
kubectl -n <application-name> exec -it <podname> -- /bin/sh < verify-lets-encrypt.sh

Example:
kubectl -n ninjas exec -it ni-r-62be-web-68b4878bf5-qw9rh -- /bin/sh < verify-lets-encrypt.sh

Output:

New ISRG Root X1 already present ✓
OpenSSL newer than 1.0.2 ✓