graphene-os-server-infrastructure/certbot-ocsp-fetcher

#!/usr/bin/env bash

# Unofficial Bash strict mode
set \
  -o errexit \
  -o errtrace \
  -o noglob \
  -o nounset \
  -o pipefail
IFS=$'\n\t'
shopt -s inherit_errexit

determine_colored_output() {
  declare -gl COLORED_STDOUT COLORED_STDERR
  readonly GREEN='\033[0;32m'
  readonly RED='\033[0;31m'
  readonly COLOR_DEFAULT='\033[0m'

  if [[ -v NO_COLOR || ${TERM-} == dumb ]]; then
    COLORED_STDOUT=false COLORED_STDERR=false
  else
    [[ -t 1 ]] || COLORED_STDOUT=false
    [[ -t 2 ]] || COLORED_STDERR=false
  fi

}

exit_with_error() {
  local error_prefix=error:$'\t\t'

  [[ ${COLORED_STDERR-} != false ]] &&
    local -r COLORED_ERROR_MSG=${RED}${error_prefix}${*}${COLOR_DEFAULT}

  # We will have closed file descriptor 2 unless verbosity was requested, so we
  # will try to use FD5 (the FD that stderr was likely redirected to), and
  # fallback to FD2 if FD5 wasn't opened yet.
  if [[ -f /dev/fd/5 ]]; then
    exec >&5
  else
    exec >&2
  fi
  printf '%b\n' "${COLORED_ERROR_MSG:-${error_prefix}${@}}"

  exit 1
}

check_for_dependencies() {
  if ((BASH_VERSINFO[0] == 4 && BASH_VERSINFO[1] < 3 || BASH_VERSINFO[0] < 4)); then
    exit_with_error "${0##*/} requires Bash 4.3+."
  fi

  if ! { command -v openssl >&- &&
    [[ $(openssl version || true) =~ ^OpenSSL\ ([[:digit:]]+)\.([[:digit:]]+) ]] &&
    ((BASH_REMATCH[1] == 1 && BASH_REMATCH[2] >= 1 || BASH_REMATCH[1] > 1)); }; then
    # shellcheck disable=2016
    exit_with_error \
      "${0##*/} requires OpenSSL 1.1.0+," \
      'but it is not available on $PATH.'
  fi
}

parse_cli_options() {
  local -r cli_options="
Usage: ${0} [-c/--certbot-dir DIRECTORY] [-f/--force-update] \\
  [-h/--help] [-l/--no-color] [-n/--cert-name NAME[,NAME...] \\
  [-u/--ocsp-responder URL]] [-o/--output-dir DIRECTORY] \\
  [-q/--quiet|-v/--verbose] [-w/--no-reload-webserver]
"

  print_option_error() {
    local reason=${1} option=${2}
    shift 2
    local option_error="${option}: "

    case ${reason} in
      --conflict)
        local second_option=${1}
        shift
        option_error+="This option cannot be combined with the option ${second_option}."
        ;;
      --duplicate)
        option_error+="This option cannot be specified multiple times."
        ;;
      --unknown)
        option_error+="Invalid option."
        ;;
      --value)
        option_error+="This option requires a value."
        ;;
      *)
        exit 1
        ;;
    esac

    exit_with_error "${option_error}" "${cli_options}"
  }

  declare -gl ERROR_ENCOUNTERED

  declare -gi VERBOSITY=${VERBOSITY:-1}

  while ((${#} > 0)); do
    local parameter=${1}

    case ${parameter} in
      -[^-]?*)
        set -- "-${parameter:1:1}" "-${parameter:2}" "${@:2}"
        ;;
      -c | --certbot-dir | --certbot-dir=?*)
        if [[ -v CERTBOT_DIR ]]; then
          print_option_error --duplicate "${parameter}"
        fi

        if [[ ${parameter} =~ --certbot-dir=(.+) ]]; then
          CERTBOT_DIR=${BASH_REMATCH[1]}
        else
          if [[ -n ${2-} ]]; then
            CERTBOT_DIR=${2}
            shift
          else
            print_option_error --value "${parameter}"
          fi
        fi

        CERTBOT_DIR=$(
          realpath \
            --canonicalize-missing \
            --relative-base . \
            -- "${CERTBOT_DIR}"
          echo x
        )
        CERTBOT_DIR=${CERTBOT_DIR%??}
        shift
        ;;
      -f | --force-update)
        if [[ ! -v FORCE_UPDATE ]]; then
          declare -glr FORCE_UPDATE=true
        fi
        shift
        ;;
      -h | --help)
        {
          printf '%s\n' certbot-ocsp-fetcher
          printf '%s\n' "${cli_options}"
          local absolute_tool_path
          absolute_tool_path=$(realpath --no-symlinks -- "${0}")
          readonly absolute_tool_path
          cat <<EOSTRING

certbot-ocsp-fetcher helps you setup OCSP stapling in nginx. The tool primes
nginx's OCSP cache to work around nginx's flawed OCSP stapling implementation.
The tool does this by fetching and saving OCSP responses for TLS certificates
issued with Certbot.

---

Example:

1. Fetch OCSP responses for all certificates managed by Certbot, and save
them in the current working directory. This should usually be run on a
schedule, e.g. as a cronjob or systemd timer.

$ ${0}

2. Add the path(s) to the resulting OCSP response(s) as the value of the
ssl_stapling_file directive in the corresponding vhosts in Nginx. Don't
forget to reload Nginx afterwards.

3. Re-issue all certificates managed by Certbot, to add the OCSP Must-Staple
flag to the certs and automatically run certbot-ocsp-fetcher during renewals:

$ certbot renew --deploy-hook ${absolute_tool_path} --force-renewal --must-staple

---

See the online README for an explanation of all the CLI options:
https://github.com/tomwassenberg/certbot-ocsp-fetcher/blob/main/README.md
EOSTRING
        } >&2
        exit
        ;;
      -l | --no-color)
        readonly COLORED_STDOUT=false COLORED_STDERR=false
        ;;
      -n | --cert-name | --cert-name=?*)
        if [[ ${parameter} =~ --cert-name=(.+) ]]; then
          local cert_lineages_value=${BASH_REMATCH[1]}
          shift
        else
          if [[ -n ${2-} ]]; then
            local cert_lineages_value=${2}
            shift 2
          else
            print_option_error --value "${parameter}"
          fi
        fi

        # Loop over any lineages passed in the same value of --cert-name.
        OLDIFS=${IFS}
        IFS=,
        declare -Ag CERT_LINEAGES
        # Check if a hardcoded OCSP responder was specified for this set of
        # lineages.
        case ${1-} in
          -u | --ocsp-responder)
            if [[ -n ${2-} ]]; then
              for lineage_name in ${cert_lineages_value}; do
                CERT_LINEAGES["${lineage_name}"]=${2}
              done
              shift
            else
              print_option_error --value "${parameter}"
            fi
            shift
            ;;
          --ocsp-responder=?*)
            [[ ${1} =~ --ocsp-responder=(.+) ]]
            for lineage_name in ${cert_lineages_value}; do
              CERT_LINEAGES["${lineage_name}"]=${BASH_REMATCH[1]}
            done
            shift
            ;;
          *)
            # If no OCSP responder was specified, just save the lineage
            # name as the key, with an empty value.
            for lineage_name in ${cert_lineages_value}; do
              CERT_LINEAGES["${lineage_name}"]=
            done
            ;;
        esac
        unset lineage_name cert_lineages_value
        IFS=${OLDIFS}
        ;;
      -o | --output-dir | --output-dir=?*)
        if [[ -v OUTPUT_DIR ]]; then
          print_option_error --duplicate "${parameter}"
        fi

        if [[ ${parameter} =~ --output-dir=(.+) ]]; then
          OUTPUT_DIR=${BASH_REMATCH[1]}
        else
          if [[ -n ${2-} ]]; then
            OUTPUT_DIR=${2}
            shift
          else
            print_option_error --value "${parameter}"
          fi
        fi

        OUTPUT_DIR=$(
          realpath \
            --canonicalize-missing \
            --relative-base . \
            -- "${OUTPUT_DIR}"
          echo x
        )
        OUTPUT_DIR=${OUTPUT_DIR%??}
        shift
        ;;
      -q | --quiet)
        if ((VERBOSITY != 1)); then
          print_option_error --conflict "${parameter}" -v/--verbose
        else
          readonly VERBOSITY=0
          shift
        fi
        ;;
      -v | --verbose)
        if ((VERBOSITY == 0)); then
          print_option_error --conflict "${parameter}" -q/--quiet
        else
          VERBOSITY+=1
          shift
        fi
        ;;
      -w | --no-reload-webserver)
        if [[ ! -v RELOAD_WEBSERVER ]]; then
          declare -glr RELOAD_WEBSERVER=false
        fi
        shift
        ;;
      *)
        print_option_error --unknown "${parameter}"
        ;;
    esac
  done

  # Respect the common "DEBUG" environment variable if set, unless the --quiet
  # or --verbose flag has been passed as well.
  if ((${DEBUG:-0} >= 1)) && ((VERBOSITY == 1)); then
    # We set VERBOSITY to 0 in case of --quiet, so use the value of $DEBUG
    # incremented with 1 to match it with $VERBOSITY.
    VERBOSITY=$((DEBUG + 1))
  fi

  # When not parsed, the stdout and/or stderr output of all external commands
  # we call in the script is redirected to file descriptor 3.  Depending on the
  # desired verbosity, we redirect this file descriptor to either stderr or to
  # /dev/null.
  if ((VERBOSITY >= 2)); then
    exec 3>&2
  else
    exec 3>/dev/null
  fi

  # First copy file descriptor 2 to a new FD, so stderr can still be used
  # (unconditionally) in the exit_with_error function.
  exec 5>&2
  if ((VERBOSITY < 1)); then
    exec 2>/dev/null
  fi
}

# Set output directory if necessary and check if it's writeable
prepare_output_dir() {
  if [[ -v OUTPUT_DIR ]]; then
    if [[ ! -e ${OUTPUT_DIR} ]]; then
      # Don't yet fail if it's not possible to create the directory, so we can
      # exit with a custom error down below
      mkdir \
        --parents \
        -- "${OUTPUT_DIR}" || true
    fi
  else
    # Use $CACHE_DIRECTORY if set (e.g. when run as a systemd service),
    # otherwise the working directory
    readonly OUTPUT_DIR=${CACHE_DIRECTORY:-.}
  fi

  if [[ ! -w ${OUTPUT_DIR} ]]; then
    exit_with_error "no write access to output directory (\"${OUTPUT_DIR}\")"
  fi
}

start_in_correct_mode() {
  # Create temporary directory to store OCSP staple file,
  # before having checked the certificate status in the response
  local temp_output_dir
  temp_output_dir=$(mktemp --directory)
  readonly temp_output_dir
  trap "rm -r -- ""${temp_output_dir}" EXIT

  declare -A lineages_processed

  # These two environment variables are set if this script is invoked by Certbot
  if [[ ! -v RENEWED_DOMAINS || ! -v RENEWED_LINEAGE ]]; then
    run_standalone
  else
    run_as_deploy_hook
  fi

  print_and_handle_result
}

# Run in "check one or all certificate lineage(s) managed by Certbot" mode
# $1 - Path to temporary output directory
run_standalone() {
  printf >&2 '%s\n\n' "Running in stand-alone mode..."

  readonly CERTBOT_DIR=${CERTBOT_DIR:-/etc/letsencrypt}

  if [[ ! -r ${CERTBOT_DIR} || (-d ${CERTBOT_DIR}/live && ! -r ${CERTBOT_DIR}/live) ]]; then
    exit_with_error "can't access ${CERTBOT_DIR}/live"
  fi

  # Check specific lineage if passed on CLI,
  # or otherwise all lineages in Certbot's dir
  if [[ -n ${!CERT_LINEAGES[*]} ]]; then
    for lineage_name in "${!CERT_LINEAGES[@]}"; do
      if [[ -r ${CERTBOT_DIR}/live/${lineage_name} ]]; then
        fetch_ocsp_response \
          --standalone \
          "${temp_output_dir}" \
          "${lineage_name}" \
          "${CERT_LINEAGES["${lineage_name}"]}"
      else
        exit_with_error "can't access ${CERTBOT_DIR}/live/${lineage_name}"
      fi
    done
  else
    set +f
    shopt -s nullglob
    for lineage_dir in "${CERTBOT_DIR}"/live/*; do
      set -f

      # Skip non-directories, like Certbot's README file
      [[ -d ${lineage_dir} ]] || continue

      fetch_ocsp_response \
        --standalone "${temp_output_dir}" "${lineage_dir##*/}"
    done
    unset lineage_dir
  fi
}

# Run in deploy-hook mode, only processing the passed lineage
# $1 - Path to temporary output directory
run_as_deploy_hook() {
  printf >&2 '%s\n\n' "Running as a deploy hook of Certbot..."

  if [[ -v CERTBOT_DIR ]]; then
    # The directory is already inferred from the environment variable that
    # Certbot passes
    exit_with_error \
      "-c/--certbot-dir cannot be passed" \
      "when run as Certbot hook"
  fi

  if [[ -v FORCE_UPDATE ]]; then
    # When run as deploy hook the behavior of this flag is used by default.
    # Therefore passing this flag would not have any effect.
    exit_with_error \
      "-f/--force-update cannot be passed" \
      "when run as Certbot hook"
  fi

  if [[ -n ${!CERT_LINEAGES[*]} ]]; then
    # The certificate lineage is already inferred from the environment
    # variable that Certbot passes
    exit_with_error "-n/--cert-name cannot be passed when run as Certbot hook"
  fi

  fetch_ocsp_response \
    --deploy_hook "${temp_output_dir}" "${RENEWED_LINEAGE##*/}"
}

# Check if it's necessary to fetch a new OCSP response
check_for_existing_ocsp_staple_file() {
  [[ -f ${OUTPUT_DIR}/${lineage_name}.der ]] || return 1

  # Validate and verify the existing local OCSP staple file
  local existing_ocsp_response
  set +e
  existing_ocsp_response=$(openssl ocsp \
    -no_nonce \
    -issuer "${lineage_dir}/chain.pem" \
    -cert "${lineage_dir}/cert.pem" \
    -verify_other "${lineage_dir}/chain.pem" \
    -respin "${OUTPUT_DIR}/${lineage_name}.der" 2>&3)
  local -ir existing_ocsp_response_rc=${?}
  set -e
  readonly existing_ocsp_response

  ((existing_ocsp_response_rc == 0)) || return 1

  for existing_ocsp_response_line in ${existing_ocsp_response}; do
    if [[ ${existing_ocsp_response_line} =~ ^[[:blank:]]*"This Update: "(.+)$ ]]; then
      local -r this_update=${BASH_REMATCH[1]}
    elif [[ ${existing_ocsp_response_line} =~ ^[[:blank:]]*"Next Update: "(.+)$ ]]; then
      local -r next_update=${BASH_REMATCH[1]}
    fi
  done
  [[ -n ${this_update-} && -n ${next_update-} ]] || return 1

  # Only continue fetching OCSP response if existing response expires within
  # half of its lifetime.
  {
    # The command substitutions here don't respect `set -o errexit`, but in
    # case any of them fail, the total command still fails unless both
    # substitutions print an integer. This seems very unlikely to occur, so
    # let's ignore this.
    # shellcheck disable=2312
    local -ri response_lifetime_in_seconds=$(($(date +%s --date "${next_update}") - $(date +%s --date "${this_update}")))

    # `set -o errexit` isn't respected here either, but we default to renewing
    # the OCSP response, so this is fine.
    # shellcheck disable=2312
    (($(date +%s) < $(date +%s --date "${this_update}") + response_lifetime_in_seconds / 2)) || return 1
  }
}

# Generate file used by ssl_stapling_file in nginx config of websites
# $1 - Whether to run as a deploy hook for Certbot, or standalone
# $2 - Path to temporary output directory
# $3 - Name of certificate lineage
# $4 - OCSP endpoint (if specified on command line)
fetch_ocsp_response() {
  local -r temp_output_dir=${2}
  local -r lineage_name=${3}

  # This validation should be revisited once
  # https://github.com/certbot/certbot/issues/6127 is fixed.
  if [[ ${lineage_name} =~ ($'\n')|($'\t') ]]; then
    ERROR_ENCOUNTERED=true
    exit_with_error \
      "Unsupported characters encountered in the following" \
      "lineage name: ${lineage_name}$'\n\n'" \
      "Lineage names with embedded tabs or newlines are not supported," \
      "because Certbot (as of version 1.18.0) does not have well-defined" \
      'behavior on handling any "unconventional" lineage names.'
  fi

  case ${1} in
    --standalone)
      local -r lineage_dir=${CERTBOT_DIR}/live/${lineage_name}

      # `set -o errexit` is not respected here, but in case of failure we still
      # err on the safe side by renewing the OCSP staple file.
      # shellcheck disable=2310
      if [[ ${FORCE_UPDATE-} != true ]] &&
        check_for_existing_ocsp_staple_file; then
        lineages_processed["${lineage_name}"]="not updated"$'\t'"valid staple file on disk"
        return
      fi
      ;;
    --deploy_hook)
      local -r lineage_dir=${RENEWED_LINEAGE}
      ;;
    *)
      return 1
      ;;
  esac
  shift 3

  # Verify that the leaf certificate is still valid. If the certificate is
  # expired, we don't have to request a (new) OCSP response.
  local cert_expiry_output
  set +e
  cert_expiry_output=$(openssl x509 \
    -in "${lineage_dir}/cert.pem" \
    -checkend 0 \
    -noout 2>&3)
  local -ri cert_expiry_rc=${?}
  set -e
  if ((cert_expiry_rc != 0)); then
    ERROR_ENCOUNTERED=true
    lineages_processed["${lineage_name}"]="failed to update"
    if [[ ${cert_expiry_output} == "Certificate will expire" ]]; then
      lineages_processed["${lineage_name}"]+=$'\t'"leaf certificate expired"
    fi
    return
  fi

  local ocsp_endpoint
  if [[ -n ${1-} ]]; then
    ocsp_endpoint=${1}
  else
    ocsp_endpoint=$(openssl x509 \
      -noout \
      -ocsp_uri \
      -in "${lineage_dir}/cert.pem" \
      2>&3)
  fi

  # Request, verify and temporarily save the actual OCSP response,
  # and check whether the certificate status is "good"
  local ocsp_call_output
  set +e
  ocsp_call_output=$(openssl ocsp \
    -no_nonce \
    -url "${ocsp_endpoint}" \
    -issuer "${lineage_dir}/chain.pem" \
    -cert "${lineage_dir}/cert.pem" \
    -verify_other "${lineage_dir}/chain.pem" \
    -respout "${temp_output_dir}/${lineage_name}.der" 2>&3)
  local -ir ocsp_call_rc=${?}
  set -e
  readonly ocsp_call_output=${ocsp_call_output#"${lineage_dir}"/cert.pem: }
  local -r cert_status=${ocsp_call_output%%$'\n'*}

  if [[ ${ocsp_call_rc} != 0 || ${cert_status} != good ]]; then
    ERROR_ENCOUNTERED=true

    lineages_processed["${lineage_name}"]="failed to update"
    if ((VERBOSITY >= 2)); then
      lineages_processed["${lineage_name}"]+=$'\t'"${ocsp_call_output//[[:space:]]/ }"
    else
      lineages_processed["${lineage_name}"]+=$'\t'"${cert_status}"
    fi

    return
  fi

  # If arrived here status was good, so move OCSP staple file to definitive
  # folder
  mv "${temp_output_dir}/${lineage_name}.der" "${OUTPUT_DIR}/"

  lineages_processed["${lineage_name}"]=updated
}

print_and_handle_result() {
  local -r header=LINEAGE$'\t'RESULT$'\t'REASON

  local lineages_processed_marked_up
  for lineage_name in "${!lineages_processed[@]}"; do
    lineages_processed_marked_up+=$'\n'"${lineage_name}"$'\t'
    if [[ ${COLORED_STDOUT-} != false ]]; then
      if [[ ${lineages_processed["${lineage_name}"]} =~ ^updated ]]; then
        lineages_processed_marked_up+=${GREEN}
      elif [[ ${lineages_processed["${lineage_name}"]} =~ ^"failed to update" ]]; then
        lineages_processed_marked_up+=${RED}
      fi
      lineages_processed_marked_up+=${lineages_processed["${lineage_name}"]}${COLOR_DEFAULT}
    else
      lineages_processed_marked_up+=${lineages_processed["${lineage_name}"]}
    fi
  done
  unset lineage_name
  lineages_processed_marked_up=$(sort <<<"${lineages_processed_marked_up-}")
  readonly lineages_processed_marked_up

  if [[ ${RELOAD_WEBSERVER-} != false ]]; then
    reload_webserver
  fi

  local output=${header}${lineages_processed_marked_up-}${nginx_status-}

  if ((VERBOSITY >= 1)); then
    local output_table
    # shellcheck disable=2016
    output_table=$(column \
      --output-separator $'\t' \
      --separator $'\t' \
      --table \
      <<<"${output}" \
      2>/dev/null) ||
      output_table=$(column -s$'\t' -t <<<"${output}" 2>/dev/null) ||
      local -r column_error=($'\n'
        'Install the BSD utility `column` for properly formatted output.'
        'If the version of `column` supports the `--output-separator` flag,'
        'the output will be formatted as TSV.'
        $'\n'
      )
    readonly output=${output_table:-${output}}
    unset output_table

    # Extract header to direct it to stderr
    printf '%s\n' "${output%%$'\n'*}" >&2
    # Remove header before printing everything else to stdout
    [[ -n ${!lineages_processed[*]} ]] && printf '%b\n' "${output#*$'\n'}"

    if [[ ${COLORED_STDERR-} != false ]]; then
      printf %b "${RED}${column_error[*]-}${COLOR_DEFAULT}" >&2
    else
      printf %b "${column_error[*]-}" >&2
    fi
  fi

  [[ ${ERROR_ENCOUNTERED-} != true ]]
}

reload_webserver() {
  for lineage_name in "${!lineages_processed[@]}"; do
    if [[ ${lineages_processed["${lineage_name}"]} == updated ]]; then
      local nginx_status
      if nginx -s reload >&3 2>&1; then
        [[ ${COLORED_STDERR-} != false ]] && nginx_status=${GREEN}
        # The last line includes a leading space, to workaround the lack of the
        # `-n` flag in later versions of `column`.
        nginx_status+=$'\n\n \t'"nginx reloaded"
      else
        ERROR_ENCOUNTERED=true
        [[ ${COLORED_STDERR-} != false ]] && nginx_status=${RED}
        nginx_status=$'\n\n \t'"nginx not reloaded"$'\t'"unable to reload nginx service, try manually"
      fi
      [[ ${COLORED_STDERR-} != false ]] &&
        readonly nginx_status+=${COLOR_DEFAULT}
      break
    fi
  done
  unset lineage_name
}

main() {
  check_for_dependencies

  determine_colored_output

  parse_cli_options "${@}"

  prepare_output_dir

  start_in_correct_mode
}

main "${@}"