-
-
Save AfroThundr3007730/ba99753dda66fc4abaf30fb5c0e5d012 to your computer and use it in GitHub Desktop.
| #!/bin/bash | |
| # Imports DoD root certificates into Linux CA store | |
| # Version 0.4.2 updated 20250425 by AfroThundr | |
| # SPDX-License-Identifier: GPL-3.0-or-later | |
| # For issues or updated versions of this script, browse to the following URL: | |
| # https://gist.github.com/AfroThundr3007730/ba99753dda66fc4abaf30fb5c0e5d012 | |
| # Dependencies: curl gawk openssl unzip wget | |
| set -euo pipefail | |
| shopt -s extdebug nullglob | |
| add_dod_certs() { | |
| local bundle cert certdir file form tmpdir url update | |
| trap '[[ -d ${tmpdir:-} ]] && rm -fr $tmpdir' EXIT INT TERM | |
| # Location of bundle from DISA site | |
| url='https://public.cyber.mil/pki-pke/pkipke-document-library/' | |
| bundle=$(curl -s $url | awk -F '"' 'tolower($2) ~ /dod.zip/ {print $2}') | |
| # Set cert directory and update command based on OS | |
| [[ -f /etc/os-release ]] && source /etc/os-release | |
| if [[ ${ID:-} =~ (fedora|rhel|centos) || | |
| ${ID_LIKE:-} =~ (fedora|rhel|centos) ]]; then | |
| certdir=/etc/pki/ca-trust/source/anchors | |
| update='update-ca-trust' | |
| elif [[ ${ID:-} =~ (debian|ubuntu|mint) || | |
| ${ID_LIKE:-} =~ (debian|ubuntu|mint) ]]; then | |
| certdir=/usr/local/share/ca-certificates | |
| update='update-ca-certificates' | |
| else | |
| certdir=${1:-} && update=${2:-} | |
| fi | |
| [[ ${certdir:-} && ${update:-} ]] || { | |
| printf 'Unable to autodetect OS using /etc/os-release.\n' | |
| printf 'Please provide CA certificate directory and update command.\n' | |
| printf 'Example: %s /cert/store/location update-cmd\n' "${0##*/}" | |
| exit 1 | |
| } | |
| # Extract the bundle | |
| wget -qP "${tmpdir:=$(mktemp -d)}" "$bundle" | |
| unzip -qj "$tmpdir"/"${bundle##*/}" -d "$tmpdir" | |
| # Check for existence of PEM or DER format p7b. | |
| for file in "$tmpdir"/*_{DoD,dod}{.,_}{pem,der}.p7b; do | |
| # Iterate over glob instead of testing directly (SC2144) | |
| [[ -f ${file:-} ]] && | |
| form=${file%.*} && form=${form##*_} && form=${form##*.} && break | |
| done | |
| [[ ${form:-} && ${file:-} ]] || { printf 'No bundles found!\n' && exit 1; } | |
| # Convert the PKCS#7 bundle into individual PEM files | |
| openssl pkcs7 -print_certs -inform "$form" -in "$file" | | |
| awk -v d="$tmpdir" \ | |
| 'BEGIN {c=0} /subject=/ {c++} {print > d "/cert." c ".pem"}' | |
| # Rename the files based on the CA name | |
| for cert in "$tmpdir"/cert.*.pem; do | |
| mv "$cert" "$certdir"/"$( | |
| openssl x509 -noout -subject -in "$cert" | | |
| awk -F '(=|= )' '{print gensub(/ /, "_", "g", $NF)}' | |
| )".crt | |
| done | |
| # Remove temp files and update certificate stores | |
| rm -fr "$tmpdir" && $update | |
| } | |
| # Only execute if not being sourced | |
| [[ ${BASH_SOURCE[0]} == "$0" ]] || return 0 && add_dod_certs "$@" |
@allebone - I use the code above with some of the modifications that the users have reported. @AfroThundr3007730 did incorporate a bunch of stuff as he mentioned. His script is a big help. The DoD site continually changes their structures which requires a modification to the script. I have come here to this chat and seen recommended updates within a day to hours of required changes based on DoD site changes.
@senterfd-jrg @AfroThundr3007730 I hope my comment wasn’t taken as a complaint or criticism. TBH, I was a little tired and on a small screen with a half-wit understanding of the GIST revisions tab. (Which I didn’t see until today)
I’m just getting started on a base install of 72 servers, and this problem plagues us! (Times a ton)
I’m not scripting savvy but if there is anything I can do to help…let me know. Or I can go back to lurking until someone wants a layman to test. :)
I've updated the file glob to account for the varying bundle names as per @nathanhoeller and I've adjusted the awk command to replace all spaces properly as per @senterfd-jrg . As of today at least, it appears to be working correctly (again).
The other changes to grab the bundle URL don't appear to be needed for now. If they were needed, you can avoid calling grep like so:
- bundle=$(curl -s $url | awk -F '"' 'tolower($2) ~ /dod.zip/ {print $2}')
+ bundle=$(curl -s $url | awk -F '"' '/https/ && tolower($2) ~ /dod.zip/ {print $2}')
@AfroThundr3007730, thanks for this code, have you considered retrofitting to pull the other DISA cert bundles and cycling through them to do a complete install of:
# unclass-certificates_pkcs7_DoD.zip
# unclass-certificates_pkcs7_ECA.zip
# unclass-certificates_pkcs7_JITC.zip
# unclass-certificates_pkcs7_WCF.zip
# unclass-dod_approved_external_pkis_trust_chains_types_1-2_federal_agencies.zip
# unclass-dod_approved_external_pkis_trust_chains_types_3-4_non_federal_issuers.zip
# unclass-dod_approved_external_pkis_trust_chains_types_5-6_foreign_other.zip
# unclass-dod_approved_external_pkis_trust_chains.zip
I'm frequently needing the WCF bundle and was just considering pulling these all for import, just curious if you have done this already before I start modifying the code.
Just tried to run this on Linux Mint Cinnamon 22.1 (xia) using the instructions found here:
https://community.linuxmint.com/tutorial/view/313
When I attempt to execute the file in my terminal, I'm getting this error:
./add-dod-certs.sh: 11: set: Illegal option -o pipefail
What am I doing wrong?
@R1ceAR0n1e - You need to execute with bash. Either set execution bit with chmod or execute as bash add-dod-certs.sh. Also, need to ensure you have bash installed on your OS.
Is this currently functional, as-is above? I see lots of suggestions for fixes, but wasn't sure if this is still being maintained.