48 lines
1.2 KiB
Bash
48 lines
1.2 KiB
Bash
#!/bin/sh
|
|
# Download AtlasHorizon CAs from pki.atlashorizon.net/certs/ and write PEM files.
|
|
# Never fetch /root.crt — that path is deprecated.
|
|
set -eu
|
|
|
|
ROOT="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
|
|
DEST="${ROOT}/certs"
|
|
PKI="http://pki.atlashorizon.net/certs"
|
|
|
|
if ! command -v curl >/dev/null 2>&1; then
|
|
echo "curl is required" >&2
|
|
exit 1
|
|
fi
|
|
if ! command -v openssl >/dev/null 2>&1; then
|
|
echo "openssl is required" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "${DEST}"
|
|
|
|
# Convert DER or PEM input to a normalized PEM certificate.
|
|
to_pem() {
|
|
src="$1"
|
|
dest="$2"
|
|
if grep -q "BEGIN CERTIFICATE" "${src}"; then
|
|
openssl x509 -in "${src}" -out "${dest}"
|
|
else
|
|
openssl x509 -inform DER -in "${src}" -out "${dest}"
|
|
fi
|
|
}
|
|
|
|
fetch_pem() {
|
|
url="$1"
|
|
dest="$2"
|
|
tmp="${dest}.tmp"
|
|
echo "Fetching ${url}"
|
|
curl -fsSL "${url}" -o "${tmp}"
|
|
to_pem "${tmp}" "${dest}"
|
|
rm -f "${tmp}"
|
|
openssl x509 -in "${dest}" -noout -subject -issuer
|
|
}
|
|
|
|
fetch_pem "${PKI}/AtlasHorizonRootCA.crt" "${DEST}/AtlasHorizon-Root-CA.crt"
|
|
fetch_pem "${PKI}/AtlasHorizon%20Enterprise%20CA.crt" "${DEST}/AtlasHorizon-Enterprise-CA.crt"
|
|
fetch_pem "${PKI}/AtlasHorizon%20Issuing%20CA.crt" "${DEST}/AtlasHorizon-Issuing-CA.crt"
|
|
|
|
echo "Wrote AtlasHorizon CAs to ${DEST}"
|