PHPki

Verified on:
SME Server 7.4 - RequestedDeletion

yum --enablerepo=smecontribs install smeserver-phpki-ng

yum --enablerepo=smecontribs,epel install smeserver-phpki

expand-template /etc/httpd/conf/httpd.conf
expand-template /etc/httpd/pki-conf/httpd.conf
sv t /service/httpd-e-smith
sv u /service/httpd-pki

signal-event post-upgrade; signal-event reboot

expand-template /etc/httpd/conf/httpd.conf
expand-template /etc/httpd/pki-conf/httpd.conf
sv t /service/httpd-e-smith
sv t /service/httpd-pki

yum --enablerepo=smecontribs install smeserver-phpki

expand-template /etc/httpd/conf/httpd.conf
expand-template /etc/httpd/pki-conf/httpd.conf
sv t /service/httpd-e-smith
sv u /service/httpd-pki

signal-event post-upgrade; signal-event reboot

#!/bin/bash

# Read Openvpn-Bridge DB
ORGNAME=$(/sbin/e-smith/db openvpn-bridge getprop default_config organizationName)
COUNTRY=$(/sbin/e-smith/db openvpn-bridge getprop default_config countryCode)
STATE=$(/sbin/e-smith/db openvpn-bridge getprop default_config countryName)
LOC=$(/sbin/e-smith/db openvpn-bridge getprop default_config localityName)
DEP=$(/sbin/e-smith/db openvpn-bridge getprop default_config sectionName)
KEYSIZE=$(/sbin/e-smith/db openvpn-bridge getprop default_config keySize)
EMAIL=$(/sbin/e-smith/db openvpn-bridge getprop default_config mailAddress)


OPENSSL=/usr/bin/openssl
OLDDIR=/etc/openvpn/easy-rsa/keys/bridge/
NEWDIR=/opt/phpki/phpki-store/CA/


# Store the actual time in $TIME
TIME=$(date +%d%m%Y%H%M%S)


# Create needed directories
prepare_dir(){
        mkdir -p $NEWDIR/{certs,newcerts,requests,pfx,private}
}


# Migrate the certificates to phpki store
migrate_certs(){
        cd $OLDDIR

        # Copy the old index.txt and serial
        cat $OLDDIR/index.txt > $NEWDIR/index.txt
        cat serial > $NEWDIR/serial

        # Copy the cacert related files
        cat ca.crt > $NEWDIR/certs/cacert.pem
        cat ca.key > $NEWDIR/private/cakey.pem

        # Now, for each file ending with .crt
        for CERT in $(ls ./*.crt); do
                CERT=$(basename $CERT .crt)

                ISININDEX=$(grep -c "/CN=$CERT/" $NEWDIR/index.txt)

                # If the current cert isn't referenced in the index,
                # or the corresponding key or csr file dosn't exists, then skip it
                # This can happen in some situation where the serial has been corrupted

                if [ $ISININDEX -gt 0 ]&&[ -s $CERT.key ]&&[ -s $CERT.csr ]; then
                        # Retrieve the serial number as reported by  openssl
                        SERIAL=$(openssl x509 -noout -serial -in $CERT.crt | cut -d"=" -f 2)

                        # Create the pem only cert in the new dir
                        $OPENSSL x509 -in $CERT.crt -inform PEM -outform PEM -out $NEWDIR/newcerts/$SERIAL.pem

                        # Create the der formated cert
                        $OPENSSL x509 -in $CERT.crt -inform PEM -outform DER -out $NEWDIR/certs/$SERIAL.der

                        # And the pkcs12 bundle (cert+key+ca)
                        $OPENSSL pkcs12 -export -in $CERT.crt -inkey $CERT.key -certfile ca.crt -caname $ORGNAME -passout pass: -out $NEWDIR/pfx/$SERIAL.pfx

                        # Copy the private key
                        cat $CERT.key > $NEWDIR/private/$SERIAL-key.pem 

                        # And the cert request
                        cat $CERT.csr > $NEWDIR/requests/$SERIAL-req.pem
                fi
        done
}

perms(){
        # Restrict access
        chown -R phpki:phpki $NEWDIR
        chmod -R o-rwx $NEWDIR
}

phpki_conf(){
        # Retrieve the common name of our CA with openssl command
        CACN=$($OPENSSL x509 -subject -noout -in $OLDDIR/ca.crt | cut -d'=' -f 8 | cut -d'/' -f 1)


        if [ -e /opt/phpki/phpki-store/config/config.php ]; then
                # Move the actual phpki configuration file               
                mv /opt/phpki/phpki-store/config/config.php /opt/phpki/phpki-store/config/config.php.$TIME

                # And use sed to configure it properly
                sed -e "s/config\['organization'\].*/config\['organization'\] = '$ORGNAME';/" \
                        -e "s/config\['unit'\].*/config\['unit'\] = '$DEP';/" \
                        -e "s/config\['contact'\].*/config\['contact'\] = '$EMAIL';/" \
                        -e "s/config\['locality'\].*/config\['locality'\] = '$LOC';/" \
                        -e "s/config\['province'\].*/config\['province'\] = '$STATE';/" \
                        -e "s/config\['country'\].*/config\['country'\] = '$COUNTRY';/" \
                        -e "s/config\['common_name'\].*/config\['common_name'\] = '$CACN';/" \
                        -e "s/config\['ca_pwd'\].*/config\['ca_pwd'\] = '';/" \
                        -e "s/config\['keysize'\].*/config\['keysize'\] = '$KEYSIZE';/" \
                        /opt/phpki/phpki-store/config/config.php.$TIME \
                        > /opt/phpki/phpki-store/config/config.php
        fi
}

migrate_var(){
        # Here, we just migrate dhparam and ta to phpki store
        if [ -e $OLDDIR/dh.pem ]; then
                cat $OLDDIR/dh.pem > $NEWDIR/private/dhparam1024.pem
        fi
        if [ -e $OLDDIR/ta.key ]; then
                cat $OLDDIR/ta.key > $NEWDIR/private/takey.pem
        fi
}


prepare_dir
migrate_certs
phpki_conf
migrate_var
perms

yum remove smeserver-phpki-ng phpki-ng
expand-template /etc/httpd/conf/httpd.conf
sv t /service/httpd-e-smith

cd /opt/phpki
tar cvzf ~/phpki-backup.tar.gz ./

cd /opt/phpki/html/
rm -f index.php 
rm -f setup.php
ln -s main.php index.php
cat config.php.rpmsave > config.php
cd ca
rm -f index.php
ln -s main.php index.php
cd /opt/phpki/
chown phpki:phpki -R phpki-store 
chown root:phpki -R html/config.php

ID	Product	Version	Status	Summary (4 tasks) ⇒
12436	SME Contribs	10.0	CONFIRMED	failure to download crl
12426	SME Contribs	10.0	CONFIRMED	smeserver-phpki-ng Setting httpd-pki PHPVersion does not alter template
12228	SME Contribs	10.0	RESOLVED	wrong uid and gid
10903	SME Contribs	Futur	CONFIRMED	NFR: Save certificate bundle for ovpn configs

ID	Product	Version	Status	Summary (2 tasks) ⇒
12420	SME Contribs	10.0	CONFIRMED	phpki-ng Create and download file has no name
12275	SME Contribs	10.0	CONFIRMED	PHP Warning: Use of undefined constant

PHPki

Contents

Maintainer

Version

Description

Requirements

Installation

Configure your new PKI

Migrate Certificates from previous OpenVPN-Bridge contrib installations

Uninstall

Re-install

Bugs

Navigation menu

Page actions

Page actions

Personal tools

Koozali SME Server

Recent activities

Koozali resources

Koozali SME Server wiki

Tools

Search

	Note:
	For v10 we have created a new update version of PHPKi called PHPKi-ng with fixes and higher security defaults. If you used the previous version you will need to create a new CA and certificates. We have imported the original version to contribs if you really need to use it, but it is not recommended, and will not be generally released

	Warning:
	This version of PHPki is a slightly modified version, so it can be used with certificates generated with previous release of smeserver-openvpn-bridge, plus some others minor modifications.

	Note:
	If you just installed the OpenVPN_Bridge contrib and are installing PHPki as suggested by the wiki page, or you just want to use PHPki without OpenVPN_Bridge contrib, then you are done here, and you don't have to migrate any certificates

	Warning:
	Of course, take some time to read this script before runing it as root.

	Note:
	As with many other rpms, removing phpki won't remove everything from your server. Especially certificates will be kept, and some php files. PHPKi-ng will attempt to backup any old certificates.