|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Exit script on error |
| 3 | +set -o errexit |
| 4 | + |
| 5 | +# Generate a new local CA inside the Nginx container |
| 6 | +echo "Generating a new local Certificate Authority (CA)..." |
| 7 | +bin/docker-compose exec -T -u root nginx mkcert -install |
| 8 | + |
| 9 | +# Copy the generated CA certificate to the host |
| 10 | +CONTAINER_ID=$(bin/docker-compose ps -q nginx | awk '{print $1}') |
| 11 | +docker cp "$CONTAINER_ID":/root/.local/share/mkcert/rootCA.pem . |
| 12 | + |
| 13 | +echo "System password required to install the CA certificate on the host..." |
| 14 | + |
| 15 | +# Determine the operating system and install CA accordingly |
| 16 | +if [ "$(uname)" == "Darwin" ]; then |
| 17 | + echo "Installing CA certificate on macOS..." |
| 18 | + |
| 19 | + sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain rootCA.pem |
| 20 | + |
| 21 | + # Check if Firefox is installed |
| 22 | + FIREFOX_BIN="/Applications/Firefox.app/Contents/MacOS/firefox-bin" |
| 23 | + if [ -f "$FIREFOX_BIN" ]; then |
| 24 | + echo "Configuring Firefox to trust the CA certificate..." |
| 25 | + |
| 26 | + # Create Firefox policy for trusting enterprise certificates |
| 27 | + echo "{\"policies\": {\"Certificates\": {\"ImportEnterpriseRoots\": true}}}" | sudo tee policies.json |
| 28 | + |
| 29 | + # Ensure the distribution directory exists |
| 30 | + FIREFOX_DIST_DIR="/Applications/Firefox.app/Contents/Resources/distribution" |
| 31 | + [ ! -d "$FIREFOX_DIST_DIR" ] && sudo mkdir -p "$FIREFOX_DIST_DIR" |
| 32 | + |
| 33 | + # Move policy file to Firefox distribution directory |
| 34 | + sudo mv policies.json "$FIREFOX_DIST_DIR/policies.json" |
| 35 | + |
| 36 | + # Ensure the Mozilla Certificates directory exists |
| 37 | + MOZILLA_CERT_DIR="/Library/Application Support/Mozilla/Certificates" |
| 38 | + [ ! -d "$MOZILLA_CERT_DIR" ] && sudo mkdir -p "$MOZILLA_CERT_DIR" |
| 39 | + |
| 40 | + # Move the CA certificate to the Mozilla Certificates directory |
| 41 | + sudo mv rootCA.pem "$MOZILLA_CERT_DIR/rootCA.pem" |
| 42 | + else |
| 43 | + sudo rm rootCA.pem |
| 44 | + fi |
| 45 | + |
| 46 | +else |
| 47 | + echo "Installing CA certificate on Linux..." |
| 48 | + |
| 49 | + # Ensure required package `libnss3-tools` is installed |
| 50 | + REQUIRED_PKG="libnss3-tools" |
| 51 | + if ! dpkg-query -W --showformat='${Status}\n' "$REQUIRED_PKG" | grep -q "install ok installed"; then |
| 52 | + echo "Installing required package: $REQUIRED_PKG..." |
| 53 | + sudo apt-get --yes install "$REQUIRED_PKG" |
| 54 | + fi |
| 55 | + |
| 56 | + # Define certificate variables |
| 57 | + CERT_FILE="rootCA.pem" |
| 58 | + CERT_NAME="Root CA" |
| 59 | + |
| 60 | + # Install certificate for legacy cert8 (DBM format) |
| 61 | + echo "Configuring legacy certificate database (cert8.db)..." |
| 62 | + find ~/ -name "cert8.db" -print0 | while IFS= read -r -d '' CERT_DB; do |
| 63 | + CERT_DIR=$(dirname "$CERT_DB") |
| 64 | + certutil -D -n "$CERT_NAME" -i "$CERT_FILE" -d dbm:"$CERT_DIR" |
| 65 | + certutil -A -n "$CERT_NAME" -t "TCu,Cu,Tu" -i "$CERT_FILE" -d dbm:"$CERT_DIR" |
| 66 | + done |
| 67 | + |
| 68 | + # Install certificate for modern cert9 (SQL format) |
| 69 | + echo "Configuring modern certificate database (cert9.db)..." |
| 70 | + find ~/ -name "cert9.db" -print0 | while IFS= read -r -d '' CERT_DB; do |
| 71 | + CERT_DIR=$(dirname "$CERT_DB") |
| 72 | + certutil -D -n "$CERT_NAME" -i "$CERT_FILE" -d sql:"$CERT_DIR" |
| 73 | + certutil -A -n "$CERT_NAME" -t "TCu,Cu,Tu" -i "$CERT_FILE" -d sql:"$CERT_DIR" |
| 74 | + done |
| 75 | + |
| 76 | + # Move CA certificate to system-wide directory and update certificates |
| 77 | + sudo mv rootCA.pem /usr/local/share/ca-certificates/rootCA.crt |
| 78 | + sudo update-ca-certificates |
| 79 | +fi |
| 80 | + |
| 81 | +echo "SSL CA setup completed successfully." |
0 commit comments