kereis / traefik-certs-dumper

Dumps Let's Encrypt certificates of a specified domain which Traefik stores in acme.json.
Apache License 2.0
129 stars 24 forks source link

OVERRIDE_UID/OVERRIDE_GID and CONVERT_KEYS_TO_RSA #120

Closed itsalljustdata closed 1 year ago

itsalljustdata commented 2 years ago

Hi

It seems that the OVERRIDE_UID/OVERRIDE_GID environment variables are not being respected when creating the RSA Cert. It works for the other files though....

env_file

OVERRIDE_UID=99
OVERRIDE_GID=100
DOMAIN=domain1.au,domain2.au
COMBINED_PEM=combined.pem
CONVERT_KEYS_TO_RSA=yes
RSA_KEY_FILE_NAME=rsacert
RSA_KEY_FILE_EXT=.key
COMBINE_PKCS12=yes
PKCS12_PASSWORD_FILE=/run/secrets/pkcs12_password

Output folder

total 44
drwxr-xr-x 2 root   root  4096 Nov 23 10:36 .
drwxr-xr-x 4 root   root  4096 Nov 23 10:04 ..
-rw-r----- 1 nobody users 7109 Nov 23 10:36 cert.p12
-rw-r--r-- 1 nobody users 5934 Nov 23 10:36 cert.pem
-rw-r--r-- 1 nobody users 9181 Nov 23 10:36 combined.pem
-rw-r----- 1 nobody users 3247 Nov 23 10:36 key.pem
-rw------- 1 root   root  3247 Nov 23 10:36 rsacert.key
itsalljustdata commented 2 years ago

aah, it seems that this line is the culprit.

find ${outputdir}/ -type f \( -name "*${certificate_file_ext}" -o -name "*${privatekey_file_ext}" -o -name "*.p12" \) | while read -r f; do

it needs to take into account the fact that RSA_KEY_FILE_EXT can alter the filename created

itsalljustdata commented 2 years ago

Created PR#121

kereis commented 2 years ago

Hi,

thank you for your contribution. :) This issue relates #118 and #112. The current workaround is to use a post-hook script.

I will take a look at #121 .