3 # Script to deploy certificates to Palo Alto Networks PANOS via API
4 # Note PANOS API KEY and IP address needs to be set prior to running.
5 # The following variables exported from environment will be used.
6 # If not set then values previously saved in domain.conf file are used.
8 # Firewall admin with superuser and IP address is required.
10 # export PANOS_USER="" # required
11 # export PANOS_PASS="" # required
12 # export PANOS_HOST="" # required
14 # This function is to parse the XML
17 if [ "$type" = 'keygen' ]; then
18 status
=$
(echo "$1" |
sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
19 if [ "$status" = "success" ]; then
20 panos_key
=$
(echo "$1" |
sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
23 message
="PAN-OS Key could not be set."
26 status
=$
(echo "$1" |
sed 's/^.*"\([a-z]*\)".*/\1/g')
27 message
=$
(echo "$1" |
sed 's/^.*<result>\(.*\)<\/result.*/\1/g')
34 type=$1 # Types are keygen, cert, key, commit
35 _debug
"**** Deploying $type *****"
36 panos_url
="https://$_panos_host/api/"
37 if [ "$type" = 'keygen' ]; then
38 _H1
="Content-Type: application/x-www-form-urlencoded"
39 content
="type=keygen&user=$_panos_user&password=$_panos_pass"
40 # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}"
43 if [ "$type" = 'cert' ] ||
[ "$type" = 'key' ]; then
45 delim
="-----MultipartDelimiter$(date "+%s
%N
")"
48 export _H1
="Content-Type: multipart/form-data; boundary=$delim"
49 if [ "$type" = 'cert' ]; then
50 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
51 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"
52 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
53 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
54 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
55 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
57 if [ "$type" = 'key' ]; then
58 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
59 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\nprivate-key"
60 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
61 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
62 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
63 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n\r\n123456"
64 content
="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
67 content
="$content${nl}--$delim--${nl}"
69 content
=$
(printf %b
"$content")
72 if [ "$type" = 'commit' ]; then
73 export _H1
="Content-Type: application/x-www-form-urlencoded"
74 cmd
=$
(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode
)
75 content
="type=commit&key=$_panos_key&cmd=$cmd"
77 response
=$
(_post
"$content" "$panos_url" "" "POST")
78 parse_response
"$response" "$type"
79 # Saving response to variables
80 response_status
=$status
82 _debug response_status
"$response_status"
83 if [ "$response_status" = "success" ]; then
84 _debug
"Successfully deployed $type"
87 _err
"Deploy of type $type failed. Try deploying with --debug to troubleshoot."
93 # This is the main function that will call the other functions to deploy everything.
99 if [ -z "$PANOS_USER" ] ||
[ -z "$PANOS_PASS" ] ||
[ -z "$PANOS_HOST" ]; then
100 _debug
"No ENV variables found lets check for saved variables"
101 _getdeployconf PANOS_USER
102 _getdeployconf PANOS_PASS
103 _getdeployconf PANOS_HOST
104 _panos_user
=$PANOS_USER
105 _panos_pass
=$PANOS_PASS
106 _panos_host
=$PANOS_HOST
107 if [ -z "$_panos_user" ] && [ -z "$_panos_pass" ] && [ -z "$_panos_host" ]; then
108 _err
"No host, user and pass found.. If this is the first time deploying please set PANOS_HOST, PANOS_USER and PANOS_PASS in environment variables. Delete them after you have succesfully deployed certs."
111 _debug
"Using saved env variables."
114 _debug
"Detected ENV variables to be saved to the deploy conf."
115 # Encrypt and save user
116 _savedeployconf PANOS_USER
"$PANOS_USER" 1
117 _savedeployconf PANOS_PASS
"$PANOS_PASS" 1
118 _savedeployconf PANOS_HOST
"$PANOS_HOST" 1
119 _panos_user
="$PANOS_USER"
120 _panos_pass
="$PANOS_PASS"
121 _panos_host
="$PANOS_HOST"
123 _debug
"Let's use username and pass to generate token."
124 if [ -z "$_panos_user" ] ||
[ -z "$_panos_pass" ] ||
[ -z "$_panos_host" ]; then
125 _err
"Please pass username and password and host as env variables PANOS_USER, PANOS_PASS and PANOS_HOST"
128 _debug
"Getting PANOS KEY"
130 if [ -z "$_panos_key" ]; then
131 _err
"Missing apikey."