3 # Here is a script to deploy cert to routeros router.
4 # Deploy the cert to remote routeros
7 # acme.sh --deploy -d ftp.example.com --deploy-hook routeros
10 # Before you can deploy the certificate to router os, you need
11 # to add the id_rsa.pub key to the routeros and assign a user
14 # The user need to have access to ssh, ftp, read and write.
16 # There are no need to enable ftp service for the script to work,
17 # as they are transmitted over SCP, however ftp is needed to store
18 # the files on the router.
20 # Then you need to set the environment variables for the
21 # deploy script to work.
24 # export ROUTER_OS_USERNAME=certuser
25 # export ROUTER_OS_HOST=router.example.com
27 # acme.sh --deploy -d ftp.example.com --deploy-hook routeros
30 # The deploy script will remove previously deployed certificates,
31 # and it does this with an assumption on how RouterOS names imported
32 # certificates, adding a "cer_0" suffix at the end. This is true for
33 # versions 6.32 -> 6.41.3, but it is not guaranteed that it will be
34 # true for future versions when upgrading.
36 # If the router have other certificates with the same name as the one
37 # beeing deployed, then this script will remove those certificates.
39 # At the end of the script, the services that use those certificates
40 # could be updated. Currently only the www-ssl service is beeing
41 # updated, but more services could be added.
45 # export ROUTER_OS_ADDITIONAL_SERVICES="/ip service set api-ssl certificate=$_cdomain.cer_0"
48 # One optional thing to do as well is to create a script that updates
49 # all the required services and run that script in a single command.
51 # returns 0 means success, otherwise error.
53 ######## Public functions #####################
55 #domain keyfile certfile cafile fullchain
63 _debug _cdomain
"$_cdomain"
65 _debug _ccert
"$_ccert"
67 _debug _cfullchain
"$_cfullchain"
69 if [ -z "$ROUTER_OS_HOST" ]; then
70 _debug
"Using _cdomain as ROUTER_OS_HOST, please set if not correct."
71 ROUTER_OS_HOST
="$_cdomain"
74 if [ -z "$ROUTER_OS_USERNAME" ]; then
75 _err
"Need to set the env variable ROUTER_OS_USERNAME"
79 if [ -z "$ROUTER_OS_ADDITIONAL_SERVICES" ]; then
80 _debug
"Not enabling additional services"
81 ROUTER_OS_ADDITIONAL_SERVICES
=""
84 _info
"Trying to push key '$_ckey' to router"
85 scp
"$_ckey" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.key"
86 _info
"Trying to push cert '$_cfullchain' to router"
87 scp
"$_cfullchain" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.cer"
88 DEPLOY_SCRIPT_CMD
="/system script add name=\"LE Cert Deploy - $_cdomain\" owner=admin policy=ftp,read,write,password,sensitive
89 source=\"## generated by routeros deploy script in acme.sh
90 \n/certificate remove [ find name=$_cdomain.cer_0 ]
91 \n/certificate remove [ find name=$_cdomain.cer_1 ]
93 \n/certificate import file-name=$_cdomain.cer passphrase=\\\"\\\"
94 \n/certificate import file-name=$_cdomain.key passphrase=\\\"\\\"
96 \n/file remove $_cdomain.cer
97 \n/file remove $_cdomain.key
99 \n/ip service set www-ssl certificate=$_cdomain.cer_0
100 \n$ROUTER_OS_ADDITIONAL_SERVICES
103 # shellcheck disable=SC2029
104 ssh "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "$DEPLOY_SCRIPT_CMD"
105 # shellcheck disable=SC2029
106 ssh "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "/system script run \"LE Cert Deploy - $_cdomain\""
107 # shellcheck disable=SC2029
108 ssh "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "/system script remove \"LE Cert Deploy - $_cdomain\""