OCI Certificates와 Load Balancer를 위한 ACME 인증서 갱신 자동화

sudo dnf -y install git python3.11 openssl jq util-linux-core

git clone https://github.com/therealcmj/certbot-dns-oci.git
cd certbot-dns-oci

V=/opt/certbot-venv311
sudo python3.11 -m venv "$V"
sudo "$V/bin/python" -m pip install --upgrade pip
sudo "$V/bin/python" -m pip install --no-cache-dir certbot .

"$V/bin/python" -m pip check
"$V/bin/certbot" --version
"$V/bin/certbot" plugins

V=/opt/certbot-venv311
CERTBOT="$V/bin/certbot"
DOMAIN='example.com'

sudo "$CERTBOT" certonly \
  --test-cert \
  --email ops@example.com \
  --agree-tos --no-eff-email \
  --logs-dir "$V/logs" \
  --work-dir "$V/work" \
  --config-dir "$V/config" \
  --authenticator dns-oci \
  --dns-oci-propagation-seconds 120 \
  -d "*.${DOMAIN}"

sudo "$CERTBOT" certificates \
  --config-dir "$V/config" \
  --work-dir "$V/work" \
  --logs-dir "$V/logs"

CERT_DIR="$V/config/live/${DOMAIN}"
sudo openssl x509 -in "$CERT_DIR/cert.pem" -noout -subject -issuer -dates
sudo openssl verify -untrusted "$CERT_DIR/chain.pem" "$CERT_DIR/cert.pem"

sudo install -d -m 700 /etc/oci-certificate-renew
sudo tee /etc/oci-certificate-renew/renew-oci-certificate.conf >/dev/null <<'EOF'
CERTIFICATE_OCID="ocid1.certificate.oc1.<region>.<unique_id>"
LOAD_BALANCER_OCID="ocid1.loadbalancer.oc1.<region>.<unique_id>"

# Certbot live 디렉터리 이름. 보통 최초 도메인 이름입니다.
CERTBOT_CERT_NAME="example.com"
CERTBOT_BIN="/opt/certbot-venv311/bin/certbot"
OCI_BIN="/usr/bin/oci"

# 자동 탐지가 불가능하거나 여러 Listener가 같은 certificate를 쓸 때 지정합니다.
LISTENER_NAME="https-443"
RENEW_BEFORE_DAYS=30
FORCE_RENEWAL=0

# root timer에서 일반 사용자 OCI 프로파일을 읽어야 하는 경우에만 지정합니다.
OCI_CLI_PROFILE="DEFAULT"
OCI_CLI_CONFIG_FILE="/home/opc/.oci/config"

CERTBOT_CONFIG_DIR="/opt/certbot-venv311/config"
CERTBOT_WORK_DIR="/opt/certbot-venv311/work"
CERTBOT_LOGS_DIR="/opt/certbot-venv311/logs"
LE_LIVE_DIR="/opt/certbot-venv311/config/live"
OCI_WAIT_SECONDS=1200
EOF
sudo chmod 600 /etc/oci-certificate-renew/renew-oci-certificate.conf

#!/usr/bin/env bash
# /usr/local/sbin/renew-oci-certificate.sh
set -Eeuo pipefail

CONFIG_FILE=/etc/oci-certificate-renew/renew-oci-certificate.conf
source "$CONFIG_FILE"

: "${CERTIFICATE_OCID:?CERTIFICATE_OCID is required}"
: "${LOAD_BALANCER_OCID:?LOAD_BALANCER_OCID is required}"
: "${CERTBOT_CERT_NAME:?CERTBOT_CERT_NAME is required}"

RENEW_BEFORE_DAYS="${RENEW_BEFORE_DAYS:-30}"
FORCE_RENEWAL="${FORCE_RENEWAL:-0}"
SKIP_CERTBOT_RENEWAL="${SKIP_CERTBOT_RENEWAL:-0}"
OCI_ARGS=(--profile "$OCI_CLI_PROFILE" --config-file "$OCI_CLI_CONFIG_FILE")
CERTBOT_ARGS=(--config-dir "$CERTBOT_CONFIG_DIR" --work-dir "$CERTBOT_WORK_DIR" --logs-dir "$CERTBOT_LOGS_DIR")
CERT_DIR="${LE_LIVE_DIR}/${CERTBOT_CERT_NAME}"
CERT_PEM="$CERT_DIR/cert.pem"
CHAIN_PEM="$CERT_DIR/chain.pem"
KEY_PEM="$CERT_DIR/privkey.pem"
FULLCHAIN_PEM="$CERT_DIR/fullchain.pem"

for cmd in openssl jq flock "$OCI_BIN" "$CERTBOT_BIN"; do
  command -v "$cmd" >/dev/null 2>&1 || { echo "missing: $cmd" >&2; exit 1; }
done
umask 077
exec 9>/tmp/oci-certificate-renew.lock
flock -n 9 || { echo "another renewal is running"; exit 0; }

versions="$("$OCI_BIN" certs-mgmt certificate-version list \
  --certificate-id "$CERTIFICATE_OCID" --all "${OCI_ARGS[@]}")"
current="$(jq -ce '[.data.items[] | select(.stages | index("CURRENT"))] | if length == 1 then .[0] else error("CURRENT version") end' <<<"$versions")"
not_after="$(jq -er '.validity["time-of-validity-not-after"]' <<<"$current")"
expiry_epoch="$(date -d "$not_after" +%s)"
days_left=$(( (expiry_epoch - $(date +%s)) / 86400 ))
echo "OCI CURRENT expires at ${not_after} (${days_left} day(s) remaining)."

if (( FORCE_RENEWAL == 0 && days_left > RENEW_BEFORE_DAYS )); then
  echo "No renewal needed."
  exit 0
fi

for file in "$CERT_PEM" "$CHAIN_PEM" "$KEY_PEM" "$FULLCHAIN_PEM"; do
  [[ -r "$file" ]] || { echo "cannot read $file" >&2; exit 1; }
done
openssl x509 -in "$CERT_PEM" -noout >/dev/null
openssl pkey -in "$KEY_PEM" -noout >/dev/null
cmp -s <(openssl x509 -in "$CERT_PEM" -pubkey -noout) \
        <(openssl pkey -in "$KEY_PEM" -pubout) \
  || { echo "certificate and private key do not match" >&2; exit 1; }

if (( SKIP_CERTBOT_RENEWAL == 0 )); then
  "$CERTBOT_BIN" renew --cert-name "$CERTBOT_CERT_NAME" --force-renewal \
    --non-interactive "${CERTBOT_ARGS[@]}"
else
  echo "SKIP_CERTBOT_RENEWAL=1: reusing existing local certificate."
fi

new_expiry_epoch="$(openssl x509 -in "$FULLCHAIN_PEM" -noout -enddate | cut -d= -f2- | xargs -I{} date -d '{}' +%s)"
(( new_expiry_epoch > expiry_epoch )) || { echo "expiry did not advance; OCI unchanged" >&2; exit 1; }

request="$(mktemp /tmp/oci-certificate-import.XXXXXX.json)"
trap 'rm -f "$request"' EXIT
jq -n --arg certificateId "$CERTIFICATE_OCID" \
  --rawfile certificatePem "$CERT_PEM" \
  --rawfile certChainPem "$CHAIN_PEM" \
  --rawfile privateKeyPem "$KEY_PEM" \
  '{certificateId: $certificateId, certificatePem: $certificatePem, certChainPem: $certChainPem, privateKeyPem: $privateKeyPem, stage: "CURRENT"}' > "$request"

"$OCI_BIN" certs-mgmt certificate update-certificate-by-importing-config-details \
  --from-json "file://${request}" --wait-for-state ACTIVE \
  --max-wait-seconds "$OCI_WAIT_SECONDS" --force "${OCI_ARGS[@]}" >/dev/null

echo "OCI certificate version is ACTIVE."
lb_json="$("$OCI_BIN" lb load-balancer get --load-balancer-id "$LOAD_BALANCER_OCID" "${OCI_ARGS[@]}")"
listener="$(jq -ce --arg name "$LISTENER_NAME" '.data.listeners[$name]' <<<"$lb_json")"
"$OCI_BIN" lb listener update \
  --load-balancer-id "$LOAD_BALANCER_OCID" --listener-name "$LISTENER_NAME" \
  --default-backend-set-name "$(jq -er '.["default-backend-set-name"]' <<<"$listener")" \
  --port "$(jq -er '.port' <<<"$listener")" \
  --protocol "$(jq -er '.protocol' <<<"$listener")" \
  --ssl-certificate-ids "[\"${CERTIFICATE_OCID}\"]" \
  --wait-for-state SUCCEEDED --max-wait-seconds "$OCI_WAIT_SECONDS" \
  --force "${OCI_ARGS[@]}" >/dev/null

echo "SUCCESS: certificate renewed, imported to OCI, and listener updated."

sudo install -o root -g root -m 700 \
  renew-oci-certificate.sh /usr/local/sbin/renew-oci-certificate.sh
sudo /usr/local/sbin/renew-oci-certificate.sh

DOMAIN=example.com
openssl s_client -connect "${DOMAIN}:443" -servername "$DOMAIN" </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -serial

curl -Iv "https://${DOMAIN}/"

sudo /usr/local/sbin/renew-oci-certificate.sh

sudo FORCE_RENEWAL=1 /usr/local/sbin/renew-oci-certificate.sh

sudo FORCE_RENEWAL=1 SKIP_CERTBOT_RENEWAL=1 \
  /usr/local/sbin/renew-oci-certificate.sh

sudo systemctl daemon-reload
sudo systemctl enable --now oci-certificate-renew.timer
systemctl list-timers oci-certificate-renew.timer
journalctl -u oci-certificate-renew.service --since today

gcloud services enable publicca.googleapis.com

gcloud publicca external-account-keys create

CERTBOT=/opt/certbot-venv311/bin/certbot

# GTS staging: 통합 시험용, 공개 신뢰 인증서가 아님
sudo "$CERTBOT" register \
  --email ops@example.com --no-eff-email \
  --server https://dv.acme-v02.test-api.pki.goog/directory \
  --eab-kid "$EAB_KID" \
  --eab-hmac-key "$EAB_HMAC_KEY"

sudo "$CERTBOT" certonly \
  --email ops@example.com --agree-tos --no-eff-email \
  --server https://dv.acme-v02.api.pki.goog/directory \
  --logs-dir /opt/certbot-venv311/logs \
  --work-dir /opt/certbot-venv311/work \
  --config-dir /opt/certbot-venv311/config \
  --authenticator dns-oci \
  --dns-oci-propagation-seconds 120 \
  -d '*.example.com'