Add script to run periodically for cert management

FreePBX Security
1

I have had trouble with the lets encrypt certificate management and I just realized that our integrations haven’t been syncing from the freepbx system because the certificate is invalid.

I swapped the machine to pull network certificates from our domain.

Is there any “right way” to add a script to the fwconsole job manager? I wasn’t able to find documentation on it but it appears to be a cron wrapper.

Here is my CLI that generates and assigns the certs. I haven’t written it up as a script yet until I figure out the FreePBX way to schedule it to run periodically.

sudo rm -R /etc/asterisk/keys/integration
sudo rm /etc/asterisk/keys/*
sudo ls -la /etc/asterisk/keys/
sudo fwconsole certificates --delete 0
sudo cp /tmp/certs/auto_ComputerAutoEnroll.key /etc/asterisk/keys/auto_ComputerAutoEnroll.key
sudo openssl rsa -check -noout -in /etc/asterisk/keys/auto_ComputerAutoEnroll.key
sudo openssl pkcs7 -in /tmp/certs/auto_ComputerAutoEnroll.chain -print_certs -out /etc/asterisk/keys/auto_ComputerAutoEnroll.chain
sudo openssl x509 -in /tmp/certs/auto_ComputerAutoEnroll.cert -out /etc/asterisk/keys/auto_ComputerAutoEnroll.crt
sudo chown asterisk:asterisk /etc/asterisk/keys/auto_ComputerAutoEnroll.*
sudo chmod 0440 /etc/asterisk/keys/auto_ComputerAutoEnroll.crt
sudo chmod 0440 /etc/asterisk/keys/auto_ComputerAutoEnroll.chain
sudo chmod 0400 /etc/asterisk/keys/auto_ComputerAutoEnroll.key
sudo ls -la /etc/asterisk/keys/
sudo fwconsole certificates --import
sudo fwconsole certificates --default=0
sudo fwconsole reload
sudo fwconsole sa ihc default
sudo systemctl reload httpd

Thanks!

2

I am guessing from the lack of responses that maybe it is meant as an internal use api and I should use my own scheduler?

3

Do you have port 80 exposed for the firewall?

1 Like
4

It was just easier to swap to domain certs since they were available. I have gotten the letsencrypt certs working initially in the past but then they stopped. But I did not spend any time debugging and am swapping to our internal certs moving forward. Our integrations accept this so it works out

5

I just need to automate with some scheduler now but my commands above do the work

6

This was moved to security and labeled “certman” but it isn’t really a question about that. I was trying to work out how to use the freepbx job scheduler for running my own script