Changeset 7789

Timestamp:

23/12/10 16:35:07 (10 years ago)

Author:

pjkersha

Message:

Improvements to:

• allow for keystores where no password is set
• error handling

Location:

TI12-security/trunk/esg_keytool_utils

Files:

• export_keystore_certs2pems.cfg (modified) (1 diff)
• export_keystore_certs2pems.sh (modified) (3 diffs)

TI12-security/trunk/esg_keytool_utils/export_keystore_certs2pems.cfg

@@ -17 +17 @@
 keystore="./keystore"
 
-# Java Key store password.  If omitted, it will be prompted for from stdin
+# Java Key store password.  If omitted, it is assumed to be null
 keystore_passwd=123456
 
-# Directory for storage of temporary DER files used by keytool
-tmp_dir=.
+# Uncomment this to prompt from stdin instead
+#keystore_passwd_from_stdin=True
 
 # Export directory for output PEM files

TI12-security/trunk/esg_keytool_utils/export_keystore_certs2pems.sh

@@ -45 +45 @@
 fi
 
+# Check output directory setting
+if [ -z "$export_dir" ]; then
+    echo "Missing 'export_dir' setting from config file or value is null." >&2;
+    echo $usage >&2 ;
+    exit 1;
+
+elif [ ! -d "export_dir" ]; then
+    # Attempt to create path
+    mkdir -p $export_dir
+fi
+
 # Keystore password may be retrieved from stdin
-if [ -z "$keystore_passwd" ]; then
+if [ "$keystore_passwd_from_stdin" ]; then
     # Read from stdin
     read -t 60 -p "Keystore password: " -s keystore_passwd ;
@@ -52 +63 @@
 fi
 
-if [ -z "$keystore_passwd" ]; then 
-    echo "No keystore password set: exiting ..." >&2 ;
-    exit 1;
-   
-elif [ ${#keystore_passwd} -lt 6 ]; then
+# Check password is longer than 6 chars but skip if no password was set at
+# all - this is legal.
+if [ "$keystore_passwd" ] && [ ${#keystore_passwd} -lt 6 ]; then
     echo "keystore password must be longer than 6 characters." >&2 ;
     exit 1;
 fi
 
+# Temporary file to collect stderr from keytool
+tmp_error_filepath=$(tempfile)
 if [ -z "$aliases" ]; then
     # Get aliases for all the stored certificates
-    aliases=$(keytool -list -keystore $keystore -storepass $keystore_passwd | grep trustedCertEntry|awk -F, '{print $1}')
+    # (Needs alternate invocations based on whether a password is set or not)
+    if [ -z "$keystore_passwd" ]; then
+        # Use echo to pipe in a null password at the prompt
+        aliases=$(echo|keytool -list -keystore $keystore $keystore_passwd \
+                2> $tmp_error_filepath | \
+                grep trustedCertEntry | awk -F, '{print $1}')
+    else
+        aliases=$(keytool -list -keystore $keystore -storepass $keystore_passwd \
+                2> $tmp_error_filepath | \
+                grep trustedCertEntry| awk -F, '{print $1}')
+    fi
+    
+    # Collected stderr from keytool
+    tmp_file_output=$(< $tmp_error_filepath)
+    rm -f $tmp_error_filepath
+    
+    # Check again to flag 'keytool -list' operation failed
+    if [ -z "$aliases" ]; then
+        echo No aliases found for keystore $keystore. Error output is: "$tmp_file_output" >&2 ;
+        rm -f $(tempfile)
+        exit 1;  
+    fi
 fi
+
+# Temporary directory for DER file intermediate output
+tmp_dir=$(mktemp -d)
 
 # Export based on alias
@@ -70 +105 @@
     # Export as DER format cert
     der_file="$tmp_dir/${alias}.der"
-    keytool -export -alias "$alias" -keystore $keystore -storepass $keystore_passwd -file "$der_file" 
-
+    if [ -z "$keystore_passwd" ]; then
+        # Use echo to pipe in a null password at the prompt
+        echo | keytool -export -alias "$alias" -keystore $keystore \
+            $keystore_passwd -file "$der_file" 2> /dev/null
+    else
+        keytool -export -alias "$alias" -keystore $keystore -storepass \
+            $keystore_passwd -file "$der_file" 2> /dev/null
+    fi
+    
     # Find out the hash and use this to name the exported PEM file
     cert_hash=$(openssl x509 -inform DER -in "$der_file" -noout -hash)
+    if [ $? != "0" ]; then
+        echo "Error calculating hash for certificate $der_file" >&2 ;
+        break ;  
+    fi 
+           
     pem_file="$export_dir/${cert_hash}.0"
     
     # Convert exported file to PEM
     openssl x509 -inform DER -in "$der_file" -outform PEM -out "$pem_file"
+done
 
-    # Cleanup
-    rm -f "$der_file"
-done
+rm -rf $tmp_dir ;
+echo "Certificates exported from keystore $keystore to $export_dir." ;
+exit 0 ;