#!/usr/bin/env bash
# zero-downtime-renewal.sh - Nginx 零停机证书轮换
set -euo pipefail

DOMAIN="${1:?用法: $0 <domain>}"
CERT_DIR="/etc/nginx/ssl"
BACKUP_DIR="/etc/nginx/ssl/backup/$(date +%Y%m%d%H%M%S)"

# 1. 备份当前证书
mkdir -p "$BACKUP_DIR"
cp "${CERT_DIR}/${DOMAIN}.crt" "$BACKUP_DIR/"
cp "${CERT_DIR}/${DOMAIN}.key" "$BACKUP_DIR/"
echo "✅ 备份完成: $BACKUP_DIR"

# 2. 生成新证书（示例：使用 certbot）
certbot certonly --nginx -d "$DOMAIN" --force-renewal --quiet

# 3. 复制新证书
cp "/etc/letsencrypt/live/${DOMAIN}/fullchain.pem" "${CERT_DIR}/${DOMAIN}.crt"
cp "/etc/letsencrypt/live/${DOMAIN}/privkey.pem" "${CERT_DIR}/${DOMAIN}.key"

# 4. 验证 Nginx 配置
if ! nginx -t; then
  echo "❌ Nginx 配置验证失败，回滚..."
  cp "${BACKUP_DIR}/${DOMAIN}.crt" "${CERT_DIR}/"
  cp "${BACKUP_DIR}/${DOMAIN}.key" "${CERT_DIR}/"
  exit 1
fi

# 5. 热重载（不中断现有连接）
nginx -s reload
echo "✅ Nginx 已重载"

# 6. 验证新证书
sleep 2
NEW_SERIAL=$(echo | openssl s_client -connect "${DOMAIN}:443" 2>/dev/null \
  | openssl x509 -noout -serial)
echo "✅ 新证书序列号: $NEW_SERIAL"

# cert-manager 自动轮换
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: app-tls
spec:
  secretName: app-tls-secret
  duration: 720h       # 30 天
  renewBefore: 240h    # 到期前 10 天续期
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
    - app.example.com

# prometheus 配置
scrape_configs:
  - job_name: 'ssl-certificates'
    metrics_path: /probe
    params:
      module: [http_2xx_tls]
    static_configs:
      - targets:
          - https://www.example.com
          - https://api.example.com
          - https://admin.example.com
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: 127.0.0.1:9115  # Blackbox Exporter

# blackbox.yml
modules:
  http_2xx_tls:
    prober: http
    timeout: 10s
    http:
      valid_http_versions: ["HTTP/1.1", "HTTP/2.0"]
      valid_status_codes: [200, 301, 302]
      preferred_ip_protocol: "ip4"
      tls_config:
        insecure_skip_verify: false

# 告警规则 (Prometheus AlertManager)
groups:
  - name: ssl-certificate
    rules:
      - alert: SSLCertExpiringSoon
        expr: (probe_ssl_earliest_cert_expiry - time()) / 86400 < 30
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: "SSL 证书即将过期"
          description: "{{ $labels.instance }} 的证书将在 {{ $value }} 天后过期"

      - alert: SSLCertExpiryCritical
        expr: (probe_ssl_earliest_cert_expiry - time()) / 86400 < 7
        for: 10m
        labels:
          severity: critical
        annotations:
          summary: "SSL 证书即将过期（紧急）"
          description: "{{ $labels.instance }} 的证书将在 {{ $value }} 天后过期"

      - alert: SSLCertExpired
        expr: (probe_ssl_earliest_cert_expiry - time()) < 0
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "SSL 证书已过期"
          description: "{{ $labels.instance }} 的证书已过期"

{
  "title": "SSL Certificate Monitoring",
  "panels": [
    {
      "title": "证书剩余天数",
      "type": "gauge",
      "targets": [
        {
          "expr": "(probe_ssl_earliest_cert_expiry - time()) / 86400"
        }
      ],
      "thresholds": {
        "steps": [
          {"value": 0, "color": "red"},
          {"value": 7, "color": "orange"},
          {"value": 30, "color": "yellow"},
          {"value": 60, "color": "green"}
        ]
      }
    }
  ]
}

#!/usr/bin/env bash
# cert-monitor-simple.sh - 简单的证书监控脚本
set -euo pipefail

HOSTS_FILE="/etc/ssl-monitor/hosts.txt"
WARN_DAYS=30
CRIT_DAYS=7
LOG_FILE="/var/log/ssl-monitor.log"
WEBHOOK_URL="${WEBHOOK_URL:-}"

log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$LOG_FILE"; }

ALERTS=()

while IFS= read -r host || [ -n "$host" ]; do
  [ -z "$host" ] && continue
  
  # 获取证书过期时间
  NOT_AFTER=$(echo | openssl s_client -connect "${host}:443" -servername "$host" \
    2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
  
  if [ -z "$NOT_AFTER" ]; then
    log "❌ ${host}: 无法获取证书信息"
    ALERTS+=("❌ ${host}: 连接失败")
    continue
  fi
  
  EXPIRE_EPOCH=$(date -d "$NOT_AFTER" +%s)
  NOW_EPOCH=$(date +%s)
  DAYS_LEFT=$(( (EXPIRE_EPOCH - NOW_EPOCH) / 86400 ))
  
  if [ "$DAYS_LEFT" -le 0 ]; then
    log "❌ ${host}: 证书已过期 ${DAYS_LEFT#-} 天"
    ALERTS+=("❌ ${host}: 已过期 ${DAYS_LEFT#-} 天")
  elif [ "$DAYS_LEFT" -le "$CRIT_DAYS" ]; then
    log "🔴 ${host}: 证书将在 ${DAYS_LEFT} 天后过期（紧急）"
    ALERTS+=("🔴 ${host}: ${DAYS_LEFT} 天后过期")
  elif [ "$DAYS_LEFT" -le "$WARN_DAYS" ]; then
    log "🟡 ${host}: 证书将在 ${DAYS_LEFT} 天后过期（警告）"
    ALERTS+=("🟡 ${host}: ${DAYS_LEFT} 天后过期")
  else
    log "✅ ${host}: 证书剩余 ${DAYS_LEFT} 天"
  fi
done < "$HOSTS_FILE"

# 发送告警
if [ ${#ALERTS[@]} -gt 0 ] && [ -n "$WEBHOOK_URL" ]; then
  MESSAGE="⚠️ SSL 证书告警\n\n"
  for alert in "${ALERTS[@]}"; do
    MESSAGE+="  ${alert}\n"
  done
  
  curl -s -X POST "$WEBHOOK_URL" \
    -H "Content-Type: application/json" \
    -d "{\"msgtype\":\"text\",\"text\":{\"content\":\"$(echo -e "$MESSAGE")\"}}" \
    >/dev/null 2>&1
fi

# Nginx TLS 安全基线配置
server {
    listen 443 ssl http2;
    
    # ✅ 证书和密钥
    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
    
    # ✅ 协议版本（仅 TLS 1.2 和 1.3）
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # ✅ 密码套件（优先 AEAD，禁用弱算法）
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # ✅ DH 参数（如果使用 DHE）
    # ssl_dhparam /etc/nginx/ssl/dhparam.pem;  # openssl dhparam -out dhparam.pem 4096
    
    # ✅ OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/ssl/chain.pem;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    
    # ✅ Session 配置
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;  # 禁用 session tickets 以保证前向保密
    
    # ✅ 安全头部
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
}

# 使用 testssl.sh 进行全面检查
git clone https://github.com/drwetter/testssl.sh.git
cd testssl.sh
./testssl.sh --full https://example.com

# 或使用 SSL Labs API
curl -s "https://api.ssllabs.com/api/v3/analyze?host=example.com&publish=off&all=done" | \
  jq '.endpoints[0] | {grade, details: {protocols, suites}}'

# GitLab CI: 证书检查
ssl-check:
  stage: test
  image: alpine:latest
  before_script:
    - apk add --no-cache openssl curl
  script:
    - |
      for domain in $(cat domains.txt); do
        EXPIRY=$(echo | openssl s_client -connect "${domain}:443" 2>/dev/null \
          | openssl x509 -noout -enddate | cut -d= -f2)
        DAYS_LEFT=$(( ($(date -d "$EXPIRY" +%s) - $(date +%s)) / 86400 ))
        if [ "$DAYS_LEFT" -lt 30 ]; then
          echo "❌ ${domain}: 证书将在 ${DAYS_LEFT} 天后过期"
          exit 1
        fi
        echo "✅ ${domain}: 剩余 ${DAYS_LEFT} 天"
      done
  rules:
    - if: '$CI_PIPELINE_SOURCE == "schedule"'

# GitHub Actions: 证书检查
name: SSL Certificate Check
on:
  schedule:
    - cron: '0 9 * * 1'  # 每周一 9:00
  workflow_dispatch:

jobs:
  check-certs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check SSL Certificates
        run: |
          WARN_DAYS=30
          FAILED=0
          while IFS= read -r domain; do
            EXPIRY=$(echo | openssl s_client -connect "${domain}:443" 2>/dev/null \
              | openssl x509 -noout -enddate | cut -d= -f2)
            DAYS_LEFT=$(( ($(date -d "$EXPIRY" +%s) - $(date +%s)) / 86400 ))
            echo "${domain}: ${DAYS_LEFT} days remaining"
            [ "$DAYS_LEFT" -lt "$WARN_DAYS" ] && FAILED=1
          done < domains.txt
          exit $FAILED
      - name: Alert on Failure
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          payload: '{"text":"⚠️ SSL 证书告警：有证书即将过期！"}'

# roles/ssl/tasks/main.yml
---
- name: Ensure SSL directory exists
  file:
    path: "/etc/ssl/{{ item }}"
    state: directory
    mode: '0700'
  loop:
    - certs
    - private

- name: Deploy certificates
  template:
    src: "{{ item }}.j2"
    dest: "/etc/ssl/certs/{{ item }}"
    mode: '0644'
  loop:
    - "{{ domain }}.crt"
    - ca-chain.crt
  notify: reload web server

- name: Deploy private key
  copy:
    content: "{{ vault_ssl_key }}"
    dest: "/etc/ssl/private/{{ domain }}.key"
    mode: '0600'
    owner: root
    group: root
  notify: reload web server
  no_log: true  # 避免日志泄露私钥

- name: Add custom CA to trust store
  copy:
    src: company-ca.crt
    dest: /usr/local/share/ca-certificates/company-ca.crt
    mode: '0644'
  notify: update ca-certificates

# 严格的文件权限
chmod 600 /etc/ssl/private/*.key
chown root:root /etc/ssl/private/*.key

# 目录权限
chmod 700 /etc/ssl/private/

# ACL 限制
setfacl -m u:nginx:r /etc/ssl/private/server.key
setfacl -m d:u:nginx:r /etc/ssl/private/

# 加密存储
openssl pkey -in server.key -aes-256-cbc -out server-encrypted.key
# 需要密码才能使用

# 审计日志
auditctl -w /etc/ssl/private/ -p rwxa -k ssl-keys

# 存储私钥到 Vault
vault kv put secret/ssl/example.com \
  key=@server.key \
  cert=@server.crt \
  chain=@chain.crt

# 读取私钥
vault kv get -field=key secret/ssl/example.com > server.key

# 配置自动过期
vault kv put -mount=secret ssl/example.com \
  key=@server.key \
  ttl=720h

#!/usr/bin/env bash
# cert-backup.sh - 证书和密钥备份
set -euo pipefail

BACKUP_DIR="/var/backup/ssl/$(date +%Y%m%d)"
mkdir -p "$BACKUP_DIR"

# 备份系统证书
cp -r /etc/ssl/certs/ "$BACKUP_DIR/system-certs/"
cp -r /etc/ssl/private/ "$BACKUP_DIR/private-keys/"

# 备份 Let's Encrypt
cp -r /etc/letsencrypt/ "$BACKUP_DIR/letsencrypt/"

# 备份 Nginx SSL 配置
cp -r /etc/nginx/ssl/ "$BACKUP_DIR/nginx-ssl/"

# 加密备份
tar czf "$BACKUP_DIR.tar.gz" "$BACKUP_DIR"
gpg --encrypt --recipient [email protected] "$BACKUP_DIR.tar.gz"

# 清理明文备份
rm -rf "$BACKUP_DIR" "$BACKUP_DIR.tar.gz"

echo "✅ 备份完成: ${BACKUP_DIR}.tar.gz.gpg"

# 1. 解密备份
gpg --decrypt backup.tar.gz.gpg > backup.tar.gz

# 2. 解压
tar xzf backup.tar.gz

# 3. 恢复证书
cp backup/system-certs/*.pem /etc/ssl/certs/
cp backup/private-keys/*.key /etc/ssl/private/
chmod 600 /etc/ssl/private/*.key

# 4. 恢复 Let's Encrypt
cp -r backup/letsencrypt/* /etc/letsencrypt/

# 5. 更新证书存储
update-ca-certificates

# 6. 重启服务
systemctl reload nginx

#!/usr/bin/env bash
# cert-emergency-revoke.sh - 紧急吊销证书
set -euo pipefail

DOMAIN="${1:?用法: $0 <domain>}"
CERT_PATH="/etc/letsencrypt/live/${DOMAIN}/cert.pem"

echo "⚠️ 紧急吊销: ${DOMAIN}"
echo ""

# 确认操作
read -p "确认吊销 ${DOMAIN} 的证书？(y/N) " -n 1 -r
echo
[[ $REPLY =~ ^[Yy]$ ]] || exit 0

# 1. 吊销证书
echo "正在吊销证书..."
certbot revoke \
  --cert-path "$CERT_PATH" \
  --reason keycompromise \
  --non-interactive

# 2. 删除本地证书
echo "删除本地证书..."
certbot delete --cert-name "$DOMAIN" --non-interactive

# 3. 重新签发
echo "重新签发证书..."
certbot certonly --nginx -d "$DOMAIN" --force-renewal

# 4. 重新加载服务
echo "重新加载 Nginx..."
nginx -t && nginx -s reload

echo ""
echo "✅ 吊销和重签完成: ${DOMAIN}"
echo "   新证书序列号: $(openssl x509 -in "/etc/letsencrypt/live/${DOMAIN}/cert.pem" -noout -serial)"

#!/usr/bin/env bash
# cert-compliance-check.sh - 证书合规性检查
set -euo pipefail

HOST="${1:?用法: $0 <host>}"
ERRORS=0

echo "=== 合规性检查: ${HOST} ==="
echo ""

# 获取证书信息
CERT_INFO=$(echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" \
  -status 2>/dev/null)

# 1. 密钥长度
KEY_BITS=$(echo "$CERT_INFO" | openssl x509 -noout -text 2>/dev/null \
  | grep "Public-Key" | grep -oP '\d+')
if [ "${KEY_BITS:-0}" -lt 2048 ]; then
  echo "❌ 密钥长度: ${KEY_BITS} bit (要求 ≥ 2048)"
  ((ERRORS++))
else
  echo "✅ 密钥长度: ${KEY_BITS} bit"
fi

# 2. 有效期
NOT_AFTER=$(echo "$CERT_INFO" | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
NOT_BEFORE=$(echo "$CERT_INFO" | openssl x509 -noout -startdate 2>/dev/null | cut -d= -f2)
DAYS_VALID=$(( ($(date -d "$NOT_AFTER" +%s) - $(date -d "$NOT_BEFORE" +%s)) / 86400 ))
if [ "$DAYS_VALID" -gt 398 ]; then
  echo "⚠️ 有效期: ${DAYS_VALID} 天 (Apple 要求 ≤ 398 天)"
  ((ERRORS++))
else
  echo "✅ 有效期: ${DAYS_VALID} 天"
fi

# 3. TLS 版本
if echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" \
  -tls1_1 </dev/null 2>&1 | grep -q "Protocol.*TLSv1.1"; then
  echo "❌ 支持 TLS 1.1（应禁用）"
  ((ERRORS++))
else
  echo "✅ TLS 1.1 已禁用"
fi

# 4. OCSP Stapling
if echo "$CERT_INFO" | grep -q "OCSP Response Status: successful"; then
  echo "✅ OCSP Stapling 已启用"
else
  echo "⚠️ OCSP Stapling 未启用"
  ((ERRORS++))
fi

# 5. 证书链完整性
VERIFY=$(echo "$CERT_INFO" | grep "Verify return code" | head -1)
if echo "$VERIFY" | grep -q "0 (ok)"; then
  echo "✅ 证书链完整"
else
  echo "❌ 证书链验证失败: $VERIFY"
  ((ERRORS++))
fi

echo ""
if [ "$ERRORS" -gt 0 ]; then
  echo "❌ 发现 ${ERRORS} 个合规问题"
  exit 1
else
  echo "✅ 所有检查通过"
  exit 0
fi