Hack on how to export a nginx proxy manager certificate in other software

[egandro]

Hello,

I am using the nginx proxy manager for a lot of projects. I am using (most times) *.example.com certificates.

To have a single point of how and where I generate them, I wrote a small script to exprt cert + private key e.g. for using it in Truenas or similar other systems.

Here the script: export-cert.sh

export-cert.sh and ./letsencrypt are located in the same directory.

You can use export-cert.sh *.example.org - that creates certs-*.example.org.zip

You can also can the script by export-cert.sh *.example.org --. That will generate the zip file to stdout (very usefull in ansible, ssh etc.)

Have fun.

#!/bin/bash

if [ -z "$1" ]; then
  echo "Error: missing domain parameter."
  exit 1
fi

DOMAIN="$1"

SCRIPT_DIR="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
CURRENT_CERTS_DIR="${SCRIPT_DIR}/letsencrypt/live"

ZIP_FILE="${SCRIPT_DIR}/certs-${DOMAIN}.zip"

if [ "$2" = "--" ]; then
  # redirect to stdout
  ZIP_FILE="-"
fi

TMPFILE="$(mktemp)"
trap 'rm -rf -- "$TMPFILE"' EXIT

find "${CURRENT_CERTS_DIR}" \
        -name "cert.pem" \
        -exec sh -c 'openssl x509 -noout -subject -in $0 | sed -s "s|.*= ||" | sed -z "s|\n|, |g"  && echo "$0" ' {} \; >"${TMPFILE}"


MATCH=$(cat "${TMPFILE}" | grep -e "^${DOMAIN}," | head -n1)

if [ -z "${MATCH}" ]; then
  echo "Error: domain ${DOMAIN} not found."
  exit 1
fi

CERT_FILE=$(echo "${MATCH}" | sed -e 's|^.*, ||')
KEY_FILE=$(dirname "${CERT_FILE}")/privkey.pem

zip -qq -j "${ZIP_FILE}" "${CERT_FILE}" "${KEY_FILE}"

[yorkshirelandscape]

This is great! I eventually got it working, but it took a little effort, the result of which is these two suggestions:

• The first sed replacement in your find command should be s|.*=||. The extra space breaks it (at least in the output I'm getting. Or at least make the space optional if there's some variability.
• You may want to add -L to the find command and put in some logic to figure out whether someone is already in /etc/letsencrypt or has, for example, symlinked it to someplace else. I didn't want to put the script anywhere in /etc, so I symlinked /etc/letsencrypt to my home directory, then got confused when the script didn't work from there.

[egandro]

I have a better approach now. I created a tool

https://github.com/egandro/nginx_proxy_manager_tool

This is a CLI tool (in python) it is also an Ansible role.

I can use the wildcard certificates to push to my other tools e.g. truenas.

[yorkshirelandscape]

Slick! I'll check it out.

[egandro]

It's a bit AI vomit - but I have tests and it works. Probably I will add some ci with docker to Github.