Aruba Instant OS + Letsencrypt script

[fredesq]

Written my first ever script cos i didn't want to manually upload LE certs every 3 months, didn't want to have cert errors on guest Wifi and got the po turned down for a cert.

Thought i'd put this here for those of you with Aruba AP's, don't have a controller and want to use Letsencrypt.

 

It relies on the renewal part of certbot, so you'll need to have already gone through getting LE certs already.

 

I run this on ubuntu server 18.04

 

There's two parts to it, a simple shell script and then it calls an except script. Put them both together and update file locations etc in the script.

Add it to crontab -e and set it to run every day (as per the letsencrypt guide for autorenew certs).

 

# Script to push letsencrypt certifcates to aruba instant wifi controller.
# Reqires TCL, Except, Certbot, tftp and OpenSSL.
## Run certificate renewal (Remove --dry-run)
certbot certonly -n --standalone -d urlofserver.com --dry-run
# Move certifcates to working space
cp /etc/letsencrypt/live/urlofserver.com/* /home/user/cert/
## Add passphrase to passkey
openssl rsa -aes192 -in /home/user/cert/privkey.pem -out /home/user/cert/privkeypw.pem -passout pass:yourpassphrase
## Append the private key to the end of the fullchain.pem
cat /home/user/cert/fullchain.pem /home/user/cert/privkeypw.pem > /home/user/cert/combinedchain.pem
## Move the new combined cert to the tftpboot location
mv /home/user/cert/combinedchain.pem /var/lib/tftpboot/
## Run the expect script which logs into the Aruba AP and copies the cert from the TFTPboot location
expect /home/user/cert/push-cert-to-ap.exp

 

and push-cert-to-ap.exp

 

#!/usr/bin/expect -f
#spawn ssh
spawn  ssh  admin@apmaster
#Catch the password prompt and send supplied password
expect {
"word:" {send "yourappassword\r"}
}
sleep 1
#run send command to pull cert from server
expect {
"*#" {send "copy tftp ipoftftpserver combinedchain.pem cpserver cert yourpassphrase format pem\r"}
}
sleep 1
#run aruba show version (i did this to get some visual feedback that the prev command finished)
expect {
"*#" {send "sh ver\r"}
}
sleep 10
#quit ssh session
expect {
"*#" {send "exit\r"}
}

Edited September 23, 2019 by fredesq