hyh
3 weeks ago
3 changed files with 227 additions and 0 deletions
@ -0,0 +1,155 @@ |
|||
#!/bin/bash |
|||
|
|||
# SSL 证书诊断脚本 |
|||
# 用于检查 SSL 证书配置是否正确 |
|||
|
|||
echo "==========================================" |
|||
echo "SSL 证书诊断工具" |
|||
echo "==========================================" |
|||
echo "" |
|||
|
|||
# 检查证书文件路径 |
|||
CERT_PATH="/home/owen/ssl_key/smartsensiguard.cn.pem" |
|||
KEY_PATH="/home/owen/ssl_key/smartsensiguard.cn.key" |
|||
|
|||
echo "1. 检查证书文件是否存在..." |
|||
echo "----------------------------------------" |
|||
|
|||
if [ -f "$CERT_PATH" ]; then |
|||
echo "✓ 证书文件存在: $CERT_PATH" |
|||
ls -lh "$CERT_PATH" |
|||
else |
|||
echo "✗ 证书文件不存在: $CERT_PATH" |
|||
echo " 请确保证书文件存在于该路径" |
|||
fi |
|||
|
|||
echo "" |
|||
|
|||
if [ -f "$KEY_PATH" ]; then |
|||
echo "✓ 私钥文件存在: $KEY_PATH" |
|||
ls -lh "$KEY_PATH" |
|||
else |
|||
echo "✗ 私钥文件不存在: $KEY_PATH" |
|||
echo " 请确保私钥文件存在于该路径" |
|||
fi |
|||
|
|||
echo "" |
|||
echo "2. 检查证书文件内容..." |
|||
echo "----------------------------------------" |
|||
|
|||
if [ -f "$CERT_PATH" ]; then |
|||
echo "证书文件内容预览（前 5 行）：" |
|||
head -5 "$CERT_PATH" |
|||
echo "" |
|||
|
|||
# 检查证书格式 |
|||
if grep -q "BEGIN CERTIFICATE" "$CERT_PATH"; then |
|||
echo "✓ 证书文件格式正确（包含 BEGIN CERTIFICATE）" |
|||
else |
|||
echo "✗ 证书文件格式可能不正确（未找到 BEGIN CERTIFICATE）" |
|||
fi |
|||
|
|||
# 检查是否包含证书链 |
|||
CERT_COUNT=$(grep -c "BEGIN CERTIFICATE" "$CERT_PATH" || echo "0") |
|||
if [ "$CERT_COUNT" -gt 1 ]; then |
|||
echo "✓ 证书文件包含证书链（$CERT_COUNT 个证书）" |
|||
else |
|||
echo "⚠ 证书文件可能不包含完整的证书链（仅 $CERT_COUNT 个证书）" |
|||
echo " 如果遇到 PR_END_OF_FILE_ERROR，可能需要合并证书链" |
|||
fi |
|||
else |
|||
echo "跳过：证书文件不存在" |
|||
fi |
|||
|
|||
echo "" |
|||
|
|||
if [ -f "$KEY_PATH" ]; then |
|||
echo "私钥文件内容预览（前 5 行）：" |
|||
head -5 "$KEY_PATH" |
|||
echo "" |
|||
|
|||
# 检查私钥格式 |
|||
if grep -q "BEGIN.*PRIVATE KEY" "$KEY_PATH"; then |
|||
echo "✓ 私钥文件格式正确（包含 BEGIN PRIVATE KEY）" |
|||
else |
|||
echo "✗ 私钥文件格式可能不正确（未找到 BEGIN PRIVATE KEY）" |
|||
fi |
|||
else |
|||
echo "跳过：私钥文件不存在" |
|||
fi |
|||
|
|||
echo "" |
|||
echo "3. 使用 OpenSSL 验证证书..." |
|||
echo "----------------------------------------" |
|||
|
|||
if command -v openssl >/dev/null 2>&1; then |
|||
if [ -f "$CERT_PATH" ]; then |
|||
echo "证书信息：" |
|||
openssl x509 -in "$CERT_PATH" -text -noout 2>/dev/null | head -20 || echo "✗ 无法解析证书文件" |
|||
echo "" |
|||
|
|||
echo "证书有效期：" |
|||
openssl x509 -in "$CERT_PATH" -noout -dates 2>/dev/null || echo "✗ 无法读取证书有效期" |
|||
echo "" |
|||
|
|||
echo "证书域名：" |
|||
openssl x509 -in "$CERT_PATH" -noout -subject -issuer 2>/dev/null || echo "✗ 无法读取证书信息" |
|||
else |
|||
echo "跳过：证书文件不存在" |
|||
fi |
|||
|
|||
if [ -f "$KEY_PATH" ]; then |
|||
echo "" |
|||
echo "验证私钥：" |
|||
openssl rsa -in "$KEY_PATH" -check -noout 2>/dev/null && echo "✓ 私钥格式正确" || echo "✗ 私钥格式可能有问题" |
|||
|
|||
echo "" |
|||
echo "验证证书和私钥是否匹配：" |
|||
CERT_MD5=$(openssl x509 -noout -modulus -in "$CERT_PATH" 2>/dev/null | openssl md5) |
|||
KEY_MD5=$(openssl rsa -noout -modulus -in "$KEY_PATH" 2>/dev/null | openssl md5) |
|||
if [ "$CERT_MD5" = "$KEY_MD5" ] && [ -n "$CERT_MD5" ]; then |
|||
echo "✓ 证书和私钥匹配" |
|||
else |
|||
echo "✗ 证书和私钥不匹配" |
|||
fi |
|||
else |
|||
echo "跳过：私钥文件不存在" |
|||
fi |
|||
else |
|||
echo "⚠ OpenSSL 未安装，跳过证书验证" |
|||
echo " 可以运行: yum install openssl -y (CentOS) 或 apt-get install openssl (Ubuntu)" |
|||
fi |
|||
|
|||
echo "" |
|||
echo "4. 检查 Docker 容器状态..." |
|||
echo "----------------------------------------" |
|||
|
|||
if command -v docker >/dev/null 2>&1; then |
|||
if docker ps -a | grep -q "nginx-https"; then |
|||
echo "Nginx 容器状态：" |
|||
docker ps -a | grep "nginx-https" |
|||
echo "" |
|||
echo "Nginx 容器日志（最后 20 行）：" |
|||
docker logs --tail 20 nginx-https 2>&1 | grep -i "ssl\|cert\|error" || docker logs --tail 20 nginx-https |
|||
else |
|||
echo "⚠ Nginx 容器未运行" |
|||
fi |
|||
else |
|||
echo "⚠ Docker 未安装或不可用" |
|||
fi |
|||
|
|||
echo "" |
|||
echo "==========================================" |
|||
echo "诊断完成" |
|||
echo "==========================================" |
|||
echo "" |
|||
echo "常见问题解决方案：" |
|||
echo "1. 如果证书文件不存在，请将证书文件放置到: $CERT_PATH" |
|||
echo "2. 如果证书链不完整，需要合并证书和证书链：" |
|||
echo " cat cert.pem chain.pem > fullchain.pem" |
|||
echo "3. 如果证书和私钥不匹配，请检查证书文件是否正确" |
|||
echo "4. 如果容器无法启动，检查证书文件权限：" |
|||
echo " chmod 644 $CERT_PATH" |
|||
echo " chmod 600 $KEY_PATH" |
|||
echo "" |
|||
|
|||
Loading…
Reference in new issue