#!/bin/bash

# Il faut en amont de ce script générer les certificats avec ACME.SH
# Puis copier le dossier d'ACME.SH vers /root
# Et appeler le script

ADMIN_VCENTER='administrator@vsphere.local'
PASSWORD_ADMIN_VCENTER='LOGIN ADMIN'
FQDN_VCENTER='VOTRE FQDN'

# Mise à jour du certificat dans le magasin

CERT_FILE_PATH="/root/$FQDN_VCENTER/fullchain.cer"
KEY_FILE_PATH="/root/$FQDN_VCENTER/$FQDN_VCENTER.key"
OLD_CERT_PATH="/root/$FQDN_VCENTER/old_cert.crt"

if ! [ -e $CERT_FILE_PATH ]; then
	exit
fi

if ! [ -e $KEY_FILE_PATH ]; then
	exit
fi

service-control --stop --all
service-control --start vmafdd
service-control --start vmdird
service-control --start vmcad

/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store MACHINE_SSL_CERT --alias __MACHINE_CERT -y
/usr/lib/vmware-vmafd/bin/vecs-cli entry create --store MACHINE_SSL_CERT --alias __MACHINE_CERT --cert "$CERT_FILE_PATH" --key "$KEY_FILE_PATH"

service-control --start --all

# Mise à jour de l'emprunt du certificat

OLD_KEY=$(/usr/lib/vmidentity/tools/scripts/lstool.py list --url https://localhost/lookupservice/sdk --no-check-cert --ep-type com.vmware.cis.cs.identity.sso 2>/dev/null | grep trust | cut -d: -f2 | sed 's/ //g')
BEGIN="-----BEGIN CERTIFICATE-----"
END="-----END CERTIFICATE-----"
echo $BEGIN > $OLD_CERT_PATH && echo $OLD_KEY >> $OLD_CERT_PATH && echo $END >> $OLD_CERT_PATH

OLD_FINGERPRINT=$(openssl x509 -in $OLD_CERT_PATH -noout -sha1 -fingerprint | cut -d' ' -f2 | cut -d'=' -f2)

cd /usr/lib/vmidentity/tools/scripts/
python ls_update_certs.py --url https://$FQDN_VCENTER/lookupservice/sdk --fingerprint "$OLD_FINGERPRINT" --certfile "$CERT_FILE_PATH" --user "$ADMIN_VCENTER" --password "$PASSWORD_ADMIN_VCENTER"
cd /root/
rm old_cert.crt