スクリプトタイプ

SNI FQDN 情報を JSON として次の形式で出力する SNI スクリプトをセットアップします。

[
   {
        "IP": "10.1.2.3",
        "Port": "8443",
        "Domain": "www.example.com"
    },
    {
        "IP": "10.1.2.3",
        "Port": "8443",
        "Domain": "app2.example.com"
    }
]

次の SNI 情報スクリプトの例は、Microsoft PowerShell スクリプト言語を使用して、ローカル IIS Web サーバーから最新の SNI 情報を読み取ります。このスクリプトは、ローカルの DigiCert エージェントを動的に構成するために使用される情報を JSON 形式で出力します。

$bindingInfo = get-website | select -ExpandProperty Bindings | Select -ExpandProperty Collection | where sslFlags -eq 1 | select bindingInformation

$res = @{}

foreach($ele in $bindingInfo) {
        $list = $ele.bindingInformation.split(":")
        $res[$list[2]] = @{IP=$list[0]; Port=$list[1]; Domain=$list[2]}
}

$thumbs = Get-ChildItem IIS:SSLBindings | Foreach-Object {
        [PSCustomObject]@{
                Host       = $_.Host
                Thumbprint = $_.Thumbprint
        }
}

echo($res.values | ConvertTo-Json)

インストール前スクリプトが成功した場合は 0 を返し、失敗した場合は 0 以外の値を返します。戻りコード 1、127、または 4294770688 の使用は避けてください。これらは他の目的のためにエージェントによって事前定義されています。

インストール前スクリプトを使用すると、DigiCert エージェントは、スクリプトから成功コード 0 が返されなければ、自動化イベントをキャンセルします。これは、証明書が外部入力に基づいて自動化されるタイミングを制御するのに役立ちます。

During a certificate delivery event, the local DigiCert agent adds script-related data to the DC1_POST_SCRIPT_DATA environment variable in Base64-encoded JSON format. Target and decode this variable in your post-delivery scripts to get the list of parameters passed from Trust Lifecycle Manager and other relevant details to help process the delivered certificate, as in the following examples:

JSON fields in the output depend on the type of certificate delivered and may include:

The following example post-delivery script uses the Microsoft PowerShell scripting language to import a delivered PKCS#12 (PFX) certificate to the LocalMachine\My certificate store on a Windows system. The script decodes and parses the JSON in the DC1_POST_SCRIPT_DATA environment variable to determine the certificate filename, password, and directory where it was delivered by the local DigiCert agent.

# Function to decode base64 encoded string
function Decode-Base64 {
    param (
        [string]$base64String
    )
    $bytes = [System.Convert]::FromBase64String($base64String)
    $decodedString = [System.Text.Encoding]::UTF8.GetString($bytes)
    return $decodedString
}

# Base64 encoded JSON input
$base64Json = [System.Environment]::GetEnvironmentVariable("DC1_POST_SCRIPT_DATA")

# Decode the base64 encoded JSON
$jsonString = Decode-Base64 -base64String $base64Json

# Convert JSON string to PowerShell object
$jsonObject = $jsonString | ConvertFrom-Json

Write-Host "Arguments : "$jsonObject.args

# Extract values from JSON object
$certFolder = $jsonObject.certfolder
$pfxFile = Join-Path -Path $certFolder -ChildPath $jsonObject.files[0]
$password = $jsonObject.password

# Validate inputs
if (-not (Test-Path -Path $pfxFile)) {
    Write-Error "ERROR: The PFX file does not exist."
    exit 1
}

# Import the PFX file into the LocalMachine\My store
try {
    $cert = Import-PfxCertificate -FilePath $pfxFile -CertStoreLocation Cert:\LocalMachine\My -Password (ConvertTo-SecureString -String $password -Force -AsPlainText)
    if ($null -eq $cert) {
        throw "Failed to import the certificate."
    }
    Write-Output "Certificate imported successfully."
} catch {
    Write-Error "ERROR: Failed to import the certificate. $_"
    exit 1
}

The following example post-delivery script uses the Bash shell scripting language to import a delivered X.509 (CRT) certificate to the /etc/pki/ca-trust/source/anchors trusted CA directory on a Red Hat-based Linux system that has the ca-certificates package installed. The script decodes and parses the JSON in the DC1_POST_SCRIPT_DATA environment variable to determine the certificate filename and directory where it was delivered by the local DigiCert agent.

#!/bin/bash

# Step 1: Read the Base64-encoded JSON string from the environment variable
CERT_INFO=${DC1_POST_SCRIPT_DATA}

if [[ -z "$CERT_INFO" ]]; then
    echo "Error: Environment variable 'DC1_POST_SCRIPT_DATA' is not set or is empty."
    exit 1
fi

# Step 2: Decode the Base64 string into JSON
JSON_STRING=$(echo "$CERT_INFO" | base64 -d)

# Step 3: Parse JSON manually to extract 'certfolder' and '.crt' file
CERT_FOLDER=$(echo "$JSON_STRING" | grep -oP '"certfolder":"\K[^"]+')
CRT_FILE=$(echo "$JSON_STRING" | grep -oP '"files":\["\K[^"]+\.crt')

if [[ -z "$CERT_FOLDER" || -z "$CRT_FILE" ]]; then
    echo "Error: Invalid JSON data. Could not find 'certfolder' or '.crt' file."
    exit 1
fi

# Step 4: Construct full path to the certificate file
CRT_FILE_PATH="${CERT_FOLDER}/${CRT_FILE}"

if [[ ! -f "$CRT_FILE_PATH" ]]; then
    echo "Error: Certificate file not found at path '$CRT_FILE_PATH'."
    exit 1
fi

# Step 5: Copy the certificate to the system's trusted CA directory
TRUSTED_CA_DIR="/etc/pki/ca-trust/source/anchors"
DEST_CRT_FILE="${TRUSTED_CA_DIR}/$(basename "$CRT_FILE")"

echo "Copying certificate to trusted CA directory..."
sudo cp "$CRT_FILE_PATH" "$DEST_CRT_FILE"

# Step 6: Update the system's trusted certificates
echo "Updating trusted certificates..."
sudo update-ca-trust extract

if [[ $? -eq 0 ]]; then
    echo "Certificate successfully added to the system's trusted certificates."
else
    echo "Error: Failed to update the trusted certificates."
    exit 1
fi

Use either of the following methods to verify execution of an agent post-delivery script and see any error details for it: