TLS va HTTPS

[ -f logs/nginx.pid ] && kill -QUIT "$(cat logs/nginx.pid)" 2>/dev/null
sleep 0.3
mkdir -p conf/tls logs html temp
echo "<h1>HTTPS ishlayapti</h1>" > html/index.html

openssl req -x509 -newkey rsa:2048 \
    -keyout conf/tls/kalit.pem -out conf/tls/sert.pem \
    -days 365 -nodes -subj "/CN=sinov.local" >/dev/null 2>&1
chmod 600 conf/tls/kalit.pem

cat > conf/nginx.conf <<'EOF'
worker_processes 1;
error_log logs/error.log warn;
pid logs/nginx.pid;
events { worker_connections 64; }
http {
    access_log logs/access.log;
    client_body_temp_path temp;
    proxy_temp_path temp/proxy;
    fastcgi_temp_path temp/fastcgi;
    uwsgi_temp_path temp/uwsgi;
    scgi_temp_path temp/scgi;
    default_type text/html;

    server {
        listen 127.0.0.1:8080;
        server_name sinov.local;
        return 301 https://$host:8443$request_uri;
    }

    server {
        listen 127.0.0.1:8443 ssl;
        server_name sinov.local;

        ssl_certificate     tls/sert.pem;
        ssl_certificate_key tls/kalit.pem;
        ssl_protocols       TLSv1.2 TLSv1.3;
        ssl_session_cache   shared:SSL:10m;
        ssl_session_timeout 1d;

        add_header Strict-Transport-Security "max-age=31536000" always;

        root html;
    }
}
EOF

openssl x509 -in conf/tls/sert.pem -noout -subject -issuer

openssl x509 -in conf/tls/sert.pem -noout -checkend 86400 \
    && echo "kamida bir kun amal qiladi"

a=$(openssl x509 -noout -modulus -in conf/tls/sert.pem | openssl sha256)
b=$(openssl rsa -noout -modulus -in conf/tls/kalit.pem 2>/dev/null | openssl sha256)
[ "$a" = "$b" ] && echo "kalit sertifikatga mos"

nginx -p "$PWD" -c conf/nginx.conf
sleep 1
curl -sk https://127.0.0.1:8443/
nginx -p "$PWD" -c conf/nginx.conf -s quit 2>/dev/null

nginx -p "$PWD" -c conf/nginx.conf
sleep 1
curl -s -o /dev/null -w '%{http_code}' --max-time 3 https://127.0.0.1:8443/
echo " kod=$?"
nginx -p "$PWD" -c conf/nginx.conf -s quit 2>/dev/null

nginx -p "$PWD" -c conf/nginx.conf
sleep 1
curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' http://127.0.0.1:8080/sahifa
nginx -p "$PWD" -c conf/nginx.conf -s quit 2>/dev/null

nginx -p "$PWD" -c conf/nginx.conf
sleep 1
curl -skI https://127.0.0.1:8443/ | grep -i 'strict-transport'
nginx -p "$PWD" -c conf/nginx.conf -s quit 2>/dev/null

nginx -p "$PWD" -c conf/nginx.conf
sleep 1
curl -sk --tls-max 1.1 -o /dev/null -w '%{http_code}' --max-time 3 https://127.0.0.1:8443/
echo " kod=$?"
nginx -p "$PWD" -c conf/nginx.conf -s quit 2>/dev/null

nginx -p "$PWD" -c conf/nginx.conf
sleep 1
echo | openssl s_client -connect 127.0.0.1:8443 -brief 2>&1 \
    | grep -E '^Protocol version|^Ciphersuite'
nginx -p "$PWD" -c conf/nginx.conf -s quit 2>/dev/null

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d softromeda.uz -d www.softromeda.uz

openssl x509 -in conf/tls/sert.pem -noout -checkend 2592000 \
    && echo "30 kundan ortiq qoldi" || echo "30 kundan kam qoldi"

if ! openssl x509 -in /etc/letsencrypt/live/softromeda.uz/fullchain.pem \
        -noout -checkend 1209600 >/dev/null; then
    logger -t tls-nazorat -p user.warning \
        "sertifikat 14 kundan kam qoldi"
fi