zscaler-cert-install.sh

#!/bin/sh

# Sample script for Linux hosts to install a certificate from a DigiCert integration
# with PR #31296 applied against fleetd. In this example, the CA name is
# "ZSCALER_CERTIFICATE."

set -euo pipefail

base64 -d <<'EOF' > /tmp/zscaler.pfx
$FLEET_VAR_DIGICERT_DATA_ZSCALER_CERTIFICATE
EOF

test -d /opt/zscaler/client_cert || mkdir -p /opt/zscaler/client_cert
test -d /opt/zscaler/private_key || mkdir -p /opt/zscaler/private_key

pw='$FLEET_VAR_DIGICERT_PASSWORD_ZSCALER_CERTIFICATE'

openssl pkcs12 -in /tmp/zscaler.pfx \
  -passin "pass:$pw" \
  -noenc -clcerts -nokeys \
  -out /opt/zscaler/client_cert/client_cert.pem

openssl pkcs12 -in /tmp/zscaler.pfx \
  -passin "pass:$pw" \
  -noenc -nocerts \
  -out /opt/zscaler/private_key/client_cert.key

rm -f /tmp/zscaler.pfx

chmod 0600 /opt/zscaler/client_cert/client_cert.pem
chmod 0600 /opt/zscaler/private_key/client_cert.key