Rollback strategija

Planovi za nuždu i postupci za povratak na klasični PKI kod problema s hibridnim.

Okidač: Jedan server ne funkcionira s hibridnim certifikatom.

#!/bin/bash
# rollback-single.sh - Vraćanje pojedinačnog certifikata
 
SERVER="$1"
CERT_NAME="$2"
 
if [ -z "$SERVER" ] || [ -z "$CERT_NAME" ]; then
    echo "Usage: $0 <server> <cert-name>"
    exit 1
fi
 
echo "Rollback za $SERVER/$CERT_NAME"
 
# 1. Backup hibridnog certifikata
ssh "$SERVER" "cp /etc/ssl/certs/${CERT_NAME}.pem /etc/ssl/certs/${CERT_NAME}.pem.hybrid-backup"
 
# 2. Vraćanje klasičnog certifikata (ako postoji)
if [ -f "/backup/certs/${SERVER}/${CERT_NAME}-classic.pem" ]; then
    scp "/backup/certs/${SERVER}/${CERT_NAME}-classic.pem" "$SERVER:/etc/ssl/certs/${CERT_NAME}.pem"
else
    # Ponovno izdavanje s Classic-CA
    echo "Ponovno izdavanje Classic certifikata..."
    ssh "$SERVER" "openssl req -new -key /etc/ssl/private/${CERT_NAME}.key -out /tmp/rollback.csr -subj \"/CN=$SERVER\""
    scp "$SERVER:/tmp/rollback.csr" "/tmp/rollback-$SERVER.csr"
 
    openssl ca -config /etc/pki/classic/openssl.cnf \
        -in "/tmp/rollback-$SERVER.csr" \
        -out "/tmp/rollback-$SERVER.pem" \
        -days 365 -batch
 
    scp "/tmp/rollback-$SERVER.pem" "$SERVER:/etc/ssl/certs/${CERT_NAME}.pem"
fi
 
# 3. Ponovno učitavanje servisa
ssh "$SERVER" "systemctl reload nginx || systemctl reload apache2"
 
# 4. Verifikacija
ssh "$SERVER" "openssl s_client -connect localhost:443 -brief" 2>/dev/null | head -5
 
echo "Rollback završen za $SERVER"

Okidač: Više servera jednog servisa pogođeno.

#!/bin/bash
# rollback-service.sh - Vraćanje svih servera jednog servisa
 
SERVICE="$1"
SERVERS_FILE="/etc/pki/inventory/${SERVICE}-servers.txt"
 
if [ ! -f "$SERVERS_FILE" ]; then
    echo "Lista servera nije pronađena: $SERVERS_FILE"
    exit 1
fi
 
echo "=== Rollback servisa za $SERVICE ==="
echo "Serveri: $(wc -l < "$SERVERS_FILE")"
 
# Paralelno na svim serverima
cat "$SERVERS_FILE" | parallel -j 10 '
    echo "Rollback: {}"
    ./rollback-single.sh {} server-cert
'
 
echo "=== Verifikacija ==="
cat "$SERVERS_FILE" | while read server; do
    status=$(curl -sk "https://$server/health" 2>/dev/null && echo "OK" || echo "FAIL")
    echo "$server: $status"
done

Okidač: Problem s Hybrid-CA certifikatom.

#!/bin/bash
# rollback-ca.sh - Prebacivanje na Classic-CA
 
echo "=== CA-ROLLBACK ==="
echo "UPOZORENJE: Ovo mijenja CA za potpisivanje za sve nove certifikate!"
read -p "Nastaviti? (yes/no): " confirm
[ "$confirm" != "yes" ] && exit 1
 
# 1. Backup trenutne konfiguracije
cp /etc/pki/CA/openssl.cnf /etc/pki/CA/openssl.cnf.hybrid-backup
cp -r /etc/pki/CA/issued /etc/pki/CA/issued-hybrid-backup
 
# 2. Aktivacija Classic-CA
ln -sf /etc/pki/classic/openssl.cnf /etc/pki/CA/openssl.cnf
export CA_CERT=/etc/pki/classic/intermediate-ca.pem
export CA_KEY=/etc/pki/classic/intermediate-ca.key
 
# 3. Generiranje nove CRL s Classic-CA
openssl ca -config /etc/pki/CA/openssl.cnf -gencrl -out /var/www/pki/crl.pem
 
# 4. Ponovno pokretanje OCSP respondera (ako postoji)
systemctl restart ocsp-responder
 
# 5. Dokumentacija
echo "$(date -Iseconds) CA-ROLLBACK: Prebacivanje na Classic-CA" >> /var/log/pki-rollback.log
 
echo "CA-Rollback završen."
echo "Novi certifikati će sada biti potpisani s Classic-CA."

Okidač: Katastrofalni problemi s Hybrid-PKI.

#!/bin/bash
# rollback-complete.sh - Potpuni rollback na Classic-PKI
 
echo "========================================"
echo "     POTPUNI PKI-ROLLBACK"
echo "========================================"
echo ""
echo "UPOZORENJE: Ovo će:"
echo "  1. Opozvati sve hibridne certifikate"
echo "  2. Prebaciti sve servere na Classic"
echo "  3. Deaktivirati Hybrid-CA"
echo ""
read -p "Unesite 'ROLLBACK' za nastavak: " confirm
[ "$confirm" != "ROLLBACK" ] && exit 1
 
LOG="/var/log/pki-complete-rollback-$(date +%Y%m%d-%H%M%S).log"
exec > >(tee -a "$LOG") 2>&1
 
echo "Početak: $(date -Iseconds)"
 
# 1. Identificiranje svih hibridnih certifikata
echo "=== Faza 1: Inventura ==="
find /etc/pki/hybrid/issued -name "*.pem" > /tmp/hybrid-certs.txt
echo "Hibridni certifikati: $(wc -l < /tmp/hybrid-certs.txt)"
 
# 2. Kreiranje liste servera
echo "=== Faza 2: Mapiranje servera ==="
# (Server → Certifikat mapiranje iz CMDB ili Inventory)
 
# 3. Izdavanje Classic certifikata za sve
echo "=== Faza 3: Classic Re-Issue ==="
while read cert; do
    serial=$(openssl x509 -in "$cert" -serial -noout | cut -d= -f2)
    subject=$(openssl x509 -in "$cert" -subject -noout | sed 's/subject=//')
 
    echo "Re-Issue: $subject"
    # Ovdje: Izdavanje Classic certifikata
done < /tmp/hybrid-certs.txt
 
# 4. Ažuriranje servera
echo "=== Faza 4: Deployment ==="
# (Paralelni deployment Classic certifikata na sve servere)
 
# 5. Opoziv hibridnih certifikata
echo "=== Faza 5: Revocation ==="
while read cert; do
    openssl ca -config /etc/pki/hybrid/openssl.cnf -revoke "$cert" -crl_reason superseded
done < /tmp/hybrid-certs.txt
 
# 6. Finalni CRL
openssl ca -config /etc/pki/hybrid/openssl.cnf -gencrl -out /var/www/pki/hybrid-final.crl
 
# 7. Offline prebacivanje Hybrid-CA
echo "=== Faza 6: Deaktivacija Hybrid-CA ==="
mv /etc/pki/hybrid /etc/pki/hybrid-DISABLED-$(date +%Y%m%d)
 
echo "=== ROLLBACK ZAVRŠEN ==="
echo "Kraj: $(date -Iseconds)"
echo "Log: $LOG"

# Skripta za testiranje rollbacka
#!/bin/bash
TEST_SERVER="test-server.example.com"
 
echo "=== Test rollbacka $(date) ==="
 
# Spremanje trenutnog statusa
openssl s_client -connect "$TEST_SERVER:443" -brief 2>/dev/null > /tmp/before.txt
 
# Izvršavanje rollbacka
./rollback-single.sh "$TEST_SERVER" server-cert
 
# Provjera novog statusa
openssl s_client -connect "$TEST_SERVER:443" -brief 2>/dev/null > /tmp/after.txt
 
# Usporedba
echo "Prije:"
grep "Signature" /tmp/before.txt
echo "Poslije:"
grep "Signature" /tmp/after.txt
 
# Vraćanje
echo "Vraćanje Hybrid certifikata..."
# ...

Dokumentirati kod svakog rollbacka:

• Classic → Hybrid – Migracija
• Disaster Recovery – Veći ispadi
• Opoziv certifikata – Pojedinačni opoziv

« ← Paralelni rad | → Inventura »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional