Change the pubkey extension from .pem to .pub.

16 files changed, 8 insertions, 8 deletions

diff --git a/certs/gencerts.sh b/certs/gencerts.sh
index 099d846..9318e42 100755
--- a/certs/gencerts.sh
+++ b/certs/gencerts.sh
@@ -3,41 +3,41 @@
 set -ue
 PATH=/usr/bin:/bin
 
 if [ -n "${GNUPGBIN:-}" ]; then
     GPG="$GNUPGBIN"
 elif [ -x /usr/bin/gpg2 ]; then
     GPG=/usr/bin/gpg2
 else
     GPG=gpg
 fi
 GPG_OPTS='--no-auto-check-trustdb --batch --no-verbose --yes'
 
 usage() {
     echo "Usage: $0 /path/to/certs.asc" >&2
     exit 1
 }
 
 x509fpr() {
     local msg="$1" host cert h spki
     host="${msg%%,*}"; host="${host%% *}"; host="${host#\`}"
-    cert="$DIR/${host%%:*}.pem"
+    cert="$DIR/${host%%:*}.pub"
     spki=$(openssl pkey -pubin -outform DER <"$cert" | openssl dgst -sha256  | sed -nr 's/^[^=]+=\s*//p')
     [ "$typ" = mdwn ] && printf '\n    [%s](https://crt.sh/?spkisha256=%s&iCAID=16418)\n\n' "$msg" "$spki" \
                       || printf '    %s\n    X.509: https://crt.sh/?spkisha256=%s&iCAID=16418\n    SPKI:\n' \
                                 "$( echo "$msg" | tr -d '`' )" "$spki"
     for h in sha1 sha256; do
         [ "$typ" = mdwn ] || echo -n '  '
         echo -n "$h" | tr '[a-z]' '[A-Z]'
         for i in $(seq 1 $((7 - ${#h}))); do echo -n ' '; done
         openssl pkey -pubin -outform DER <"$cert" | openssl dgst -"$h" -c | sed -nr 's/^[^=]+=\s*//p'
     done | sed -r "s/(\S+)(.*)/$indent\1\U\2/"
 }
 
 sshfpr() {
     local msg="$1" host t h fpr
     host="${msg%%,*}"; host="${host%% *}"; host="${host#*@}"; host="${host#\`}"; host="${host%\`}"
     [ "$typ" = mdwn ] && { echo; echo "    $msg"; echo; } || { echo "    $msg" | tr -d '`'; }
     [ "${host#*:}" != 22 ] || host="${host%%:*}"
     for h in MD5 SHA256; do
         ssh-keygen -E "$h" -f "$DIR/../ssh_known_hosts" -lF "${host#*@}"
     done | sed -nr 's/^[^ #]+\s+//p' | sed -r 's/^(\S+)\s+(MD5|SHA256):/\1 \2 /' |
diff --git a/certs/public/fripost.org.pem b/certs/public/fripost.org.pub
index 48298e0..48298e0 100644
--- a/certs/public/fripost.org.pem
+++ b/certs/public/fripost.org.pub
diff --git a/certs/public/git.fripost.org.pem b/certs/public/git.fripost.org.pub
index 289261a..289261a 100644
--- a/certs/public/git.fripost.org.pem
+++ b/certs/public/git.fripost.org.pub
diff --git a/certs/public/imap.fripost.org.pem b/certs/public/imap.fripost.org.pub
index 8481196..8481196 100644
--- a/certs/public/imap.fripost.org.pem
+++ b/certs/public/imap.fripost.org.pub
diff --git a/certs/public/lists.fripost.org.pem b/certs/public/lists.fripost.org.pub
index 0e520ad..0e520ad 100644
--- a/certs/public/lists.fripost.org.pem
+++ b/certs/public/lists.fripost.org.pub
diff --git a/certs/public/mail.fripost.org.pem b/certs/public/mail.fripost.org.pub
index c6852f6..c6852f6 100644
--- a/certs/public/mail.fripost.org.pem
+++ b/certs/public/mail.fripost.org.pub
diff --git a/certs/public/mx1.fripost.org.pem b/certs/public/mx1.fripost.org.pub
index d2b978c..d2b978c 100644
--- a/certs/public/mx1.fripost.org.pem
+++ b/certs/public/mx1.fripost.org.pub
diff --git a/certs/public/mx2.fripost.org.pem b/certs/public/mx2.fripost.org.pub
index 3bdb105..3bdb105 100644
--- a/certs/public/mx2.fripost.org.pem
+++ b/certs/public/mx2.fripost.org.pub
diff --git a/certs/public/smtp.fripost.org.pem b/certs/public/smtp.fripost.org.pub
index fa89958..fa89958 100644
--- a/certs/public/smtp.fripost.org.pem
+++ b/certs/public/smtp.fripost.org.pub
diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml
index 26bed8d..51e7694 100644
--- a/roles/IMAP/tasks/imap.yml
+++ b/roles/IMAP/tasks/imap.yml
@@ -65,41 +65,41 @@
     - unseen
 
 - name: Create directory /home/mail/spamspool
   file: path=/home/mail/spamspool
         state=directory
         owner=vmail group=vmail
         mode=0700
 
 - name: Create directory /etc/dovecot/ssl
   file: path=/etc/dovecot/ssl
         state=directory
         owner=root group=root
         mode=0755
 
 
 - name: Fetch Dovecot's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/dovecot/ssl/imap.fripost.org.pem
-             dest=certs/public/imap.fripost.org.pem
+             dest=certs/public/imap.fripost.org.pub
   tags:
     - genkey
 
 - name: Configure Dovecot
   copy: src=etc/dovecot/{{ item }}
         dest=/etc/dovecot/{{ item }}
         owner=root group=root
         mode=0644
   register: r1
   with_items:
     - conf.d/10-auth.conf
     - conf.d/10-logging.conf
     - conf.d/10-mail.conf
     - conf.d/10-ssl.conf
     - conf.d/15-mailboxes.conf
     # LDA is also used by LMTP
     - conf.d/15-lda.conf
     - conf.d/20-imap.conf
     - conf.d/20-lmtp.conf
     - conf.d/90-plugin.conf
diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index 7ae2680..3800fe6 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -13,41 +13,41 @@
     - Reload Postfix
 
 - name: Copy the Regex to anonymize senders
   # no need to reload upon change, as cleanup(8) is short-running
   copy: src=etc/postfix/anonymize_sender.pcre
         dest=/etc/postfix-{{ postfix_instance[inst].name }}/anonymize_sender.pcre
         owner=root group=root
         mode=0644
 
 - meta: flush_handlers
 
 - name: Start Postfix
   service: name=postfix state=started
 
 - name: Fetch Postfix's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   # `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
   fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/postfix/ssl/smtp.fripost.org.pem
-             dest=certs/public/smtp.fripost.org.pem
+             dest=certs/public/smtp.fripost.org.pub
   tags:
     - genkey
 
 
 - name: Install 'postfix_mailqueue_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
         dest=/etc/munin/plugins/postfix_mailqueue_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
   tags:
     - munin
     - munin-node
   notify:
     - Restart munin-node
 
 - name: Install 'postfix_stats_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_stats_
         dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index f95945c..c8853be 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -67,41 +67,41 @@
   notify:
     - Reload Postfix
 
 - name: Copy reserved-alias.pl
   copy: src=usr/local/bin/reserved-alias.pl
         dest=/usr/local/bin/reserved-alias.pl
         owner=root group=root
         mode=0755
 
 - meta: flush_handlers
 
 - name: Start Postfix
   service: name=postfix state=started
 
 - name: Fetch Postfix's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   # `/usr/sbin/postmulti -i mx -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
   fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/postfix/ssl/mx.fripost.org.pem
-             dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pem
+             dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pub
   tags:
     - genkey
 
 
 - name: Install 'postfix_mailqueue_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
         dest=/etc/munin/plugins/postfix_mailqueue_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
   tags:
     - munin
     - munin-node
   notify:
     - Restart munin-node
 
 - name: Install 'postfix_stats_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/postfix_stats_
         dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix-{{ postfix_instance[inst].name }}
         owner=root group=root
         state=link force=yes
diff --git a/roles/git/tasks/cgit.yml b/roles/git/tasks/cgit.yml
index 48f4d18..5f4e0e9 100644
--- a/roles/git/tasks/cgit.yml
+++ b/roles/git/tasks/cgit.yml
@@ -90,23 +90,23 @@
 - name: Create /etc/nginx/sites-enabled/git
   file: src=../sites-available/git
         dest=/etc/nginx/sites-enabled/git
         owner=root group=root
         state=link force=yes
   register: r2
   notify:
     - Restart Nginx
 
 - name: Start Nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
 
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/nginx/ssl/git.fripost.org.pem
-             dest=certs/public/git.fripost.org.pem
+             dest=certs/public/git.fripost.org.pub
   tags:
     - genkey
diff --git a/roles/lists/tasks/nginx.yml b/roles/lists/tasks/nginx.yml
index fa52781..20b3262 100644
--- a/roles/lists/tasks/nginx.yml
+++ b/roles/lists/tasks/nginx.yml
@@ -13,23 +13,23 @@
 - name: Create /etc/nginx/sites-enabled/sympa
   file: src=../sites-available/sympa
         dest=/etc/nginx/sites-enabled/sympa
         owner=root group=root
         state=link
   register: r2
   notify:
     - Restart Nginx
 
 - name: Start nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
 
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/nginx/ssl/lists.fripost.org.pem
-             dest=certs/public/lists.fripost.org.pem
+             dest=certs/public/lists.fripost.org.pub
   tags:
     - genkey
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index d1fb8a2..caa91dc 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -125,23 +125,23 @@
 - name: Create /etc/nginx/sites-enabled/roundcube
   file: src=../sites-available/roundcube
         dest=/etc/nginx/sites-enabled/roundcube
         owner=root group=root
         state=link force=yes
   register: r2
   notify:
     - Restart Nginx
 
 - name: Start Nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
 
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/nginx/ssl/mail.fripost.org.pem
-             dest=certs/public/mail.fripost.org.pem
+             dest=certs/public/mail.fripost.org.pub
   tags:
     - genkey
diff --git a/roles/wiki/tasks/main.yml b/roles/wiki/tasks/main.yml
index c07d4f7..4a64c2f 100644
--- a/roles/wiki/tasks/main.yml
+++ b/roles/wiki/tasks/main.yml
@@ -87,35 +87,35 @@
         owner=root group=root
         state=link force=yes
   register: r2
   with_items:
     - website
     - wiki
   notify:
     - Restart Nginx
 
 - name: Start Nginx
   service: name=nginx state=started
   when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
 
 - name: Fetch Nginx's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   fetch_cmd: cmd="openssl x509 -noout -pubkey"
              stdin=/etc/nginx/ssl/www.fripost.org.pem
-             dest=certs/public/fripost.org.pem
+             dest=certs/public/fripost.org.pub
   tags:
     - genkey
 
 - name: Create directory /var/www/fripost.org/autoconfig/mail
   file: path=/var/www/fripost.org/autoconfig/mail
         state=directory
         owner=root group=root
         mode=0755
 
 - name: Copy /var/www/fripost.org/autoconfig/mail/config-v1.1.xml
   copy: src=var/www/fripost.org/autoconfig/mail/config-v1.1.xml
         dest=/var/www/fripost.org/autoconfig/mail/config-v1.1.xml
         owner=root group=root
         mode=0644