add script 'certificate-renew-issued'

1 files changed, 14 insertions, 0 deletions

diff --git a/certificate-renew-issued b/certificate-renew-issued
new file mode 100644
index 0000000..e7241f2
--- /dev/null
+++ b/certificate-renew-issued
@@ -0,0 +1,14 @@
+#!rsc
+# RouterOS script: certificate-renew-issued
+# Copyright (c) 2019 Christian Hesse <mail@eworm.de>
+#
+# renew locally issued certificates
+
+:foreach Cert in=[ / certificate find where issued expires-after<3w ] do={
+  :local CertVal [ / certificate get $Cert ];
+  / certificate issued-revoke $Cert;
+  / certificate set name=($CertVal->"name" . "-revoked-" . [ / system clock get date ]) $Cert;
+  / certificate add name=($CertVal->"name") common-name=($CertVal->"common-name") \
+      key-usage=($CertVal->"key-usage") subject-alt-name=($CertVal->"subject-alt-name");
+  / certificate sign ($CertVal->"name") ca=($CertVal->"ca");
+}