如何编写自动安装证书脚本

wen 实用脚本 2026-07-27 3

本文目录导读：

如何编写自动安装证书脚本

Windows 自动安装证书脚本
Linux 自动安装证书脚本
自动化安装脚本（支持多平台）
Docker 环境证书安装
Python 自动化脚本
使用建议

Windows 自动安装证书脚本

导入受信任根证书

@echo off
set CERT_PATH=C:\certs\rootCA.cer
set STORE=Root
certutil -addstore %STORE% %CERT_PATH%
if %errorlevel% equ 0 (
    echo 证书安装成功
) else (
    echo 证书安装失败，错误码：%errorlevel%
)

导入个人证书（带私钥）

@echo off
set PFX_PATH=C:\certs\client.pfx
set PFX_PASSWORD=YourPassword123
set STORE=My
REM 导入到个人证书存储
certutil -importpfx -p %PFX_PASSWORD% %PFX_PATH% nochain
REM 或者使用 PowerShell
powershell -Command "
    $pfx = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
    $pfx.Import('%PFX_PATH%', '%PFX_PASSWORD%', 'Exportable,PersistKeySet')
    $store = New-Object System.Security.Cryptography.X509Certificates.X509Store('%STORE%', 'LocalMachine')
    $store.Open('ReadWrite')
    $store.Add($pfx)
    $store.Close()
    Write-Host '证书安装成功'
"

Linux 自动安装证书脚本

Bash 脚本 - Debian/Ubuntu

#!/bin/bash
# 安装 CA 证书
install_ca_cert() {
    local cert_path="$1"
    local cert_name=$(basename "$cert_path")
    # 复制到系统证书目录
    sudo cp "$cert_path" "/usr/local/share/ca-certificates/${cert_name}"
    # 更新证书
    sudo update-ca-certificates
    echo "CA证书安装完成: ${cert_name}"
}
# 安装后信任证书
install_and_trust() {
    local cert_path="$1"
    # 复制到系统证书目录
    sudo cp "$cert_path" "/etc/ssl/certs/"
    # 计算哈希链接
    local hash=$(openssl x509 -hash -noout -in "$cert_path")
    sudo ln -sf "/etc/ssl/certs/$(basename $cert_path)" "/etc/ssl/certs/${hash}.0"
    echo "证书已安装并信任"
}
# 主函数
main() {
    if [ $# -eq 0 ]; then
        echo "用法: $0 <证书文件路径>"
        exit 1
    fi
    for cert in "$@"; do
        if [ -f "$cert" ]; then
            install_ca_cert "$cert"
        else
            echo "文件不存在: $cert"
        fi
    done
}
main "$@"

RHEL/CentOS/Fedora 版本

#!/bin/bash
install_cert_redhat() {
    local cert_path="$1"
    local cert_name=$(basename "$cert_path")
    # 复制到系统证书目录
    sudo cp "$cert_path" "/etc/pki/ca-trust/source/anchors/${cert_name}"
    # 更新证书信任
    sudo update-ca-trust extract
    echo "证书已安装: ${cert_name}"
}
# 交互式安装
interactive_install() {
    read -p "请输入证书路径: " cert_path
    if [ ! -f "$cert_path" ]; then
        echo "文件不存在"
        return 1
    fi
    install_cert_redhat "$cert_path"
}
# 参数处理
case "${1:-interactive}" in
    interactive)
        interactive_install
        ;;
    *)
        if [ -f "$1" ]; then
            install_cert_redhat "$1"
        else
            echo "用法: $0 [证书文件路径]"
            exit 1
        fi
        ;;
esac

自动化安装脚本（支持多平台）

#!/bin/bash
# 自动证书安装脚本 - 支持多平台
set -e
# 配置变量
CERT_DIR="/tmp/certs"
CERT_URLS=(
    "https://example.com/certs/intermediate.crt"
    "https://example.com/certs/root.crt"
)
# 检测操作系统
detect_os() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        OS=$ID
    elif [ -f /etc/redhat-release ]; then
        OS="rhel"
    elif [ "$(uname)" = "Darwin" ]; then
        OS="macos"
    else
        OS="unknown"
    fi
    echo "检测到操作系统: $OS"
}
# 下载证书
download_certs() {
    mkdir -p "$CERT_DIR"
    for url in "${CERT_URLS[@]}"; do
        echo "下载证书: $url"
        wget -q --show-progress -P "$CERT_DIR" "$url"
    done
}
# 安装证书
install_certs() {
    case $OS in
        ubuntu|debian)
            echo "安装证书到 Debian/Ubuntu..."
            for cert in "$CERT_DIR"/*.crt; do
                if [ -f "$cert" ]; then
                    sudo cp "$cert" /usr/local/share/ca-certificates/
                fi
            done
            sudo update-ca-certificates
            ;;
        rhel|centos|fedora)
            echo "安装证书到 RHEL/CentOS/Fedora..."
            for cert in "$CERT_DIR"/*.crt; do
                if [ -f "$cert" ]; then
                    sudo cp "$cert" /etc/pki/ca-trust/source/anchors/
                fi
            done
            sudo update-ca-trust extract
            ;;
        macos)
            echo "安装证书到 macOS..."
            for cert in "$CERT_DIR"/*.crt; do
                if [ -f "$cert" ]; then
                    sudo security add-trusted-cert -d -r trustRoot \
                        -k /Library/Keychains/System.keychain "$cert"
                fi
            done
            ;;
        *)
            echo "不支持的操作系统: $OS"
            exit 1
            ;;
    esac
}
# 清理临时文件
cleanup() {
    echo "清理临时文件..."
    rm -rf "$CERT_DIR"
}
# 主函数
main() {
    echo "开始自动安装证书..."
    detect_os
    download_certs
    install_certs
    cleanup
    echo "证书安装完成！"
}
# 执行主函数
main

Docker 环境证书安装

FROM ubuntu:20.04
# 复制证书文件
COPY certs/ /usr/local/share/ca-certificates/
# 安装证书
RUN apt-get update && \
    update-ca-certificates --fresh && \
    rm -rf /var/lib/apt/lists/*
# 或者使用 ENV 变量
ENV REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

Python 自动化脚本

#!/usr/bin/env python3
import os
import sys
import subprocess
import platform
class CertificateInstaller:
    def __init__(self):
        self.system = platform.system().lower()
        self.cert_dir = None
    def install_certificate(self, cert_path):
        """安装证书"""
        if not os.path.exists(cert_path):
            print(f"证书文件不存在: {cert_path}")
            return False
        if self.system == "linux":
            return self._install_linux(cert_path)
        elif self.system == "windows":
            return self._install_windows(cert_path)
        else:
            print(f"不支持的系统: {self.system}")
            return False
    def _install_linux(self, cert_path):
        """Linux安装证书"""
        cert_name = os.path.basename(cert_path)
        # Ubuntu/Debian
        if os.path.exists("/usr/local/share/ca-certificates/"):
            dest = f"/usr/local/share/ca-certificates/{cert_name}"
            os.system(f"sudo cp {cert_path} {dest}")
            return os.system("sudo update-ca-certificates") == 0
        # RHEL/CentOS
        elif os.path.exists("/etc/pki/ca-trust/source/anchors/"):
            dest = f"/etc/pki/ca-trust/source/anchors/{cert_name}"
            os.system(f"sudo cp {cert_path} {dest}")
            return os.system("sudo update-ca-trust extract") == 0
        return False
    def _install_windows(self, cert_path):
        """Windows安装证书"""
        import subprocess
        # 安装到受信任根证书颁发机构
        cmd = f'certutil -addstore -user Root "{cert_path}"'
        return subprocess.run(cmd, shell=True).returncode == 0
# 使用示例
if __name__ == "__main__":
    installer = CertificateInstaller()
    # 批量安装证书
    certificates = [
        "path/to/cert1.crt",
        "path/to/cert2.pem"
    ]
    for cert in certificates:
        if installer.install_certificate(cert):
            print(f"证书安装成功: {cert}")
        else:
            print(f"证书安装失败: {cert}")

使用建议

权限管理：安装证书通常需要管理员/root权限
证书验证：安装前验证证书完整性
错误处理：添加完善的错误处理机制
日志记录：记录安装过程和结果
备份恢复：考虑添加备份原有证书的功能

你可以根据实际需求选择合适的脚本方案,并调整配置参数。