Automatic CRL files converter In my job we use our internal CA, which runs on a Windows server. When I want to use its CRL on a Linux machine I have to do these steps:


download root CA and intermediate CAs
covert them to x509
merge into one file (CRL.pem)


For this I wrote the small script below, which I run automatically by timer unit (cron on systems without systemd) once a day.

#!/usr/bin/env bash

crls=(RootCA IntermediateCA IntermediateCA2)
new_crl="newcrl.pem"
crl_temp=$(mktemp -q -d /tmp/pullcrl.XXXXX)
crl_dir="/etc/pki/tls/misc"


for crl in ${crls[@]}; do
  if curl -s http://url_of_crls/${crl}.crl -o ${crl_temp}/${crl}.crl; then
    openssl crl -in ${crl_temp}/${crl}.crl -inform DER -out ${crl_temp}/${crl}.pem
  else
    echo "Download a crl file failed!"
    exit 1
  fi
done

cat ${crl_temp}/*.pem &gt; ${crl_temp}/${new_crl}

mv ${crl_temp}/${new_crl} ${crl_dir}/${new_crl}


Could I do something better?
for crl in ${crls[@]}; do



It's a good habit to always double-quote array expansions.

Cleaning up the temp directory after a successful run would be a nice touch (or do away with it altogether; see below).


cat ${crl_temp}/*.pem &gt; ${crl_temp}/${new_crl}
mv ${crl_temp}/${new_crl} ${crl_dir}/${new_crl}



I assume you're doing this to get atomic replacement?  It only works if /tmp and /etc are on the same filesystem.  If they're not, you could get an empty destination file when (for example) the target is full.  Consider creating a working directory under /etc to be certain.

You could be more concise using cd and brace expansion and bash's own error handling (via set -euxo pipefail):

set -euxo pipefail

cd /etc/pki/tls/misc
temp=$( mktemp -p . )

for url in http://…blahblah…/{RootCA,IntermediateCA,IntermediateCA2}.crl ; do 
    curl $url | openssl crl -in - -inform DER
done &gt; $temp
mv $temp newcrl.pem