Created A Reload Nginx Script After SSL Certificate Update

/usr/local/cwpsrv/htdocs/resources/scripts/cwp_ssl_watch.sh

#!/bin/bash

SCRIPT_DIR="/usr/local/cwpsrv/htdocs/resources/scripts"
STATE_DIR="$SCRIPT_DIR/.state"
STATE_FILE="$STATE_DIR/cwp_ssl_watch.sha256"
LOG_FILE="/var/log/cwp_ssl_watch.log"
TMP_FILE="/tmp/cwp_ssl_watch.$$"

mkdir -p "$STATE_DIR"

log() {
  echo "[$(date '+%F %T')] $*" >> "$LOG_FILE"
}

get_cert_files() {
  {
    grep -RhoP '^\s*SSLCertificateFile\s+\K\S+' /usr/local/apache/conf 2>/dev/null
    grep -RhoP '^\s*ssl_certificate\s+\K[^;]+' /etc/nginx 2>/dev/null
  } | sed 's/"//g' | sed "s/'//g" | sort -u
}

> "$TMP_FILE"

for cert in $(get_cert_files); do
  if [ -f "$cert" ]; then
    sha256sum "$cert" >> "$TMP_FILE"
  fi
done

sort -k2 "$TMP_FILE" -o "$TMP_FILE"

if [ ! -s "$TMP_FILE" ]; then
  log "No SSL certificate hashes collected"
  rm -f "$TMP_FILE"
  exit 0
fi

if [ ! -f "$STATE_FILE" ]; then
  cp "$TMP_FILE" "$STATE_FILE"
  chmod 600 "$STATE_FILE"
  log "Baseline created"
  rm -f "$TMP_FILE"
  exit 0
fi

cmp -s "$TMP_FILE" "$STATE_FILE"
CMP_STATUS=$?

if [ "$CMP_STATUS" -eq 0 ]; then
  log "No SSL changes detected"
  rm -f "$TMP_FILE"
  exit 0
fi

cp "$TMP_FILE" "$STATE_FILE"
chmod 600 "$STATE_FILE"
log "SSL certificate change detected"
rm -f "$TMP_FILE"
exit 1

/usr/local/cwpsrv/htdocs/resources/scripts/cwp_reload_web_after_ssl.sh

#!/bin/bash
set -euo pipefail

LOG_FILE="/var/log/cwp_ssl_reload.log"

log() {
  echo "[$(date '+%F %T')] $*" >> "$LOG_FILE"
}

reload_service() {
  local svc="$1"

  if command -v systemctl >/dev/null 2>&1; then
    systemctl reload "$svc"
  else
    service "$svc" reload
  fi
}

if [ -x /usr/local/apache/bin/httpd ]; then
  /usr/local/apache/bin/httpd -t
elif command -v apachectl >/dev/null 2>&1; then
  apachectl configtest
elif command -v httpd >/dev/null 2>&1; then
  httpd -t
fi

if command -v nginx >/dev/null 2>&1; then
  nginx -t
fi

reload_service httpd || systemctl restart httpd
reload_service nginx || systemctl restart nginx

log "Apache and Nginx reloaded after SSL change detection."
exit 0

chmod 700 /usr/local/cwpsrv/htdocs/resources/scripts/cwp_ssl_watch.sh
chmod 700 /usr/local/cwpsrv/htdocs/resources/scripts/cwp_reload_web_after_ssl.sh

/etc/monit.d/cwp_ssl_watch.monitrc

check program cwp_ssl_watch with path "/usr/local/cwpsrv/htdocs/resources/scripts/cwp_ssl_watch.sh"
  every 2 cycles
  if status != 0 then exec "/usr/local/cwpsrv/htdocs/resources/scripts/cwp_reload_web_after_ssl.sh"

sed -i 's/\r$//' /usr/local/cwpsrv/htdocs/resources/scripts/cwp_reload_web_after_ssl.sh
sed -i 's/\r$//' /usr/local/cwpsrv/htdocs/resources/scripts/cwp_ssl_watch.sh
chmod 700 /usr/local/cwpsrv/htdocs/resources/scripts/cwp_reload_web_after_ssl.sh
chmod 700 /usr/local/cwpsrv/htdocs/resources/scripts/cwp_ssl_watch.sh

monit -t
systemctl restart monit
monit reload