SSL channel security

#!/bin/bash

# Script that is used to generate and import self-signed certificates to java keystore
# Edit NUMHOSTS and HOSTS as it will be suitable for your case.

declare -a NUMHOSTS
declare -a HOSTS

SSH_OPTS='-o GlobalKnownHostsFile=/dev/null -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'
NUMHOSTS=(1 2 3)
HOSTS=$(for i in "${NUMHOSTS[@]}"; do echo "sov-ads-test-$i.ru-central1.internal"; done)


for HOST in $HOSTS; do
  	echo "update-ca-trust"
	ssh $SSH_OPTS $HOST "sudo update-ca-trust extract"
done

echo Generate keystore.jks on each host
for HOST in $HOSTS; do
  	echo "remove old alias"
  	ssh $SSH_OPTS $HOST "keytool -delete -alias $HOST -keystore /tmp/keystore.jks -storepass bigdata";

  	echo "Generating keypair"
	ssh $SSH_OPTS $HOST "keytool 	-genkey \
	                                -noprompt \
	                                -keyalg RSA \
	                                -ext san=dns:$HOST \
	                                -alias $HOST \
	                                -dname \"CN=$HOST, OU=AD, O=AD, L=MSK, S=MO, C=RU\" \
	                                -keystore /tmp/keystore.jks \
	                                -storepass bigdata \
	                                -keypass bigdata \
	                                -validity 360 \
	                                -keysize 2048";
done

echo
echo Export certificates
for HOST in $HOSTS;do
	ssh $SSH_OPTS $HOST "keytool 	-export \
	                                -file /tmp/$HOST.crt \
	                                -keystore /tmp/keystore.jks \
	                                -storepass bigdata \
	                                -alias $HOST \
	                                -rfc";
done

echo
echo Collect all certificates
for HOST in $HOSTS; do
 	scp $SSH_OPTS $HOST:/tmp/$HOST.crt /tmp/

#        scp $SSH_OPTS $HOST:/tmp/*.crt /tmp/
done

echo
echo Transfer certificates on hosts
for HOST in $HOSTS; do
	for CERT in $HOSTS; do
	    scp $SSH_OPTS /tmp/$CERT.crt $HOST:/tmp/
	done

#	scp $SSH_OPTS /tmp/*.crt $HOST:/tmp/
done

echo
echo Import certificates on each host
for HOST in $HOSTS; do

	ssh $SSH_OPTS $HOST "for CERT in $(echo ${HOSTS[*]}); do

		echo "remove old alias before import"
		keytool -delete -noprompt -alias \$CERT -keystore /tmp/truststore.jks -storepass bigdata

		echo "Import Cert"
		keytool 	-import \
		 	        -noprompt \
		 	        -alias \$CERT \
		 	        -file /tmp/\$CERT.crt \
		 	        -keystore /tmp/truststore.jks \
		 	        -storepass bigdata;
		sudo bash -c \"cat /tmp/\$CERT.crt >> /etc/pki/tls/certs/ca-bundle.crt\";
		done";
done

echo
echo Import truststore to Java CA store
for HOST in $HOSTS; do
	ssh $SSH_OPTS $HOST "sudo keytool 	-importkeystore \
	 	                                -noprompt \
	 	                                -srckeystore /tmp/truststore.jks \
	 	                                -destkeystore /etc/pki/java/cacerts \
	 	                                -deststorepass changeit \
	 	                                -srcstorepass bigdata"
done

echo
echo Create directories for certs
for HOST in $HOSTS; do
	ssh $SSH_OPTS $HOST "[ -d /etc/ssl ] || sudo mkdir /etc/ssl;
			     [ -d /etc/ssl/certs ] || sudo mkdir /etc/ssl/certs"
done

echo
echo Create and import cert for Nginx
for HOST in $HOSTS; do
	ssh $SSH_OPTS $HOST "sudo openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj \"/C=RU/ST=Denial/L=MSK/O=AD/CN=$HOST\" -keyout /etc/ssl/host_cert.key  -out /etc/ssl/certs/host_cert.cert"
	ssh $SSH_OPTS $HOST "sudo bash -c \"cat /etc/ssl/certs/host_cert.cert >> /etc/pki/tls/certs/ca-bundle.crt\""
done