macOS shell脚本筛选最新有效期重复证书实现咨询

实现逻辑 #

你已经拿到了每个证书的数值格式到期时间（YYYYMMDD，数值越大有效期越晚）和对应SHA1哈希，只要增加临时变量存储全局最晚到期时间和对应保留哈希，再收集所有证书哈希最后遍历删除即可，具体修改如下：

完整修改后代码 #

#!/bin/sh

# 先备份原有IFS，处理完后复原避免影响后续命令
OLD_IFS=$IFS
IFS=","

CERT_LIST=$( security find-certificate -a -c "my_certificate" -p -Z "/Library/Keychains/System.keychain" | sed s/"-----END CERTIFICATE-----"/"-----END CERTIFICATE-----","/g)

if [[ -n "${CERT_LIST}" ]]; then
    CERT_ARRAY=(${CERT_LIST})
    # 初始化变量：索引计数、当前最晚到期时间、要保留的证书哈希、所有证书哈希列表
    CERT_ARRAY_INDEX_NUMBER=0
    LATEST_EXPIRE=0
    KEEP_CERT_HASH=""
    ALL_CERT_HASHES=()

    for CERT_ELEMENT in "${CERT_ARRAY[@]}"; do
        # 跳过空元素（避免sed最后加的逗号导致的空项）
        [[ -z "${CERT_ELEMENT}" ]] && continue
        
        CERT_EXPIRATION_DATE_FULL=$( openssl x509 -noout -enddate <<< "${CERT_ELEMENT}" | cut -f2 -d= )
        CERT_EXPIRATION_DATE_FORMATTED=$( date -j -f "%b %d %T %Y %Z" "${CERT_EXPIRATION_DATE_FULL}" "+%Y-%m-%d" )
        CERT_EXPIRATION_DATE_FORMATTED_TRUNCATED=$( echo ${CERT_EXPIRATION_DATE_FORMATTED} | tr -d "-" )        
        CERT_SHA1_HASH=$( grep -e 'SHA-1 hash:' <<< "${CERT_ELEMENT}" | cut -d" "  -f3- )
        CERT_ARRAY_INDEX_NUMBER=$((${CERT_ARRAY_INDEX_NUMBER}+1))

        echo "QA testing: Certificate (${CERT_ARRAY_INDEX_NUMBER}): Hash: ${CERT_SHA1_HASH} Expiration date: ${CERT_EXPIRATION_DATE_FORMATTED_TRUNCATED}"

        # 新增筛选逻辑
        # 把当前证书哈希加入总列表
        ALL_CERT_HASHES+=("${CERT_SHA1_HASH}")
        # 对比到期时间，更新要保留的证书
        if [[ ${CERT_EXPIRATION_DATE_FORMATTED_TRUNCATED} -gt ${LATEST_EXPIRE} ]]; then
            LATEST_EXPIRE=${CERT_EXPIRATION_DATE_FORMATTED_TRUNCATED}
            KEEP_CERT_HASH=${CERT_SHA1_HASH}
        fi
    done

    # 循环结束后执行删除逻辑
    echo " "
    echo "Will keep certificate with hash: ${KEEP_CERT_HASH}, expiration date: ${LATEST_EXPIRE}"
    for HASH in "${ALL_CERT_HASHES[@]}"; do
        if [[ "${HASH}" != "${KEEP_CERT_HASH}" ]]; then
            echo "Deleting old certificate: ${HASH}"
            # 可直接使用以下系统自带删除命令，也可替换为你自己实现的删除逻辑
            security delete-certificate -Z "${HASH}" "/Library/Keychains/System.keychain"
        fi
    done

else
    echo "Error: Certificate \"my_certificate\" could not be found."
    exit 1
fi

# 复原原有IFS
IFS=$OLD_IFS
exit 0

验证逻辑 #

以你给出的测试输出为例：

• 第一个证书到期时间为20220503，会先赋值给LATEST_EXPIRE，对应哈希存入KEEP_CERT_HASH
• 第二个证书到期时间为20220507，数值大于20220503，会更新LATEST_EXPIRE和KEEP_CERT_HASH为第二个证书的对应值
• 最终删除时会跳过第二个证书的哈希，仅删除第一个证书

内容的提问来源于stack exchange，提问作者Daniel Stranathan