mikrotik check cert

certpusher.py

@@ -269,8 +269,12 @@ class MikroTikManager(SSHManager):
         self.cert_name = "letsencrypt"
         self.key_name = "letsencrypt-key"
     
-    def check_certificate_expiry(self, source_cert: x509.Certificate) -> bool:
-        """Check if certificate on MikroTik needs update"""
+    def check_certificate_expiry(self, source_cert: x509.Certificate, services: List[str]) -> bool:
+        """
+        Check if certificate on MikroTik needs update
+        Also verifies that services are properly configured
+        Returns True if upload needed, False if everything is OK
+        """
         try:
             logger.info("Checking MikroTik certificate")
             
@@ -311,28 +315,86 @@ class MikroTikManager(SSHManager):
             
             time_diff = abs((source_expiry - mikrotik_expiry).total_seconds())
             
-            if time_diff < 86400:
-                logger.info("✓ Certificate is current. Skipping.")
-                return False
-            else:
+            if time_diff >= 86400:
                 logger.info(f"Certificate differs. Upload needed.")
                 return True
             
+            # Certificate is current, but check if services are properly configured
+            logger.info("Certificate is current. Verifying services configuration...")
+            
+            cert_name = "letsencrypt.pem_0"
+            services_need_update = False
+            
+            for service in services:
+                success, stdout, stderr = self.execute_command(
+                    f'/ip service print where name="{service}"',
+                    ignore_error=True
+                )
+                
+                if success and stdout:
+                    # Check if certificate is set correctly
+                    if f'certificate={cert_name}' not in stdout and 'certificate=letsencrypt' not in stdout:
+                        logger.warning(f"Service {service} not using correct certificate")
+                        services_need_update = True
+                    else:
+                        logger.info(f"✓ Service {service} properly configured")
+                else:
+                    logger.warning(f"Could not check service {service}")
+                    services_need_update = True
+            
+            if services_need_update:
+                logger.info("Services need reconfiguration. Updating...")
+                self.configure_services(services, cert_name)
+                return False  # Don't need to upload cert, just reconfigure
+            
+            logger.info("✓ Certificate and services are current. Skipping.")
+            return False
+                
         except Exception as e:
             logger.warning(f"Error checking: {e}")
             return True
         
+        def configure_services(self, services: List[str], cert_name: str):
+            """Configure services to use certificate without re-uploading"""
+            try:
+                for service in services:
+                    logger.info(f"Configuring {service}")
+                    
+                    # Set certificate
+                    success, _, stderr = self.execute_command(
+                        f'/ip service set {service} certificate="{cert_name}"',
+                        ignore_error=True
+                    )
+                    
+                    if success:
+                        logger.info(f"✓ {service} configured")
+                    else:
+                        logger.warning(f"Failed to configure {service}: {stderr}")
+                    
+                    # Ensure service is enabled
+                    success, stdout, _ = self.execute_command(
+                        f'/ip service print where name="{service}"',
+                        ignore_error=True
+                    )
+                    
+                    if 'disabled=yes' in stdout:
+                        logger.info(f"Enabling {service}")
+                        self.execute_command(f'/ip service enable {service}')
+                        
+            except Exception as e:
+                logger.error(f"Service configuration failed: {e}")
+
         def upload_certificate(self, cert_path: str, key_path: str, check_first: bool, 
                             source_cert: x509.Certificate, services: List[str] = None) -> Tuple[bool, bool]:
             """Upload certificate to MikroTik"""
             try:
-            if check_first and source_cert:
-                if not self.check_certificate_expiry(source_cert):
-                    return True, False
-            
                 if not services:
                     services = ['www-ssl']
                 
+                if check_first and source_cert:
+                    if not self.check_certificate_expiry(source_cert, services):
+                        return True, False  # Certificate and services are OK
+                
                 logger.info(f"Deploying certificate for: {', '.join(services)}")
                 
                 # Disable services
@@ -409,22 +471,8 @@ class MikroTikManager(SSHManager):
                 imported_cert_name = "letsencrypt.pem_0"
                 logger.info(f"Using certificate: {imported_cert_name}")
                 
-            # Configure services
-            for service in services:
-                logger.info(f"Configuring {service}")
-                success, _, stderr = self.execute_command(
-                    f'/ip service set {service} certificate="{imported_cert_name}"'
-                )
-                
-                if not success:
-                    logger.error(f"Failed to configure {service}: {stderr}")
-                else:
-                    logger.info(f"✓ {service} configured")
-            
-            # Enable services
-            for service in services:
-                logger.info(f"Enabling {service}")
-                self.execute_command(f'/ip service enable {service}')
+                # Configure services using the new method
+                self.configure_services(services, imported_cert_name)
                 
                 time.sleep(1)