mjhjmtu

I am trying to automate the installation of certificate(s):q! in jboss server.
i wrote this rudimentary script:

#!/usr/bin/expect


set Temp_Dir "/tmp/install"
set jboss_sec "/opt/jboss/security"
set jboss_prof "/opt/jboss/profiles/CLOUD_0000"
set fokp [open "/tmp/install/keystore.pw" r]
#set frkp [read $fokp]
set frkp [read -nonewline $fokp]

exp_internal 1
spawn sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file /tmp/install/mqcert/'Symantec_Class_3_Secure_Server_CA_-_G4.cer' -alias Symantec
expect "Enter keystore password" send "$frkpr" 
expect "Owner" send "yesr" eof 

#spawn sudo keytool -import -keystore $jboss_sec/server_keystore.jks -file $Temp_Dir/mqcert/TRMISMQtestSwifNetCertauth.cer -alias TRMISMQtestSwifNetCertauth
#expect "Enter keystore passwordr" send "$frkpr" 
#expect "Trust this certificate?r" send "yesr" eof 

Output::

cloud-user@jboss-vm1-98ojcp:~ $ ./Step3-tcl-script.sh
spawn sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file /tmp/install/mqcert/'Symantec_Class_3_Secure_Server_CA_-_G4.cer' -alias Symantec
Enter keystore password: spawn sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file /tmp/install/mqcert/TRMISMQtestSwifNetCertauth.cer -alias TRMISMQtestSwifNetCertauth
Enter keystore password: (DEV) cloud-user@jboss-vm1-98ojcp:~ $

And the cerfitcates are not installing because its not going for second expect where it is asking for "Trust this certificate?"

If i run the command manually

cloud-user@jboss-vm1-98ojcp:/tmp/install/mqcert $ sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file Symantec_Class_3_Secure_Server_CA_-_G4.cer -alias Symantec
Enter keystore password:
Owner: CN=Symantec Class 3 Secure Server CA - G4, OU= Trust Network, O= Corporation, C=US
Issuer: CN= Public Primary Certification Authority - G5, OU="(c) 2006 - For authorized use only", OU=Trust Network, C=US
Serial number: 513fb9743870b734404
Valid from: Wed Oct 30 20:00:00 EDT 2013 until: Mon Oct 30 19:59:59 EDT 2023
Certificate fingerprints:
 MD5: 23:D5:85:F7:26:C5
 SHA1: FF:E1:8B:CC:E1:D7:0F:DA:BD:7C:86:61:35
 SHA256: EA::98:D0:F0:D6:A9:CF:17
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions:

#1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
 [
 accessMethod: ocsp
 accessLocation: URIName: http://s2.symcb.com
]
]

#2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 7F D3 65 A7 F3 43 39 FA 02 ..e......0..C9..
0010: AF 33 31 33 .313
]
]

#3: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
 CA:true
 PathLen:0
]

#4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
 [DistributionPoint:
 [URIName: http://s.crl]
]]

#5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
 [CertificatePolicyId: [2.16.840.1.113733.1.7.54]
[PolicyQualifierInfo: [
 qualifierID: 1.3.6.1.5.5.7.2.1
 qualifier: 0000: 2F 77 77 77 2E 73 79 6D ..http://www.sym
0010: 61 75 74 68 2E 63 6F 6D 2F 63 70 73 auth.com/cps

], PolicyQualifierInfo: [
 qualifierID: 1.3.6.1.5.5.7.2.2
 qualifier: 0000: 303 0...http://www.s
0010: 79 6D 61 75 74 68 2E 63 6F 6D 2F 72 70 61 ymauth.com/rpa

]] ]
]

#6: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
 Key_CertSign
 Crl_Sign
]

#7: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
 CN=PKI-1-534
]

#8: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
00: 5F 60 CF 61 90 55 DF 84 60 2A B2 F5 7A _`.a.U..C..`*..z
00: F4 4 EF .C..
]
]

Trust this certificate? [no]: no
Certificate was not added to keystore

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /opt/jboss/security/server_keystore.jks -destkeystore /opt/jboss/security/server_keystore.jks -deststoretype pkcs12".

Am i doing any mistake in anywhere?

Debug:

cloud-user@jboss-vm1-98ojcp:~ $ ./Step3-tcl-script.sh
spawn sudo keytool -import -keystore /opt/jboss/security/server_keystore.jks -file /tmp/install/mqcert/'Symantec_Class_3_Secure_Server_CA_-_G4.cer' -alias Symantec
parent: waiting for sync byte
parent: telling child to go ahead
parent: now unsynchronized from child
spawn: returns 8220

expect: does "" (spawn_id exp5) match glob pattern " "Enter keystore passwordr" send "$frkpr" "? no
Enter keystore password:
expect: does "Enter keystore password: " (spawn_id exp5) match glob pattern " "Enter keystore passwordr" send "$frkpr" "? no
expect: timed out

expect: does "Enter keystore password: " (spawn_id exp5) match glob pattern " "Owner" send "yesr" eof "? no
expect: timed out

Don't use r in the expected pattern to match, since it stands for carriage-return and the prompts you are getting do not seem to end with one. For example, replace "Ownerr" by "Owner". Only use r to end a reply you are sending, such as "yesr".

set frkp [read $fokp] -- this will include the trailing newline from the file, and you probably don't want to include that character as part of the passphrase. Instead:

set frkp [read -nonewline $fokp]

Also, while developing your expect script, add the command exp_internal 1 before the first spawn. The verbose debugging output will show you why your patterns aren't matching.