#!/bin/bash

# The script contains a sequence of commands described in README.md
# Generate client/server self signed CAs and certs.
openssl req -x509 -newkey rsa:4096 \
  -keyout provider_server_trust_key.pem \
  -out provider_server_trust_cert.pem \
  -days 3650 \
  -config provider_ca.cnf \
  -nodes

openssl req -x509 -newkey rsa:4096 \
  -keyout provider_client_trust_key.pem \
  -out provider_client_trust_cert.pem \
  -days 3650 \
  -config provider_ca.cnf \
  -nodes

openssl req -newkey rsa:4096                                                \
  -keyout provider_server_cert.key                                          \
  -out provider_new_cert.csr                                                \
  -nodes                                                                    \
  -subj "/C=US/ST=CA/L=DUMMYCITY/O=Internet Widgits Pty Ltd/CN=foo.bar.com" \
  -sha256

openssl x509 -req                      \
  -in provider_new_cert.csr            \
  -out provider_server_cert.pem        \
  -CA provider_client_trust_cert.pem   \
  -CAkey provider_client_trust_key.pem \
  -CAcreateserial                      \
  -days 3650                           \
  -sha256                              \
  -extfile provider_extensions.conf

openssl req -newkey rsa:4096                                        \
  -keyout provider_client_cert.key                                  \
  -out provider_new_cert.csr                                        \
  -nodes                                                            \
  -subj "/C=US/ST=CA/O=Internet Widgits Pty Ltd/CN=foo.bar.hoo.com" \
  -sha256

openssl x509 -req                      \
  -in provider_new_cert.csr            \
  -out provider_client_cert.pem        \
  -CA provider_server_trust_cert.pem   \
  -CAkey provider_server_trust_key.pem \
  -CAcreateserial                      \
  -days 3650                           \
  -sha256                              \
  -extfile provider_extensions.conf

# Generate files need for CRL issuing.

echo "1000" > provider_crlnumber.txt

touch provider_index.txt

# Generate two CRLs.

openssl ca -gencrl                       \
  -keyfile provider_client_trust_key.pem \
  -cert provider_client_trust_cert.pem   \
  -out provider_crl_empty.pem            \
  -config provider_crl.cnf

openssl ca -revoke provider_server_cert.pem \
  -keyfile provider_client_trust_key.pem    \
  -cert provider_client_trust_cert.pem      \
  -config provider_crl.cnf

openssl ca -gencrl                       \
  -keyfile provider_client_trust_key.pem \
  -cert provider_client_trust_cert.pem   \
  -out provider_crl_server_revoked.pem   \
  -config provider_crl.cnf

# Generate malicious CRLs.

openssl genrsa                                      \
  -out provider_malicious_client_trust_key.pem 4096

SubjectKeyIdentifier=$(openssl x509 -in provider_client_trust_cert.pem \
  -noout                                              \
  -text                                               \
  | awk '/Subject Key Identifier/ {getline; print $1;}')


sed "s/subjectKeyIdentifier = hash/subjectKeyIdentifier = $SubjectKeyIdentifier/g" \
  provider_extensions.conf > provider_extensions.conf.tmp &&
  mv provider_extensions.conf.tmp provider_extensions.conf

openssl req -new                                       \
  -key provider_malicious_client_trust_key.pem         \
  -out cert_malicious_request.csr                      \
  -subj "/C=US/ST=CA/L=SVL/O=Internet Widgits Pty Ltd"

openssl x509 -req                                  \
  -in cert_malicious_request.csr                   \
  -signkey provider_malicious_client_trust_key.pem \
  -out provider_malicious_client_trust_cert.pem    \
  -days 3650                                       \
  -extfile provider_extensions.conf                \
  -extensions extensions

openssl ca -gencrl                                 \
  -keyfile provider_malicious_client_trust_key.pem \
  -cert provider_malicious_client_trust_cert.pem   \
  -out provider_malicious_crl_empty.pem            \
  -config provider_crl.cnf

sed "s/subjectKeyIdentifier = .*/subjectKeyIdentifier = hash/g" \
  provider_extensions.conf > provider_extensions.conf.tmp &&
  mv provider_extensions.conf.tmp provider_extensions.conf

rm -f *.csr provider_{index.txt*,crlnumber.txt*,ca_client.cnf,ca_server.cnf} *.srl
