#! /bin/sh
#set -x
#=========================================================================
# Copyright (C) GemTalk Systems, Inc. 1986-2014.  All Rights Reserved..
#
# Name - make_example_certs.sh
#
#  Example shell script to create certificate files for the 
#  GsSecureSocket example code.
#
#  This script is provided as an example only.
#
# $Id$
#
#=========================================================================

# Directory where created certificates go
CERT_DIR=/tmp/certs

# Uncomment to replace the example certificates
#CERT_DIR=$GEMSTONE/examples/openssl/certs

# Directory where openssl config files live.
CONF_DIR=$GEMSTONE/examples/openssl/config

# Log file for the output of this script.
LOG_FILE=/tmp/make_example_certs.log

# Place to put the full path to the openssl executable.
# Otherwise, it is assumed to be in your path.
#
OPENSSL=$GEMSTONE/bin/openssl


# Do some checks before starting

if [ ! -d $CERT_DIR ]; then
  echo "Error: $CERT_DIR must exist"
  exit 1
fi

if [ ! -d $CONF_DIR ]; then
  echo "Error: $CONF_DIR must exist and contain configuration files"
  exit 1
fi

if [ "$OPENSSL" = "" ]; then
#  "Just hope it's in the path..."
  OPENSSL=openssl
fi

touch $LOG_FILE
if [ ! -f $LOG_FILE ]; then
 echo "Error: could not open the log file $LOG_FILE"
 exit 1
fi


# ##############################################################################
# Step 1: Create the root certificate.
# ##############################################################################

echo "Creating root private key" >>$LOG_FILE 2>&1 
$OPENSSL req -newkey rsa:1024 -sha1 -config $CONF_DIR/rootreq.cnf \
  -keyout $CERT_DIR/rootkey.pem -out $CERT_DIR/rootkey.pem -passout \
   pass:ROOTKEY >>$LOG_FILE 2>&1

echo "" >>$LOG_FILE 2>&1 
echo "Creating self-signed root certificate" >>$LOG_FILE 2>&1 
$OPENSSL x509 -req -in $CERT_DIR/rootkey.pem -sha1 -days 3650 \
 -extfile $CONF_DIR/root.cnf -extensions v3_ca -signkey $CERT_DIR/rootkey.pem \
 -out $CERT_DIR/rootcert.pem -passin pass:ROOTKEY >>$LOG_FILE 2>&1

cat $CERT_DIR/rootcert.pem $CERT_DIR/rootkey.pem >>$CERT_DIR/root.pem

echo "" >>$LOG_FILE 2>&1 
echo "Finished creating root certificate" >>$LOG_FILE 2>&1 
echo "Subject and issuer of root certificate:" >>$LOG_FILE 2>&1 
$OPENSSL x509 -subject -issuer -noout \
  -in $CERT_DIR/root.pem >>$LOG_FILE 2>&1

echo "" >>$LOG_FILE 2>&1 
echo "" >>$LOG_FILE 2>&1 
# ##############################################################################
# Step 2: Create the certificate authority (CA) and sign it with the root
#         cert from step 1.
# ##############################################################################

echo "" >>$LOG_FILE 2>&1 
echo "Creating server CA private key" >>$LOG_FILE 2>&1 
$OPENSSL req -newkey rsa:1024 -sha1 -config \
  $CONF_DIR/req_serverca.cnf -keyout $CERT_DIR/serverCAkey.pem \
  -out $CERT_DIR/serverCAreq.pem -passout pass:SERVERCAKEY >>$LOG_FILE 2>&1 

echo "" >>$LOG_FILE 2>&1 
echo "Creating server CA private key with no passphrase"
$OPENSSL rsa -in $CERT_DIR/serverCAkey.pem -out $CERT_DIR/serverCAkey_NO_PASS.pem \
-passin pass:SERVERCAKEY >>$LOG_FILE 2>&1 

echo "" >>$LOG_FILE 2>&1 
echo "Creating server CA certificate signed by the root private key" >>$LOG_FILE 2>&1 
$OPENSSL x509 -req -in $CERT_DIR/serverCAreq.pem \
  -sha1 -extfile $CONF_DIR/serverCA.cnf -extensions v3_ca -days 3650 \
  -CA $CERT_DIR/root.pem -CAkey $CERT_DIR/root.pem -CAcreateserial \
  -out $CERT_DIR/serverCAcert.pem -passin pass:ROOTKEY >>$LOG_FILE 2>&1 

cat $CERT_DIR/serverCAcert.pem $CERT_DIR/serverCAkey.pem $CERT_DIR/rootcert.pem > $CERT_DIR/serverCA.pem
echo "" >>$LOG_FILE 2>&1 
echo "Creating server CA private key" >>$LOG_FILE 2>&1 
echo "Finished creating server authority key and certificate" >>$LOG_FILE 2>&1 
echo "Subject and issuer of CA certificate:" >>$LOG_FILE 2>&1 
$OPENSSL x509 -subject -issuer -noout \
  -in $CERT_DIR/serverCA.pem >>$LOG_FILE 2>&1 

echo "" >>$LOG_FILE 2>&1 
echo "" >>$LOG_FILE 2>&1 
# ##############################################################################
# Step 3: create the server certificate and sign it with the CA in step 2.
# ##############################################################################
echo "" >>$LOG_FILE 2>&1 
echo "Creating server private key" >>$LOG_FILE 2>&1 
$OPENSSL req -newkey rsa:1024 -config $CONF_DIR/req_server.cnf \
  -sha1 -keyout $CERT_DIR/serverkey.pem -out $CERT_DIR/serverreq.pem \
  -passout pass:SERVERKEY >>$LOG_FILE 2>&1 

echo "" >>$LOG_FILE 2>&1 
echo "Creating server certificate signed by the server CA private key" >>$LOG_FILE 2>&1 
$OPENSSL x509 -req -in $CERT_DIR/serverreq.pem -sha1  -days 3650 \
 -extfile $CONF_DIR/server.cnf -extensions usr_cert \
 -CA $CERT_DIR/serverCA.pem -CAkey $CERT_DIR/serverCA.pem \
 -CAcreateserial -out $CERT_DIR/servercert.pem \
 -passin pass:SERVERCAKEY >>$LOG_FILE 2>&1 

echo "" >>$LOG_FILE 2>&1 
echo "Removing pass phrase from server private key" >>$LOG_FILE 2>&1 
# "Creating a private key file without the pass phrase"
$OPENSSL rsa -in $CERT_DIR/serverkey.pem \
 -out $CERT_DIR/serverkey_NO_PASS.pem \
 -passin pass:SERVERKEY >>$LOG_FILE 2>&1 

cat $CERT_DIR/servercert.pem $CERT_DIR/serverkey_NO_PASS.pem \
   $CERT_DIR/serverCAcert.pem  $CERT_DIR/rootcert.pem > $CERT_DIR/server.pem

echo "" >>$LOG_FILE 2>&1 
echo "Finished creating server certificate" >>$LOG_FILE 2>&1 
echo "Subject and issuer of server certificate:" >>$LOG_FILE 2>&1 
$OPENSSL x509 -subject -issuer -noout -in $CERT_DIR/server.pem >>$LOG_FILE 2>&1 

echo "" >>$LOG_FILE 2>&1 
echo "" >>$LOG_FILE 2>&1 
echo "Verifying certificate $CERT_DIR/server.pem :" >>$LOG_FILE 2>&1 
$OPENSSL verify -CAfile $CERT_DIR/serverCA.pem -purpose sslclient $CERT_DIR/server.pem >>$LOG_FILE 2>&1 
echo "Finished!"
echo "trusted CA certificates are in: $CERT_DIR/serverCA.pem"
echo "server certificates are in $CERT_DIR/server.pem"

exit 0
