#!/bin/bash

if [[ "$1" != "for" && "$1" != "revoked" || -z "$2" || "$3" != "on" || -z "$4" ]]; then
	echo "usage:"
	echo "	$0 for USER on SERVER"
	echo "	$0 revoked USER on SERVER"
	exit 1
fi

USER=$2
SERVER=$4

CA_PATH="./pki/ca"
SERVER_PATH="./pki/server"
CLIENT_PATH="./pki/client/${USER}"

mkdir -p ${CA_PATH}
mkdir -p ${SERVER_PATH}
mkdir -p ${CLIENT_PATH}

CA_TMPL="${CA_PATH}/ca.tmpl"

cat << _EOF_ > ${CA_TMPL}
cn = "${SERVER}'s CA"
organization = "${SERVER}"
expiration_days = -1
ca
signing_key
cert_signing_key
crl_signing_key
_EOF_

SERVER_TMPL="${SERVER_PATH}/server.tmpl"

cat << _EOF_ > ${SERVER_TMPL}
cn = "${SERVER}"
organization = "${SERVER}"
expiration_days = -1
encryption_key
signing_key
tls_www_server
_EOF_

CRL_TMPL="${SERVER_PATH}/crl.tmpl"

cat << _EOF_ > ${CRL_TMPL}
crl_next_update = 9999 
_EOF_


CLIENT_TMPL="${CLIENT_PATH}/${USER}.tmpl"

cat << _EOF_ > ${CLIENT_TMPL}
cn = "${USER}"
uid = "${USER}"
unit = "users"
organization = "${SERVER}"
expiration_days = -1
tls_www_client
signing_key
encryption_key
_EOF_



CA_KEY="${CA_PATH}/ca-key.pem"

if [[ ! -f "${CA_KEY}" ]]; then
	certtool --generate-privkey     --outfile ${CA_KEY} 
fi

CA_CERT="${CA_PATH}/ca-cert.pem"

if [[ ! -f "${CA_CERT}" ]]; then
	certtool --generate-self-signed --outfile ${CA_CERT}      --template ${CA_TMPL}     --load-privkey ${CA_KEY} 
fi

SERVER_KEY="${SERVER_PATH}/server-key.pem"

if [[ ! -f "${SERVER_KEY}" ]]; then
	certtool --generate-privkey     --outfile ${SERVER_KEY} 
fi

SERVER_CERT="${SERVER_PATH}/server-cert.pem"

if [[ ! -f "${SERVER_CERT}" ]]; then
	certtool --generate-certificate --outfile ${SERVER_CERT}  --template ${SERVER_TMPL} --load-privkey ${SERVER_KEY} --load-ca-certificate ${CA_CERT} --load-ca-privkey ${CA_KEY} 
fi

CLIENT_KEY="${CLIENT_PATH}/${USER}-key.pem"

if [[ ! -f "${CLENT_KEY}" ]]; then
	certtool --generate-privkey     --outfile ${CLIENT_KEY} 
fi

CLIENT_CERT="${CLIENT_PATH}/${USER}-cert.pem"

if [[ ! -f "${CLIENT_CERT}" ]]; then
	certtool --generate-certificate --outfile ${CLIENT_CERT}  --template ${CLIENT_TMPL} --load-privkey ${CLIENT_KEY} --load-ca-certificate ${CA_CERT} --load-ca-privkey ${CA_KEY} 
fi

CLIENT_P12="${CLIENT_PATH}/${USER}-cert.p12"

if [[ ! -f "${CLIENT_P12}" ]]; then
	openssl pkcs12 -export -inkey ${CLIENT_KEY} -in ${CLIENT_CERT} -name "${USER}" -certfile ${CA_CERT} -out ${CLIENT_P12} -password pass:
#	certtool --to-p12 --pkcs-cipher 3des-pkcs12 --outder --outfile ${CLIENT_P12} --load-certificate ${CLIENT_CERT} --load-privkey ${CLIENT_KEY} --load-ca-certificate ${CA_CERT} --load-ca-privkey ${CA_KEY} --password='' --p12-name="${USER}"
fi

if [[ "$1" != "revoked" ]]; then
	exit 0
fi

REVOKED_CERT="${SERVER_PATH}/revoked.pem"

cat ${CLIENT_CERT} >> ${REVOKED_CERT}

CRL="${SERVER_PATH}/crl.pem"

certtool --generate-crl         --outfile ${CRL}   --template ${CRL_TMPL} --load-certificate ${REVOKED_CERT}     --load-ca-certificate ${CA_CERT} --load-ca-privkey ${CA_KEY} 

