#!/bin/bash

###
# How to generate certificate authority:
#    openssl genrsa -out certs/rootCA.key 2048
#    openssl req -x509 -new -nodes -key certs/rootCA.key -sha256 -days 3650 -subj "/C=CZ/ST=Prague/L=Prague/O=DEVCERTS" -out certs/rootCA.crt
###

if [ $# -lt 2 ]; then
  echo "Please specify domain(s)."
  echo "Usage: $0 <output directory> <main domain> [another domain] [another domain] ..."
  exit 2
fi

ROOTCA="DEVCERTS"

PWD=$(dirname "$(realpath "$0")")
CERTSDIR="$PWD/../certs"

DIRECTORY=$1
DOMAIN=$2
CONF="/tmp/$DOMAIN.openssl.cnf"
PRIVATE_KEY="$DIRECTORY/$DOMAIN.key"
CERTIFICATE="$DIRECTORY/$DOMAIN.crt"
PEM="$DIRECTORY/$DOMAIN.pem"
CERTIFICATE_REQUEST="$DIRECTORY/$DOMAIN.crt.req"
ANOTHER_DOMAINS=""
ANOTHER_DOMAINS_INFO=""

ANOTHER_DOMAIN_INDEX=3
for ANOTHER_DOMAIN in ${@:$ANOTHER_DOMAIN_INDEX}
do
  ANOTHER_DOMAINS="${ANOTHER_DOMAINS}DNS.${ANOTHER_DOMAIN_INDEX} = ${ANOTHER_DOMAIN}"$'\n'
  ANOTHER_DOMAIN_INDEX=$((ANOTHER_DOMAIN_INDEX + 1))
  ANOTHER_DOMAINS="${ANOTHER_DOMAINS}DNS.${ANOTHER_DOMAIN_INDEX} = *.${ANOTHER_DOMAIN}"$'\n'
  ANOTHER_DOMAIN_INDEX=$((ANOTHER_DOMAIN_INDEX + 1))

  ANOTHER_DOMAINS_INFO=${ANOTHER_DOMAINS_INFO}"-> ${ANOTHER_DOMAIN}"$'\n'
done

cat > $CONF <<-EOF
[req]
default_bits = 2048
prompt = no
x509_extensions = v3_req
distinguished_name = dn

[dn]
C = CZ
ST = Prague
L = Prague
O = $ROOTCA
CN = *.$DOMAIN

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = $DOMAIN
DNS.2 = *.$DOMAIN
$ANOTHER_DOMAINS
EOF

openssl genrsa -out $PRIVATE_KEY 2048
chmod 600 $PRIVATE_KEY
openssl req -new -config $CONF -key $PRIVATE_KEY -out $CERTIFICATE_REQUEST

openssl x509 -req -in $CERTIFICATE_REQUEST -CA ${CERTSDIR}/rootCA-${ROOTCA}.crt -CAkey ${CERTSDIR}/rootCA-${ROOTCA}.key \
  -CAcreateserial -out $CERTIFICATE -days 3650 -sha256 -extfile $CONF -extensions 'v3_req'

rm $CERTIFICATE_REQUEST
rm $CONF
rm -f ${CERTSDIR}/rootCA-${ROOTCA}.srl
rm -f ${PWD}/.srl

cat ${CERTIFICATE} ${PRIVATE_KEY} | sudo tee ${PEM} > /dev/null

echo -e "\nSelf signed certificate ${CERTIFICATE}, private key ${PRIVATE_KEY} and pem ${PEM} for main domain ${DOMAIN} were generated with 10 years expiration time"

if [ "$ANOTHER_DOMAINS_INFO" ]; then
  echo "Another domains:"
  echo "${ANOTHER_DOMAINS_INFO}"
fi
