#!/bin/bash

# Create certificate for Digital Signing

# Example for use with key name and lifetime
# ./create_signing_certificate.sh --key-name=ap --days=365

# Example for use with key name, CA key name and lifetime
# ./create_signing_certificate.sh --key-name=ap --ca-key-name=signing-ca --days=4017

# Example for use with key name, subject and lifetime
# ./create_signing_certificate.sh --key-name=ap --subject="/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=ap" --days=4017

set -e

ca_home=$(cd "$(dirname "$0")" >/dev/null && pwd)
ca_certs="${ca_home}"/certs
ca_csr="${ca_home}"/csr
ca_private="${ca_home}"/private

# default key name
key_name=
# default CA key name
ca_key_name=root-ca
# default subject
subject_default="/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT"
# default certificate lifetime
days=3652

subject=

# check command line options
for option in "$@"
do
    case "${option}" in
            --ca-key-name=*)  ca_key_name=$(echo "${option}" | sed 's/--ca-key-name=//' | sed 's/^"//' | sed 's/"$//' | sed 's/^\(.*\)\/$/\1/')
                            ;;
            --key-name=*)   key_name=$(echo "${option}" | sed 's/--key-name=//' | sed 's/^"//' | sed 's/"$//' | sed 's/^\(.*\)\/$/\1/')
                            ;;
            --subject=*)    subject=$(echo "${option}" | sed 's/--subject=//' | sed 's/^"//' | sed 's/"$//' | sed 's/^\(.*\)\/$/\1/')
                            ;;
            --days=*)       days=$(echo "${option}" | sed 's/--days=//' | sed 's/^"//' | sed 's/"$//' | sed 's/^\(.*\)\/$/\1/')
                            ;;
            *)              >&2 echo "unknown option: ${option}, use --key-name=, --subject=, --dns=, --days="
                            exit 1
                            ;;
    esac
done

if [ -z "${key_name}" ]; then
    echo "Key name missisng, use: --key-name=<basename>"
    exit 1
fi

if [ -z "${subject}" ]; then
    subject="${subject_default}"/CN=${key_name}
fi

# Create required sub-directories
mkdir -p "${ca_certs}" "${ca_csr}" "${ca_private}"

echo "step 1: Create Private Key"
openssl ecparam -genkey -name secp384r1 -out "${ca_private}"/"${key_name}".key

echo "step 2: Create Certificate Signing Request"
openssl req -new -sha512 -nodes \
    -key "${ca_private}"/"${key_name}".key \
    -out "${ca_csr}"/"${key_name}".csr \
    -subj "${subject}"

echo "step 3: Create and sign Signing Certificate"
openssl x509 -req -sha512 -days "${days}" \
    -in "${ca_csr}"/"${key_name}".csr \
    -CA "${ca_certs}"/"${ca_key_name}".crt \
    -CAkey "${ca_private}"/"${ca_key_name}".key \
    -CAcreateserial \
    -out "${ca_certs}"/"${key_name}".crt \
    -extfile <(printf '\nkeyUsage=critical,nonRepudiation,digitalSignature\nextendedKeyUsage=critical,codeSigning\n')

openssl x509 -in "${ca_certs}"/"${key_name}".crt -noout -text