generate-certs.sh

#!/bin/bash

set -euo pipefail

cd "$(dirname "$0")"

clean() {
    rm -f *.pem *.key *.csr *.srl config
    rm -rf ./ca/
}

clean

DEFAULT_RSA_PSS_SIGNOPTS='-sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:20'
export RSA_PSS_SIGNOPTS="${RSA_PSS_SIGNOPTS-${DEFAULT_RSA_PSS_SIGNOPTS}}"

export ALG="${ALG:-rsa}"
./00-generate-root-ca.sh
./01-issue-inter-ca.sh server
./01-issue-inter-ca.sh client
./02-issue-server-cert.sh "${SERVER_CERT_ISSUER:-inter-ca-server}"
./03-issue-client-cert.sh "${CLIENT_CERT_ISSUER:-inter-ca-client}"

CLIENT_KEYFILE="${TLS_CLIENT_FNAME:-client-key}.pem"
CLIENT_CERTFILE="${TLS_CLIENT_FNAME:-client-cert}.pem"
SERVER_KEYFILE="server-key.pem"
SERVER_CERTFILE="server-cert.pem"

dir="$(date --iso-8601=second | tr ':' '-')"
mkdir "$dir"

mv ca.pem "$dir/ca.pem"

mv $CLIENT_KEYFILE "$dir/$CLIENT_KEYFILE"
cat $CLIENT_CERTFILE inter-ca-client.pem > "$dir/$CLIENT_CERTFILE"

mv $SERVER_KEYFILE "$dir/key.pem"
cat $SERVER_CERTFILE inter-ca-server.pem > "$dir/cert.pem"

clean