#!/bin/sh
set -e -u

dpkg -l easy-rsa | grep '^ii'

cadir=$(mktemp -d -u)

trap 'rm -r -f "${cadir}"' EXIT

echo 'Initialising PKI dir'

make-cadir "${cadir}"

cd "${cadir}"

./easyrsa --batch init-pki

cp ./vars ./vars.bak

bits=4096
sed -i -e "s/^#*\\(set_var EASYRSA_KEY_SIZE[[:space:]]*\\)[0-9]*$/\\1$((bits))/" ./vars


echo
echo 'Creating CA'

ca_cn='My Example CA'
ca_email='example@example.com'
./easyrsa --batch --req-cn="${ca_cn}" --req-email="${ca_email}" build-ca nopass

echo
echo 'Generating certificate'

cert_cn='server.example.com'
./easyrsa --batch --req-cn="${cert_cn}" --req-email='server@example.com' gen-req example-server nopass
./easyrsa --batch --days=365 sign-req server example-server

echo
echo 'checks'


echo "check CA public key size (should be $((bits)) bits)"
openssl x509 -noout -text -in "${cadir}/pki/ca.crt" \
| sed -n -e '/Public-Key: /s/^[[:space:]]*//p'

echo "check CA subject (should be \"${ca_cn}\")"
openssl x509 -noout -subject -in "${cadir}/pki/ca.crt"


echo "check cert public key size (should be $((bits)) bits)"
openssl x509 -noout -text -in "${cadir}/pki/issued/example-server.crt" \
| sed -n -e '/Public-Key: /s/^[[:space:]]*//p'

echo "check cert subject (should be \"${cert_cn}\")"
openssl x509 -noout -subject -in "${cadir}/pki/issued/example-server.crt"