#!/usr/bin/env bash
# This script will create a custom Certificate Authority (CA) and End Entity (EE) certificates.
#
# for local development this should be fine and you can ignore certificate trust errors related to
# an untrusted root. For public facing access, you can submit the generated lesspass.csr to a trusted
# ca so that they can provide you with a trusted certificate to replace this development certificate.

CA_CRT_SUBJ="${CA_CRT_SUBJ:-/C=US/CN=Root-CA}"
CA_KEY_TYPE="${CA_KEY_TYPE:-rsa:2048}"
EE_CRT_SUBJ="${EE_CRT_SUBJ:-/C=FR/ST=Gironde/L=Bordeaux/O=LessPass/CN=lesspass.local}"
EE_KEY_TYPE="${EE_KEY_TYPE:-${CA_KEY_TYPE}}"

openssl req -x509 -nodes -new -sha256 -days 1024 -newkey "$CA_KEY_TYPE" -keyout RootCA.key -out RootCA.pem -subj "$CA_CRT_SUBJ"
openssl x509 -outform pem -in RootCA.pem -out RootCA.crt
openssl req -new -nodes -newkey "$EE_KEY_TYPE" -keyout lesspass.key -out lesspass.csr -subj "$EE_CRT_SUBJ"
openssl x509 -req -sha256 -days 1024 -in lesspass.csr -CA RootCA.pem -CAkey RootCA.key -CAcreateserial -extfile domains.ext -out lesspass.crt

openssl verify -verbose -CAfile RootCA.crt RootCA.crt lesspass.crt