#!/usr/bin/env bash

sudo rm -rf ./ssl ; mkdir ssl
cd ssl

lgtm_ssl=/home/vst/lgtm-stack/ssl
scart=$lgtm_ssl/ca.crt
hostname=$(hostname)
subj="/CN=$hostname.stuyckv.local"
san="subjectAltName=DNS:$hostname.stuyckv.local,DNS:localhost,IP:127.0.0.1"
function request-certificate {
    type=$1
    scsr=$lgtm_ssl/$hostname.$type.csr
    scrt=$lgtm_ssl/$hostname.$type.crt

    openssl req -new -newkey rsa:2048 \
        -keyout $type.key -out $type.csr \
        -nodes  -subj $subj
    scp $type.csr vst@shion.stuyckv.local:$scsr

    ssh vst@shion.stuyckv.local \
        "echo '$san' > /tmp/$hostname.san &&
         openssl x509 -req \
            -in $scsr -out $scrt -days 365 \
            -CA $scart -CAkey $lgtm_ssl/ca.key \
            -CAcreateserial \
            -extfile /tmp/$hostname.san && \
         rm /tmp/$hostname.san"

    scp vst@shion.stuyckv.local:$scrt $type.crt
    rm $type.csr
    cat ca.crt >> $type.crt
}

scp vst@shion.stuyckv.local:$scart ca.crt
request-certificate client
request-certificate server
# openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -subj "/CN=$(hostname).stuyckv.local"
# openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365

cd ..

sudo chown -R 10001:10001 ./ssl