#!/usr/bin/env bash
#
# Generates certs required for mTLS testing:
# - ca.key and ca.cert.pem are self-signed, used as the source of truth for client and server to verify each other.
# - client.key and client.crt are the client's key and cert (signed by the ca key and cert)
# - server.key and server.crt are the server's key and cert (signed by the ca key and cert)

set -ex

# I was doing this on M1 mac and needed newer openssl to add the SAN IP; please export OPENSSL when invoking as needed
OPENSSL="${OPENSSL:-openssl}"

# Nuke and recreate the certs dir
rm -rf certs
mkdir certs
cd certs || exit 1

# CA
"$OPENSSL" genrsa -out ca.key 4096
"$OPENSSL" req -new -x509 -days 365000 -key ca.key -out ca.cert.pem

# Server
"$OPENSSL" genrsa -out server.key 4096
"$OPENSSL" req -new -key server.key -out server.csr -addext 'subjectAltName = IP:127.0.0.1'
"$OPENSSL" x509 -req -days 365000 -in server.csr -CA ca.cert.pem -CAkey ca.key -CAcreateserial -out server.crt -copy_extensions copy

# Client
"$OPENSSL" genrsa -out client.key 4096
"$OPENSSL" req -new -key client.key -out client.csr -addext 'subjectAltName = IP:127.0.0.1'
"$OPENSSL" x509 -req -days 365000 -in client.csr -CA ca.cert.pem -CAkey ca.key -CAcreateserial -out client.crt -copy_extensions copy