#! /bin/sh
# @(#)(CAcert) $Id: make-ocsp-csr,v 1.4 2019/08/26 15:34:43 wytze Exp $
# make-ocsp-csr - create new csr for ocsp server, and optionally a new key

HOST=ocsp
DOMAIN=cacert.org

TMP=/tmp/openssl.cnf.$$
trap "rm -f ${TMP}" 0 1 2 3 15

DIR=ssl
KEY=${DIR}/private/${HOST}.${DOMAIN}.key
CSR=${DIR}/private/${HOST}.${DOMAIN}.csr
CRT=${DIR}/certs/${HOST}.${DOMAIN}.crt
CNF=${TMP}

INSDIR=/etc/lighttpd
INSDIR_KEY=${INSDIR}/ssl
INSDIR_CRT=${INSDIR}/ssl

umask 077
mkdir -p ${DIR} ${DIR}/private ${DIR}/certs

echo -e "#1. Creating openssl config file in ${CNF}\n"
cat >${CNF} <<!
[ req ]
distinguished_name	= req_distinguished_name
prompt			= no

[ req_distinguished_name ]
countryName		= AU
stateOrProvinceName	= NSW
localityName		= Sydney
0.organizationName	= CAcert Inc.
organizationalUnitName	= Server Administration
commonName		= ${HOST}.${DOMAIN}
emailAddress		= critical-admin@cacert.org
!

if [ -f ${KEY} ]
then
	echo -e "#2. Creating csr in ${CSR},"
	echo -e "        from key in ${KEY}\n"
	/usr/bin/openssl req -config ${CNF} -new -key ${KEY} -out ${CSR}
else
	echo -e "#2. Creating csr in ${CSR},"
	echo -e "         and key in ${KEY}\n"
	/usr/bin/openssl req -config ${CNF} -nodes -newkey rsa:4096 \
						-keyout ${KEY} -out ${CSR}
fi

echo -e "#3. Displaying content of csr in ${CSR}\n"
/usr/bin/openssl req -in ${CSR} -noout -text

echo -e "\n#4. Please mail ${CSR} to the CAcert Certificate Manager, see"
echo -e "    https://wiki.cacert.org/SystemAdministration/Procedures/CertificateIssuing\n"

echo -e "\n#5. After receiving the certificate back, please store it in"
echo -e "    ${CRT},"
echo -e "    then install cert (and optionally the key) in lighttpd webserver:"
echo -e "	sudo cp ${KEY} ${INSDIR_KEY}"
echo -e "	sudo cp ${CRT} ${INSDIR_CRT}"
echo -e "	sudo service lighttpd restart"

exit 0