#! /bin/sh
# @(#)(CAcert) $Id: make-ocspd-csr,v 1.1 2011/04/28 15:46:41 wytze Exp $
# make-ocspd-csr - create new csr for ocsp responder, and optionally a new key

HOST=ocsp

TMP=/tmp/openssl.cnf.$$
trap "rm -f ${TMP}" 0 1 2 3 15

DIR=/usr/local/etc/ocspd
KEY=${DIR}/private/class1.key
CSR=${DIR}/private/${HOST}.csr
CRT1=${DIR}/certs/class1.crt
CRT2=${DIR}/certs/class3.crt
CNF=${TMP}

umask 077
mkdir -p ${DIR} ${DIR}/private ${DIR}/certs

echo -e "#1. Creating openssl config file in ${CNF}\n"
cat >${CNF} <<!
[ req ]
distinguished_name	= req_distinguished_name
prompt			= no
req_extensions		= ocsp_req

[ req_distinguished_name ]
countryName		= AU
stateOrProvinceName	= NSW
localityName		= Sydney
0.organizationName	= CAcert Inc.
organizationalUnitName	= Server Administration
commonName		= ${HOST}.cacert.org
emailAddress		= critical-admin@cacert.org

[ ocsp_req ]
basicConstraints=CA:FALSE
extendedKeyUsage=1.3.6.1.5.5.7.3.2, 1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.9
!

if [ -f ${KEY} ]
then
	echo -e "#2. Creating csr in ${CSR},"
	echo -e "        from key in ${KEY}\n"
	/usr/bin/openssl req -config ${CNF} -new -key ${KEY} -out ${CSR}
else
	echo -e "#2. Creating csr in ${CSR},"
	echo -e "         and key in ${KEY}\n"
	/usr/bin/openssl req -config ${CNF} -nodes -newkey rsa:2048 \
						-keyout ${KEY} -out ${CSR}
fi

echo -e "#3. Displaying content of csr in ${CSR}\n"
/usr/bin/openssl req -in ${CSR} -noout -text

echo -e "\n#4. Please mail ${CSR} to the CAcert Certificate Manager, see"
echo -e "    https://wiki.cacert.org/SystemAdministration/Procedures/CertificateIssuing\n"
cat <<\!
SPECIAL NOTE: request TWO certificates based on this CSR, one signed by the
CAcert main root, and one signed by the Class 3 subroot -- this will trick
openca-ocspd 1.9.0 to do "the right thing" ...
!

echo -e "\n#5. After receiving the certificates back, please store them in"
echo -e "    ${CRT1} and ${CRT2},"
echo -e "    then restart the ocsp responder with /etc/init.d/ocspd restart"

exit 0