#!/bin/sh
# $Id: gen-req.sh,v 1.17 2006/05/12 06:21:43 lha Exp $
#
# This script need openssl 0.9.8a or newer, so it can parse the
# otherName section for pkinit certificates.
#

gen_cert()
{
	openssl req \
		-new \
		-subj "$1" \
		-config openssl.cnf \
		-newkey rsa:1024 \
		-sha1 \
		-nodes \
		-keyout out.key \
		-out cert.req > /dev/null 2>/dev/null

        if [ "$3" = "ca" ] ; then
	    openssl x509 \
		-req \
		-days 3650 \
		-in cert.req \
		-extfile openssl.cnf \
		-extensions $4 \
                -signkey out.key \
		-out cert.crt

		ln -s ca.crt `openssl x509 -hash -noout -in cert.crt`.0

		name=$3

        elif [ "$3" = "proxy" ] ; then

	    openssl x509 \
		-req \
		-in cert.req \
		-days 3650 \
		-out cert.crt \
		-CA $2.crt \
		-CAkey $2.key \
		-CAcreateserial \
		-extfile openssl.cnf \
		-extensions $4

		name=$5
	else

	    openssl ca \
		-name $4 \
		-days 3650 \
		-cert $2.crt \
		-keyfile $2.key \
		-in cert.req \
		-out cert.crt \
		-outdir . \
		-batch \
		-config openssl.cnf 

		name=$3
	fi

	mv cert.crt $name.crt
	mv out.key $name.key
}

echo "01" > serial
> index.txt
rm -f *.0

gen_cert "/CN=PacketCable Root CA/C=AR" "root" "ca" "v3_ca"
gen_cert "/CN=client/C=AR" "ca" "client" "pkinit_client"
gen_cert "/CN=kdc/C=AR" "ca" "kdc" "pkinit_kdc"