functions

#!/bin/bash
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.

# Derek Moore <derek@ripple.com>
# Christian Göttsche <cgzones@googlemail.com>

# Binaries copied during install
export BINARIES_ROOT="
create-signing-ca
create-server
create-client
sign-csr
revoke-cert
functions
show-status
gen-html
renew-cert
"

export TEMPLATES_ROOT="
client.tpl
server.tpl
signing.tpl
root_index.tpl
sign_index.tpl
"

export BINARIES_SIGN="
create-server
create-client
sign-csr
revoke-cert
functions
show-status
gen-html
renew-cert
"

export TEMPLATES_SIGN="
client.tpl
server.tpl
sign_index.tpl
"

# Output highlighting

NOTE="\033[35;1m[*]\033[0m"
SUCC="\033[32;1m[!]\033[0m"
INPUT="\033[36;1m[>]\033[0m"
ERR="\033[31;1m[!]\033[0m"


fullpath() {
    cd "$(dirname "$1")" || exit 2
    echo "$PWD/$(basename "$1")"
}

##
## template TEMPLATE_FILE DESTINATION_FILE
##
## Performs variable interpolation on TEMPLATE_FILE and copies
## the result to DESTINATION_FILE. All strings in TEMPLATE_FILE
## that match {{CA_*}} will be replaced with the contents of the
## environment variable with the same name.
##
template() {
    local REGEX=""
    for VAR in ${!CA_*}; do
        REGEX="${REGEX}s#{{\s*${VAR}\s*}}#${!VAR}#g; "
    done
    sed -e "${REGEX}" < "$1" > "$2"
}


##
## init_ca_home CA_PATH
##
## Initializes a CA directory skeleton at PATH
##
init_ca_home() {
    CA_HOME="$1"

    # Ensure we're initializing an empty directory
    if [ -d "${CA_HOME}" ]; then
        echo -e "$ERR Directory '${CA_HOME}' already exists, exiting."
        exit 1
    fi

    if ! mkdir -p "${CA_HOME}"; then
        echo -e "$ERR Unable to create directory '${CA_HOME}', exiting."
        exit 1
    fi

    echo -e "$NOTE Initializing CA home"

    pushd "${CA_HOME}" > /dev/null || exit

    # Create top-level CA structure
    mkdir ca
    mkdir ca/archive
    mkdir ca/crl
    mkdir ca/db
    mkdir ca/private

    mkdir bin
    mkdir certs
    mkdir certs/clients
    mkdir certs/server

    # Create empty databases
    touch ca/db/certificate.db
    touch ca/db/certificate.db.attr
    echo 01 > ca/db/crt.srl
    echo 01 > ca/db/crl.srl

    popd > /dev/null || exit
}

##
## generate_conf CONF
##
## Generate the ca.conf for new root and signing CAs
##
generate_conf() {
    DEST="$1"

    echo -e -n "$INPUT Short label for new CA [${CA_NAME}]: "
    read -r NAME
    if [ -n "${NAME}" ]; then
        # shellcheck disable=SC2001
        CA_NAME=$(echo "${NAME}" | sed 's/[^A-Za-z0-9-]/-/g')
    fi

    echo -e -n "$INPUT Domain name for new CA [${CA_DOMAIN}]: "
    read -r DOMAIN
    if [ -n "${DOMAIN}" ]; then
        CA_DOMAIN="${DOMAIN}"
    elif [ -z "${CA_DOMAIN}" ]; then
        echo -e "$ERR Domain is required."
        exit 1
    fi

    echo
    echo -e "$SUCC CRL URL will be 'https://${CA_DOMAIN}/ca/${CA_NAME}/${CA_NAME}.crl'"
    echo

    echo -e -n "$INPUT Default country code for new certificates [${CA_CERT_C}]: "
    read -r CERT_C
    if [ -n "${CERT_C}" ]; then
        CA_CERT_C="${CERT_C}"
    fi

    echo -e -n "$INPUT Default state for new certificates [${CA_CERT_ST}]: "
    read -r CERT_ST
    if [ -n "${CERT_ST}" ]; then
        CA_CERT_ST="${CERT_ST}"
    fi

    echo -e -n "$INPUT Default city for new certificates [${CA_CERT_L}]: "
    read -r CERT_L
    if [ -n "${CERT_L}" ]; then
        CA_CERT_L="${CERT_L}"
    fi

    echo -e -n "$INPUT Default organization for new certificates [${CA_CERT_O}]: "
    read -r CERT_O
    if [ -n "${CERT_O}" ]; then
        CA_CERT_O="${CERT_O}"
    fi

    echo -e -n "$INPUT Default organization unit for new certificates [${CA_CERT_OU}]: "
    read -r CERT_OU
    if [ -n "${CERT_OU}" ]; then
        CA_CERT_OU="${CERT_OU}"
    fi

    echo

    cat > "${DEST}" << EOF
CA_DOMAIN="${CA_DOMAIN}"
CA_NAME="${CA_NAME}"

CA_CERT_C="${CA_CERT_C}"
CA_CERT_ST="${CA_CERT_ST}"
CA_CERT_L="${CA_CERT_L}"
CA_CERT_O="${CA_CERT_O}"
CA_CERT_OU="${CA_CERT_OU}"

CA_KEY_ALG="${CA_KEY_ALG}"
CA_KEY_LENGTH_ROOTCA="${CA_KEY_LENGTH_ROOTCA}"
CA_KEY_LENGTH_SIGNCA="${CA_KEY_LENGTH_SIGNCA}"
CA_KEY_LENGTH_ENDCRT="${CA_KEY_LENGTH_ENDCRT}"
EOF
}

##
## ask_server_cert_quesetions
##
## Ask questions to fill a server certificate
##
ask_server_cert_questions() {

    #echo -e -n "$INPUT Country code for new certificates [${CA_CERT_C}]: "
    #read -r CERT_C
    #if [ -n "${CERT_C}" ]; then
    #    CA_CERT_C="${CERT_C}"
    #fi

    #echo -e -n "$INPUT State for new certificates [${CA_CERT_ST}]: "
    #read -r CERT_ST
    #if [ -n "${CERT_ST}" ]; then
    #    CA_CERT_ST="${CERT_ST}"
    #fi

    echo -e -n "$INPUT City for new certificates [${CA_CERT_L}]: "
    read -r CERT_L
    if [ -n "${CERT_L}" ]; then
        CA_CERT_L="${CERT_L}"
    fi

    #echo -e -n "$INPUT Organization for new certificates [${CA_CERT_O}]: "
    #read -r CERT_O
    #if [ -n "${CERT_O}" ]; then
    #    CA_CERT_O="${CERT_O}"
    #fi

    echo -e -n "$INPUT Organization unit for new certificates [${CA_CERT_OU}]: "
    read -r CERT_OU
    if [ -n "${CERT_OU}" ]; then
        CA_CERT_OU="${CERT_OU}"
    fi
}

##
## ask_client_cert_quesetions
##
## Ask questions to fill a client certificate
##
ask_client_cert_questions() {

    #echo -e -n "$INPUT Country code for new certificates [${CA_CERT_C}]: "
    #read -r CERT_C
    #if [ -n "${CERT_C}" ]; then
    #    CA_CERT_C="${CERT_C}"
    #fi

    #echo -e -n "$INPUT State for new certificates [${CA_CERT_ST}]: "
    #read -r CERT_ST
    #if [ -n "${CERT_ST}" ]; then
    #    CA_CERT_ST="${CERT_ST}"
    #fi

    echo -e -n "$INPUT City for new certificates [${CA_CERT_L}]: "
    read -r CERT_L
    if [ -n "${CERT_L}" ]; then
        CA_CERT_L="${CERT_L}"
    fi

    #echo -e -n "$INPUT Organization for new certificates [${CA_CERT_O}]: "
    #read -r CERT_O
    #if [ -n "${CERT_O}" ]; then
    #    CA_CERT_O="${CERT_O}"
    #fi

    echo -e -n "$INPUT Organization unit for new certificates [${CA_CERT_OU}]: "
    read -r CERT_OU
    if [ -n "${CERT_OU}" ]; then
        CA_CERT_OU="${CERT_OU}"
    fi

    echo -e -n "$INPUT Email Address (name@fqdn) for new certificates [${CA_CERT_MAIL}]: "
    read -r CERT_MAIL
    if [ -n "${CERT_MAIL}" ]; then
        CA_CERT_MAIL="${CERT_MAIL}"
    else
        echo -e "$ERR No email address supplied, exiting."
        exit 1
    fi
}