#!/bin/bash
#

##
	_Auteur_="Jonathan DEMMERLÉ"
	_Version_=1.170126
	_License_="https://creativecommons.org/licenses/by-nc-sa/3.0/"
##

##
#	HELP
##

function printHelp {
	echo -e	"USAGE :\t\t$0 [PARAMETERS] [OPTIONS]"
	echo -e	"VERSION :\t$_Version_"
	echo -e	"LICENSE :\t$_License_"
	echo -e	""
	echo -e	"PARAMETERS :"
	echo -e	"  -c\t\tinitials of the country"
	echo -e	"  -l\t\tlocality, name of the city"
	echo -e	"  -o\t\torganisation, name of the entreprise for example"
	echo -e	"  -u\t\torganisational unit, name of the team for example"
	echo -e	"OPTIONS :"
	echo -e	"  -d\t\tdomainname, hostname by default"
	echo -e	"  -m\t\tmail, `whoami`@localhost by default"
	echo -e	"  -p\t\tpassword, printed into \$domain.pass by default"
	echo -e "  -a\t\tCA file, created by default"
	echo -e "  -w\t\tWorking directory, /etc/ssl/certs/`date +"%Y"` by default"
	echo -e	""
	echo -e	"  -h, --help\tdisplay this help message"
	echo -e	""
}

# If no params print help
if [ -z "$*" ]
then
	printHelp
	exit 0
fi

##
#	OPTIONS
##

while getopts ":c:s:l:o:u:a:w::d::m::p::h:" opt
do
	case $opt in
		c)	country=$OPTARG;;
		s)	state=$OPTARG;;
		l)	locality=$OPTARG;;
		o)	orga=$OPTARG;;
		u)	unit=$OPTARG;;
		d)	domain=$OPTARG;;
		m)	mail=$OPTARG;;
		p)	password=$OPTARG;;
		a)	caname=$OPTARG;;
		w)	wd=$OPTARG;;
		h)	printHelp;
			exit 0;;
		*)	printHelp;
			exit 2;;
	esac
done

##
#	CONSTANTES
##

# Check authorisations :
_thisUser="`whoami`"

##
#	VARIABLES
##

# Check authorisations :
if [ "$_thisUser" != "root" ]
then
	echo "You have to be root or sudoer to run this script."
	echo "Aborded."
	exit 2
fi

# Working directory :
if [ -z "$wd" ]
then
	WD="/etc/ssl/certs/`date +"%Y"`"
elif [ -d "$wd" ]
then
	WD="$wd"
else
	echo "WARNING : $wd doesn't exist."
	echo "Aborded."
	exit 1
fi

# If directory doesn't exist, make it :
if [ ! -d "$WD" ]
then
	mkdir "$WD"
fi

# Use hostname if necessary :
if [ -z "$domain" ]
then
	plop=`dnsdomainname`
	if [ -n "$plop" ]
	then
		domain="`hostname`.$plop"
	else
		domain="`hostname`"
	fi
fi

# If CA isn't specified :
if [ -z "$caname" ]
then
# If CA already exist, stop now :
	if [ -e "$WD/ca_$domain.crt" ]
	then
		echo "WARNING : $WD/ca_$domain.crt already exist, please rename, delete files, or explicitly use this CA before run again."
		echo "Aborded."
		exit 2
	else
		caname="ca_$domain"
	fi
# Select only CA name file
elif [ -e "$WD/$caname.crt" ]
then
	caname="`echo "$caname" | rev | cut -d'/' -f1 | rev`"
else
	echo "WARNING : $WD/$caname.crt doesn't exist"
	echo "Aborded."
	exit 1
fi

# Use user@localhost as mail address if necessary :
if [ -z "$mail" ]
then
	mail="$_thisUser@localhost"
fi
	

# Generate password if it's necessary :
if [ -z "$password" ]
then
	password="`date +%s | base64 | md5sum | head -c 20`"
fi

##
#	PROGRAMME
##

# Save password for later :
echo "$password" >> "$WD/$domain.pass"

# Create private key of the server :
openssl genrsa 2048 > "$WD/$domain.key"

# Create certificate signing request :
openssl req -new -key "$WD/$domain.key" -subj "/C=$country/ST=$state/L=$locality/O=$orga/OU=$unit/CN=$domain/emailAddress=$mail" > "$WD/$domain.csr"

# Create CA (certificate authority) autosigned :
openssl genrsa -des3 -passout pass:"$password" -out "$WD/$caname.key" 2048
openssl req -new -x509 -days 1095 -key "$WD/$caname.key" -passin pass:"$password" -subj "/C=$country/ST=$state/L=$locality/O=$orga/OU=$unit/CN=$ca_domain/emailAddress=$mail" > "$WD/$caname.crt"

# Signing certificate with previous CA :
openssl x509 -req -in "$WD/$domain.csr" -out "$WD/$domain.crt" -CA "$WD/$caname.crt" -passin pass:"$password" -CAkey "$WD/$caname.key" -CAcreateserial -CAserial "$WD/$caname.srl"
