#!/bin/sh
set -eu

SSL_DIR="${SSL_DIR:-/ssl}"
cd "$SSL_DIR"

openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
  -subj "/CN=PMI Test CA" -out ca.crt

openssl genrsa -out server.key 2048
openssl req -new -key server.key -subj "/CN=nginx-test" -out server.csr
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out server.crt -days 825 -sha256

openssl genrsa -out client.key 2048
openssl req -new -key client.key -subj "/CN=trusted-client" -out client.csr
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out client.crt -days 825 -sha256

openssl genrsa -out untrusted.key 2048
openssl req -x509 -new -nodes -key untrusted.key -sha256 -days 365 \
  -subj "/CN=untrusted-client" -out untrusted.crt

chmod 600 ca.key server.key client.key untrusted.key
chmod 644 ca.crt server.crt client.crt untrusted.crt
cat server.crt ca.crt > fullchain.crt
chmod 644 fullchain.crt
rm -f server.csr client.csr ca.srl

echo "Certificates generated in $SSL_DIR"