#! /bin/bash
# This is a script version of the procedure outlined in:
# https://docs.couchbase.com/server/current/manage/manage-security/configure-server-certificates.html#root-intermediate-and-node-certificates

set -e

echo "test" > passphrase.txt
passphrase=`pwd`/passphrase.txt
couchbase_server_root=$HOME/compile/neo/install
couchbase_server_user=Administrator
couchbase_server_password=asdfasdf


rm -rf ${couchbase_server_root}/var/lib/servercertfiles2

# step 1
mkdir ${couchbase_server_root}/var/lib/servercertfiles2
cd ${couchbase_server_root}/var/lib/servercertfiles2
mkdir -p {root,servers,clients}/{issued,reqs,private}

# step 2
cd root

cat > config <<EOF
[req]
distinguished_name = cn_only
x509_extensions = ca_ext
[ cn_only ]
commonName = Norbye.org
commonName_max = 64
commonName_default = CA
[ca_ext]
basicConstraints = CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = cRLSign, keyCertSign
EOF

# step 3
openssl req \
	-config config \
	-passout file:${passphrase} \
	-new \
	-x509 \
	-days 3650 \
	-sha256 \
	-newkey rsa:2048 \
	-keyout ca.key \
	-out ca.pem \
	-subj '/C=NO/O=norbye.org/CN=RootCA'

# step 4
cat > ca.ext <<EOF
basicConstraints = CA:TRUE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
keyUsage = cRLSign, keyCertSign
EOF

# step 5
openssl req \
	-new \
	-passout file:${passphrase} \
	-sha256 \
	-newkey rsa:2048 \
	-keyout ../servers/ca.key \
	-out reqs/server-signing.csr \
	-subj '/C=NO/O=norbye.org/OU=Servers/CN=ServerSigningCA'

# step 6
openssl x509 \
	-passin file:${passphrase} \
	-CA ca.pem \
	-CAkey ca.key \
	-CAcreateserial \
	-CAserial serial.srl \
	-days 3650 \
	-req \
	-in reqs/server-signing.csr \
	-out issued/server-signing.pem \
	-extfile ca.ext

# step 7
cp issued/server-signing.pem ../servers/ca.pem

# step 8
cd ../servers

cat > server.ext <<EOF
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
extendedKeyUsage = serverAuth
keyUsage = digitalSignature,keyEncipherment
EOF

# step 9
openssl genrsa -out private/couchbase.node.svc.key 2048

# step 10
openssl req \
	-new \
	-key private/couchbase.node.svc.key \
	-out reqs/couchbase.node.svc.csr \
	-subj "/C=NO/O=norbye.org/OU=Servers/CN=couchbase.node.svc"

# step 11
cp server.ext temp.ext
echo 'subjectAltName = IP:172.17.0.2' >> temp.ext

# step 12
openssl x509 \
	-passin file:${passphrase} \
	-CA ca.pem \
	-CAkey ca.key \
	-CAcreateserial \
	-CAserial serial.srl \
	-days 365 \
	-req \
	-in reqs/couchbase.node.svc.csr \
	-out issued/couchbase.node.svc.pem \
	-extfile temp.ext

# step 13
openssl verify \
	-trusted ../root/ca.pem \
	-untrusted ca.pem \
	issued/couchbase.node.svc.pem

# step 14
cat issued/couchbase.node.svc.pem ca.pem > chain.pem
cp private/couchbase.node.svc.key pkey.key

# step 15
inbox=${couchbase_server_root}/var/lib/couchbase/inbox
mkdir -p ${inbox}
cp ./chain.pem ${inbox}/chain.pem
cp ./pkey.key ${inbox}/pkey.key

# step 16
echo "Step 16"
cd ../root
curl -X POST \
     --data-binary "@./ca.pem" \
     http://${couchbase_server_user}:${couchbase_server_password}@127.0.0.1:8091/controller/uploadClusterCA

curl -X POST \
     http://${couchbase_server_user}:${couchbase_server_password}@127.0.0.1:8091/node/controller/reloadCertificate

# Create client certificates as outlined in:
# https://docs.couchbase.com/server/current/manage/manage-security/configure-client-certificates.html#client-certificate-authorized-by-an-intermediate-certificate

# step 1, already done as we're located in the root directory

# step 2
openssl req \
	-passout file:${passphrase} \
	-new \
	-sha256 \
	-newkey rsa:2048 \
	-keyout ../clients/ca.key \
	-out reqs/client-signing.csr \
	-subj '/C=NO/O=norbye.org/OU=People/CN=ClientSigningCA'

# step 3
openssl x509 \
	-passin file:${passphrase} \
	-CA ca.pem \
	-CAkey ca.key \
	-CAcreateserial \
	-CAserial serial.srl \
	-days 3650 \
	-req \
	-in reqs/client-signing.csr \
	-out issued/client-signing.pem \
	-extfile ca.ext

# step 4
cp issued/client-signing.pem ../clients/ca.pem

# step 5
cd ../clients
cat > client.ext <<EOF
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
extendedKeyUsage = clientAuth
keyUsage = digitalSignature
EOF

# step 6
openssl genrsa -out private/clientuser.key 2048

# step 7
openssl req \
	-passin file:${passphrase} \
	-new \
	-key private/clientuser.key \
	-out reqs/clientuser.csr \
	-subj "/C=NO/O=norbye.org/OU=People/CN=trond"

# step 8
openssl x509 \
	-passin file:${passphrase} \
	-CA ca.pem \
	-CAkey ca.key \
	-CAcreateserial \
	-CAserial serial.srl \
	-days 365 \
	-req \
	-in reqs/clientuser.csr \
	-out issued/clientuser.pem \
	-extfile client.ext

# step 9
openssl verify \
	-trusted ../root/ca.pem \
	-untrusted ca.pem \
	issued/clientuser.pem

# step 10
cat issued/clientuser.pem ca.pem > clientuser.pem
