#!/usr/bin/env bash
# Generate a throwaway CA, a server certificate for the downstream service, and two client
# certificates - one signed by that CA and one signed by a different CA. Into target/, so
# nothing here is committed and nothing here should ever be trusted.
#
#   ./scripts/certs.sh
set -eu
cd "$(dirname "$0")/.."
D=target/certs
rm -rf "$D" && mkdir -p "$D"
cd "$D"

gen_ca() {   # gen_ca <name> <cn>
  openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
    -keyout "$1-ca.key" -out "$1-ca.crt" -subj "/CN=$2" 2>/dev/null
}

sign() {     # sign <ca> <name> <subject> [extfile-content]
  openssl req -newkey rsa:2048 -nodes -keyout "$2.key" -out "$2.csr" -subj "$3" 2>/dev/null
  if [ -n "${4:-}" ]; then printf '%s\n' "$4" > "$2.ext"; else : > "$2.ext"; fi
  openssl x509 -req -in "$2.csr" -CA "$1-ca.crt" -CAkey "$1-ca.key" -CAcreateserial \
    -out "$2.crt" -days 3650 -extfile "$2.ext" 2>/dev/null
}

gen_ca internal "Internal Mesh CA"
gen_ca other    "Some Other CA"

sign internal server "/CN=localhost" "subjectAltName=DNS:localhost,IP:127.0.0.1"
sign internal edge   "/CN=edge-service/OU=payments"
sign other    rogue  "/CN=edge-service/OU=payments"

echo "wrote:"
ls -1 *.crt *.key | sed 's/^/  target\/certs\//'
echo
echo "Note that rogue.crt carries the SAME subject as edge.crt. Identity in mTLS is not the"
echo "subject; it is the subject plus the fact that a trusted CA vouched for it."