#!/bin/bash
(($#)) || { echo "Syntax: $0 <channel#> | CA"; exit -1; }

ca() {
    read -p "Really to discard existing credentials? y|[N]" x
    x=$x.
    x=${x:0:1}
    [[ ${x^[a-z]} != Y ]] && exit 1
    rm -f *.crt
    rm -f *.bks
    who=$ca
    set -e
    # create CA keys -----------------------------------------------------------
    echo "creating $who keys..."
    openssl req -new -nodes -out $who.req -keyout $who.key -subj /CN=$who -newkey rsa:2048 -sha512
    chmod 600 $who.key
    # selfsign CA public key ---------------------------------------------------
    echo "selfsigning $who public key..."
    openssl x509 -req -in $who.req -signkey $who.key -days 9999 -set_serial $RANDOM -sha512 -extfile CA.ext -out $who.crt
    # upload CA public key -----------------------------------------------------
    echo "uploading $who public key..."
    up $who.crt
    echo "$ca successfully created and uploaded."
}
channel() {
    [[ -e $ca.crt ]] && [[ -e $ca.key ]] || { echo "$ca keys not available."; exit 1; }
    who=$chan
    bouncy_store="-keystore $who.bks -storetype bks-v1 -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath $jar -storepass:env PASS"
    default_store="-keystore $who.jks -storepass:env PASS"
    p=heslo
    set -e
    rm -f $chan.{pem,bks,jks}
    # import CA public key into android key store ------------------------------
    store=$bouncy_store
    echo "importing $ca public key into android key store..."
    PASS=$p keytool -import -noprompt -alias $ca -file $ca.crt $store
    # create android client keys -----------------------------------------------
    echo "creating $who android client keys..."
    PASS=$p keytool -genkey -alias $who -keysize 2048 -keyalg RSA -dname "CN=$who" -validity 9999 -keypass:env PASS $store
    PASS=$p keytool -certreq -alias $who -file $who.req $store
     # sign android client public key -------------------------------------------
    echo "signing $who android client public key..."
    openssl x509 -req -in $who.req -CAkey $ca.key -CA $ca.crt -days 9999 -set_serial $RANDOM -sha512 -out $who.crt
    cat $ca.crt >> $who.crt
    # import client public key into android key store --------------------------
    echo "importing $who client public key into android key store..."
    PASS=$p keytool -import -alias $who -file $who.crt $store
    # import server public key into android client key store -------------------
    echo "importing server public key into android client key store..."
    PASS=$p keytool -import -noprompt -alias srv -file srv.crt $store
    rm -f $who.{req,crt}
    echo -e "*-----\n* Android client keystore $who.bks successfully created.\n*-----"
    # import CA public key into default java key store -------------------------
    store=$default_store
    echo "importing $ca public key into default java key store..."
    PASS=$p keytool -import -noprompt -alias $ca -file $ca.crt $store
    # create default java client keys ------------------------------------------
    echo "creating $who default java client keys..."
    PASS=$p keytool -genkey -alias $who -keysize 2048 -keyalg RSA -dname "CN=$who" -validity 9999 -keypass:env PASS $store
    PASS=$p keytool -certreq -alias $who -file $who.req $store
    # sign default java client public key --------------------------------------
    echo "signing $who default java client public key..."
    openssl x509 -req -in $who.req -CAkey $ca.key -CA $ca.crt -days 9999 -set_serial $RANDOM -sha512 -out $who.crt
    cat $ca.crt >> $who.crt
    # import client public key into default java key store ---------------------
    echo "importing $who client public key into default java key store..."
    PASS=$p keytool -import -alias $who -file $who.crt $store
    rm -f $who.{req,crt}
    # import server public key into default java client key store --------------
    echo "importing server public key into default java client key store..."
    PASS=$p keytool -import -noprompt -alias srv -file srv.crt $store
    echo -e "*-----\n* Default java client keystore $who.jks successfully created.\n*-----"
    # create openssl client keys -----------------------------------------------
    echo "creating $who openssl client keys..."
    openssl req -new -nodes -out $who.req -keyout $who.key -subj /CN=$who -newkey rsa:2048 -sha512
    # sign openssl client public key -------------------------------------------
    echo "signing $who openssl client public key..."
    openssl x509 -req -in $who.req -CAkey $ca.key -CA $ca.crt -days 9999 -set_serial $RANDOM -sha512 -out $who.crt    
    cat $who.key $who.crt > $who.pem
    chmod 600 $who.pem
    rm -f $who.{key,req,crt}
    echo -e "*-----\n* Client keys $who.pem successfully created.\n*-----"
}
srv() {
    set -e
    who=srv
    rm -f $who.{pem,crt,key}
    # create server keys -------------------------------------------------------
    echo "creating $who server keys..."
    openssl req -new -nodes -out $who.req -keyout $who.key -subj /CN=$who -newkey rsa:2048 -sha512
    # sign server public key ---------------------------------------------------
    echo "signing $who server public key..."
    openssl x509 -req -in $who.req -CAkey $ca.key -CA $ca.crt -days 9999 -set_serial $RANDOM -sha512 -out $who.crt
    cat $who.key $who.crt > $who.pem
    chmod 600 $who.pem
    rm -f $who.{key,req}
    # upload server keys -------------------------------------------------------
    echo "uploading $who server keys..."
    up $who.pem
    echo -e "*-----\n* Server keys $who.pem successfully created and uploaded.\n*-----"
}
up() {
#    scp -p $1 hh@hal.hh.cz:/L/dejsem/ssl/
	echo "--->DUMMY UPLOAD<---"
}

ca=dejCA
# bcprov od verze 149 nabízí zvláštní typ KeyStore "BKS_V1" pro zpětnou kompatibilitu
jar=bcprov-jdk15on-150.jar
[[ -e $jar ]] || { echo "Bouncy Castle $jar not found in current dir"; exit 1; }
if [[ $1 == CA ]] 
then    ca
        srv
else    declare -i n=10#${1^^[a-z]}
        if [[ $n -gt 99 ]] || [[ $n -lt 0 ]]
        then    { echo "needed 0 =< channel# < 100"; exit 1; }
        else    chan=$(printf %02d $n)
                channel
        fi
fi