#!/bin/sh -e

if [ "$1" != "--force" -a -f /etc/apache2/ssl/apache.pem ]; then
  echo "/etc/apache2/ssl/apache.pem exists!  Use \"$0 --force.\""
  exit 0
fi

if [ "$1" = "--force" ]; then
  shift
fi

echo
echo creating selfsigned certificate
echo "replace it with one signed by a certification authority (CA)"
echo
echo enter your ServerName at the Common Name prompt
echo
echo If you want your certificate to expire after x days call this programm
echo with "-days x"

# use special .cnf, because with normal one no valid selfsigned
# certificate is created

trap 'rm -f $TMPFILE' EXIT
TMPFILE=$(mktemp) || exit 1
cat >$TMPFILE <<EOF
#
# SSLeay example configuration file.
#

RANDFILE                = $ENV::HOME/.rnd

[ req ]
default_bits            = 1024
default_keyfile         = privkey.pem
distinguished_name      = req_distinguished_name

[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = GB
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Some-State

localityName                    = Locality Name (eg, city)

organizationName                = Organization Name (eg, company; recommended)
organizationName_max            = 64

organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_max      = 64

commonName                      = server name (eg. ssl.domain.tld; required!!!)
commonName_max                  = 64

emailAddress                    = Email Address
emailAddress_max                = 40

EOF

export RANDFILE=/dev/random
openssl req $@ -config $TMPFILE \
  -new -x509 -nodes -out /etc/apache2/ssl/apache.pem \
  -keyout /etc/apache2/ssl/apache.pem
chmod 600 /etc/apache2/ssl/apache.pem
ln -sf /etc/apache2/ssl/apache.pem \
  /etc/apache2/ssl/`/usr/bin/openssl \
  x509 -noout -hash < /etc/apache2/ssl/apache.pem`.0