#!/bin/bash

# Default password if not provided
DEFAULT_PASSWORD="!Q2w3e4r"
CERTS_DIR="./certs"
DAYS_VALID=365

# Check if at least one service is provided
if [ "$#" -lt 2 ]; then
    echo "Usage: $0 <password> <service1> <service2> ... <serviceN>"
    exit 1
fi

# Use the first argument as password; default to DEFAULT_PASSWORD if empty
PFX_PASSWORD=${1:-$DEFAULT_PASSWORD}
shift  # Shift arguments so that the remaining are service names

# Create directory to store certificates
mkdir -p $CERTS_DIR

# Step 1: Generate the CA certificate
echo "Generating CA certificate..."
openssl genrsa -out "$CERTS_DIR/ca.key" 2048
openssl req -x509 -new -nodes -key "$CERTS_DIR/ca.key" -sha256 -days $DAYS_VALID -out "$CERTS_DIR/ca.crt" \
    -subj "/C=US/ST=YourState/L=YourCity/O=YourOrganization/OU=YourUnit/CN=your-ca"

# Function to create SSL certificate for a service
generate_certificate () {
    SERVICE_NAME=$1

    echo "Generating certificate for $SERVICE_NAME..."

    # Generate private key
    openssl genrsa -out "$CERTS_DIR/$SERVICE_NAME.key" 2048

    # Create CSR
    openssl req -new -key "$CERTS_DIR/$SERVICE_NAME.key" -out "$CERTS_DIR/$SERVICE_NAME.csr" \
        -subj "/C=US/ST=YourState/L=YourCity/O=YourOrganization/OU=YourUnit/CN=$SERVICE_NAME"

    # Sign the certificate with the CA
    openssl x509 -req -in "$CERTS_DIR/$SERVICE_NAME.csr" -CA "$CERTS_DIR/ca.crt" -CAkey "$CERTS_DIR/ca.key" \
        -CAcreateserial -out "$CERTS_DIR/$SERVICE_NAME.crt" -days $DAYS_VALID -sha256

    # Convert to PFX format for ASP.NET
    openssl pkcs12 -export -out "$CERTS_DIR/$SERVICE_NAME.pfx" -inkey "$CERTS_DIR/$SERVICE_NAME.key" \
        -in "$CERTS_DIR/$SERVICE_NAME.crt" -certfile "$CERTS_DIR/ca.crt" -password pass:$PFX_PASSWORD

    # Clean up CSR
    rm "$CERTS_DIR/$SERVICE_NAME.csr"
}

# Step 2: Generate certificates for each specified service
for SERVICE in "$@"
do
    generate_certificate "$SERVICE"
done

echo "Certificates generated successfully in $CERTS_DIR."