openssl_scripts/certificate.sh

#!/bin/bash

#------ Settings ------

OPENSSL="openssl"
CONFIG="./openssl.cnf"

ROOTCADAYS="-days 3650"		# 10 years
CADAYS="-days 1825"		#  5 years
#CADAYS="-days 825"		#  2 years
DAYS="-days 397"		#  1 year

CONFIGOPTION="-config ${CONFIG}"
REQ="${OPENSSL} req ${CONFIGOPTION}"
CA="${OPENSSL} ca ${CONFIGOPTION}"
VERIFY="${OPENSSL} verify"
X509="${OPENSSL} x509"
PKCS12="${OPENSSL} pkcs12"

CERTFOLDER="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd -P )"
CAFOLDER="./CA"
CAKEY="./cakey.pem"
CAREQ="./careq.pem"
CACERT="./cacert.pem"
PASSEXTENSION="keyfile"
PASSFILE="./${PASSEXTENSION}"
TYPEFILE="./type"
CHAINFILE="./cachain.pem"

CERTBOT="certbot"
#CERTBOT="certbot --staging"
CERTBOTACMEPATH="${CERTFOLDER}/../../certbot"

C="NL"
ST="Noord-Brabant"
L="Veldhoven"
O="Dierkse DataManagement"
OU="Secure Digital Certificate Signing"
#CN="CommonName"
E="certification@dierkse.nl"

#------ Functions ------

execute() {
	COMMAND=$@

	eval ${COMMAND}
	RETURNVALUE=$?

	if [ "${RETURNVALUE}" -ne "0" ]; then
		exit ${RETURNVALUE}
	fi
}

writeRandomString() {
	SIZE=$1
	FILE=$2

	tr -dc 'A-Za-z0-9!"#$%&'\''()*+,-./:;<=>?@[\]^_`{|}~' < /dev/urandom | head -c ${SIZE} > "${FILE}"
}

validateType() {
	TYPE=$1
	VALIDTYPE=""

	if [[ "${TYPE}" == "ROOTCA" ||
	      "${TYPE}" == "INTERMEDIATECA" ||
	      "${TYPE}" == "VPNCA" ||
	      "${TYPE}" == "WEBSERVER" ||
	      "${TYPE}" == "LETSENCRYPT" ||
	      "${TYPE}" == "WEBCLIENT" ||
	      "${TYPE}" == "APPLICATIONCLIENT" ||
	      "${TYPE}" == "EMAIL" ||
	      "${TYPE}" == "VPN" ]]; then
		VALIDTYPE=${TYPE}
	fi

}

copyPem() {
	INFILE=$1
	OUTFILE=$2
	BOUND=$3
	FLAG=0

	if [ ! -f "${INFILE}" ]; then
		echo "Missing File ${INFILE}"
		exit -1
	fi

	if [[ -z "$BOUND" ]]; then
		echo "Missing Boundary"
		exit -1
	fi

	exec < "${INFILE}";
	while read LINE; do
		if [ ${FLAG} -eq 1 ]; then
			echo ${LINE}|grep "^-----END.*${BOUND}"  2>/dev/null 1>/dev/null
			if [ $? -eq 0 ] ; then
				echo ${LINE} >> "${OUTFILE}"
				break
			else
				echo ${LINE} >> "${OUTFILE}"
			fi
		fi

		echo ${LINE} | grep "^-----BEGIN.*${BOUND}"  2>/dev/null 1>/dev/null
		if [ $? -eq 0 ]; then
			echo ${LINE} > "${OUTFILE}"
			FLAG=1
		fi
	done
}

newCertificate() {
	KEYBITS=2048

	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	if [[ "${TYPE}" == "WEBSERVER" ]]; then
		EXTENSIONS="server_cert -nodes"

		SAN=()
		if [ ! -z "${CN}" ]; then
			SAN+=("${CN}")
			SAN+=("*.${CN}")
		fi
		SAN+=("${EXTRASAN[@]}")

		IP=("${EXTRAIP[@]}")
	fi

	if [[ "${TYPE}" == "LETSENCRYPT" ]]; then
		EXTENSIONS="server_cert -nodes"

		SAN=()
		if [ ! -z "${CN}" ]; then
			SAN+=("${CN}")
			SAN+=("remote.${CN}")
		fi
		SAN+=("${EXTRASAN[@]}")
	fi

	if [[ "${TYPE}" == "WEBCLIENT" ]]; then
		EXTENSIONS="client_cert -nodes"
	fi

	if [[ "${TYPE}" == "APPLICATIONCLIENT" ]]; then
		EXTENSIONS="application_cert -nodes"
	fi

	if [[ "${TYPE}" == "EMAIL" ]]; then
		EXTENSIONS="email_cert -nodes"
	fi

	if [[ "${TYPE}" == "VPN" ]]; then
		EXTENSIONS="vpn_cert -nodes"

		SAN=()
		if [ ! -z "${CN}" ]; then
			SAN+=("${CN}")
		fi
	fi

	if [[ "${TYPE}" == "INTERMEDIATECA" ]]; then
		KEYBITS=4096
		DAYS=${CADAYS}
		EXTENSIONS="intermediate_extensions"
	fi

	COMMAND="${REQ} -new -x509 -newkey rsa:${KEYBITS} -extensions ${EXTENSIONS} -keyout \"${FILENAME}.key\" -out \"${FILENAME}.crt\" ${DAYS}"

	if [ ! -z "${CN}" ]; then
		SUBJECT="/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}/emailAddress=${E}"
		COMMAND+=" -subj \"${SUBJECT}\""
	fi

	if [[ "${TYPE}" == "WEBSERVER" || "${TYPE}" == "LETSENCRYPT"|| "${TYPE}" == "VPN" || ${#SAN[@]} -ne "0" || ${#IP[@]} -ne "0" ]]; then
		if [[ ${#SAN[@]} -ne "0" || ${#IP[@]} -ne "0" ]]; then
			COMMAND+=" -addext \"subjectAltName="
			INDEX=0
			for S in "${SAN[@]}"
			do
				((INDEX+=1))
				COMMAND+="DNS.${INDEX}: ${S},"
			done

			INDEX=0
			for I in "${IP[@]}"
			do
				((INDEX+=1))
				COMMAND+="IP.${INDEX}: ${I},"
			done

			COMMAND=${COMMAND%?}
			COMMAND+="\""
		fi
	fi

	execute ${COMMAND}
}

newRequest() {
	KEYBITS=2048

	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	if [[ "${TYPE}" == "WEBSERVER" ]]; then
		EXTENSIONS="server_cert -nodes"

		SAN=()
		if [ ! -z "${CN}" ]; then
			SAN+=("${CN}")
			SAN+=("*.${CN}")
		fi
		SAN+=("${EXTRASAN[@]}")

		IP=("${EXTRAIP[@]}")
	fi

	if [[ "${TYPE}" == "LETSENCRYPT" ]]; then
		EXTENSIONS="server_cert -nodes"

		SAN=()
		if [ ! -z "${CN}" ]; then
			SAN+=("${CN}")
			SAN+=("remote.${CN}")
		fi
		SAN+=("${EXTRASAN[@]}")
	fi

	if [[ "${TYPE}" == "WEBCLIENT" ]]; then
		EXTENSIONS="client_cert -nodes"
	fi

	if [[ "${TYPE}" == "APPLICATIONCLIENT" ]]; then
		EXTENSIONS="application_cert -nodes"
	fi

	if [[ "${TYPE}" == "EMAIL" ]]; then
		EXTENSIONS="email_cert -nodes"
	fi

	if [[ "${TYPE}" == "VPN" ]]; then
		EXTENSIONS="vpn_cert -nodes"

		SAN=()
		if [ ! -z "${CN}" ]; then
			SAN+=("${CN}")
		fi
	fi

	if [[ "${TYPE}" == "INTERMEDIATECA" ]]; then
		KEYBITS=4096
		writeRandomString 128 "${FILENAME}.${PASSEXTENSION}"
		chmod 000 "${FILENAME}.${PASSEXTENSION}"
		EXTENSIONS="intermediate_extensions -passout file:\"${FILENAME}.${PASSEXTENSION}\""
	fi

	COMMAND="${REQ} -new -newkey rsa:${KEYBITS} -extensions ${EXTENSIONS} -keyout \"${FILENAME}.key\" -out \"${FILENAME}.csr\""

	if [ ! -z "${CN}" ]; then
		SUBJECT="/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}/emailAddress=${E}"
		COMMAND+=" -subj \"${SUBJECT}\""
	fi

	if [[ "${TYPE}" == "WEBSERVER" || "${TYPE}" == "LETSENCRYPT" || "${TYPE}" == "VPN" || ${#SAN[@]} -ne "0" || ${#IP[@]} -ne "0" ]]; then
		if [[ ${#SAN[@]} -ne "0" || ${#IP[@]} -ne "0" ]]; then
			COMMAND+=" -addext \"subjectAltName="
			INDEX=0
			for S in "${SAN[@]}"
			do
				((INDEX+=1))
				COMMAND+="DNS.${INDEX}: ${S},"
			done

			INDEX=0
			for I in "${IP[@]}"
			do
				((INDEX+=1))
				COMMAND+="IP.${INDEX}: ${I},"
			done

			COMMAND=${COMMAND%?}
			COMMAND+="\""
		fi
	fi

	execute ${COMMAND}
}

newCertificateAuthority() {
	if [[ "${TYPE}" == "ROOTCA" ]]; then
		KEYBITS=8192
		EXTENSIONS="CA_root"
		DAYS=${ROOTCADAYS}
		SUBTYPE="INTERMEDIATECA"
	fi

	if [[ "${TYPE}" == "INTERMEDIATECA" ]]; then
		KEYBITS=4096
		EXTENSIONS="CA_intermediate"
		DAYS=${CADAYS}
	fi

	if [[ "${TYPE}" == "VPNCA" ]]; then
		KEYBITS=4096
		EXTENSIONS="CA_root"
		DAYS=${ROOTCADAYS}
		SUBTYPE="VPN"
	fi

	if [ -z "${KEYBITS}" ]; then
		echo "Error: invalid certificate authority type" >&2

		exit -1
	fi

	if [ ! -f ${CAFOLDER}/serial ]; then
		mkdir -p ${CAFOLDER}
		mkdir -p ${CAFOLDER}/certs
		mkdir -p ${CAFOLDER}/crl
		mkdir -p ${CAFOLDER}/newcerts
		mkdir -p ${CAFOLDER}/private
		touch ${CAFOLDER}/index.txt
		echo 1000 > ${CAFOLDER}/crl/crlnumber
		openssl rand -writerand ${CAFOLDER}/private/.rand
		writeRandomString 128 ${CAFOLDER}/private/${PASSFILE}
		chmod 000 ${CAFOLDER}/private/${PASSFILE}
		if [ ! -z "${SUBTYPE}" ]; then
			echo "${SUBTYPE}" > ${CAFOLDER}/${TYPEFILE}
		fi
	fi

	if [ ! -f ${CAFOLDER}/private/${CAKEY} ]; then
		if [[ "${TYPE}" == "INTERMEDIATECA" ]]; then
			echo "CA certificate filename (or enter to create)"
			read NAME
		fi

		if [ "${NAME}" ]; then
			if [ -f "./${NAME}" ]; then
				NAME="./${NAME%.*}"
			else
				if [ -f "../${NAME}" ]; then
					NAME="../${NAME%.*}"
				else
					if [ -f "./${NAME}.crt" ]; then
						NAME="./${NAME}"
					else
						if [ -f "../${NAME}.crt" ]; then
							NAME="../${NAME}"
						else
							echo "Certificate not found"
							echo "   ("./${NAME}")"
							echo "   ("../${NAME}")"
							echo "   ("./${NAME}.crt")"
							echo "   ("../${NAME}.crt")"
							echo ""
							exit -1
						fi
					fi
				fi
			fi

			if [ -f "${NAME}.csr" ]; then
				copyPem "${NAME}.csr" ${CAFOLDER}/${CAREQ} CERTIFICATE
			else
				echo "CA Request missing (${NAME}.csr)"
				exit -1
			fi

			if [ -f "${NAME}.key" ]; then
				copyPem "${NAME}.key" ${CAFOLDER}/private/${CAKEY} PRIVATE
			else
				echo "CA Private Key missing (${NAME}.key)"
				exit -1
			fi

			if [ -f "${NAME}.${PASSEXTENSION}" ]; then
				cp "${NAME}.${PASSEXTENSION}" ${CAFOLDER}/private/${PASSFILE}
				chmod 000 ${CAFOLDER}/private/${PASSFILE}
			else
				echo "CA Private Key Keyfile missing (${NAME}.${PASSEXTENSION})"
			fi

			if [ -f "${NAME}.crt" ]; then
				copyPem "${NAME}.crt" ${CAFOLDER}/${CACERT} CERTIFICATE
			else
				echo "CA Certificate missing (${NAME}.crt)"
				exit -1
			fi

			if [ -f "${NAME}.pem" ]; then
				COMMAND="cp \"${NAME}.pem\" ${CAFOLDER}/${CHAINFILE}"
				execute ${COMMAND}
			else
				echo "CA Chain missing (${NAME}.pem)"
				exit -1
			fi

			if [ ! -f "${CAFOLDER}/serial" ]; then
				COMMAND="$X509 -in ${CAFOLDER}/${CACERT} -noout -next_serial -out ${CAFOLDER}/serial"
				execute ${COMMAND}
			fi
		else
			COMMAND="$REQ -new -newkey rsa:${KEYBITS} -passout file:${CAFOLDER}/private/${PASSFILE} -keyout ${CAFOLDER}/private/${CAKEY} -out ${CAFOLDER}/${CAREQ}"

			if [ ! -z "${CN}" ]; then
				SUBJECT="/C=${C}/ST=${ST}/L=${L}/O=${O}/OU=${OU}/CN=${CN}/emailAddress=${E}"
				COMMAND+=" -subj \"${SUBJECT}\""
			fi

			execute ${COMMAND}

			COMMAND="$CA -create_serial -out ${CAFOLDER}/${CACERT} ${DAYS} -batch -keyfile ${CAFOLDER}/private/${CAKEY} -passin file:${CAFOLDER}/private/${PASSFILE} -selfsign -name ${EXTENSIONS} -infiles ${CAFOLDER}/${CAREQ}"
			execute ${COMMAND}

			copyPem ${CAFOLDER}/${CACERT} ${CAFOLDER}/${CACERT}.tmp CERTIFICATE

			COMMAND="mv ${CAFOLDER}/${CACERT}.tmp ${CAFOLDER}/${CACERT}"
			execute ${COMMAND}

			COMMAND="cp ${CAFOLDER}/${CACERT} ${CAFOLDER}/${CHAINFILE}"
			execute ${COMMAND}
		fi
	fi

	generateCrl
}

renewCertificate() {
	revokeCertificate
	signRequest	
}

renewCertificateAuthorityCertificate() {
	# TODO

	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	echo "Not implemented"
	exit -1
}

signCertificate() {
	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	if [ ! -f "${FILENAME}.csr" ]; then
		echo "Missing Certificate Request"
		exit -1
	fi

	if [[ "${TYPE}" == "LETSENCRYPT" ]]; then
		echo "Not implemented"
		exit -1
	fi

	COMMAND="${X509} -x509toreq -signkey \"${FILENAME}.key\" -in \"${FILENAME}.csr\" -out temporary.pem"
	execute ${COMMAND}

	COMMAND="${CA} -policy policy_anything -passin file:${CAFOLDER}/private/${PASSFILE} ${DAYS} -out \"${FILENAME}.crt\" -infiles temporary.pem"
	execute ${COMMAND}

	copyPem "${FILENAME}.crt" "${FILENAME}.crt.tmp" CERTIFICATE

	COMMAND="mv \"${FILENAME}.crt.tmp\" \"${FILENAME}.crt\""
	execute ${COMMAND}

	COMMAND="cat \"${FILENAME}.crt\" ${CAFOLDER}/${CHAINFILE} > \"${FILENAME}.pem\""
	execute ${COMMAND}
}

signRequest() {
	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	if [ ! -f "${FILENAME}.csr" ]; then
		echo "Missing Certificate Request"
		exit -1
	fi

	if [[ "${TYPE}" == "WEBSERVER" ]]; then
		EXTENSIONS="server_cert"
	fi

	if [[ "${TYPE}" == "LETSENCRYPT" ]]; then
		if [ -f "${FILENAME}.crt" ]; then
			echo "Certificate Exists (${FILENAME}.crt)"
			exit -1
		fi

		if [ -f "${FILENAME}.ca.pem" ]; then
			echo "Certificate Exists (${FILENAME}.ca.pem)"
			exit -1
		fi

		if [ -f "${FILENAME}.pem" ]; then
			echo "Certificate Exists (${FILENAME}.pem)"
			exit -1
		fi

		COMMAND="${CERTBOT} certonly -n --webroot -w ${CERTBOTACMEPATH} --csr \"${FILENAME}.csr\" --cert-path \"${FILENAME}.crt\" --chain-path \"${FILENAME}.ca.pem\" --fullchain-path \"${FILENAME}.pem\" --agree-tos --email ${E}"
		execute ${COMMAND}

		return
	fi

	if [[ "${TYPE}" == "WEBCLIENT" ]]; then
		EXTENSIONS="client_cert"
	fi

	if [[ "${TYPE}" == "APPLICATIONCLIENT" ]]; then
		EXTENSIONS="application_cert"
	fi

	if [[ "${TYPE}" == "EMAIL" ]]; then
		EXTENSIONS="email_cert"
	fi

	if [[ "${TYPE}" == "VPN" ]]; then
		EXTENSIONS="vpn_cert"
	fi

	if [[ "${TYPE}" == "INTERMEDIATECA" ]]; then
		DAYS=${CADAYS}
		EXTENSIONS="intermediate_extensions"
	fi

	COMMAND="${CA} -policy policy_match -passin file:${CAFOLDER}/private/${PASSFILE} -name CA_intermediate -extensions ${EXTENSIONS} ${DAYS} -out \"${FILENAME}.crt\" -infiles \"${FILENAME}.csr\""
	execute ${COMMAND}

	copyPem "${FILENAME}.crt" "${FILENAME}.crt.tmp" CERTIFICATE

	COMMAND="mv \"${FILENAME}.crt.tmp\" \"${FILENAME}.crt\""
	execute ${COMMAND}

	COMMAND="cat \"${FILENAME}.crt\" ${CAFOLDER}/${CHAINFILE} > \"${FILENAME}.pem\""
	execute ${COMMAND}
}

signCertificateAuthorityCertificate() {
	# TODO

	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	# $CA -policy policy_anything -out newcert.pem -extensions v3_ca -infiles newreq.pem
	# RET=$?

	echo "Not implemented"
	exit -1
}

signRequestAnything() {
	# TODO

	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	# $CA -policy policy_anything -infiles newreq.pem
	# RET=$?

	echo "Not implemented"
	exit -1
}

createCertificatePackage() {
	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	if [ ! -f "${FILENAME}.crt" ]; then
		echo "Missing Certificate"
		exit -1
	fi

	if [ ! -f "${FILENAME}.key" ]; then
		echo "Missing Private Key"
		exit -1
	fi

	if [[ "${TYPE}" == "LETSENCRYPT" ]]; then
		echo "Not implemented"
		exit -1
	fi

	CACERTCN=$(${X509} -noout -subject -nameopt multiline -in ${CAFOLDER}/${CACERT} | sed -n 's/ *commonName *= //p')

	COMMAND="${PKCS12} -in \"${FILENAME}.crt\" -inkey \"${FILENAME}.key\" -certfile ${CAFOLDER}/${CHAINFILE} -caname \"${CACERTCN}\" -out \"${FILENAME}.p12\" -export -name \"${FILENAME}\""
	execute ${COMMAND}
}

generateCrl() {
	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	if [[ "${TYPE}" == "LETSENCRYPT" ]]; then
		echo "Not implemented"
		exit -1
	fi

	COMMAND="${CA} -passin file:${CAFOLDER}/private/${PASSFILE} -gencrl -out ${CAFOLDER}/crl/crl.pem"
	execute ${COMMAND}

	COMMAND="cat ${CAFOLDER}/${CHAINFILE} ${CAFOLDER}/crl/crl.pem > ${CAFOLDER}/crl/crl_chain.pem"
	execute ${COMMAND}
}

revokeCertificate() {
	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	if [ ! -f "${FILENAME}.crt" ]; then
		echo "Missing Certificate"
		exit -1
	fi

	if [[ "${TYPE}" == "LETSENCRYPT" ]]; then
		#COMMAND="${CERTBOT} revoke -n --cert-path \"${FILENAME}.crt\""
		#execute ${COMMAND}

		COMMAND="mv \"${FILENAME}.crt\" \"${FILENAME}.crt.revoked\""
		execute ${COMMAND}

		COMMAND="rm -f \"${FILENAME}.pem\" \"${FILENAME}.ca.pem\""
		execute ${COMMAND}

		return
	fi

	COMMAND="${CA} -passin file:${CAFOLDER}/private/${PASSFILE} -revoke \"${FILENAME}.crt\""
	execute ${COMMAND}

	COMMAND="mv \"${FILENAME}.crt\" \"${FILENAME}.crt.revoked\""
	execute ${COMMAND}

	COMMAND="rm -f \"${FILENAME}.pem\""
	execute ${COMMAND}

	generateCrl
}

verifyCertificate() {
	if [ ! -d ${CAFOLDER} ]; then
		echo "Missing CA Folder"
		exit -1
	fi

	if [ ! -f "${FILENAME}.crt" ]; then
		echo "Missing Certificate"
		exit -1
	fi

	if [[ "${TYPE}" == "LETSENCRYPT" ]]; then
		COMMAND="${VERIFY} \"${FILENAME}.ca.pem\""
		execute ${COMMAND}

		COMMAND="${VERIFY} -CAfile \"${FILENAME}.ca.pem\" \"${FILENAME}.crt\""
		execute ${COMMAND}

		#"openssl ocsp -issuer \"${FILENAME}.ca.pem\" -cert \"${FILENAME}.crt\" -text -url http://stg-r3.o.lencr.org"

		return
	fi

	COMMAND="${VERIFY} ${CAFOLDER}/${CHAINFILE}"
	execute ${COMMAND}

	COMMAND="${VERIFY} -CAfile ${CAFOLDER}/${CHAINFILE} \"${FILENAME}.crt\""
	execute ${COMMAND}

	COMMAND="${VERIFY} -crl_check -CAfile ${CAFOLDER}/crl/crl_chain.pem \"${FILENAME}.crt\""
	execute ${COMMAND}
}

printHelp() {
	echo "" >&2
	echo "usage: $0 <OPERATION> -t <TYPE> [--san <SAN>] [--ip <IP>] [COMMON NAME]" >&2
	echo "" >&2
	echo "  Certificate Types:" >&2
	echo "   ROOTCA			" >&2
	echo "   INTERMEDIATECA		" >&2
	echo "   VPNCA			" >&2
	echo "   WEBSERVER		" >&2
	echo "   LETSENCRYPT		" >&2
	echo "   WEBCLIENT		" >&2
	echo "   APPLICATIONCLIENT	" >&2
	echo "   EMAIL			" >&2
	echo "   VPN			" >&2
	echo "" >&2
	echo "  Operations:" >&2
	echo "   -c|--newcert		Create a new certificate and private key" >&2
	echo "   -n|--newreq		Create a new certificate request and private key" >&2
	echo "   --newca		Create a new certificate authority" >&2
	echo "   -r|--renewcert		Renew an existing certificate (requires a certificate request)" >&2
	#echo "   --renewca		Renew the certificate authority certificate" >&2
	echo "   --signcert		Sign a certificate with the certificate authority" >&2
	echo "   -s|--signreq		Create and sign a new certificate with the certificate autority" >&2
	#echo "   --signca		Sign the certificate authority certificate" >&2
	#echo "   --xsign		Sign the certificate request with the certificate authority using the 'policy_anything' option" >&2
	echo "   -p|--pkcs12		Create pkcs12 package containing the certificate and its private key" >&2
	echo "   --revoke		Revoke a certificate" >&2
	echo "   --crl			Generate CRL file" >&2
	echo "   -v|--verify		Verify a certificate" >&2
	echo "   -h|--help		Display this help message" >&2
	echo "" >&2
}

#------ Commandline parsing ------

shopt -s nocasematch

EXTRASAN=()
EXTRAIP=()

POSITIONAL=()
while [[ $# -gt 0 ]]; do
	key="$1"

	case $key in
		-t|--type)
			validateType ${2}

			shift # past argument
			shift # past value
			;;
		-c|--newcert)
			OPERATION="newCertificate"

			shift # past argument
			;;
		-n|--newreq)
			OPERATION="newRequest"

			shift # past argument
			;;
		--newca)
			OPERATION="newCertificateAuthority"

			shift # past argument
			;;
		-r|--renewcert)
			OPERATION="renewCertificate"

			shift # past argument
			;;
		#--renewca)
		#	OPERATION="renewCertificateAuthorityCertificate"
		#
		#	shift # past argument
		#	;;
		--signcert)
			OPERATION="signCertificate"

			shift # past argument
			;;
		-s|--signreq)
			OPERATION="signRequest"

			shift # past argument
			;;
		#--signca)
		#	OPERATION="signCertificateAuthorityCertificate"
		#
		#	shift # past argument
		#	;;
		#--xsign)
		#	OPERATION="signRequestAnything"
		#
		#	shift # past argument
		#	;;
		-p|--pkcs12)
			OPERATION="createCertificatePackage"

			shift # past argument
			;;
		--revoke)
			OPERATION="revokeCertificate"

			shift # past argument
			;;
		--crl)
			OPERATION="generateCrl"

			shift # past argument
			;;
		-v|--verify)
			OPERATION="verifyCertificate"

			shift # past argument
			;;
		--san)
			EXTRASAN+=("$2")

			shift # past argument
			shift # past value
			;;
		--ip)
			EXTRAIP+=("$2")

			shift # past argument
			shift # past value
			;;
		-h|--help)
			OPERATION="printHelp"

			shift # past argument
			;;

		*)
			POSITIONAL+=("$1")
			shift # past argument
			;;
	esac
done

FILENAME="newCertificate"
if (( ${#POSITIONAL[@]} )); then
	CN=${POSITIONAL[0]}
	FILENAME=${CN}
fi

if [[ -z "${TYPE}" &&
      -f "${CAFOLDER}/${TYPEFILE}" ]]; then
	TYPE=$(<${CAFOLDER}/${TYPEFILE})

	validateType ${TYPE}
fi

if [[ -z "${TYPE}" &&
      "${OPERATION}" != "revokeCertificate" &&
      "${OPERATION}" != "generateCrl" &&
      "${OPERATION}" != "verifyCertificate" &&
      "${OPERATION}" != "createCertificatePackage" &&
      "${OPERATION}" != "printHelp" ]]; then
	echo "Error: missing certificate type" >&2

	printHelp
	exit -1
fi

if [[ ! -z "${TYPE}" &&
      -z "${VALIDTYPE}" &&
      "${OPERATION}" != "revokeCertificate" &&
      "${OPERATION}" != "generateCrl" &&
      "${OPERATION}" != "verifyCertificate" &&
      "${OPERATION}" != "createCertificatePackage" &&
      "${OPERATION}" != "printHelp" ]]; then
	echo "Error: invalid certificate type" >&2

	printHelp
	exit -1
fi

if [ -z "${OPERATION}" ]; then
	echo "Error: missing operation" >&2

	printHelp
	exit -1
fi

TYPE=${VALIDTYPE}
eval ${OPERATION}

exit 0