#!/bin/bash
#
# YACHT (Yet Another CA How To) Placed in public domain. RLamb 2019
#
wdest="root@mywebserver:/siteroot"
mkdir -p newcerts
if [ ! -f crlnumber ]; then echo 01 > crlnumber; fi
if [ ! -f index.txt.attr ]; then
    echo "unique_subject = no" > index.txt.attr
fi   
if [ ! -f serial ]; then echo 01 > serial; fi
if [ ! -f index.txt ]; then touch index.txt; fi
#
read -p "CKA_ID: " kid
lst=`./hcardshow 2>/dev/null | grep ID | cut -f2 -d':' | sort -u`
for i in $lst; do
    if [ "$i" = "$kid" ]; then break; fi
done
if [ "$i" != "$kid" ]; then
    echo "$kid CKA_ID does not exist in HSM. Check with hcardshow."
    exit 0
fi
#
serial="1"
if [ -f rootserial ]; then
    n=`cat rootserial`
    if [ $n -gt 0 ]; then
	serial=$(( $n + 1 ))
    fi
fi
echo "$serial" > rootserial	
# export OPENSSL_CONF=ca.cnf
openssl req -config ca.cnf -engine pkcs11 -keyform engine -new -key 1:$kid -subj "/CN=Example Certificate Authority/O=Example/L=Ballarat/ST=California/C=US" -x509 -out ca.crt -extensions root_ca -days 7300 -set_serial $serial
openssl x509 -in ca.crt -outform der -out ca.cer
echo scp -p ca.cer ca.crt $wdest/docs/ca/