#!/bin/bash
SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
DESTDIR=$SCRIPTDIR/../roles/apache/files/cert
KEY_FILE=$DESTDIR/true-snakeoil.key
CRT_FILE=$DESTDIR/true-snakeoil.crt

echo "Generating self-signed SSL certificate..."

if openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
	-keyout $DESTDIR/true-snakeoil.key \
	-out    $DESTDIR/true-snakeoil.crt \
	-subj "/C=XX/ST=Default/L=Default/O=Default/CN=default" \
	-addext "basicConstraints = CA:FALSE"; then
	{
		echo "=========================================="
		echo " 1. Private Key Info ($KEY_FILE)"
		echo "=========================================="
		openssl pkey -in "$KEY_FILE" -text -noout
		echo ""

		echo "=========================================="
		echo " 2. Certificate Info ($CRT_FILE)"
		echo "=========================================="
		openssl x509 -in "$CRT_FILE" -text -noout
		echo ""

		echo "=========================================="
		echo " 3. Modulus Consistency Check (Pair Validation)"
		echo "=========================================="
		crt_hash=$(openssl x509 -in "$CRT_FILE" -modulus -noout | openssl md5)
		key_hash=$(openssl rsa -in "$KEY_FILE" -modulus -noout 2>/dev/null | openssl md5)
		echo "Certificate Modulus MD5: $crt_hash"
		echo "Private Key Modulus MD5: $key_hash"
		if [ "$crt_hash" = "$key_hash" ]; then
			echo "Result: MATCH (Key and Certificate belong together)"
		else
			echo "Result: MISMATCH (ERROR)"
		fi
	} | less
else
	echo "Error: Failed to generate certificate." >&2
	exit 1
fi