#!/bin/bash

#handling calling arguments
if [ "$#" -gt 0 ]; then
	echo "Arg0: DefaultKeySize=$1"
	KEYSIZE=$1
else
	KEYSIZE=2048
fi
if [ "$#" -gt 1 ]; then
	echo "Arg1: CurrentDir=$2"
	CURRENT_DIR=$2
else
	#getting current directory where the script is called
	pushd `dirname $0` > /dev/null
	CURRENT_DIR="$PWD"
	popd > /dev/null
fi

if [ "$#" -gt 2 ]; then
	echo "Arg2: IsProjectDir=$3"
	ISPROJECTDIR=$3
fi

if [ "$#" -gt 3 ]; then
	echo "Arg3: ApplicationDir=$4"
	APPLICATION_DIR=$4
else
	APPLICATION_DIR=$CURRENT_DIR
fi

echo "Working directory: $CURRENT_DIR"

STORE_PATH=$CURRENT_DIR/TMPPKI
if ! [ $ISPROJECTDIR -eq 1 ]; then
	DEPLOYED_SERVER_PKI_PATH=$CURRENT_DIR/../ServerProjects/PKI
	DEPLOYED_CLIENT_PKI_PATH=$CURRENT_DIR/../ClientProjects/PKI
else
	DEPLOYED_SERVER_PKI_PATH=$CURRENT_DIR/PKI
	DEPLOYED_CLIENT_PKI_PATH=$CURRENT_DIR/PKI
fi

DEPLOYED_SERVER_STORE_PATH=$DEPLOYED_SERVER_PKI_PATH/CA
DEPLOYED_CLIENT_STORE_PATH=$DEPLOYED_CLIENT_PKI_PATH/CA

HOSTNAME=$(hostname)

# Initialize certificate subject fields
DEFAULTKEYSIZE=$KEYSIZE
CERTCN="UA Compliance Test Tool"
CERTO="OPC Foundation"
CERTL="Scottsdale"
CERTS="Arizona"
CERTC="US"
X509_SUBJ="/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"

SUBJECT_ALTERNATIVE_NAME="URI:urn:$HOSTNAME:OPCFoundation:UaComplianceTestTool"

CERT_VALIDITY_DAYS=365
CA_CERT_VALIDITY_DAYS=1825

export YEAR=$(date +"%y")
export MONTH=$(date +"%m")
export DAY=$(date +"%d")

export LASTYEAR=$(($YEAR-1))
export NEXTYEAR=$(($YEAR+1))

#Environment variable used by OpenSSL
OPENSSL_CONF=$APPLICATION_DIR/openssl.cnf

# These variables are referenced from the OpenSSL configuration file
export G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
export G_STORE_PATH=$STORE_PATH

echo "Initialize folder structures"

# Temporary PKI store (working directory)
mkdir -p "$STORE_PATH/certs"			|| { echo "Failed to create folder"; exit 1; }
mkdir -p "$STORE_PATH/crl"			|| { echo "Failed to create folder"; exit 1; }
mkdir -p "$STORE_PATH/private"			|| { echo "Failed to create folder"; exit 1; }
mkdir -p "$STORE_PATH/request"			|| { echo "Failed to create folder"; exit 1; }

# ServerProject PKI store
mkdir -p "$DEPLOYED_SERVER_STORE_PATH/certs"	|| { echo "Failed to create folder"; exit 1; }
mkdir -p "$DEPLOYED_SERVER_STORE_PATH/crl"	|| { echo "Failed to create folder"; exit 1; }
mkdir -p "$DEPLOYED_SERVER_STORE_PATH/private"	|| { echo "Failed to create folder"; exit 1; }

# ClientProject PKI store
mkdir -p "$DEPLOYED_CLIENT_STORE_PATH/certs"	|| { echo "Failed to create folder"; exit 1; }
mkdir -p "$DEPLOYED_CLIENT_STORE_PATH/crl"	|| { echo "Failed to create folder"; exit 1; }
mkdir -p "$DEPLOYED_CLIENT_STORE_PATH/private"	|| { echo "Failed to create folder"; exit 1; }

# ServerProject PKI copy_needed_files
export COPYTOSERVER_PATH=$DEPLOYED_SERVER_PKI_PATH/copyToServer
export CS_AI_PKI=$COPYTOSERVER_PATH/ApplicationInstance_PKI
export CS_USER_PKI=$COPYTOSERVER_PATH/X509UserIdentity_PKI
mkdir -p "$COPYTOSERVER_PATH" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_AI_PKI" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_USER_PKI" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_AI_PKI/trusted" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_AI_PKI/trusted/certs" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_AI_PKI/trusted/crl" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_AI_PKI/issuers" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_AI_PKI/issuers/certs" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_AI_PKI/issuers/crl" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_USER_PKI/trusted" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_USER_PKI/trusted/certs" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_USER_PKI/trusted/crl" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_USER_PKI/issuers" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_USER_PKI/issuers/certs" || { echo "Failed to create folder"; exit 1; }
mkdir -p "$CS_USER_PKI/issuers/crl" || { echo "Failed to create folder"; exit 1; }

#Write .rnd file to avoid errors in terminal
openssl rand -writerand $STORE_PATH/.rnd

#================================================================
#====================== Helper functions ========================
#================================================================

process_end_success()
{
	rm -rf "$STORE_PATH"
	echo ""
	echo ""
	echo "~~~ Certificates successfully created ~~~	"

	exit 0
}

process_end_error()
{
	rm -rf "$STORE_PATH"
	rm -rf "$DEPLOYED_SERVER_PKI_PATH"
	rm -rf "$DEPLOYED_CLIENT_PKI_PATH"
	echo ""
	echo ""
	echo "~~~ Failed to create certificates ~~~"

	exit 1
}

create_self_signed_certificate()
{
	if [ "$#" -ne 2 ]; then
		echo "Invalid arguments when calling script function (expected=2|received=$#)"
		return 1
	fi

	NAME=$1
	SUBJ=$2

	PRIVATE_KEY_LOCATION=$STORE_PATH/private/$NAME.pem
	REQUEST_LOCATION=$STORE_PATH/request/$NAME.csr
	CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.der
	TEMP_CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.pem

	# These variables are referenced from the OpenSSL configuration file
	export G_CA_DATABASE_LOCATION=$STORE_PATH/database_$NAME.txt
	export G_CA_SERIAL_NUMBER_LOCATION=$STORE_PATH/serial_$NAME.txt
	export G_CA_CRL_NUMBER_LOCATION=$STORE_PATH/crlnumber_$NAME.txt

	# remove files to create when they already exist
	if [ -f "$PRIVATE_KEY_LOCATION" ]; then rm "$PRIVATE_KEY_LOCATION" ; fi
	if [ -f "$REQUEST_LOCATION" ]; then rm "$REQUEST_LOCATION" ; fi
	if [ -f "$CERTIFICATE_LOCATION" ]; then rm "$CERTIFICATE_LOCATION" ; fi
	if [ -f "$TEMP_CERTIFICATE_LOCATION" ]; then rm "$TEMP_CERTIFICATE_LOCATION" ; fi
	if [ -f "$G_CA_DATABASE_LOCATION" ]; then rm "$G_CA_DATABASE_LOCATION"* ; fi
	if [ -f "$G_CA_SERIAL_NUMBER_LOCATION" ]; then rm "$G_CA_SERIAL_NUMBER_LOCATION"* ; fi
	if [ -f "$G_CA_CRL_NUMBER_LOCATION" ]; then rm "$G_CA_CRL_NUMBER_LOCATION"* ; fi

	# Creating CA related files
	# Generate an empty file
	touch "$G_CA_DATABASE_LOCATION"
	echo 00 > "$G_CA_SERIAL_NUMBER_LOCATION"
	echo 00 > "$G_CA_CRL_NUMBER_LOCATION"

	# Creating private key
	openssl genrsa -out "$PRIVATE_KEY_LOCATION" $KEYSIZE || return 1

	# Creating certificate request
	openssl req -config "$OPENSSL_CONF" -new -key "$PRIVATE_KEY_LOCATION" -outform PEM -out "$REQUEST_LOCATION" || return 1

	# Creating self signed cert
	openssl ca -config "$OPENSSL_CONF" -batch -days $CERT_VALIDITY_DAYS -selfsign -keyfile "$PRIVATE_KEY_LOCATION"  -in "$REQUEST_LOCATION" -out "$TEMP_CERTIFICATE_LOCATION"  -subj "$SUBJ" -extensions v3_self_signed || return 1

	# Converting PEM certificate to DER format
	openssl x509 -inform PEM -in "$TEMP_CERTIFICATE_LOCATION" -outform DER -out "$CERTIFICATE_LOCATION" || return 1
	
	return 0
}

create_self_signed_certificate_validity()
{
	if [ "$#" -ne 4 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	NAME=$1
	SUBJ=$2
	STARTDATE=$3
	ENDDATE=$4

	PRIVATE_KEY_LOCATION=$STORE_PATH/private/$NAME.pem
	REQUEST_LOCATION=$STORE_PATH/request/$NAME.csr
	CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.der
	TEMP_CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.pem

	# These variables are referenced from the OpenSSL configuration file
	export G_CA_DATABASE_LOCATION=$STORE_PATH/database_$NAME.txt
	export G_CA_SERIAL_NUMBER_LOCATION=$STORE_PATH/serial_$NAME.txt
	export G_CA_CRL_NUMBER_LOCATION=$STORE_PATH/crlnumber_$NAME.txt

	# remove files to create when they already exist
	if [ -f "$PRIVATE_KEY_LOCATION" ]; then rm "$PRIVATE_KEY_LOCATION" ; fi
	if [ -f "$REQUEST_LOCATION" ]; then rm "$REQUEST_LOCATION" ; fi
	if [ -f "$CERTIFICATE_LOCATION" ]; then rm "$CERTIFICATE_LOCATION" ; fi
	if [ -f "$TEMP_CERTIFICATE_LOCATION" ]; then rm "$TEMP_CERTIFICATE_LOCATION" ; fi
	if [ -f "$G_CA_DATABASE_LOCATION" ]; then rm "$G_CA_DATABASE_LOCATION"* ; fi
	if [ -f "$G_CA_SERIAL_NUMBER_LOCATION" ]; then rm "$G_CA_SERIAL_NUMBER_LOCATION"* ; fi
	if [ -f "$G_CA_CRL_NUMBER_LOCATION" ]; then rm "$G_CA_CRL_NUMBER_LOCATION"* ; fi

	# Creating CA related files
	# Generate an empty file
	touch "$G_CA_DATABASE_LOCATION"
	echo 00 > "$G_CA_SERIAL_NUMBER_LOCATION"
	echo 00 > "$G_CA_CRL_NUMBER_LOCATION"

	# Creating private key
	openssl genrsa -out "$PRIVATE_KEY_LOCATION" $KEYSIZE || return 1

	# Creating certificate request
	openssl req -config "$OPENSSL_CONF" -new -key "$PRIVATE_KEY_LOCATION" -outform PEM -out "$REQUEST_LOCATION" || return 1

	# Creating self signed cert
	openssl ca -config "$OPENSSL_CONF" -batch -startdate $STARTDATE -enddate $ENDDATE -selfsign -keyfile "$PRIVATE_KEY_LOCATION"  -in "$REQUEST_LOCATION" -out "$TEMP_CERTIFICATE_LOCATION"  -subj "$SUBJ" -extensions v3_self_signed || return 1

	# Converting PEM certificate to DER format
	openssl x509 -inform PEM -in "$TEMP_CERTIFICATE_LOCATION" -outform DER -out "$CERTIFICATE_LOCATION" || return 1
	
	return 0
}

invalidate_certificate_signature()
{
	if [ "$#" -ne 1 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	NAME=$1

	CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.der

	FILE_SIZE=`stat -c%s "$CERTIFICATE_LOCATION"`

	BYTECNT_PRE=`expr $FILE_SIZE - 51`

	TEMP_FILE=$STORE_PATH/certs/tempinvalidsign.der

	if [ -f "$TEMP_FILE" ]; then rm "$TEMP_FILE" ; fi

	head -c $BYTECNT_PRE "$CERTIFICATE_LOCATION" >  $TEMP_FILE
	echo -n -e "\x3F"                            >> $TEMP_FILE
	tail -c 50 "$CERTIFICATE_LOCATION"           >> $TEMP_FILE

	cp "$TEMP_FILE" "$CERTIFICATE_LOCATION" || return 1
	rm "$TEMP_FILE" || return 1

	return 0
}

create_root_ca_certificate()
{
	if [ "$#" -ne 2 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	NAME=$1
	SUBJ=$2

	PRIVATE_KEY_LOCATION=$STORE_PATH/private/$NAME.pem
	REQUEST_LOCATION=$STORE_PATH/request/$NAME.csr
	CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.der
	TEMP_CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.pem

	# These variables are referenced from the OpenSSL configuration file
	export G_CA_DATABASE_LOCATION=$STORE_PATH/database_$NAME.txt
	export G_CA_SERIAL_NUMBER_LOCATION=$STORE_PATH/serial_$NAME.txt
	export G_CA_CRL_NUMBER_LOCATION=$STORE_PATH/crlnumber_$NAME.txt

	# remove files to create when they already exist
	if [ -f "$PRIVATE_KEY_LOCATION" ]; then rm "$PRIVATE_KEY_LOCATION" ; fi
	if [ -f "$REQUEST_LOCATION" ]; then rm "$REQUEST_LOCATION" ; fi
	if [ -f "$CERTIFICATE_LOCATION" ]; then rm "$CERTIFICATE_LOCATION" ; fi
	if [ -f "$TEMP_CERTIFICATE_LOCATION" ]; then rm "$TEMP_CERTIFICATE_LOCATION" ; fi
	if [ -f "$G_CA_DATABASE_LOCATION" ]; then rm "$G_CA_DATABASE_LOCATION"* ; fi
	if [ -f "$G_CA_SERIAL_NUMBER_LOCATION" ]; then rm "$G_CA_SERIAL_NUMBER_LOCATION"* ; fi
	if [ -f "$G_CA_CRL_NUMBER_LOCATION" ]; then rm "$G_CA_CRL_NUMBER_LOCATION"* ; fi

	# Creating CA related files
	# Generate an empty file
	touch "$G_CA_DATABASE_LOCATION"
	echo 00 > "$G_CA_SERIAL_NUMBER_LOCATION"
	echo 00 > "$G_CA_CRL_NUMBER_LOCATION"

	# Creating private key
	openssl genrsa -out "$PRIVATE_KEY_LOCATION" $KEYSIZE || return 1

	# Creating certificate request
	openssl req -config "$OPENSSL_CONF" -new -key "$PRIVATE_KEY_LOCATION" -outform PEM -out "$REQUEST_LOCATION" || return 1

	# Creating self signed cert
	openssl ca -config "$OPENSSL_CONF" -batch -days $CA_CERT_VALIDITY_DAYS -selfsign -keyfile "$PRIVATE_KEY_LOCATION"  -in "$REQUEST_LOCATION" -out "$TEMP_CERTIFICATE_LOCATION"  -subj "$SUBJ" -extensions v3_ca || return 1

	# Converting PEM certificate to DER format
	openssl x509 -inform PEM -in "$TEMP_CERTIFICATE_LOCATION" -outform DER -out "$CERTIFICATE_LOCATION" || return 1
	
	return 0
}

create_issued_ca()
{
	if [ "$#" -ne 3 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	NAME=$1
	SUBJ=$2
	CA_NAME=$3

	PRIVATE_KEY_LOCATION=$STORE_PATH/private/$NAME.pem
	REQUEST_LOCATION=$STORE_PATH/request/$NAME.csr
	CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.der
	TEMP_CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.pem

	CA_PEM_CERTIFICATE=$STORE_PATH/certs/$CA_NAME.pem
	CA_PRIVATE_KEY=$STORE_PATH/private/$CA_NAME.pem

	# These variables are referenced from the OpenSSL configuration file
	export G_CA_DATABASE_LOCATION=$STORE_PATH/database_$NAME.txt
	export G_CA_SERIAL_NUMBER_LOCATION=$STORE_PATH/serial_$NAME.txt
	export G_CA_CRL_NUMBER_LOCATION=$STORE_PATH/crlnumber_$NAME.txt

	# remove files to create when they already exist
	if [ -f "$PRIVATE_KEY_LOCATION" ]; then rm "$PRIVATE_KEY_LOCATION" ; fi
	if [ -f "$REQUEST_LOCATION" ]; then rm "$REQUEST_LOCATION" ; fi
	if [ -f "$CERTIFICATE_LOCATION" ]; then rm "$CERTIFICATE_LOCATION" ; fi
	if [ -f "$TEMP_CERTIFICATE_LOCATION" ]; then rm "$TEMP_CERTIFICATE_LOCATION" ; fi
	if [ -f "$G_CA_DATABASE_LOCATION" ]; then rm "$G_CA_DATABASE_LOCATION"* ; fi
	if [ -f "$G_CA_SERIAL_NUMBER_LOCATION" ]; then rm "$G_CA_SERIAL_NUMBER_LOCATION"* ; fi
	if [ -f "$G_CA_CRL_NUMBER_LOCATION" ]; then rm "$G_CA_CRL_NUMBER_LOCATION"* ; fi

	# Creating CA related files
	# Generate an empty file
	touch "$G_CA_DATABASE_LOCATION"
	echo 00 > "$G_CA_SERIAL_NUMBER_LOCATION"
	echo 00 > "$G_CA_CRL_NUMBER_LOCATION"

	# Creating private key
	openssl genrsa -out "$PRIVATE_KEY_LOCATION" $KEYSIZE || return 1

	# Creating certificate request
	openssl req -config "$OPENSSL_CONF" -new -key "$PRIVATE_KEY_LOCATION" -outform PEM -out "$REQUEST_LOCATION" || return 1

	# Creating self signed cert
	openssl ca -config "$OPENSSL_CONF" -batch -days $CA_CERT_VALIDITY_DAYS -in "$REQUEST_LOCATION" -extensions v3_ca -out "$TEMP_CERTIFICATE_LOCATION"  -subj "$SUBJ" -keyfile "$CA_PRIVATE_KEY" -cert "$CA_PEM_CERTIFICATE"  || return 1

	# Converting PEM certificate to DER format
	openssl x509 -inform PEM -in "$TEMP_CERTIFICATE_LOCATION" -outform DER -out "$CERTIFICATE_LOCATION" || return 1
	
	return 0
}

copy_needed_files()
{
	if [ "$#" -ne 2 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	export NAME=$1
	export DEPLOYED_STORE_LOCATION=$2
	export CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME

	export TARGET_CERTIFICATE_LOCATION=$DEPLOYED_STORE_LOCATION/

	cp "$CERTIFICATE_LOCATION" "$TARGET_CERTIFICATE_LOCATION" || process_end_error

}

create_issued_certificate()
{
	if [ "$#" -ne 3 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	NAME=$1
	SUBJ=$2
	CA_NAME=$3

	PRIVATE_KEY_LOCATION=$STORE_PATH/private/$NAME.pem
	REQUEST_LOCATION=$STORE_PATH/request/$NAME.csr
	CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.der
	TEMP_CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.pem

	CA_PEM_CERTIFICATE=$STORE_PATH/certs/$CA_NAME.pem
	CA_PRIVATE_KEY=$STORE_PATH/private/$CA_NAME.pem

	# These variables are referenced from the OpenSSL configuration file
	export G_CA_DATABASE_LOCATION=$STORE_PATH/database_$CA_NAME.txt
	export G_CA_SERIAL_NUMBER_LOCATION=$STORE_PATH/serial_$CA_NAME.txt
	export G_CA_CRL_NUMBER_LOCATION=$STORE_PATH/crlnumber_$CA_NAME.txt

	# remove files to create when they already exist
	if [ -f "$PRIVATE_KEY_LOCATION" ]; then rm "$PRIVATE_KEY_LOCATION" ; fi
	if [ -f "$REQUEST_LOCATION" ]; then rm "$REQUEST_LOCATION" ; fi
	if [ -f "$CERTIFICATE_LOCATION" ]; then rm "$CERTIFICATE_LOCATION" ; fi
	if [ -f "$TEMP_CERTIFICATE_LOCATION" ]; then rm "$TEMP_CERTIFICATE_LOCATION" ; fi

	# Creating private key
	openssl genrsa -out "$PRIVATE_KEY_LOCATION" $KEYSIZE || return 1

	# Creating certificate request
	openssl req -config "$OPENSSL_CONF" -new -key "$PRIVATE_KEY_LOCATION" -outform PEM -out "$REQUEST_LOCATION" || return 1

	# Creating self signed cert
	openssl ca -config "$OPENSSL_CONF" -batch -days $CERT_VALIDITY_DAYS -keyfile "$CA_PRIVATE_KEY"  -in "$REQUEST_LOCATION" -out "$TEMP_CERTIFICATE_LOCATION"  -subj "$SUBJ" -cert "$CA_PEM_CERTIFICATE" || return 1

	# Converting PEM certificate to DER format
	openssl x509 -inform PEM -in "$TEMP_CERTIFICATE_LOCATION" -outform DER -out "$CERTIFICATE_LOCATION" || return 1
	
	return 0
}

revoke_certificate()
{
	if [ "$#" -ne 2 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	NAME=$1
	CA_NAME=$2

	DER_CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.der
	PEM_CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.pem

	CA_CERTIFICATE=$STORE_PATH/certs/$CA_NAME.pem
	CA_PRIVATE_KEY=$STORE_PATH/private/$CA_NAME.pem

	# These variables are referenced from the OpenSSL configuration file
	export G_CA_DATABASE_LOCATION=$STORE_PATH/database_$CA_NAME.txt
	export G_CA_SERIAL_NUMBER_LOCATION=$STORE_PATH/serial_$CA_NAME.txt
	export G_CA_CRL_NUMBER_LOCATION=$STORE_PATH/crlnumber_$CA_NAME.txt

	# Converting DER certificate to PEM format
	openssl x509 -inform DER -in "$DER_CERTIFICATE_LOCATION" -outform PEM -out "$PEM_CERTIFICATE_LOCATION" || return 1

	# Revoking certificate
	openssl ca -config "$OPENSSL_CONF" -revoke "$PEM_CERTIFICATE_LOCATION" -cert "$CA_CERTIFICATE" -keyfile "$CA_PRIVATE_KEY" || return 1

	return 0
}

update_revocation_list()
{
	if [ "$#" -ne 1 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	CA_NAME=$1

	REVOCATION_LIST_LOCATION=$STORE_PATH/crl/$CA_NAME.crl
	CA_CERTIFICATE=$STORE_PATH/certs/$CA_NAME.pem
	CA_PRIVATE_KEY=$STORE_PATH/private/$CA_NAME.pem

	# These variables are referenced from the OpenSSL configuration file
	export G_CA_DATABASE_LOCATION=$STORE_PATH/database_$CA_NAME.txt
	export G_CA_SERIAL_NUMBER_LOCATION=$STORE_PATH/serial_$CA_NAME.txt
	export G_CA_CRL_NUMBER_LOCATION=$STORE_PATH/crlnumber_$CA_NAME.txt

	# Generate CRL
	openssl ca -config "$OPENSSL_CONF" -gencrl -crldays 1825 -out "$REVOCATION_LIST_LOCATION" -cert "$CA_CERTIFICATE" -keyfile "$CA_PRIVATE_KEY" || return 1

	# Convert CRL from PEM to DER format
	openssl crl -inform PEM -in "$REVOCATION_LIST_LOCATION" -outform DER -out "$REVOCATION_LIST_LOCATION" || return 1

	return 0
}

deploy_certificate()
{
	if [ "$#" -ne 2 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	NAME=$1
	DEPLOYED_STORE_LOCATION=$2

	CERTIFICATE_LOCATION=$STORE_PATH/certs/$NAME.der
	PRIVATE_KEY_LOCATION=$STORE_PATH/private/$NAME.pem

	TARGET_CERTIFICATE_LOCATION=$DEPLOYED_STORE_LOCATION/certs/$NAME.der
	TARGET_PRIVATE_KEY_LOCATION=$DEPLOYED_STORE_LOCATION/private/$NAME.pem

	cp "$CERTIFICATE_LOCATION" "$TARGET_CERTIFICATE_LOCATION" || { echo "Failed to copy certificate"; return 1; }

	cp "$PRIVATE_KEY_LOCATION" "$TARGET_PRIVATE_KEY_LOCATION" || { echo "Failed to copy private key"; return 1; }

	return 0
}

deploy_revocation_list()
{
	if [ "$#" -ne 2 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	CA_NAME=$1
	DEPLOYED_STORE_LOCATION=$2

	REVOCATION_LIST_LOCATION=$STORE_PATH/crl/$CA_NAME.crl

	TARGET_REVOCATION_LIST_LOCATION=$DEPLOYED_STORE_LOCATION/crl/$CA_NAME.crl

	cp "$REVOCATION_LIST_LOCATION" "$TARGET_REVOCATION_LIST_LOCATION" || return 1

	return 0;
}

create_all_issued_certificates()
{
	if [ "$#" -ne 2 ]; then
		echo "Invalid arguments when calling script function"
		return 1
	fi

	CATOISSUECERTIFICATESFROM=$1
	PATHTORI=$2

	echo "Creating all issued certificates for $CATOISSUECERTIFICATESFROM which is $PATHORI"

	echo ""
	echo ""
	echo "====================================="
	echo "= Issue a trusted Certificate from $CATOISSUECERTIFICATESFROM for the CTT"
	echo "====================================="
	CERTCN=$CATOISSUECERTIFICATESFROM\_appT
	X509_SUBJ="/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
	create_issued_certificate "$CERTCN" "$X509_SUBJ" "$CATOISSUECERTIFICATESFROM" || process_end_error
	deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
	copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error

	echo ""
	echo ""
	echo "====================================="
	echo "= Issue a untrusted Certificate from $CATOISSUECERTIFICATESFROM for the CTT"
	echo "====================================="
	CERTCN=$CATOISSUECERTIFICATESFROM\_appU
	X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
	create_issued_certificate "$CERTCN" "$X509_SUBJ" "$CATOISSUECERTIFICATESFROM" || process_end_error
	deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error

	echo ""
	echo ""
	echo "====================================="
	echo "= Revoke an issued Certificate from $CATOISSUECERTIFICATESFROM for the trusted folder"
	echo "====================================="
	CERTCN=$CATOISSUECERTIFICATESFROM\_appTR
	X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
	create_issued_certificate "$CERTCN" "$X509_SUBJ" "$CATOISSUECERTIFICATESFROM" || process_end_error
	revoke_certificate "$CERTCN" "$CATOISSUECERTIFICATESFROM" || process_end_error
	update_revocation_list "$CATOISSUECERTIFICATESFROM" || process_end_error
	deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
	deploy_revocation_list "$CATOISSUECERTIFICATESFROM" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
	copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error

	echo ""
	echo ""
	echo "====================================="
	echo "= Revoke a second issued Certificate from $CATOISSUECERTIFICATESFROM which is not trusted"
	echo "====================================="
	CERTCN=$CATOISSUECERTIFICATESFROM\_appUR
	X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
	create_issued_certificate "$CERTCN" "$X509_SUBJ" "$CATOISSUECERTIFICATESFROM" || process_end_error
	revoke_certificate "$CERTCN" "$CATOISSUECERTIFICATESFROM" || process_end_error
	update_revocation_list "$CATOISSUECERTIFICATESFROM" || process_end_error
	deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
	deploy_revocation_list "$CATOISSUECERTIFICATESFROM" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error

	echo "Now lets issue the user certs for this ca"

	export G_SUBJECT_ALTERNATIVE_NAME=URI:compliance@opcfoundation.org
	echo ""
	echo ""
	echo "====================================="
	echo "= Issue a trusted User Certificate from $CATOISSUECERTIFICATESFROM for the CTT"
	echo "====================================="
	CERTCN=$CATOISSUECERTIFICATESFROM\_usrT
	X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
	create_issued_certificate "$CERTCN" "$X509_SUBJ" "$CATOISSUECERTIFICATESFROM" || process_end_error
	deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
	copy_needed_files "$CERTCN.der" "$CS_USER_PKI/trusted/certs" || process_end_error

	echo ""
	echo ""
	echo "====================================="
	echo "= Issue a untrusted User Certificate from $CATOISSUECERTIFICATESFROM for the CTT"
	echo "====================================="
	CERTCN=$CATOISSUECERTIFICATESFROM\_usrU
	X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
	create_issued_certificate "$CERTCN" "$X509_SUBJ" "$CATOISSUECERTIFICATESFROM" || process_end_error
	deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error

	echo ""
	echo ""
	echo "====================================="
	echo "= Revoke an issued User Certificate from $CATOISSUECERTIFICATESFROM for the trusted folder"
	echo "====================================="
	CERTCN=$CATOISSUECERTIFICATESFROM\_usrTR
	X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
	create_issued_certificate "$CERTCN" "$X509_SUBJ" "$CATOISSUECERTIFICATESFROM" || process_end_error
	revoke_certificate "$CERTCN" "$CATOISSUECERTIFICATESFROM" || process_end_error
	update_revocation_list "$CATOISSUECERTIFICATESFROM" || process_end_error
	deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
	deploy_revocation_list "$CATOISSUECERTIFICATESFROM" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
	copy_needed_files "$CERTCN.der" "$CS_USER_PKI/trusted/certs" || process_end_error

	echo ""
	echo ""
	echo "====================================="
	echo "= Revoke a second issued Certificate from $CATOISSUECERTIFICATESFROM which is not trusted"
	echo "====================================="
	CERTCN=$CATOISSUECERTIFICATESFROM\_usrUR
	X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
	create_issued_certificate "$CERTCN" "$X509_SUBJ" "$CATOISSUECERTIFICATESFROM" || process_end_error
	revoke_certificate "$CERTCN" "$CATOISSUECERTIFICATESFROM" || process_end_error
	update_revocation_list "$CATOISSUECERTIFICATESFROM" || process_end_error
	deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error

	export G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME

}

echo ""
echo ""
echo "======================================"
echo "= CTT Application Instance Certificate"
echo "======================================"
CERTCN=ctt_appT
X509_SUBJ="/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_CLIENT_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error

echo ""
echo ""
echo "====================================="
echo "= CTT Application Instance Certificate (Sha1, 1024 Bit)"
echo "====================================="
KEYSIZE=1024
CERTSIGNATUREALG=sha1
OPENSSL_CONF=$APPLICATION_DIR/openssl_sha1.cnf
CERTCN=ctt_appTSha1_1024
X509_SUBJ="/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_CLIENT_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error
export KEYSIZE=$DEFAULTKEYSIZE
export CERTSIGNATUREALG=sha256
export OPENSSL_CONF=$APPLICATION_DIR/openssl.cnf

echo ""
echo ""
echo "====================================="
echo "= CTT Application Instance Certificate (Sha1, 2048 Bit)"
echo "====================================="
KEYSIZE=2048
CERTSIGNATUREALG=sha1
OPENSSL_CONF=$APPLICATION_DIR/openssl_sha1.cnf
CERTCN=ctt_appTSha1_2048
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_CLIENT_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error
KEYSIZE=$DEFAULTKEYSIZE
CERTSIGNATUREALG=sha256
OPENSSL_CONF=$APPLICATION_DIR/openssl.cnf

echo ""
echo ""
echo "====================================="
echo "= CTT Application Instance Certificate (Sha256, 2048 Bit)"
echo "====================================="
KEYSIZE=2048
CERTSIGNATUREALG=sha256
CERTCN=ctt_appTSha256_2048
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_CLIENT_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error
KEYSIZE=$DEFAULTKEYSIZE
CERTSIGNATUREALG=sha256

echo ""
echo ""
echo "====================================="
echo "= CTT Application Instance Certificate (Sha256, 4096 Bit)"
echo "====================================="
KEYSIZE=4096
CERTSIGNATUREALG=sha256
CERTCN=ctt_appTSha256_4096
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_CLIENT_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error
KEYSIZE=$DEFAULTKEYSIZE
CERTSIGNATUREALG=sha256

echo ""
echo ""
echo "====================================================="
echo "= CTT Application Instance Certificate - Not Trusted!"
echo "====================================================="
CERTCN=ctt_appU
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error

echo ""
echo ""
echo "===================================================="
echo "= CTT Not Yet Valid Application Instance Certificate"
echo "===================================================="
CERTCN=ctt_appTV
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate_validity "$CERTCN" "$X509_SUBJ" $NEXTYEAR"0101120000Z" $NEXTYEAR"0601120000Z" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error

echo ""
echo ""
echo "========================================================="
echo "= CTT Expired Application Instance Certificate - Trusted!"
echo "========================================================="
CERTCN=ctt_appTE
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate_validity "$CERTCN" "$X509_SUBJ" $LASTYEAR"0101120000Z" $LASTYEAR"1206120000Z" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error

echo ""
echo ""
echo "============================================================="
echo "= CTT Expired Application Instance Certificate - Not Trusted!"
echo "============================================================="
CERTCN=ctt_appUE
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate_validity "$CERTCN" "$X509_SUBJ" $LASTYEAR"0101120000Z" $LASTYEAR"1206120000Z" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error

echo ""
echo ""
echo "====================================="
echo "= CTT Invalid IP Address"
echo "====================================="
CERTCN=ctt_appTSip
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:noSuchHost:UA Compliance Test Tool"
create_self_signed_certificate "$CERTCN" "//C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=noSuchHost" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error

echo ""
echo ""
echo "====================================="
echo "= CTT Incorrectly Signed"
echo "====================================="
CERTCN=ctt_appTSincorrect
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
create_self_signed_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
invalidate_certificate_signature "$CERTCN" || process_end_error
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error

echo ""
echo ""
echo "====================================="
echo "= CTT Invalid ApplicationURI"
echo "====================================="
CERTCN=ctt_appTSuri
X509_SUBJ="/C=$CERTC/L=$CERTL\ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME"
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:ThisIsAnInvalidUri"
create_self_signed_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error


echo ""
echo ""
echo "====================================="
echo "= Create a Certificate Authority (CA)"
echo "====================================="
CERTCN=ctt_ca1T
CURRENTCA=$CERTCN
X509_SUBJ=/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:$HOSTNAME:$CERTCN"					 
create_root_ca_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/trusted/certs" || process_end_error
create_all_issued_certificates $CURRENTCA "trusted"
copy_needed_files "../crl/$CURRENTCA.crl" "$CS_AI_PKI/trusted/crl" || process_end_error
copy_needed_files "../crl/$CURRENTCA.crl" "$CS_USER_PKI/trusted/crl" || process_end_error

echo ""
echo ""
echo "====================================="
echo "= Create a trusted root Certificate Authority (CA) where the revocation list is not available"
echo "====================================="
CERTCN=ctt_ca1TC
CURRENTCA=$CERTCN
X509_SUBJ=/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:$HOSTNAME:$CERTCN"					 
create_root_ca_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/trusted/certs" || process_end_error
create_all_issued_certificates $CURRENTCA "trusted"
deploy_revocation_list "$CURRENTCA" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error

echo ""
echo ""
echo "====================================="
echo "= Create a unknown root Certificate Authority (CA)"
echo "====================================="
CERTCN=ctt_ca1U
CURRENTCA=$CERTCN
X509_SUBJ=/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:$HOSTNAME:$CERTCN"					 
create_root_ca_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
create_all_issued_certificates $CURRENTCA "trusted"

echo ""
echo ""
echo "====================================="
echo "= Create a issuers root Certificate Authority (CA)"
echo "====================================="
CERTCN=ctt_ca1I
CURRENTCA=$CERTCN
X509_SUBJ=/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:$HOSTNAME:$CERTCN"					 
create_root_ca_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/issuers/certs" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/issuers/certs" || process_end_error
create_all_issued_certificates $CURRENTCA "issuers"
deploy_revocation_list "$CURRENTCA" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "../crl/$CURRENTCA.crl" "$CS_AI_PKI/issuers/crl" || process_end_error
copy_needed_files "../crl/$CURRENTCA.crl" "$CS_USER_PKI/issuers/crl" || process_end_error

echo ""
echo ""
echo "====================================="
echo "= Create a issuers root Certificate Authority (CA) where the revocation list is not known"
echo "====================================="
CERTCN=ctt_ca1IC
CURRENTCA=$CERTCN
X509_SUBJ=/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:$HOSTNAME:$CERTCN"					 
create_root_ca_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/issuers/certs" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/issuers/certs" || process_end_error
create_all_issued_certificates $CURRENTCA "issuers"

echo ""
echo ""
echo "====================================="
echo "= Create a untrusted secondary Certificate Authority (CA) from ctt_ca1T"
echo "====================================="
CERTCN=ctt_ca1T_ca2U
CURRENTCA=$CERTCN
X509_SUBJ=/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:$HOSTNAME:$CERTCN"					 
create_issued_ca "$CERTCN" "$X509_SUBJ" "ctt_ca1T" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
create_all_issued_certificates $CURRENTCA "trusted"

echo ""
echo ""
echo "====================================="
echo "= Create a trusted secondary Certificate Authority (CA) from ctt_ca1I"
echo "====================================="
CERTCN=ctt_ca1I_ca2T
CURRENTCA=$CERTCN
X509_SUBJ=/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:$HOSTNAME:$CERTCN"					 
create_issued_ca "$CERTCN" "$X509_SUBJ" "ctt_ca1I" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/trusted/certs" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/trusted/certs" || process_end_error
create_all_issued_certificates $CURRENTCA "trusted"
copy_needed_files "../crl/$CURRENTCA.crl" "$CS_AI_PKI/trusted/crl" || process_end_error
copy_needed_files "../crl/$CURRENTCA.crl" "$CS_USER_PKI/trusted/crl" || process_end_error

echo ""
echo ""
echo "====================================="
echo "= Create a issuers secondary Certificate Authority (CA) from ctt_ca1TC"
echo "====================================="
CERTCN=ctt_ca1TC_ca2I
CURRENTCA=$CERTCN
X509_SUBJ=/C=$CERTC/L=$CERTL/ST=$CERTS/O=$CERTO/CN=$CERTCN/DC=$HOSTNAME
G_SUBJECT_ALTERNATIVE_NAME="URI:urn:$HOSTNAME:$CERTCN"					 
create_issued_ca "$CERTCN" "$X509_SUBJ" "ctt_ca1TC" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_AI_PKI/issuers/certs" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/issuers/certs" || process_end_error
create_all_issued_certificates $CURRENTCA "issuers"
copy_needed_files "../crl/$CURRENTCA.crl" "$CS_AI_PKI/issuers/crl" || process_end_error
copy_needed_files "../crl/$CURRENTCA.crl" "$CS_USER_PKI/issuers/crl" || process_end_error

echo "Now we are starting to generate the user certificates"

echo ""
echo ""
echo "=========================================="
echo "= Creating a USER Certificate for the CTT"
echo "=========================================="
CERTCN=ctt_usrT
G_SUBJECT_ALTERNATIVE_NAME="URI:compliance@opcfoundation.org"
create_self_signed_certificate "$CERTCN" "//O=$CERTO/CN=$CERTCN/DC=$HOSTNAME" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/trusted/certs" || process_end_error

echo ""
echo ""
echo "=========================================================="
echo "Creating a 2nd (not trusted) USER Certificate for the CTT"
echo "=========================================================="
CERTCN=ctt_usrU
G_SUBJECT_ALTERNATIVE_NAME="URI:compliance@opcfoundation.org"
create_self_signed_certificate "$CERTCN" "//O=$CERTO/CN=$CERTCN/DC=$HOSTNAME" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error

echo ""
echo ""
echo "======================================="
echo "CTT Expired User Certificate - Trusted!"
echo "======================================="
CERTCN=ctt_usrTE
G_SUBJECT_ALTERNATIVE_NAME="URI:compliance@opcfoundation.org"
create_self_signed_certificate_validity "$CERTCN" "//O=$CERTO/CN=$CERTCN/DC=$HOSTNAME" $LASTYEAR"0101120000Z" $LASTYEAR"1206120000Z" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/trusted/certs" || process_end_error

echo ""
echo ""
echo "======================================="
echo "CTT Expired User Certificate - Not Trusted!"
echo "======================================="
CERTCN=ctt_usrUE
G_SUBJECT_ALTERNATIVE_NAME="URI:compliance@opcfoundation.org"
create_self_signed_certificate_validity "$CERTCN" "//O=$CERTO/CN=$CERTCN/DC=$HOSTNAME" $LASTYEAR"0101120000Z" $LASTYEAR"1206120000Z" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error

echo ""
echo ""
echo "======================================="
echo "CTT Not Yet Valid User Certificate!"
echo "======================================="
CERTCN=ctt_usrTV
G_SUBJECT_ALTERNATIVE_NAME="URI:compliance@opcfoundation.org"
create_self_signed_certificate_validity "$CERTCN" "//O=$CERTO/CN=$CERTCN/DC=$HOSTNAME" $NEXTYEAR"0101120000Z" $NEXTYEAR"0601120000Z" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/trusted/certs" || process_end_error

echo ""
echo ""
echo "======================================="
echo "CTT Incorrectly Signed USER certificate"
echo "======================================="
CERTCN=ctt_usrTSincorrect
G_SUBJECT_ALTERNATIVE_NAME="URI:compliance@opcfoundation.org"
create_self_signed_certificate "$CERTCN" "$X509_SUBJ" || process_end_error
invalidate_certificate_signature "$CERTCN" || process_end_error
G_SUBJECT_ALTERNATIVE_NAME=$SUBJECT_ALTERNATIVE_NAME
deploy_certificate "$CERTCN" "$DEPLOYED_SERVER_STORE_PATH" || process_end_error
copy_needed_files "$CERTCN.der" "$CS_USER_PKI/trusted/certs" || process_end_error


process_end_success
