#!/bin/bash

#
# (c) 2013 Heinlein Support GmbH
#          Robert Sander <r.sander@heinlein-support.de>
#

# This is free software;  you can redistribute it and/or modify it
# under the  terms of the  GNU General Public License  as published by
# the Free Software Foundation in version 2.  This file is distributed
# in the hope that it will be useful, but WITHOUT ANY WARRANTY;  with-
# out even the implied warranty of  MERCHANTABILITY  or  FITNESS FOR A
# PARTICULAR PURPOSE. See the  GNU General Public License for more de-
# ails.  You should have  received  a copy of the  GNU  General Public
# License along with GNU Make; see the file  COPYING.  If  not,  write
# to the Free Software Foundation, Inc., 51 Franklin St,  Fifth Floor,
# Boston, MA 02110-1301 USA.

OPENSSL=$(which openssl)

if [ ! -x "$OPENSSL" ]; then
  exit
fi

CERT_DIRS="/etc/ssl/certs"

CONFIG_FILE="$MK_CONFDIR/sslcertificates"

if [ -r "$CONFIG_FILE" ]; then

  . "$CONFIG_FILE"

fi

get_cert_info() {
    certfile="$1"
    single="$2"
    if [ -f "$certfile" -a -r "$certfile" -a \( ! -L "$certfile" -o "$single" \) ] && ! [[ $certfile =~ .*~$ ]] && ! [[ $certfile =~ .*_CA.crt$ ]] && ! [[ $certfile =~ .*/ca-certificates.crt$ ]]; then
        inform='DER'
        if grep -q -- '-----BEGIN CERTIFICATE-----' "$certfile"; then
            inform='PEM'
        fi

        cert_subject=$($OPENSSL x509 -inform $inform -noout -subject -nameopt utf8 -in "$certfile" 2> /dev/null) || return
        cert_subject=$(cut -d "=" -f 2- <<<"$cert_subject" | sed -e 's/"/\\"/g')
        if ! grep -q '@snakeoil.dom' <<<"$cert_subject"; then
            cert_startdate=$($OPENSSL x509 -inform $inform -noout -startdate -in "$certfile" | cut -d "=" -f 2 )
            cert_startdate_epoch=$(date --date "$cert_startdate" '+%s')
            cert_enddate=$($OPENSSL x509 -inform $inform -noout -enddate -in "$certfile" | cut -d "=" -f 2 )
            cert_enddate_epoch=$(date --date "$cert_enddate" '+%s')
            cert_algosign=$($OPENSSL x509 -inform $inform -noout -text -in "$certfile" | awk '/Signature Algorithm: / { print $3; exit;}' )
            cert_issuer_hash=$($OPENSSL x509 -inform $inform -noout -issuer_hash -in "$certfile" )
            cert_issuer=$($OPENSSL x509 -inform $inform -noout -issuer -nameopt utf8 -in "$certfile" | sed -e 's/ = /=/g' -e 's/, /,/g' -e 's/issuer=//' -e 's/"//g')
            cert_subjAltName=$($OPENSSL x509 -inform $inform -noout -ext subjectAltName -in "$certfile" | tail -1 | tr "," "\n" | sed -e 's/^ *//' | sed -e ':a; N; $!ba; s/\n/", "/g')
            if [ -n "$cert_subjAltName" ]; then
                cert_subjAltName=", \"subjAltName\": [\"$cert_subjAltName\"]"
            else
                cert_subjAltName=""
            fi

            echo "{\"file\": \"$certfile\", \"starts\": $cert_startdate_epoch, \"expires\": $cert_enddate_epoch, \"algosign\": \"$cert_algosign\", \"issuer_hash\": \"$cert_issuer_hash\", \"issuer\": \"$cert_issuer\", \"subj\": \"$cert_subject\"$cert_subjAltName}"
        fi
    fi
}

echo '<<<sslcertificates:sep(0)>>>'

for dir in $CERT_DIRS; do
    if [ -d "$dir" ]; then
        for certfile in "$dir"/*; do
            get_cert_info "$certfile"
        done
    else
        get_cert_info "$dir" 1
    fi
done

exit 0
