#!/usr/bin/bash
# Usage: request_cert.sh <filename.json>
# Sample JSON:
# {
#                  "common_name": "",
#                  "alt_names": "",
#                  "ip_sans": "212.12.255.3,212.12.255.4,213.12.255.3,213.12.255.4",
#                  "ttl": "180d"

# }
#
# Simple Usage: request_cert.sh -s <fqdn>
#

set -eu

if [ -z "${VAULT_TOKEN-}" ]; then
   read -p USER: LDAPUSER
   read -s -p PASSWORD: LPDAPASSWD
   login_request_data=$(jq -c -n --arg password "$LDAPUSER" '{$password}'
   login_response_data=$(curl -Ssf -H "Content-Type: application/json" -d "$login_request_data" https://vault.dings:8199/v1/auth/ldap/login/$LDAPUSER)
   VAULT_TOKEN=$(echo "$login_response_data" | jq -r ".auth.client_token")
   echo $VAULT_TOKEN
fi

# These two extended regular expression are matching
# RFC952, B. Lexical grammar, <name> and <hname>, respectively
readonly RFC952_name_ERE='[0-9A-Za-z]([0-9A-Za-z-]*[0-9A-Za-z])?'
readonly RFC952_hname_ERE="$name_ERE(\\.$name_ERE)*"

# usage: is_hostname STRING
# Check if STRING is a valid host name per RFC952
is_hostname() {
  echo "$1" | grep -Eq "^$RFC952_hname_ERE\$"
}

if [ $# = 2 ] && [ "$1" = -s ]; then
   CN=$2
   if ! is_hostname "$CN"; then
     echo "error: specified FQDN is not a valid hostname: $CN" >&2
     exit 1
   fi
   cert_request_data=$(jq -c -n --arg common_name "$CN" --arg ttl 90d '{$common_name,$ttl}'
elif [ $# = 1 ]; then
   CN=$( cat $1 | jq -r ".common_name" )
   if ! is_hostname "$CN"; then
     echo "error: common_name in $1 is not a valid hostname: $CN" >&2
     exit 1
   fi
   cert_request_data=$(cat "$1")
else
   echo "USAGE: $0 -s <fqdn>|<filename>"
   exit 1
fi

DATA=$(echo "$cert_request_data" | curl -Ssf -H "X-Vault-Token: $VAULT_TOKEN" -d @- https://vault.dings:8200/v1/pki_rz_q-ca_2021aa/issue/rz-drv)

if [ -d $CN ]; then
   rm -r $CN
fi

mkdir $CN

echo $DATA > $CN/$CN.json
echo $DATA | jq -r '.data.certificate' > $CN/$CN.cer
echo $DATA | jq -r '.data.private_key' > $CN/$CN.key
echo $DATA | jq -r '.data.ca_chain|join("\n")' > $CN/$CN.ca_chain
cat $CN/$CN.cer $CN/$CN.ca_chain > $CN/$CN.cer_with_ca_chain