Latest Updates done, before integrating

infra/ca/gen-ca.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# gen-ca.sh — Generate the EMS root CA (one-time operation).
+#
+# Outputs: ca.key (KEEP SECRET) and ca.crt (distribute to all devices).
+# ca.key must be backed up encrypted and kept off the Synology.
+# Losing ca.key means all devices must re-enroll after generating a new CA.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+if [[ -f ca.key ]]; then
+    echo "ERROR: ca.key already exists."
+    echo "Delete it explicitly if you intend to replace the CA."
+    echo "WARNING: a new CA invalidates ALL existing server and client certs — every device must re-enroll."
+    exit 1
+fi
+
+echo "Generating EMS root CA (RSA-4096, 10 years)..."
+
+openssl req -x509 -newkey rsa:4096 -sha256 \
+    -days 3650 \
+    -keyout ca.key \
+    -out ca.crt \
+    -nodes \
+    -subj "/CN=EMS Private CA/O=FamFi/C=DE" \
+    -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign" \
+    -addext "subjectKeyIdentifier=hash"
+
+chmod 600 ca.key
+
+echo ""
+echo "Done."
+echo "  ca.crt  — distribute to devices (install as trusted root)"
+echo "  ca.key  — KEEP SECRET: store in encrypted backup, remove from Synology after cert issuance"
+echo ""
+echo "Next steps:"
+echo "  ./gen-server-cert.sh          # server cert for Traefik"
+echo "  ./issue-client-cert.sh <name> # one per device"