Latest Updates done, before integrating

infra/ca/gen-server-cert.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# gen-server-cert.sh — Generate the Traefik server cert for ems.famfi.dyndns.org.
+#
+# Signed by the private CA. Once ca.crt is trusted on a device,
+# this cert is accepted without warnings.
+# Renew annually (before 825-day expiry) by re-running this script.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+DOMAIN="${1:-ems.famfi.dyndns.org}"
+
+if [[ ! -f ca.key ]]; then
+    echo "ERROR: ca.key not found. Run gen-ca.sh first."
+    exit 1
+fi
+
+echo "Generating server cert for ${DOMAIN}..."
+
+openssl req -newkey rsa:2048 -nodes \
+    -keyout server.key \
+    -out server.csr \
+    -subj "/CN=${DOMAIN}/O=FamFi/C=DE"
+
+openssl x509 -req \
+    -in server.csr \
+    -CA ca.crt \
+    -CAkey ca.key \
+    -CAcreateserial \
+    -out server.crt \
+    -days 825 \
+    -sha256 \
+    -extfile <(printf "basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:%s\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid" "$DOMAIN")
+
+chmod 600 server.key
+rm -f server.csr
+
+echo ""
+echo "Done: server.crt + server.key for ${DOMAIN}"
+echo ""
+echo "Deploy certs to Synology (run from infra/ca/):"
+echo "  ssh user@synology 'mkdir -p /etc/ems/certs'"
+echo "  scp ca.crt server.crt server.key user@synology:/etc/ems/certs/"
+echo "  ssh user@synology 'chmod 600 /etc/ems/certs/server.key'"
+echo ""
+echo "Traefik will pick up the new cert on next container restart."