Latest Updates done, before integrating

infra/ca/issue-client-cert.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# issue-client-cert.sh — Issue a client cert for one device.
+#
+# Usage: ./issue-client-cert.sh <device-name>
+# Example: ./issue-client-cert.sh lutz-iphone
+#
+# Outputs <device-name>.p12 — install on the device after enrolling ca.crt.
+# See enroll-iphone.md for the full iPhone enrollment flow.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+NAME="${1:?Usage: $0 <device-name>   e.g.: $0 lutz-iphone}"
+
+if [[ ! -f ca.key ]]; then
+    echo "ERROR: ca.key not found. Run gen-ca.sh first."
+    exit 1
+fi
+
+if [[ -f "${NAME}.p12" ]]; then
+    echo "WARNING: ${NAME}.p12 already exists. Overwriting."
+fi
+
+echo "Issuing client cert for: ${NAME}"
+echo "You will be prompted for a PKCS12 export password."
+echo "Use a strong password — you will need it during iPhone installation."
+echo ""
+
+openssl req -newkey rsa:2048 -nodes \
+    -keyout "${NAME}.key" \
+    -out "${NAME}.csr" \
+    -subj "/CN=${NAME}/O=FamFi/C=DE"
+
+openssl x509 -req \
+    -in "${NAME}.csr" \
+    -CA ca.crt \
+    -CAkey ca.key \
+    -CAcreateserial \
+    -out "${NAME}.crt" \
+    -days 825 \
+    -sha256 \
+    -extfile <(printf "basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature\nextendedKeyUsage=clientAuth\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid")
+
+openssl pkcs12 -export \
+    -out "${NAME}.p12" \
+    -inkey "${NAME}.key" \
+    -in "${NAME}.crt" \
+    -certfile ca.crt \
+    -name "${NAME} EMS"
+
+chmod 600 "${NAME}.key" "${NAME}.p12"
+rm -f "${NAME}.csr" "${NAME}.crt"
+
+echo ""
+echo "Done: ${NAME}.p12"
+echo "AirDrop to iPhone, then follow enroll-iphone.md."