#!/usr/bin/env bash
# issue-client-cert.sh — Issue a client cert for one device.
#
# Usage: ./issue-client-cert.sh <device-name>
# Example: ./issue-client-cert.sh lutz-iphone
#
# Outputs <device-name>.p12 — install on the device after enrolling ca.crt.
# See enroll-iphone.md for the full iPhone enrollment flow.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
cd "$SCRIPT_DIR"

NAME="${1:?Usage: $0 <device-name>   e.g.: $0 lutz-iphone}"

if [[ ! -f ca.key ]]; then
    echo "ERROR: ca.key not found. Run gen-ca.sh first."
    exit 1
fi

if [[ -f "${NAME}.p12" ]]; then
    echo "WARNING: ${NAME}.p12 already exists. Overwriting."
fi

echo "Issuing client cert for: ${NAME}"
echo "You will be prompted for a PKCS12 export password."
echo "Use a strong password — you will need it during iPhone installation."
echo ""

openssl req -newkey rsa:2048 -nodes \
    -keyout "${NAME}.key" \
    -out "${NAME}.csr" \
    -subj "/CN=${NAME}/O=FamFi/C=DE"

openssl x509 -req \
    -in "${NAME}.csr" \
    -CA ca.crt \
    -CAkey ca.key \
    -CAcreateserial \
    -out "${NAME}.crt" \
    -days 825 \
    -sha256 \
    -extfile <(printf "basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature\nextendedKeyUsage=clientAuth\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid")

openssl pkcs12 -export \
    -out "${NAME}.p12" \
    -inkey "${NAME}.key" \
    -in "${NAME}.crt" \
    -certfile ca.crt \
    -name "${NAME} EMS"

chmod 600 "${NAME}.key" "${NAME}.p12"
rm -f "${NAME}.csr" "${NAME}.crt"

echo ""
echo "Done: ${NAME}.p12"
echo "AirDrop to iPhone, then follow enroll-iphone.md."