#!/bin/bash

# 1. Generate CA private key (if not already done)
##openssl genrsa -out ca.key 4096

# 2. Generate CA certificate (if not already done)
##openssl req -x509 -new -nodes -key ca.key -sha256 -days 1024 -out ca.crt -subj "/CN=IT24 CA"

# 3. Generate a single client private key to be shared
##openssl genrsa -out client_shared.key 2048

# 4. Generate 10 client certificates
for i in {1..10}
do
    # Format the client number with leading zeros (up to 3 digits)
    client_num=$(printf "%03d" $i)
    
    # Generate CSR
    openssl req -new -key client_shared.key -out client-$client_num.csr -subj "/CN=TestClient-$i"
    
    # Generate client certificate
    openssl x509 -req -in client-$client_num.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client-$client_num.crt -days 365 -sha256
    
    # Verify the client certificate
    openssl verify -CAfile ca.crt client-$client_num.crt
    
    # Convert to PKCS#12 format
    openssl pkcs12 -export -legacy -out client-$client_num.p12 -inkey client_shared.key -in client-$client_num.crt -certfile ca.crt -passout pass:
    
    echo "Generated certificate for client-$client_num"
done

# Clean up CSR files
rm client-*.csr

echo "All certificates generated successfully."

