# Commands to create Privoxy Root CA certificate

# References:
#     * https://github.com/macports/macports-ports/blob/master/mail/mail-server/Portfile
#     * https://github.com/macports/macports-ports/blob/master/mail/mail-server/files/prefix/etc/certificates/ca/openssl.cnf
#     * https://www.dalesandro.net/create-self-signed-smime-certificates/
#     * https://jamielinux.com/docs/openssl-certificate-authority/index.html

# Clean start
# rm certs/ca.* index.txt* newcerts/* private/ca.key.pem serial* intermediate/certs/* intermediate/index.txt* intermediate/private/intermediate.key.pem intermediate/serial*


##################
# CA
##################

# Privoxy Root CA

# export SMIME_PKI_ROOT_DIR=$(pwd)
# mkdir ca
# cd "${SMIME_PKI_ROOT_DIR}/ca"
# mkdir certs crl newcerts private
# chmod 700 private
# touch index.txt
# echo 1000 > serial

# CA certificate encrypted key passphrase, both -passin and -passout
# sf-pwgen --algorithm memorable --count 2 --length 24 2>/dev/null | paste -s -d -- '-' \
#     1>private/passphrase.txt || true
# cat private/passphrase.txt private/passphrase.txt > private/passphrase-dbl.txt \
#     && mv private/passphrase-dbl.txt private/passphrase.txt \
#     || rm -f private/passphrase-dbl.txt
# chmod go-rwx private/passphrase.txt

# CA encrypted key
# EC
# openssl genpkey -out private/ca.key.pem -algorithm EC \
#     -pkeyopt ec_paramgen_curve:P-384 -aes256 \
#     -pass file:private/passphrase.txt
#
# RSA
# # openssl genpkey -out private/ca.key.pem -algorithm RSA \
# #     -pkeyopt rsa_keygen_bits:2048 -aes256 \
# #     -pass file:private/passphrase.txt

# CA certificate
# openssl req -config openssl.cnf \
#     -new -x509 -days 3650 -sha384 -extensions v3_ca -out certs/ca.cert.pem \
#     -key private/ca.key.pem -passin file:private/passphrase.txt -batch

# CA certificate text verification
# openssl x509 -text -noout -in certs/ca.cert.pem

# CA certificate openssl self-verification
# openssl verify -CAfile certs/ca.cert.pem certs/ca.cert.pem

# CA convert to PKCS12
# Note: `man openssl`: "If the same pathname
#     argument is supplied to -passin and -passout arguments then the
#     first line will be used for the input password and the next line
#     for the output password."
# https://developer.apple.com/forums/thread/697030
# openssl pkcs12 -legacy -export -out certs/ca.p12 \
#     -inkey private/ca.key.pem -in certs/ca.cert.pem \
#     -passin file:private/passphrase.txt \
#     -passout file:private/passphrase.txt
# verify .p12 passphrase
# openssl pkcs12 -legacy -noout -in certs/ca.p12 -passin file:private/passphrase.txt

[ca]
default_ca        = CA_default

[ CA_default ]
# Directory and file locations.
dir               = .
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
RANDFILE          = $dir/private/.rand

# The root key and root certificate.
private_key       = $dir/private/ca.key.pem
certificate       = $dir/certs/ca.cert.pem

# For certificate revocation lists.
crlnumber         = $dir/crlnumber
crl               = $dir/crl/ca.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30

# SHA-1 is deprecated, so use SHA-2 instead.
default_md        = sha256

name_opt          = ca_default
cert_opt          = ca_default
default_days      = 1096
preserve          = no
policy            = policy_strict

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
# See the POLICY FORMAT section of `man ca`.
countryName             = optional
stateOrProvinceName     = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
# See the POLICY FORMAT section of the `ca` man page.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = optional
emailAddress            = optional

[req]
# Options for the `req` tool (`man req`).
# default_bits        = 4096
default_bits        = 2048
distinguished_name  = req_distinguished_name
string_mask         = utf8only

# SHA-1 is deprecated, so use SHA-2 instead.
default_md          = sha256

[req_distinguished_name]
countryName = US
countryName_default = US
countryName_min = 2
countryName_max = 2
stateOrProvinceName = Massachusetts
stateOrProvinceName_default = Massachusetts
localityName = Boston
localityName_default = Boston
0.organizationName = MacPorts
0.organizationName_default = MacPorts
organizationalUnitName = Privoxy
commonName = MacPorts Privoxy Root CA
commonName_default = MacPorts Privoxy Root CA
commonName_max = 64
emailAddress = macports-users@lists.macports.org
emailAddress_max = 40

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier = hash
#authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[ crl_ext ]
# Extension for CRLs (`man x509v3_config`).
authorityKeyIdentifier=keyid:always

[ ocsp ]
# Extension for OCSP signing certificates (`man ocsp`).
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning

[ smime ]
keyUsage = critical,nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = critical,email:copy
extendedKeyUsage = critical,emailProtection