#!/bin/bash

# Author: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
# Date: 2010-12-20 20:54:55-0500

# On a system with keys for https (or some other X.509-using protocol)
# already imported into monkeysphere-host, this script generates X.509
# certificate requests for each key, with appropriate subjectAltNames
# and the PGPExtension embedded.

# The generated requests get dumped to stdout. redirect to a file or
# copy/paste if you want to save them/send them someplace.

# This script uses bashisms

# It currently needs OpenSSL binaries to work properly

# It assumes that the monkeysphere-host keyring is in
# /var/lib/monkeysphere/host (which it is on debian)

# This should probably eventually be incorporated into
# monkeysphere-host directly.

get_openssl_config() {
    # first param is seconds since the epoch:
    X509_PGP_EXTENSION="$(TZ=UTC date -d "@$1" '+%Y%m%d%H%M%SZ')"
    # next parameter is SAN names, separated by newlines:
    SUBJECTALTNAME=$(printf "%s" "$2" | sed 's/^/DNS:/' | tr '\n' ',' | \
        sed -e 's/,*$//' -e 's/^,*//')

    printf "sAN: %s\n" "$SUBJECTALTNAME" >&2

    cat <<EOF
default_md              = sha256
oid_section		= new_oids

[ new_oids ]
PGPExtension = 1.3.6.1.4.1.3401.8.1.1 

[ req ]
distinguished_name	= req_distinguished_name
req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]
commonName			= Common Name (e.g. www.example.org)
commonName_max			= 64

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = $SUBJECTALTNAME
PGPExtension = ASN1:SEQUENCE:pgp_sect

[ pgp_sect ]
# see http://www.alvestrand.no/objectid/submissions/1.3.6.1.4.1.3401.8.1.1.html
# this is equivalent to:
#   Version  ::=  INTEGER  {  v1(0) }
version = INTEGER:0

# this is the OpenPGP creation timestamp
keyCreation = GENERALIZEDTIME:$X509_PGP_EXTENSION
EOF
}

gencertreq() {
    keyid="$1"
    
    timestamp=$(gpg --fixed-list-mode --with-colons --list-keys "0x$keyid!" | grep ^pub: | cut -f6 -d:)
    
    san=''
    primary=''
# find all the $proto-using User IDs:
    uids=$(gpg --fixed-list-mode --with-colons --list-keys "0x$keyid!" | \
        grep '^uid:' | cut -f10 -d: | \
        grep '^'"${proto}"'\\x3a//' | \
        sed -r -e 's!^'"${proto}"'\\x3a//!!' -e 's!:[0-9]+$!!')
    primary=$(printf "%s" "$uids" | head -n1)
    
    printf "Certificate Request for TLS WWW server %s\n[OpenPGP key %s]\n" "$primary" "$keyid"
    openssl req -text -new \
        -config <(get_openssl_config "$timestamp" "$uids") \
        -key <(gpg --export-secret-key "$keyid" | openpgp2ssh "$keyid") \
        -subj "/CN=${primary}/"
}


export GNUPGHOME=/var/lib/monkeysphere/host
# default to looking for https keys.
proto="${1:-https}"

for fpr in $(gpg --fixed-list-mode --with-colons --fingerprint --list-secret-keys "${proto}://" | grep '^fpr:' | cut -f10 -d:); do
    gencertreq "$fpr"
done
ected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><div class='diffstat-header'><a href='/notmuch/diff/?h=master'>Diffstat</a> (limited to 'tags/a8/ca')</div><table summary='diffstat' class='diffstat'><tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/000901c08c95%25241ba3a8a0%25241dfeffc2@k62500/inbox?h=master'>tags/a8/ca/000901c08c95%241ba3a8a0%241dfeffc2@k62500/inbox</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/000901c08c95%25241ba3a8a0%25241dfeffc2@k62500/old?h=master'>tags/a8/ca/000901c08c95%241ba3a8a0%241dfeffc2@k62500/old</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/13BDF24CAE3F4FFCBC6D5F366278E9D0.MAI@194.65.93.244/attachment?h=master'>tags/a8/ca/13BDF24CAE3F4FFCBC6D5F366278E9D0.MAI@194.65.93.244/attachment</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/13BDF24CAE3F4FFCBC6D5F366278E9D0.MAI@194.65.93.244/inbox?h=master'>tags/a8/ca/13BDF24CAE3F4FFCBC6D5F366278E9D0.MAI@194.65.93.244/inbox</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/13BDF24CAE3F4FFCBC6D5F366278E9D0.MAI@194.65.93.244/killed?h=master'>tags/a8/ca/13BDF24CAE3F4FFCBC6D5F366278E9D0.MAI@194.65.93.244/killed</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/13BDF24CAE3F4FFCBC6D5F366278E9D0.MAI@194.65.93.244/unread?h=master'>tags/a8/ca/13BDF24CAE3F4FFCBC6D5F366278E9D0.MAI@194.65.93.244/unread</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/20111021144856.GA31987@crater2.logilab.fr/debian?h=master'>tags/a8/ca/20111021144856.GA31987@crater2.logilab.fr/debian</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/20111021144856.GA31987@crater2.logilab.fr/signed?h=master'>tags/a8/ca/20111021144856.GA31987@crater2.logilab.fr/signed</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/20170122234446.EA81E6A0@xayide.jones.dk/inbox?h=master'>tags/a8/ca/20170122234446.EA81E6A0@xayide.jones.dk/inbox</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/20170122234446.EA81E6A0@xayide.jones.dk/old?h=master'>tags/a8/ca/20170122234446.EA81E6A0@xayide.jones.dk/old</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/20181109030002.172A71CC160@lxp5.free-owl.de/sys?h=master'>tags/a8/ca/20181109030002.172A71CC160@lxp5.free-owl.de/sys</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/20181109030002.172A71CC160@lxp5.free-owl.de/unread?h=master'>tags/a8/ca/20181109030002.172A71CC160@lxp5.free-owl.de/unread</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/20210919172027.C4DA431E2@xayide.jones.dk/unread?h=master'>tags/a8/ca/20210919172027.C4DA431E2@xayide.jones.dk/unread</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/E1nu5Rw-0004JJ-42@respighi.debian.org/debian?h=master'>tags/a8/ca/E1nu5Rw-0004JJ-42@respighi.debian.org/debian</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/E1nu5Rw-0004JJ-42@respighi.debian.org/inbox?h=master'>tags/a8/ca/E1nu5Rw-0004JJ-42@respighi.debian.org/inbox</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/E1nu5Rw-0004JJ-42@respighi.debian.org/killed?h=master'>tags/a8/ca/E1nu5Rw-0004JJ-42@respighi.debian.org/killed</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='add'><a href='/notmuch/diff/tags/a8/ca/E1nu5Rw-0004JJ-42@respighi.debian.org/unread?h=master'>tags/a8/ca/E1nu5Rw-0004JJ-42@respighi.debian.org/unread</a></td><td class='right'>0</td><td class='graph'><table summary='file diffstat' width='0%'><tr><td class='add' style='width: -nan%;'/><td class='rem' style='width: -nan%;'/><td class='none' style='width: -nan%;'/></tr></table></td></tr>
</table><div class='diffstat-summary'>17 files changed, 0 insertions, 0 deletions</div><table summary='diff' class='diff'><tr><td>