Refactor CA management and certificate generation

- Removed the legacy simple-ca.sh script, consolidating functionality into Go code.
- Introduced a JSON configuration file (simple-ca.json) to manage CA settings, including validity periods and AIA base URLs.
- Enhanced the makeCA function to utilize configuration values for CA creation and AIA URL management.
- Updated makeCert and makePFX functions to support configuration-driven behavior.
- Improved error handling and user feedback throughout the CA and certificate generation processes.
- Added support for using Apple's OpenSSL for PKCS#12 file generation.

run-tests.sh

@@ -22,7 +22,7 @@
 # SOFTWARE.
 
 # This script runs integration tests against one or more simple-ca implementations.
-# Usage: run-tests.sh [bash|python|go|all]   (default: all)
+# Usage: run-tests.sh [python|go|all]   (default: all)
 set -e
 
 TEST_TARGET="${1:-all}"
@@ -56,6 +56,21 @@ display_certificate() {
     fi
 }
 
+# verify_pfx LABEL PFX_PATH PASSWORD PATTERN
+# Checks that PATTERN appears in the pkcs12 -info output (case-insensitive).
+verify_pfx_algo() {
+    local LABEL="$1" PFX_PATH="$2" PASSWORD="$3" PATTERN="$4"
+    local INFO
+    INFO=$(openssl pkcs12 -in "$PFX_PATH" -noout -info -password "pass:$PASSWORD" 2>&1)
+    if echo "$INFO" | grep -qi "$PATTERN"; then
+        echo "PFX [$LABEL]: OK"
+    else
+        echo "ERROR: PFX [$LABEL]: expected pattern '$PATTERN' not found in:" >&2
+        echo "$INFO" >&2
+        exit 1
+    fi
+}
+
 # run_flow NAME MAKE_CA_CMD MAKE_CERT_CMD MAKE_PFX_CMD
 # Command variables are left unquoted on use, so multi-word prefixes
 # (e.g. "python3 simple-ca.py make-ca") word-split as expected.
@@ -74,6 +89,7 @@ run_flow() {
     echo "--- [$NAME] Standalone CA ---"
     clean_up_test_dir
     $MAKE_CA_CMD --ca-dir "$CA_DIR" "Test CA"
+    [[ -f "$CA_DIR/simple-ca.json" ]] || { echo "ERROR: simple-ca.json not created" >&2; exit 1; }
     display_certificate "$CA_DIR/ca_cert.pem"
     $MAKE_CERT_CMD --ca-dir "$CA_DIR" --cert-dir "$CERT_DIR" "test" "test.example.com" "127.0.0.1"
     display_certificate "$CERT_DIR/test_cert.pem"
@@ -82,9 +98,10 @@ run_flow() {
     echo "--- [$NAME] Two-level CA ---"
     clean_up_test_dir
     $MAKE_CA_CMD --ca-dir "$CA_DIR" "Test Two Level CA"
+    [[ -f "$CA_DIR/simple-ca.json" ]] || { echo "ERROR: simple-ca.json not created" >&2; exit 1; }
     display_certificate "$CA_DIR/ca_cert.pem"
     $MAKE_CA_CMD --ca-dir "$CA_DIR" --issuing-ca "issuing_ca" "Issuing CA"
-    display_certificate "$CA_DIR/issuing_ca_cert.pem"
+    display_certificate "$CA_DIR/issuing_ca/ca_cert.pem"
     $MAKE_CERT_CMD --ca-dir "$CA_DIR" --cert-dir "$CERT_DIR" --issuing-ca "issuing_ca" "test" "test.example.com" "127.0.0.1"
     display_certificate "$CERT_DIR/test_cert.pem"
     $MAKE_PFX_CMD --ca-dir "$CA_DIR" --issuing-ca "issuing_ca" --password "s3cr3t" "$CERT_DIR/test_cert.pem"
@@ -93,17 +110,52 @@ run_flow() {
     openssl pkcs12 -in "$CERT_DIR/test.pfx" -noout -info -password pass:"s3cr3t"
 }
 
+# run_pfx_algorithm_tests NAME MAKE_CA_CMD MAKE_CERT_CMD MAKE_PFX_CMD
+# Tests modern, legacy, and (on macOS) --apple-openssl PKCS12 variants.
+run_pfx_algorithm_tests() {
+    local NAME="$1"
+    local MAKE_CA_CMD="$2"
+    local MAKE_CERT_CMD="$3"
+    local MAKE_PFX_CMD="$4"
+
+    echo
+    echo "--- [$NAME] PFX algorithm variants ---"
+    clean_up_test_dir
+    $MAKE_CA_CMD --ca-dir "$CA_DIR" "PFX Test CA"
+    $MAKE_CA_CMD --ca-dir "$CA_DIR" --issuing-ca "issuing_ca" "Issuing CA"
+    $MAKE_CERT_CMD --ca-dir "$CA_DIR" --cert-dir "$CERT_DIR" --issuing-ca "issuing_ca" \
+        "test" "test.example.com" "127.0.0.1"
+
+    # Modern (default): OpenSSL 3.x PBES2/AES-256
+    $MAKE_PFX_CMD --ca-dir "$CA_DIR" --issuing-ca "issuing_ca" --password "s3cr3t" \
+        "$CERT_DIR/test_cert.pem"
+    verify_pfx_algo "modern" "$CERT_DIR/test.pfx" "s3cr3t" "PBES2"
+    rm "$CERT_DIR/test.pfx"
+
+    # Apple openssl (macOS only): verify the switch routes to /usr/bin/openssl
+    # and that the result is readable by Apple's binary (not PBES2).
+    if [[ "$(uname)" == "Darwin" ]]; then
+        $MAKE_PFX_CMD --apple-openssl --ca-dir "$CA_DIR" --issuing-ca "issuing_ca" --password "s3cr3t" \
+            "$CERT_DIR/test_cert.pem"
+        /usr/bin/openssl pkcs12 -in "$CERT_DIR/test.pfx" -noout -info -password pass:"s3cr3t" 2>&1
+        # Confirm Apple's binary produced its own (non-PBES2) format
+        INFO=$(/usr/bin/openssl pkcs12 -in "$CERT_DIR/test.pfx" -noout -info -password pass:"s3cr3t" 2>&1)
+        if echo "$INFO" | grep -qi "PBES2"; then
+            echo "ERROR: PFX [apple-openssl]: unexpected PBES2 — Apple binary was not used" >&2
+            exit 1
+        fi
+        echo "PFX [apple-openssl]: OK"
+        rm "$CERT_DIR/test.pfx"
+    fi
+}
+
 # Uses ;;& to fall through to subsequent patterns so 'all' matches every block.
 case "$TEST_TARGET" in
-    bash|all)
-        # shellcheck disable=SC1091
-        source "$SCRIPT_DIR/simple-ca.sh"
-        run_flow "bash" "make_ca" "make_cert" "make_pfx"
-        ;;&
     python|all)
         command -v python3 >/dev/null || { echo "ERROR: python3 not found" >&2; exit 1; }
         PY_PREFIX="python3 $SCRIPT_DIR/simple-ca.py"
         run_flow "python" "$PY_PREFIX make-ca" "$PY_PREFIX make-cert" "$PY_PREFIX make-pfx"
+        run_pfx_algorithm_tests "python" "$PY_PREFIX make-ca" "$PY_PREFIX make-cert" "$PY_PREFIX make-pfx"
         ;;&
     go|all)
         command -v go >/dev/null || { echo "ERROR: go not found" >&2; exit 1; }
@@ -112,11 +164,12 @@ case "$TEST_TARGET" in
         echo "Building Go binary..."
         (cd "$GO_SRC" && go build -o simple-ca .)
         run_flow "go" "$GO_BIN make-ca" "$GO_BIN make-cert" "$GO_BIN make-pfx"
+        run_pfx_algorithm_tests "go" "$GO_BIN make-ca" "$GO_BIN make-cert" "$GO_BIN make-pfx"
         ;;&
-    bash|python|go|all)
+    python|go|all)
         ;;
     *)
-        echo "ERROR: unknown target '$TEST_TARGET' (expected: bash|python|go|all)" >&2
+        echo "ERROR: unknown target '$TEST_TARGET' (expected: python|go|all)" >&2
         exit 1
         ;;
 esac