# Root CA certificate
openssl req \
    -x509 \
    -newkey rsa:4096 \
    -keyout ca_key.pem \
    -out ca_cert.pem \
    -days 3650 \
    -noenc \
    -subj "/CN=Test CA $(date +"%Y-%m-%d")" \
    -text \
    -addext "basicConstraints=critical,CA:TRUE,pathlen:1" \
    -addext "keyUsage=critical,keyCertSign,cRLSign"

# Issuing CA certificate
openssl req \
    -newkey rsa:4096 \
    -keyout issuing_ca_key.pem \
    -noenc \
    -subj "/CN=Issuing Test CA $(date +"%Y-%m-%d")" \
    -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
    -addext "keyUsage=critical,keyCertSign,cRLSign" |
    openssl x509 \
        -req \
        -CA ca_cert.pem \
        -CAkey ca_key.pem \
        -copy_extensions copyall \
        -days 3650 \
        -text \
        -out issuing_ca_cert.pem

# Client signing request
openssl req \
    -newkey rsa:4096 \
    -keyout client_key.pem \
    -out client_req.pem \
    -noenc \
    -subj "/CN=Test Client" \
    -addext "basicConstraints=critical,CA:FALSE" \
    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
    -addext "extendedKeyUsage=clientAuth"

# Server signing request
openssl req \
    -newkey rsa:4096 \
    -keyout server_key.pem \
    -out server_req.pem \
    -noenc \
    -subj "/CN=test.example.com" \
    -addext "basicConstraints=critical,CA:FALSE" \
    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
    -addext "extendedKeyUsage=serverAuth" \
    -addext "subjectAltName=DNS:test.example.com,DNS:test,IP:127.0.0.1"

# User signing request
openssl req \
    -newkey rsa:4096 \
    -keyout user_key.pem \
    -out user_req.pem \
    -noenc \
    -subj "/CN=Test User/emailAddress=testuser@example.com" \
    -addext "basicConstraints=critical,CA:FALSE" \
    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
    -addext "extendedKeyUsage=clientAuth,emailProtection,codeSigning" \
    -addext "subjectAltName=email:alias@example.com"

# Sign client certificate with issuing CA
openssl x509 \
    -req \
    -in client_req.pem \
    -CA issuing_ca_cert.pem \
    -CAkey issuing_ca_key.pem \
    -copy_extensions copyall \
    -days 365 \
    -out client_cert.pem

# Sign server certificate with issuing CA
openssl x509 \
    -req \
    -in server_req.pem \
    -CA issuing_ca_cert.pem \
    -CAkey issuing_ca_key.pem \
    -copy_extensions copyall \
    -days 365 \
    -out server_cert.pem

# Sign user certificate with issuing CA
openssl x509 \
    -req \
    -in user_req.pem \
    -CA issuing_ca_cert.pem \
    -CAkey issuing_ca_key.pem \
    -copy_extensions copyall \
    -days 365 \
    -out user_cert.pem

# Certificate chain for PKCS#12 bundles
cat issuing_ca_cert.pem ca_cert.pem > ca_chain.pem

# Client PKCS#12 bundle
openssl pkcs12 \
    -export \
    -out client.pfx \
    -inkey client_key.pem \
    -in client_cert.pem \
    -certfile ca_chain.pem \
    -passout pass:changeit

# Server PKCS#12 bundle
openssl pkcs12 \
    -export \
    -out server.pfx \
    -inkey server_key.pem \
    -in server_cert.pem \
    -certfile ca_chain.pem \
    -passout pass:changeit

# User PKCS#12 bundle
openssl pkcs12 \
    -export \
    -out user.pfx \
    -inkey user_key.pem \
    -in user_cert.pem \
    -certfile ca_chain.pem \
    -passout pass:changeit