#!/bin/sh
#
# PostgreSQL certification with RSA
#
# 2003-10-25
#   Changed for PostgreSQL
# 2003-04-22
#   Fix csr generation
# 2002-04-02
#   Changed to auto generation.
# 2001-12-02
#   This script delived from mod_ssl installation script.
#   Featureing for Plamo Linux installation.
#

openssl=$ROOT/usr/bin/openssl
sslkeydir=$ROOT/opt/pgsql/apps/utils/cert
sslcsrdir=$sslkeydir
sslcrtdir=$sslkeydir

if ! [ -x $openssl ]; then
   if [ -x /usr/ssl/bin/openssl ]; then
     openssl=/usr/ssl/bin/openssl
   else
      if [ -x /usr/local/bin/openssl ]; then
        openssl=/usr/local/bin/openssl
      else
        echo "############################################"
	echo "# Please run                               #"
	echo "#       $0                       #"
        echo "#               after you install openssh. #"
        echo "############################################"
      fi
   fi
fi

# STEP 1: Generating RSA private key (1024 bit) [server.key]
randfiles=''    
for file in /var/log/messages /var/adm/messages /var/log/system.log /var/wtmp \
            /kernel /kernel/genunix /vmunix /vmlinuz /mach \
            /etc/hosts /etc/group /etc/resolv.conf /bin/ls; do
    if [ -r $file ]; then
        if [ ".$randfiles" = . ]; then
            randfiles="$file"
        else
            randfiles="${randfiles}:$file" 
        fi
    fi           
done                            
$openssl genrsa -rand $randfiles -out $sslkeydir/server.key 1024
if [ $? -ne 0 ]; then
    echo "Error: Failed to generate RSA private key" 1>&2
    exit 1
fi


# STEP 2: Generating X.509 certificate signing request [server.csr]
cat >.mkrsakey.cfg <<EOT
[ req ]
default_bits                    = 1024
distinguished_name     = req_DN
prompt                 = no

[ req_DN ]
countryName                     = JP
stateOrProvinceName             = "Tokyo"
localityName                    = "Yokohama"
0.organizationName              = "JPUG"
organizationalUnitName          = "PGROM WG"
commonName                      = LOCALHOST
emailAddress                    = postgres@LOCALHOST
EOT
$openssl     req -config .mkrsakey.cfg \
             -new \
             -text \
             -key $sslkeydir/server.key \
             -out $sslcsrdir/server.csr
rm -f .mkrsakey.cfg

if [ $? -ne 0 ]; then
    echo "Error: Failed to generate certificate signing request" 1>&2
    exit 1
fi


# STEP 3: Generating X.509 certificate signed by private key
days=365
$openssl req -x509 \
              -days $days \
              -in $sslcsrdir/server.csr \
              -text \
              -key $sslkeydir/server.key \
              -out $sslcrtdir/server.crt

#########################################################
# Exitting to make plain key.                           #
# Actual key should be re-created for your instalation. #

exit
#########################################################

# STEP 4: Enrypting RSA private key with a pass phrase for security [server.key] 
# The contents of the server.key file (the generated private key) has to be
# kept secret. So we strongly recommend you to encrypt the server.key file
# with a Triple-DES cipher and a Pass Phrase.
(umask 077
 $openssl rsa -des3 \
              -in  $sslkeydir/server.key \
              -out $sslkeydir/server.key.crypt)
if [ $? -ne 0 ]; then
    echo "Error: Failed to encrypt $algo private key" 1>&2
    exit 1
fi
(umask 077; cp $sslkeydir/server.key.crypt $sslkeydir/server.key)
rm -f $sslkeydir/server.key.crypt

