#!/bin/bash
set -e

CA_DIR="/home/creylopez/SMIME"
CA_CONF="$CA_DIR/ca.cnf"
SMIME_CONF="$CA_DIR/smime.cnf"

if [ $# -lt 3 ]; then
    echo "Uso: $0 <nombre-comun> <email> <password> [dias]"
    echo "Ej: $0 \"Usuario Ejemplo\" usuario@example.com micontraseña 365"
    exit 1
fi

CN="$1"
EMAIL="$2"
PASS="$3"
DAYS="${4:-365}"
DIR="$CA_DIR/usuarios/$EMAIL"
KEY="$DIR/$EMAIL.key.pem"
CSR="$DIR/$EMAIL.csr.pem"
CERT="$DIR/$EMAIL.cert.pem"
PFX="$DIR/$EMAIL.p12"

mkdir -p "$DIR"

echo "[1/4] Generando clave privada..."
openssl genrsa -out "$KEY" 2048

echo "[2/4] Generando CSR..."
openssl req -config "$SMIME_CONF" \
    -key "$KEY" -new -sha256 -out "$CSR" \
    -subj "/C=ES/ST=Madrid/L=Madrid/O=MiCA/CN=$CN/emailAddress=$EMAIL"

echo "[3/4] Firmando certificado con la CA..."
openssl ca -config "$CA_CONF" \
    -in "$CSR" -out "$CERT" \
    -extfile "$SMIME_CONF" -extensions smime_ext \
    -days "$DAYS" -notext -batch

echo "[4/4] Creando archivo PKCS#12..."
openssl pkcs12 -export \
    -in "$CERT" -inkey "$KEY" \
    -certfile "$CA_DIR/ca/certs/ca.cert.pem" \
    -out "$PFX" -passout "pass:$PASS"

rm -f "$CSR"

echo ""
echo "=== Certificado S/MIME generado exitosamente ==="
echo "  Titular:  $CN"
echo "  Email:    $EMAIL"
echo "  Validez:  $DAYS días"
echo ""
echo "  Clave privada: $KEY"
echo "  Certificado:   $CERT"
echo "  PKCS#12:       $PFX"
echo "  Password PKCS#12: $PASS"
echo ""
echo "Importa $PFX en Thunderbird, Outlook o Apple Mail."
echo "El certificado de CA está en $CA_DIR/ca/certs/ca.cert.pem"
echo "(debe estar instalado como Autoridad de Confianza en cada cliente)"