set -e

openssl genrsa -out ca.key 2048
openssl genrsa -out itd.key 2048
openssl genrsa -out usr_x86_64.key 2048
openssl genrsa -out usr_arm.key 2048

openssl req -new -x509 -key ca.key -out ca.crt -config ca.conf -days 3650 -batch
openssl req -config itd.conf -new -sha256 -key itd.key -out itd.csr.pem -batch
openssl req -config usr_x86_64.conf -new -sha256 -key usr_x86_64.key -out usr_x86_64.csr.pem -batch
openssl req -config usr_arm.conf -new -sha256 -key usr_arm.key -out usr_arm.csr.pem -batch

echo 1000 > serial
mkdir -p ncerts
rm -f index.txt.* index.txt && touch index.txt

openssl ca -config ca.conf -extensions v3_intermediate_ca -days 3650 -notext -in itd.csr.pem -out itd.crt -md sha256 -batch

rm -f index.txt.* index.txt && touch index.txt

openssl ca -config itd.conf -extensions x86_64_cert -days 3650 -notext -in usr_x86_64.csr.pem -out usr_x86_64.crt -md sha256 -batch

rm -f index.txt.* index.txt && touch index.txt

openssl ca -config itd.conf -extensions arm_cert -days 3650 -notext -in usr_arm.csr.pem -out usr_arm.crt -md sha256 -batch

cat ca.crt itd.crt > cbd.crt

openssl pkcs12 -export -out x86_64.pfx -inkey usr_x86_64.key -in usr_x86_64.crt -certfile cbd.crt -password pass:password
openssl pkcs12 -export -out arm.pfx -inkey usr_arm.key -in usr_arm.crt -certfile cbd.crt -password pass:password
