#!/usr/bin/bash

if test "$(id -u)" -eq 0; then
  echo "Do not run as root!"
  exit 2
fi

. /etc/sysconfig/acme-tiny
DAYS="${1:-$DAYS}"
test -n "$DAYS" || DAYS="7"
if [[ "$DAYS" =~ ^[0-9]+$ ]]; then
  echo "Days before expiration: $DAYS"
  secs=$(( $DAYS * 24 * 60 * 60 ))
else
  echo "Invalid number of days: $DAYS"
  exit 1
fi

cd /var/lib/acme

if ! test -s private/account.key; then
  touch private/account.key
  chmod 0600 private/account.key
  openssl genrsa 4096 >private/account.key
fi

rc="0"
# update via ACME certs about to expire or missing and those with newer csr 
for csr in csr/*.csr; do
  test -s "$csr" || continue
  test -r "$csr" || continue
  crt="${csr%%.csr}"
  tmp="certs/${crt##csr/}.tmp"
  crt="certs/${crt##csr/}.crt"
  if test -s "$crt" && openssl x509 -in "$crt" -noout -checkend "$secs"; then
    [ $csr -nt $crt ] || continue
  fi
  if test -w "$crt" || test ! -e "$crt"; then
    echo acme_tiny --account-key private/account.key --csr "$csr" \
	--acme-dir /var/www/challenges/ --out "$crt"
  else
    echo "Can't write to $crt" 
    rc="1"
    continue
  fi

  if /usr/sbin/acme_tiny --account-key private/account.key --csr "$csr" \
	--acme-dir /var/www/challenges/ > "$tmp"; then
	mv "$tmp" "$crt" || exit 1
  else
	test -e "$tmp" && test ! -s "$tmp" && rm "$tmp"
  fi
  # append intermediate certs, now done by acme_tiny
  #cat *.pem >>"$crt"
done
# update certs with no csr
for crt in certs/*.crt; do
  csr="${crt%%.crt}"
  tmp="${csr##csr/}.tmp"
  csr="csr/${csr##certs/}.csr"
  test -e "$csr" && continue
  if test -s "$crt" && openssl x509 -in "$crt" -noout -checkend "$secs"; then
    continue
  fi
  domain=$(openssl x509 -in "$crt" -noout -subject | sed -n '/^subject/s/^.*CN=//p')
  echo "$domain"
  if openssl s_client -showcerts -servername "${domain}" -connect "${domain}:443" </dev/null 2>/dev/null | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' >"$tmp"; then
    if test -s "$tmp" && openssl x509 -in "$tmp" -noout -checkend "$secs"; then
        echo "mv $tmp $crt"
	mv "$tmp" "$crt" || exit 1
    fi
  fi
done

exit "$rc"
