#!/bin/bash
# 05-gen-certs.sh
# Generate test certificates for mTLS

# 1. Generate CA
openssl req -new -x509 -days 365 -nodes -out ca.crt -keyout ca.key -subj "/CN=MyRootCA"

# 2. Generate Server Cert
openssl req -new -nodes -out server.csr -keyout server.key -subj "/CN=localhost"
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365

# 3. Generate Client Cert
openssl req -new -nodes -out client.csr -keyout client.key -subj "/CN=client-app"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 365

echo "Certificates generated: ca.crt, server.crt, client.crt"
