pkcs12

#!/bin/sh

set -e
EVENT_NAME="$1"
[ "$EVENT_NAME" = "live-updated" ] || exit 42

if [ ! -e "${ACME_STATE_DIR}" ]; then
        exit 42
fi

umask 0027
mkdir -p "${ACME_STATE_DIR}/pkcs12"

while read name; do
        certdir="${ACME_STATE_DIR}/live/${name}"
        p12target="${ACME_STATE_DIR}/pkcs12/${name}.p12"
        if [ -z "${name}" -o ! -e "${certdir}" ]; then
                continue;
        fi

        if [ -e "${p12target}" ]; then
                rm $p12target
        fi

        if [ -e "${p12target}-password" ]; then
                rm "${p12target}-password"
        fi

        openssl pkcs12 -export \
                -out "${p12target}" \
                -in "${certdir}/cert" \
                -inkey "${certdir}/privkey" \
                -chain \
                -CAfile "${certdir}/chain" \
                -password pass:

        # Some applications are dumb and don't work when not using a password for the certificate.
        openssl pkcs12 -export \
                -out "${p12target}-password" \
                -in "${certdir}/cert" \
                -inkey "${certdir}/privkey" \
                -chain \
                -CAfile "${certdir}/chain" \
                -password pass:yourapplicationisbadandyoushouldfeelbad
done