# CA Private Key
openssl ecparam -name secp256r1 -genkey -out ca.key.pem
# Request certificate
openssl req -x509 -new -nodes -key ca.key.pem -subj "/CN=CARoot" -days 3650 -out ca.cert.pem
# Build Trust Cert
keytool -keystore ca.truststore.jks -alias ca -importcert -file ca.cert.pem -storepass rootpw -keypass rootpw -noprompt


# Create server keystore
# NOTE (Pulsar 5.0 / PIP-478): TLS hostname verification is enabled by default, so the server
# certificate MUST carry a SubjectAltName that matches the connected host (e.g. DNS:localhost / IP:127.0.0.1).
# The CN fallback the default engines apply to a SAN-less certificate does not rescue this fixture: its CN is
# "server", which matches none of the hosts below, and an IP literal is never matched against the CN anyway.
# The keystore hierarchy has its own CA (this directory's ca.cert.pem / ca.key.pem, trusted via
# ca.truststore.jks) which is SEPARATE from the PEM hierarchy's CA in the parent directory, so the server
# certificate here must be signed by THIS directory's ca.key.pem. `keytool -certreq` drops extensions and
# `openssl x509 -req` only adds a SAN when given -extfile, so the SAN is supplied both at genkey time (-ext SAN)
# and again on the openssl signing step (-extfile).
keytool -keystore server.keystore.jks -alias server -keyalg EC -validity 3600 -genkey -storepass serverpw -keypass serverpw -dname 'CN=server,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown' -ext 'SAN=dns:pulsar,dns:pulsar.default,dns:localhost,ip:127.0.0.1,ip:192.168.1.2' -noprompt
# Export the certificate request from the keystore:
keytool -keystore server.keystore.jks -alias server -certreq -file server.cert.pem -storepass serverpw -keypass serverpw -noprompt
# Sign it with the CA, re-adding the SAN via an extfile:
printf 'subjectAltName=DNS:pulsar,DNS:pulsar.default,DNS:localhost,IP:127.0.0.1,IP:192.168.1.2\n' > san.ext
openssl x509 -req -in server.cert.pem -CA ca.cert.pem -CAkey ca.key.pem -CAcreateserial -out server.signed.cert.pem -days 3650 -sha256 -extfile san.ext
rm -f san.ext
# Import signed cert into key store
keytool -keystore server.keystore.jks -alias ca -importcert -file ca.cert.pem -storepass serverpw -keypass serverpw -noprompt
keytool -keystore server.keystore.jks -alias server -importcert -file server.signed.cert.pem -storepass serverpw -keypass serverpw -noprompt


# Create broker client keystore
keytool -keystore broker_client.keystore.jks -alias broker_client -keyalg EC -validity 3600 -genkey -storepass brokerclientpw -keypass brokerclientpw -dname 'CN=broker_client,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown' -noprompt
keytool -keystore broker_client.keystore.jks -alias broker_client -certreq -file broker_client.cert.pem -storepass brokerclientpw -keypass brokerclientpw -noprompt
openssl x509 -req -in broker_client.cert.pem -CA ca.cert.pem -CAkey ca.key.pem -CAcreateserial -out broker_client.signed.cert.pem -days 3650 -sha256
keytool -keystore broker_client.keystore.jks -alias ca -importcert -file ca.cert.pem -storepass brokerclientpw -keypass brokerclientpw -noprompt
keytool -keystore broker_client.keystore.jks -alias broker_client -importcert -file broker_client.signed.cert.pem -storepass brokerclientpw -keypass brokerclientpw -noprompt


# Create client keystore
keytool -keystore client.keystore.jks -alias client -keyalg EC -validity 3600 -genkey -storepass clientpw -keypass clientpw -dname 'CN=client,OU=Unknown,O=Unknown,L=Unknown,ST=Unknown,C=Unknown' -noprompt
keytool -keystore client.keystore.jks -alias client -certreq -file client.cert.pem -storepass clientpw -keypass clientpw -noprompt
openssl x509 -req -in client.cert.pem -CA ca.cert.pem -CAkey ca.key.pem -CAcreateserial -out client.signed.cert.pem -days 3650 -sha256
keytool -keystore client.keystore.jks -alias ca -importcert -file ca.cert.pem -storepass clientpw -keypass clientpw -noprompt
keytool -keystore client.keystore.jks -alias client -importcert -file client.signed.cert.pem -storepass clientpw -keypass clientpw -noprompt