mk-cert

#!/bin/sh
# shellcheck shell=bash disable=SC2230
if [ -z "$BASH_VERSION" ];then exec bash "$0" "$@";else set +o posix;fi
(eval 'f() { local i=$((3+(6)));[[ $i = "$(cat <(echo 9))" ]];};f')\
2>/dev/null || { echo >&2 "This version of bash is too old";exit 1;}

set -e ; PROGRAM="$0"

show_help_text() {
    if [[ -t 1 && -t 0 ]]
    then show_help_text | "${PAGER:-more}" ; exit
    fi

    echo "Usage: $(basename "$PROGRAM") [Common Name] [arguments]"
    version_warnings

cat <<\!

This script can create most styles of x509 certificate from the command
line.  All options can be configured from arguments and the standard
OpenSSL configuration file is not used. The default is to prompt for a
common name (plus OU and dnQualifier) and generate an ec:prime256r1 key
and certificate which is sent to the standard output.

Options:

    -cn=String
    -subj-cn=String
    -subj-o=String
    -subj-ou=String
    -subj-dc=String
    -subj-l=String
    -subj-st=String
    -subj-c=String
    -subj:oid=value

	Set a component of the certificate subject. Some items such as
	DC, OU and CN are allowed to be duplicated. OpenSSL will accept
	duplicates for any item.

	The long names are:
	    "CN"   Common name, put the domainname here.
	    "O"    Organization Name
	    "OU"   Organizational Unit Name
	    "DC"   Domain Component
	    "L"    Locality Name: American for "City", "Town", etc
	    "ST"   State or Province: "County" for rest of world.
	    "C"    ISO two alpha Country code or "XX"

	The "-cn=" option is taken as both a common name, a SAN and the
	official common name for generic use. The "-subj-cn=" option
	string will only be used in the subject.

	The OU is the most likely to be accepted as a place to store
	any unusual part of a name you may wish to include.

	Any arguments without a "-" to make them an option are assumed
	to be names too, the first one is a common name, like the "-cn"
	option.  The rest are san names if they look like domain names
	or IP addresses and OU items if they don't.

	If a argument begins with a "/" and contains an "=" it is
	treated as an OpenSSL subject string. This conflicts with the
	other options for building a subject.

	The bare "-subj:" version copies the string "oid=value" to the
	end of the section of the configuration. This allows any of the
	possible name parts (surname, info, favouriteDrink, CSPName, etc)
	to be added in any order. If OpenSSL doesn't know a particular
	oid the numeric value can be used.

	If no subject is specified one will be prompted for by OpenSSL
	unless a SAN is requested in which case an error is generated
	unless "-no-prompt" is used.

    -days=7304
	How many days should the certificate run for?

    -days=2038-01-18
	What day should the certificate expire on?

    -alldays
	Make the certificate run until 9999-12-31

    -out=FileName
	Put the certificate, and any other items in a file.

    -addcert=FileName
	Filename contains a certificate, put it in the same location as
	the created certificate. (Used for intermediate CA certificates)

    -keyout=FileName
	Put the private key in a specific file not "-out=" or stdout.

    -crl
	Generate an empty CRL using the certificate used to sign.

    -crlout=FileName
	Generate an empty CRL using the certificate used to sign.

    -caout=FileName
	Put the certificate used to sign in a specific file.

    -ser=0123456789abcdef
    -serial=0123456789abcdef
	Set the certificate serial number (in hexadecimal).
	Various noise characters will be removed.

    -dnq
	Generate and add a dnQualifier item to the subject.
	This is the original way of making sure that the subject of
	a certificate is unique. It was only needed within an org
	as the other DN components were sufficient for identifing
	organisations.

    -dnq=...
	Add a specific dnQualifier item to the subject.

    -nodnq
	Do not add a dnQualifier item to any subject; even if told to.

    -no-prompt
	Prevent OpenSSL prompting for any part of the subject.

    -ed25519
    -ed448
	Generate an ed25519 or ed448 private key.

    -ec:prime256v1
    -ec:256
    -ec:curve:encoding
    -ec:curve:encoding:no_seed
    -ec:ed25519
	Use OpenSSL ecparam to generate an EC key. This includes ed25519, ed448
	and their X25519 and X448 counterparts. The numbers 256,384 and 521 are
	shorthands for the curves prime256v1, secp384r1 and secp521r1.

    -list-curves
    -show-curves
	List the EC curves that OpenSSL supports.

    -rsa
    -rsa=2048
	Generate RSA private keys.

    -dsa
    -dsa=1024
	Generate DSA private keys.
	NB: This also makes the default digest SHA1.

    -keyfile=FileName
	Don't generate a key, use the one in FileName. If you're
	generating a "single use ca" the second throwaway key (for the
	CA) will be generated to be the same type as the key in this
	file, if possible.
	Note that if it's a PFX file it must have a ".pfx" extension.

    -sign=FileName
	Use the key and certificate in FileName to sign the certificate.
	Note that if it's a PFX file it must have a ".pfx" extension.

    -csrin=FileName
	Use the CSR from FileName instead of generating a new key.
	This cannot be used to create a self-signed certificate.

    -pubin=FileName
	Like -csrin this will use the public key from the item in FileName
	instead of generating a new key. The file can be any recognised
	file that contains a public key, not just a CSR. But if it's
	a CSR or a certificate it's common name will also be used if
	nothing else is specified.

    -csr
	Create a certificate signing request not a certificate
	Must use -keyout= option too.

    -showcsr
	Dump any CSR we use to the output too.

    -singleuseca
    -suca
	Generate a new CA key for the CA certificate and to sign the standard
	certificate. Discard the CA key and send the CA certificate to the
	output.

    -v3singleuseca
    -v3suca
	Same but always make the CA a V3 certificate with the CA flag.

    -v1suca
	Same but always make the CA a V1 certificate.

    -casubj=...
    -caname=...
	Set the subject name for the single use CA, first is a CN or
	organisation, the rest are OU items.

    -pkcs12=FileName
    -pfx=FileName
	Create a "pfx" file with the certificate, private key and the
	CA certificate used to sign the certificate. The "-pkcs12" variant
	saves the file base64 encoded.
	Also changes the default key type to RSA.

    -pass:password
    -pass=OpenSSL:pass
	Set a password on the key.

    -cipher=name
	Select the cipher used for encrypting the key with a password.

    -dgst=sha1
    -ripemd160, -sha, -sha1, -sha224, -sha256, -sha384, -sha512, -whirlpool
	Select the digest used for signing.

    -openssl=/path/to/executable/openssl
	Use the specified copy of openssl, not the one in the PATH.

    -showconf
	Debugging option, show the config files generated for OpenSSL

Version 3 certificate extensions.

    Note V3 extensions are used to limit the uses that a certificate
    can be put to. If you're not concerned with limiting use of the
    private key (ie the user is trusted) then these generally have
    no use. However, some validators insist on certain V3 extensions
    being present.

    The SAN extension is a minor exception to this as it allows multiple
    wildcard DNS names whereas browsers only accept one wildcard CN
    item in the subject. In addition some browsers are rejecting all
    certificates that don't have a SAN extension.

    -v3
	Make the certificate V3, don't add any extensions though.

    -v3san=SanName
    -san=SanName
	Add a SAN name.
	It may include the type prefix ie: DNS:www.example.com otherwise
	a dumb huristic is used to identify the type of the item. This
	option can be repeated as many times as needed.

	Note: the common name will normally be added automatically too.

    -v3san, -san
	Make a san from the common name even if there are no others.
	This is now required by Chrome in direct contravention of the
	requirements of RFC 2818 (HTTP over SSL).

    -v3ca, -ca
	Add normal V3 extensions for a CA certificate.

    -v3basicca
	Add only the basic extension for a CA certificate.

    -v3lastca, -lastca
	Make a V3 CA certificate with the 'pathlen:0' option to prevent
	certificates that this CA signs being CAs.

    -v3nokeyid, -nokeyid
	Disable the "Subject Key Identifier" and "Authority Key Identifier"
	additions.

    -v3usr, -v3user, -usr, -user
	Prevent this V3 certificate begin used as a CA.

    -v3server, -server
	Add V3 key usage extensions to prevent the certificate being used
	as anything except an SSL server.
	NB: Can be combined with -v3client or -v3email to allow those.

    -v3client, -client
	Add V3 key usage extensions to prevent the certificate being used
	as anything except an SSL client.
	NB: Can be combined with -v3server or -v3email to allow those.

    -v3email, -email
	Add V3 key usage extensions to prevent the certificate being used
	as anything except a MIME signing or encryption certificate.
	NB: Can be combined with -v3server or -v3client to allow those.

    -v3codesign, -codesign
	Add V3 key usage extensions to prevent the certificate being used
	as anything except a code signing certificate.

    -v3timestamp, -timestamp
	Add V3 key usage extensions for timestamp signing. This can NOT
	be combined with other key usages.

    -v3ns, -ns
	Add the netscape Client/server extensions too.

    -v3ns=...
    -ns=...
	Add a specific list of netscape usages.

    -v3crit, -v3critical, -critical
	Mark CA, key usage and extended key usage extensions as critical.
	Beware:
	    https://en.wikipedia.org/wiki/X.509#Implementation_issues

    -poltext=FileName
	Add an "all uses" policy extension and include the text from
	FileName as an "issuer statement".

    -policy=OID
	The first one of these sets the OID for the '-poltext' option if
	present. Additional '-policy' arguments add extra policy extensions.

    -tlsfeature=...
	Add the V3 extension that states a server will send a 'status_request'
	or 'status_request_v2' response when requested.

    -must-staple
	Alias for -tlsfeature=status_request
	Can also be entered as -v3=1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05

    -v3permit=..., -permit=..., -v3exclude..., -exclude...
	Add the V3 extension for 'Name constraints', they consist of domain
	names or IP addresses with subnet masks in the form of tagged SAN
	names.

    -v3crluri=..., -crlurl=...
	Add a "CRL Distribution Point" item to the certificate extensions.

    -v3dv|-dv )
	Make the certificate policy "Domain validated" and set most
	of the other stuff that's supposed to be set.
	BUT would also need:
	    The certificate must be signed by a CA (not self-signed)
	    Add authorityInformationAccess extension
	    with OCSP over HTTP
	    and HTTP URL for issuing certificate

    -v3='OpenSSL extension config'
	Add any x509 v3 extension config to the OpenSSL config file used
	to create the certificate.

    -v3xt='OpenSSL extension config'
    -xt='OpenSSL extension config'
	Add any x509 v3 extension config to the OpenSSL config file used
	to create the certificate.

	This item is placed after the all "-v3=" items so can be used when
	the config file needs additional sections.
!

    exit 0
}

version_warnings() {

    [[ "$BASH3" = yes || "$NOMIXING" = yes || "$BASHREGEX" = no ]] && {
	echo ""
	echo "BEWARE: Some features are broken or work poorly on this version"
	echo "of bash: $BASH_VERSION"
    }

    [[ "$NOPKEY" = yes || "$NOECPARAM" = yes ]] && {
	echo ""
	echo "BEWARE: Some features are broken or work poorly on this version"
	echo "of openssl: $(openssl version)"
    }

    return 0
}

edit_readme_help_text() {
    [[ -f README && -f mk-cert && -f README.md ]] || {
	echo This needs to be run in the source tree
	exit 1
    }
    sed -i '/^Usage: mk-cert/,$d' README
    bash mk-cert -help >> README
    exit 0
}

main() {
    eval "typeset -A SANDUP # bash4/ksh" 2>/dev/null && BASH3=no || BASH3=yes

    init_vars
    test_for_windows
    decode_args "$@"
    default_options
    check_args

    [[ "$KFN" != '' && "$KFN" != /dev/null && -s "$KFN" ]] &&
	{ echo >&2 "ERROR: File $KFN already exists" ; exit 1 ; }

    [[ "$FN" != '' && -s "$FN" ]] &&
	{ echo >&2 "ERROR: File $FN already exists" ; exit 1 ; }

    [[ "$CAFN" != '' && -s "$CAFN" ]] &&
	{ echo >&2 "ERROR: File $CAFN already exists" ; exit 1 ; }

    [[ "$PKCS12FN" != '' && -s "$PKCS12FN" ]] &&
	{ echo >&2 "ERROR: File $PKCS12FN already exists" ; exit 1 ; }

    [[ "$CRLFN" != '' && -s "$CRLFN" ]] &&
	{ echo >&2 "ERROR: File $CRLFN already exists" ; exit 1 ; }

    build_v3_extensions
    apply_options
    create_main_cert	# or csr
    create_suca_pem

    if [[ "$CSRFN" != "" && "$SIGNPEM" = '' ]]
    then echo 'ERROR: Cannot make a self signed certificate from a csr' >&2
	 exit 1;
    fi
    if [[ "$FORCEPUB" != "" && "$SIGNPEM" = '' ]]
    then echo 'ERROR: Cannot make a self signed certificate from a public key' >&2
	 exit 1;
    fi

    sign_created_csr

    [[ "$MAKECRL" = yes ]] &&
	CRLPEM=$(create_crl_file)

    create_pfx_file

    [[ "$KFN" = '' ]] && umask 077
    # shellcheck disable=SC2094 # ironic.
    if [[ "$FN" != '' ]] ; then outp "$FN" > "$FN" ; else outp ; fi

    exit 0
}

init_vars() {
NL='
'
    export OPENSSL_CONF=/dev/null

    NOPKEY="$(openssl no-pkey >/dev/null 2>&1 && echo yes || echo no)"
    NOECPARAM="$(openssl no-ecparam >/dev/null 2>&1 && echo yes || echo no)"
    NOMIXING="$(eval 'x=1;[ "$(set -- ${x:+0 "$x"} 2;echo "$2")" = "1" ]' && echo no || echo yes)"

    FN=
    KFN=
    ADDCERT=
    CRLFN=
    CSRFN=
    PUBKEYFN=
    PUBDATA=
    CAFN=
    FORCEPUB=
    SERIAL=
    CERT_DAYS=
    EC=prime256v1
    RSABITS=2048

    # shellcheck disable=SC2046 # I knooow
    JTODAY=$(jdayjdat $(date '+%d %m %Y') )

    if [[ "$NOPKEY" = no ]] || \
       [[ "$(date +%Y -d @$((2**31)) 2>/dev/null)" = 2038 ]]
    then DEFAULT_DAYS=7304
    else
	# Older versions have a date bug on 32bit machines.
	END_OF_TIME=$(jdayjdat 18 1 2038)
	DEFAULT_DAYS=$((END_OF_TIME - JTODAY))
	# Minimum of 10 years
	[[ "$DEFAULT_DAYS" -lt 3652 ]] &&
	    DEFAULT_DAYS=3652
    fi

    V3=no
    V3HEAD=
    V3SAN=
    V3OPTS=
    V3LIST=
    V3EXTRAS=
    V3CERTONLY=
    V3CA=
    V3CAPATH=
    V3CLIENT=no
    V3SERVER=no
    V3EMAIL=no
    V3CODESIGN=no
    V3TIMESTAMP=no
    V3CRITICAL=no
    V3NS=no
    V3ENS=
    V3NAMECONS=

    SANSECT=
    SAN_ID=0

    BASHREGEX=
    NOSETSERIAL=
    KEYPASS=
    WANTCSR=no
    MAKECSR=no
    ADDDNQ=
    SHOWCSR=no
    MAKECRL=no
    SHOWCONF=
    CSRTEXT=
    SIGNPFX=
    SIGNPEM=
    CRLPEM=
    SINGLEUSECA=
    V3SUCA=
    PKCS12FN=
    PKCS12ASCII=
    POLICYTEXT=
    POLICYOID=
    NOPROMPT=
    NOKEYID=
    WANTDVCERT=
    DEFAULTCN=
    TLSFEATURE=
    NOSUCAEKU=

    CIPHER=-aes128
    DGST=

    SUBJTYPE=
    SUBJ=
    CASUBJ=

    SUBJ_ID=0
    SUBJ_C=
    SUBJ_ST=
    SUBJ_L=
    SUBJ_O=
    SUBJ_DC=
    SUBJ_OU=
    SUBJ_CN=
    SUBJ_DNQ=
    SUBJ_XX=
    CRLURI=
    CRLURI_ID=0
    EXTRA_OIDS=
    SSKEY=

    # Faketime prefix
    ft() { "$@" ; }

    # This is my default for making a key file.
    # Versions before "pkey" didn't do EC+SHA256
    if [[ "$NOECPARAM" = no && "$NOPKEY" = no ]]; then
	mkkey() { openssl ecparam -name "$EC" -genkey -noout ;}
	mktmpkey() { openssl ecparam -name "$EC" -genkey -noout ;}
	KEYCLASS=ec
    else
	mkkey() { openssl genrsa $RSABITS ; }
	mktmpkey() { openssl genrsa 512 2>/dev/null ; }
	KEYCLASS=rsa
    fi
    KEYSOURCE=
    # See also:
    # mkkey() { openssl genpkey -paramfile <(openssl genpkey -genparam -algorithm ec -pkeyopt ec_paramgen_curve:prime256v1) ;}

    X509SECT=req_x509
    V3INIT="x509_extensions=$X509SECT${NL}req_extensions=$X509SECT${NL}[$X509SECT]${NL}"

    UTF8=
    if [[ "$(locale charmap 2>/dev/null)" = UTF-8 ]]
    then
	if openssl req -help 2>&1 | grep -q -e -utf8
	then UTF8=-utf8
	fi
    fi
}

decode_args() {
    for ar
    do  case "$ar" in
	-h|-help|--help) show_help_text ;;
	-edit-readme ) edit_readme_help_text ;;

	-showconf ) SHOWCONF=yes ;;

	-days ) CERT_DAYS='' ;;
	-alldays ) CERT_DAYS=all ;;
	-days[=:]* ) CERT_DAYS="${ar#*[=:]}" ;;

	-out[=:]* ) FN="${ar#*[=:]}" ;;
	-keyout[=:]* ) KFN="${ar#*[=:]}" ;;
	-crl ) MAKECRL=yes ;;
	-crlout[=:]* ) CRLFN="${ar#*[=:]}" ; MAKECRL=yes ;;
	-caout[=:]* ) CAFN="${ar#*[=:]}" ;;

	-ser[=:]??*|-serial[=:]??* )
	    SERIAL="${ar#*[=:]}"
	    SERIAL="${SERIAL//[-: .,;]/}"
	    ;;

	-dnq ) [[ "$ADDDNQ" = no ]] || ADDDNQ=yes ;;
	-nodnq|-no-dnq ) ADDDNQ=no ;;

	-dnq[=:]*|-cn[=:]* )
	    SUBJTYPE="${SUBJTYPE:-conf}"
	    if [[ "$SUBJTYPE" != "conf" ]] ; then
		echo >&2 "Duplicate subject name definition at '$ar'"; exit 1
	    fi

	    case "$ar" in
	    -dnq* )
		SUBJ_ID=$((SUBJ_ID+1))
		SUBJ_DNQ="$SUBJ_DNQ${NL}$SUBJ_ID.dnQualifier=${ar#*[=:]}"
		;;
	    -cn* )
		if [[ "${ar#*[=:]}" != '' ]]
		then SUBJ_ID=$((SUBJ_ID+1))
		     SUBJ_CN="$SUBJ_CN${NL}$SUBJ_ID.commonName=${ar#*[=:]}"
		else SUBJ_CN="$SUBJ_CN${NL}"
		fi
		NOPROMPT=yes
		if [[ "$CN" = '' ]]
		then CN="${ar#*[=:]}"
		else add_good_san "${ar#*[=:]}" ||:
		fi
		;;
	    esac
	    ;;

	-rsa[=:]* )
	    KEYCLASS=rsa
	    KEYSOURCE="$KEYSOURCE:rsa"
	    eval "mkkey() { openssl genrsa '${ar#*[=:]}' ; }"
	    ;;
	-dsa[=:]* )
	    KEYCLASS=
	    KEYSOURCE="$KEYSOURCE:dsa"
	    eval "mkkey() { openssl dsaparam -noout -genkey '${ar#*[=:]}' ; }"
	    ;;
	-ec[=:]* )
		[[ "$NOECPARAM" = no ]] || {
		    echo >&2 "Elliptic Curve keys not supported by OpenSSL"
		    exit 1
		}
		ar="${ar#*[=:]}:" ; curve="${ar%%:*}"
		ar="${ar#*:}:" ; param="${ar%%:*}"
		ar="${ar#*:}:" ; noseed="${ar%%:*}"

		case "$curve" in
		192 ) curve=prime192v1 ;;
		224 ) curve=secp224r1 ;;
		256 ) curve=prime256v1 ;;
		384 ) curve=secp384r1 ;;
		521 ) curve=secp521r1 ;;

		[0-9]*[0-9] )
		    ncurve="$(openssl ecparam -list_curves| grep " $curve bit" |
			    awk -F: '/:/{print $1;exit;}' | tr -d ' ' )"
		    [[ "$ncurve" != "" ]] && curve="$ncurve"
		    ;;
		esac

		case "$curve" in
		X25519|x25519|X448|x448 )
		    echo >&2 "WARNING: The ${curve} EC algorithm cannot do signatures, did you mean the ED version?"
		    KEYCLASS=nosig
		    KEYSOURCE="$KEYSOURCE:X"
		    SSKEY=$(openssl genpkey -algorithm "$curve")
		    PUBDATA=$(echo "$SSKEY" | openssl pkey -pubout)
		    eval "mkkey() { openssl genpkey -algorithm 'ed${curve#?}' ; }"
		    ;;

		ED25519|ed25519|ED448|ed448 )
		    eval "mkkey() { openssl genpkey -algorithm '${curve}' ; }"
		    KEYCLASS=
		    KEYSOURCE="$KEYSOURCE:ed"
		    ;;

		*)
		    eval "mkkey() { openssl ecparam -name '$curve' ${param:+-param_enc $param} ${noseed:+-no_seed} -genkey -noout ; }"
		    KEYCLASS=ec
		    KEYSOURCE="$KEYSOURCE:ec"
		    ;;
		esac

		;;

	-ED25519|-ed25519|-ED448|-ed448 )
	    eval "mkkey() { openssl genpkey -algorithm '${ar#?}' ; }"
	    KEYCLASS=
	    KEYSOURCE="$KEYSOURCE:ed"
	    ;;

	-dsa )
	    # FIPS used to force 1024, so lots of hardware and protocols did too.
	    # 1024 bits is now considered unsafe against the most capable
	    # attackers and barely safe against publicly known attacks.
	    DGST="${DGST:--sha1}"
	    mkkey() { openssl dsaparam -noout -genkey 1024; }
	    KEYCLASS=
	    KEYSOURCE="$KEYSOURCE:dsa"
	    ;;

	-rsa )
	    mkkey() { openssl genrsa $RSABITS ; }
	    KEYCLASS=rsa
	    KEYSOURCE="$KEYSOURCE:rsa"
	    ;;

	-ec )
	    [[ "$NOECPARAM" = no ]] || {
		echo >&2 "Elliptic Curve keys not supported by OpenSSL"
		exit 1
	    }
	    mkkey() { openssl ecparam -name "$EC" -genkey -noout ; }
	    KEYCLASS=ec
	    KEYSOURCE="$KEYSOURCE:ec"
	    ;;

	-list[-_]curves|-show[_-]curves )
	    openssl ecparam -list_curves ; exit ;;

	-keyfile[=:]*|-key[=:]*.pfx )
	    eval "mkkey() { openssl pkcs12 -nodes -out - -in '${ar#*[=:]}' | openssl pkey; }"
	    [[ "$KFN" = "" ]] && KFN=/dev/null
	    KEYCLASS='file'
	    KEYSOURCE="$KEYSOURCE:keyfile"
	    ;;

	-keyfile[=:]*|-key[=:]* )
	    eval "mkkey() { cat < '${ar#*[=:]}' ; }"
	    [[ "$KFN" = "" ]] && KFN=/dev/null
	    KEYCLASS='file'
	    KEYSOURCE="$KEYSOURCE:keyfile"
	    ;;

	-csr ) WANTCSR=yes ; MAKECSR=yes ;;
	-csrin[=:]* )
	    CSRFN="${ar#*[=:]}"
	    KFN=/dev/null
	    KEYCLASS=
	    KEYSOURCE="$KEYSOURCE:csr"
	    ;;
	-showcsr ) SHOWCSR=yes ;;

	-pubin[=:]* )
	    PUBKEYFN="${ar#*[=:]}"
	    KFN=/dev/null
	    KEYCLASS=
	    KEYSOURCE="$KEYSOURCE:pubkey"
	    ;;

	-sign[=:]*.pfx )
	    SIGNPFX="${ar#*[=:]}"
	    MAKECSR=yes
	    ;;

	-sign[=:]* )
	    SIGNPEM="$(cat "${ar#*[=:]}")"
	    MAKECSR=yes
	    ;;

	-addcert[=:]* )
	    [[ "$ADDCERT" != '' ]] && ADDCERT="$ADDCERT$NL"
	    ADDCERT="$ADDCERT$(
		openssl x509 -subject -serial -dates -in "${ar#*[=:]}"
		)"
	    ;;

	-singleuseca|-suca ) MAKECSR=yes ; SINGLEUSECA=yes ;;
	-v1suca ) MAKECSR=yes ; SINGLEUSECA=yes ; V3SUCA=no ;;
	-v3singleuseca|-v3suca ) MAKECSR=yes ; SINGLEUSECA=yes ; V3SUCA=yes ;;
	-nocaeku ) NOSUCAEKU=yes ;;

	-pfx[=:]* )
	    PKCS12FN="${ar#*[=:]}"
	    [[ "$FN" = "" ]] && FN=/dev/null
	    # Default PFX files to RSA
	    [ "$KEYSOURCE" = '' ] && {
		mkkey() { openssl genrsa $RSABITS ; }
		KEYCLASS=rsa
	    }
	    ;;

	-pkcs12[=:]* )
	    PKCS12FN="${ar#*[=:]}"
	    [[ "$FN" = "" ]] && FN=/dev/null
	    PKCS12ASCII=yes
	    # Default PFX files to RSA
	    [ "$KEYSOURCE" = '' ] && {
		mkkey() { openssl genrsa $RSABITS ; }
		KEYCLASS=rsa
	    }
	    ;;

	-pass[=:]*:* ) KEYPASS="${ar#*[=:]}" ;;
	-pass[=:]* ) KEYPASS="pass:${ar#*[=:]}" ;;

	-ripemd160|-sha|-sha1|-sha224|-sha256|-sha384|-sha512|-whirlpool)
	    DGST=$ar ;;

	-dgst[=:]* ) DGST="${ar#*[=:]}" ; DGST="-${DGST%-}" ;;
	-cipher[=:]* ) CIPHER="${ar#*[=:]}" ; CIPHER="-${CIPHER%-}" ;;
	-openssl[:=]* ) eval "openssl() { command '${ar#*[=:]}' \"\$@\" ; }" ;;

	-v3 ) V3=yes ;;
	-v3ca|-ca ) V3=yes ; V3CA=yes ;;
	-v3lastca|-lastca ) V3=yes ; V3CA=yes ; V3CAPATH=0 ;;
	-v3usr|-usr|-v3user|-user ) V3=yes ; V3CA=no ;;
	-v3server|-server ) V3=yes ; V3SERVER=yes ;;
	-v3client|-client ) V3=yes ; V3CLIENT=yes ;;
	-v3email|-email ) V3=yes ; V3EMAIL=yes ;;
	-v3codesign|-codesign ) V3=yes ; V3CODESIGN=yes ;;
	-v3timestamp|-timestamp ) V3=yes ; V3TIMESTAMP=yes ; V3CRITICAL=yes ;;
	-v3crit|-v3critical|-critical )
	    V3=yes ; V3CRITICAL=yes ; V3CA=${V3CA:-no}
	    ;;
	-v3nokeyid|-nokeyid|-no-keyid) NOKEYID=yes ;;

	-v3basicca )
		V3=yes
		V3LIST="$V3LIST${NL}basicConstraints = CA:TRUE"
		;;

	-v3policytext[=:]*|-policytext[=:]*|-poltext[=:]* )
	    V3=yes
	    POLICYTEXT="$(cat "${ar#*[=:]}")"
	    ;;

	-v3policy[=:]*|-policy[=:]* )
	    V3=yes
	    POLICYOID="$POLICYOID,${ar#*[=:]}"
	    ;;

	-v3ns|-ns ) V3=yes ; V3NS=yes ;;
	-v3ns[=:]*|-ns[=:]* )
	    V3=yes
	    V3NS=yes
	    V3ENS="${ar#*[=:]}"
	    ;;

	-v3[=:]* )
		V3=yes
		V3LIST="$V3LIST$NL${ar#*[=:]}"
		;;

	-v3xt[=:]*|-xt[=:]* )
		V3=yes
		V3EXTRAS="$V3EXTRAS$NL${ar#*[=:]}$NL"
		;;

	-v3san[=:]*|-san[=:]* )
		if ! add_good_san "${ar#*[=:]}"
		then
		    san="${ar#*[=:]}"
		    case "$san" in
		    [0-9a-fA-F]*:*:*[0-9a-fA-F]|::*[0-9a-fA-F] )
			add_san "IP:$san" ;;
		    *@* ) add_san "email:$san" ;;
		    *[:-?]*|*[0-9]|[0-9]* )
			echo "Undecidable san name '$san', please label" >&2
			exit 1
			;;
		    * ) add_san "DNS:$san" ;;
		    esac
		fi
		;;

	-v3san|-san ) V3=yes ; V3SAN=yes ;;

	-v3tlsfeature[=:]*|-tlsfeature[=:]*|-must-staple )
	    V3=yes
	    if [[ "$TLSFEATURE" = '' ]]
	    then TLSFEATURE='tlsfeature = '
	    else TLSFEATURE="$TLSFEATURE,"
	    fi
	    FEATURE="${ar#*[=:]}"
	    [[ "$FEATURE" = "-must-staple" || "$FEATURE" = "must-staple" ]] &&
		FEATURE=status_request
	    TLSFEATURE="$TLSFEATURE$FEATURE"
	    ;;

	-v3permit[=:]*|-permit[=:]* )
		add_name_constraint "${ar#*[=:]}" permitted
		;;
	-v3exclude[=:]*|-exclude[=:]* )
		add_name_constraint "${ar#*[=:]}" excluded
		;;

	-v3crlur[il][=:]*|-crlur[il][=:]* )
	    V3=yes
	    CRLURI_ID=$((CRLURI_ID+1))
	    CRLURI="$CRLURI${NL}URI.$CRLURI_ID=${ar#*[=:]}"
	    ;;

	-v3dv|-dv )
	    # Make the certificate policy "Domain validated" and set most
	    # of the other stuff that's supposed to be set.
	    # BUT would also need:
	    #   Add authorityInformationAccess extension
	    #   with OCSP over HTTP extension
	    #   and HTTP URL for issuing certificate
	    #
	    # For example:
	    # -v3='authorityInfoAccess = OCSP;URI:http://ocsp.my.host/,caIssuers;URI:http://my.ca/ca.html'
	    #
	    # In addition the commonName is "deprecated",
	    # but all public CA's still include it.
	    WANTDVCERT=yes
	    V3=yes
	    V3SAN=yes
	    V3SERVER=yes
	    V3CLIENT=yes
	    V3CRITICAL=yes
	    POLICYOID="$POLICYOID,2.23.140.1.2.1"
	    DEFAULT_DAYS=398
	    ;;

	/*=* )
	    if [[ "$SUBJTYPE" != "" ]] ; then
		echo >&2 "Duplicate subject name definition at '$ar'"; exit 1
	    fi
	    SUBJ="$ar"
	    SUBJTYPE=arg
	    ;;

	-noprompt|-no-prompt ) NOPROMPT=yes ;;

	-subj[-_]c[=:]*|-subj[-_]st[=:]*|-subj[-_]l[=:]*|-subj[-_]o[=:]*|\
	-subj[-_]dc[=:]*|-subj[-_]ou[=:]*|-subj[-_]cn[=:]* )
	    SUBJTYPE="${SUBJTYPE:-conf}"
	    if [[ "$SUBJTYPE" != "conf" ]] ; then
		echo >&2 "Duplicate subject name definition at '$ar'"; exit 1
	    fi

	    V="${ar#??????}"
	    C="${V/=*/}"
	    # shellcheck disable=SC2018,SC2019
	    C="$(echo "$C" | tr 'a-z' 'A-Z')"

	    SUBJ_ID=$((SUBJ_ID+1))
	    eval "SUBJ_$C=\"\$SUBJ_$C\${NL}\$SUBJ_ID.$C=\${ar#*[=:]}\""

	    ;;

	-subj[=:]* )
	    SUBJTYPE="${SUBJTYPE:-conf}"
	    if [[ "$SUBJTYPE" != "conf" ]] ; then
		echo >&2 "Duplicate subject name definition at '$ar'"; exit 1
	    fi
	    V="${ar#*[=:]}"
	    V1="${V/=*/}"
	    V2="${V#*=}"
	    case "$V1" in
	    [0-9]*.*[0-9] ) # Looks kinda like an OID ?
		V3="oid_${V1//./_}"
		EXTRA_OIDS="$EXTRA_OIDS$NL$V3=$V1"
		SUBJ_XX="$SUBJ_XX$NL$V3=$V2"
		;;
	    * ) SUBJ_XX="$SUBJ_XX$NL$V"
		;;
	    esac
	    SUBJ_ID=$((SUBJ_ID+1))
	    ;;

	-casubj[=:]*|-caname[=:]* )
	    V="${ar#*[=:]}"
	    case "$V" in
	    *\ * ) CASUBJ="${CASUBJ}O=$V${NL}" ;;
	    * ) if [[ "$CASUBJ" = '' ]]
		then CASUBJ="CN=$V${NL}"
		else CASUBJ="${CASUBJ}OU=$V${NL}"
		fi
		;;
	    esac
	    ;;

	-*) echo >&2 "Unknown option: $ar, use -help for help text." ; exit 1 ;;

	* ) SUBJTYPE="${SUBJTYPE:-conf}"
	    if [[ "$SUBJTYPE" != "conf" ]] ; then
		echo >&2 "Duplicate subject name definition at '$ar'"; exit 1
	    fi

	    if [[ "$ar" = "" ]]
	    then SUBJ_CN="$SUBJ_CN${NL}"
		 NOPROMPT=yes
	    elif [[ "$SUBJ_CN" = "" ]]
	    then SUBJ_ID=$((SUBJ_ID+1))
		 SUBJ_CN="$SUBJ_CN${NL}${SUBJ_ID}.CN=$ar"
		 CN="$ar"
	    else
		 add_good_san "$ar" || {
		     SUBJ_ID=$((SUBJ_ID+1))
		     SUBJ_OU="$SUBJ_OU${NL}${SUBJ_ID}.OU=$ar"
		 }
	    fi
	    ;;
	esac
    done

    return 0
}

# Bash regex's are conditional so we can still mostly work on V2 bash.
if  (eval 'x=1.12.123;[[ "$x" =~ ^([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})$ ]]') \
    2>/dev/null
then
    BASHREGEX=yes
    eval "$(cat <<\!
add_good_san() {
    local san=

    if [[ "$1" =~ ^(IP|DNS|email|URI|RID|dirName): ]]
    then san="$1"
    elif [[ "$1" =~ ^otherName:.*\;.*: ]]
    then san="$1"
    elif [[ "$1" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]
    then san="IP:$1"
    elif [[ "$1" =~ ^(\*\.)?([a-zA-Z][-a-zA-Z0-9]*\.)*[a-zA-Z][-a-zA-Z0-9]+$ ]]
    then san="DNS:$1"
    fi
    [[ "$san" = '' ]] && return 1
    add_san "$san" ${2:+"$2"}
}

add_name_constraint() {
    local san=

    if [[ "$1" =~ ^(IP|DNS|email|URI|RID|dirName): ]]
    then san="$1"
    elif [[ "$1" =~ ^otherName:.*\;.*: ]]
    then san="$1"
    elif [[ "$1" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]
    then san="IP:$1"
    elif [[ "$1" =~ ^(\*\.)?([a-zA-Z][-a-zA-Z0-9]*\.)*[a-zA-Z][-a-zA-Z0-9]+$ ]]
    then san="DNS:$1"
    fi
    [[ "$san" = '' ]] && {
	echo >&2 "Cannot guess '$1', please tag it"
	exit 1
    }

    V3=yes ; V3NAMECONS=yes

    if [[ "$NAMESECT" = '' ]]
    then NAMESECT="${NAMESECT}$2;$san"
    else NAMESECT="${NAMESECT},$2;$san"
    fi

    # Hmmm, long form doesn't seem to work.
    # NAME_ID=$((NAME_ID+1))
    # NAMESECT="${NAMESECT}${1/:/.$NAME_ID=$2;}${NL}"

    #'
}
!
    )"
else
    BASHREGEX=no
add_good_san() {
    case "$1" in
    DNS:* ) add_san "$1" ${2:+"$2"} ; return 0 ;;
    IP:* ) add_san "$1" ${2:+"$2"} ; return 0 ;;
    email:* ) add_san "$1" ${2:+"$2"} ; return 0 ;;
    esac
    return 1;
}

add_name_constraint() {
    echo >&2 "You need to upgrade your version of BASH for 'add_name_constraint'"
    exit 1
}

fi

add_san() {
    V3=yes ; V3SAN=yes
    [[ "$BASH3" = no ]] && {
	[[ ${SANDUP[$1]} = 1 ]] && return 0
	SANDUP[$1]=1
    }

    SAN_ID=$((SAN_ID+1))
    if [[ "$2" = '' ]]
    then
	SANSECT="${SANSECT}${1/:/.$SAN_ID=}${NL}"
    else
	SANSECT="${1/:/.$SAN_ID=}${NL}${SANSECT}"
    fi
    return 0
}

check_args() {
    [[ "$WANTCSR" = yes && "$SINGLEUSECA" = yes ]] && {
	echo >&2 "Options -csr and -singleuseca conflict"
	exit 1
    }

    [[ "$WANTCSR" = yes && "$KFN" = '' ]] && {
	echo >&2 "ERROR: Use the -keyout= option when you use -csr"
	echo >&2 "INFO: A CSR and private key should never be put in the same file."
	exit 1
    }

    # Extract a (passworded) pfx file.
    [[ "$SIGNPFX" != '' ]] && SIGNPEM="$(openssl pkcs12 -nodes -in "$SIGNPFX")"

    # Force a CA signed certificate for DV certs
    [[ "$WANTDVCERT" = yes && "$WANTCSR" != yes && "$SIGNPEM" = '' ]] && {
	MAKECSR=yes ; SINGLEUSECA=yes
    }

    # If -suca and -sign= don't complain.
    [[ "$SIGNPEM" != '' && "$SINGLEUSECA" = yes ]] &&
	SINGLEUSECA=no

    [[ "$KEYCLASS" = nosig && "$SINGLEUSECA" != yes && "$SIGNPEM" = '' ]] && {
	echo >&2 "WARNING: Turning on -singleuseca mode because the key cannot self-sign"
	MAKECSR=yes ; SINGLEUSECA=yes
    }

    # Due to Chrome, default -suca to a certificate with SANs
    [[ "$SINGLEUSECA" = yes && "$V3SUCA" != no && "$CN" != '' ]] && {
	V3=yes ; V3SAN=yes ; V3SUCA=yes
    }

    # Put the commonName at the start of the san list
    [[ "$V3SAN" = yes && "$CN" != "" ]] && {
	add_good_san "$CN" start ||:
    }

    if  [[ "$NOPROMPT" != yes && "$V3SAN" = yes && "$CSRFN" = '' ]] &&
	[[ "$SUBJTYPE" = '' || "$SUBJTYPE.$SUBJ_ID" = conf.0 ]]
    then
	if [[ "$WANTDVCERT" = yes ]]
	then echo >&2 "The -dv option cannot be used with OpenSSL prompting for the name"
	else echo >&2 "The -san option cannot be used with OpenSSL prompting for the name"
	fi
	exit 1
    fi

    if [[ "$V3TIMESTAMP" = yes && "$V3CLIENT$V3SERVER$V3EMAIL$V3CODESIGN" != nononono ]]
    then
	echo >&2 "A timestamping certificate can only be for timestamping."
	exit 1
    fi

    # Problems?
    if ! openssl no-req 2>&1 | grep -qie ^req
    then
	echo >&2 'No suitable OpenSSL command found.'
	echo >&2 'The -openssl=/path/exe can be used to choose one.'
	exit 1
    fi

    if ! openssl x509 -help 2>&1 | grep -qie -set_serial
    then NOSETSERIAL=yes
    fi

    if openssl req -help 2>&1 | grep -qie -subject
    then REQSUBJECT=-subject
    else REQSUBJECT=-text
    fi

    if [[ "$SERIAL" != '' && "$NOSETSERIAL" = yes ]]
    then echo >&2 "ERROR: Cannot set the serial with this version of openssl."
	 exit 1
    fi

    if [[ "$SERIAL" != '' && "$NOMIXING" = yes ]]
    then echo >&2 "ERROR: Cannot set the serial with this shell."
	 exit 1
    fi

    if [[ "$SUBJ" != '' && "$NOMIXING" = yes ]]
    then echo >&2 "ERROR: /CN=.../ style option not available with this shell."
	 exit 1
    fi

    if [[ "$CASUBJ" != '' && "$NOMIXING" = yes ]]
    then echo >&2 "ERROR: Cannot set the CA subject using /CN=/ with this shell."
	 exit 1
    fi

    case "$KEYSOURCE" in
    :*:* )
	echo >&2 "ERROR: Duplicate key source locations: '$KEYSOURCE'"
	exit 1
    esac

    if ! (echo|openssl dgst "$DGST" >/dev/null 2>&1)
    then
	echo >&2 "Digest '$DGST' not supported by openssl"
	exit 1
    fi
}

build_v3_extensions() {
    # Build some V3 certificate extension sets.
    # Like the certificate extensions themselves this is very complex.
    # Your best option is probably:
    #   No option:  A v1 certificate, usually perfectly acceptable.
    #   -v3         An bare v3 certificate; eg: a strict verifiable self signed.
    #   -v3ca       A v3 CA certificate
    #   -v3usr      A v3 certificate labeled as NOT a CA.
    #   -server     A TLS (eg web) server
    #   -client     A TLS client, eg a client certificate for a web server.
    #
    # This ignores the worst of the complexity, most of which was designed to
    # allow CA's to charge more for "special" certificates.
    #
    # NOTE: Using the SAN fields forces this to be a v3 certificate.

    [[ "$V3" != yes ]] && return 0

    V3HEAD="$V3INIT"
    V3XKU=; V3EKU=
    [[ "$V3CRITICAL" != yes ]] && CR= || CR=critical,

    if  [[ "$V3SERVER" = yes || "$V3EMAIL" = yes  || "$V3CLIENT" = yes || "$V3CODESIGN" = yes || "$V3TIMESTAMP" = yes ]]
    then
	if [[ "$SIGNPEM" != "" || "$SINGLEUSECA" = yes ]]
	then V3CA="${V3CA:-no}"
	fi
    fi

    V3P=${V3CAPATH:+, pathlen:$V3CAPATH}

    [[ "$V3CA" = yes ]] && V3OPTS="$V3OPTS${NL}basicConstraints = ${CR}CA:TRUE${V3P}"
    [[ "$V3CA" = yes ]] && V3XKU=keyCertSign,cRLSign,
    [[ "$V3CA" = no ]] && V3OPTS="$V3OPTS${NL}basicConstraints = ${CR}CA:FALSE"

    [[ "$V3SERVER" = yes ]] && V3EKU=$V3EKU,serverAuth
    [[ "$V3CLIENT" = yes ]] && V3EKU=$V3EKU,clientAuth
    [[ "$V3EMAIL" = yes ]] && V3EKU=$V3EKU,emailProtection
    [[ "$V3CODESIGN" = yes ]] && V3EKU=$V3EKU,codeSigning,msCodeInd,msCodeCom
    [[ "$V3TIMESTAMP" = yes ]] && V3EKU=$V3EKU,timeStamping

    [[ "$V3EKU" != '' ]] &&
	V3OPTS="$V3OPTS${NL}extendedKeyUsage = $CR${V3EKU#,}"

    if [[ "$WANTDVCERT" = yes && "$KEYCLASS" = ec ]]
    then KEYENCY= ; KEYAGR=keyAgreement,
    elif [[ "$WANTDVCERT" = yes && "$KEYCLASS" = rsa ]]
    then KEYENCY=keyEncipherment, ; KEYAGR=
    else KEYENCY=keyEncipherment, ; KEYAGR=keyAgreement,
    fi

    if [[ "$V3CA" = '' ]]
    then :
    elif [[ "$V3SERVER" = yes && "$V3CA" != yes ]]
    then
	V3OPTS="$V3OPTS${NL}keyUsage = ${CR}${V3XKU}${KEYENCY}${KEYAGR}digitalSignature"
    elif [[ "$V3CODESIGN" = yes && "$V3CA" != yes ]]
    then
	V3OPTS="$V3OPTS${NL}keyUsage = ${CR}${V3XKU}${KEYENCY}digitalSignature"
    elif [[ "$V3EMAIL" = yes && "$V3CA" != yes ]]
    then
	V3OPTS="$V3OPTS${NL}keyUsage = ${CR}${V3XKU}${KEYENCY}digitalSignature"
    elif [[ "$V3CLIENT" = yes && "$V3CA" != yes ]]
    then
	V3OPTS="$V3OPTS${NL}keyUsage = ${CR}${V3XKU}digitalSignature"
    elif [[ "$V3TIMESTAMP" = yes && "$V3CA" != yes ]]
    then
	V3OPTS="$V3OPTS${NL}keyUsage = ${CR}${V3XKU}nonRepudiation,digitalSignature"
    elif [[ "$V3XKU" != '' ]]
    then
	V3OPTS="$V3OPTS${NL}keyUsage = ${CR}${V3XKU%,}"
    fi

    [[ "$V3SAN" = yes && "$SANSECT" != '' ]] && {
	local SUBCRIT=
	[[ "$V3CRITICAL" = yes ]] &&
	    [[ "$SUBJTYPE" = '' || "$SUBJTYPE.$SUBJ_ID" = conf.0 ]] &&
		SUBCRIT=critical,
	V3OPTS="$V3OPTS${NL}subjectAltName=${SUBCRIT}@san"
	V3EXTRAS="$V3EXTRAS${NL}[san]${NL}${SANSECT}"
    }

    [[ "$V3NAMECONS" = yes && "$NAMESECT" != '' ]] && {
	local NAMECRIT=
	[[ "$V3CRITICAL" = yes ]] &&
	    NAMECRIT=critical,
	V3OPTS="$V3OPTS${NL}nameConstraints=${NAMECRIT}${NAMESECT}"

	# V3OPTS="$V3OPTS${NL}nameConstraints=${NAMECRIT}@namec"
	# V3EXTRAS="$V3EXTRAS${NL}[namec]${NL}${NAMESECT}"
    }

    if [[ "$V3CA" = yes ]]
    then
	[[ "$V3SERVER" = yes ]] && V3ENS=$V3ENS,sslCA
	[[ "$V3CLIENT" = yes ]] && V3ENS=$V3ENS,sslCA
	[[ "$V3EMAIL" = yes ]] && V3ENS=$V3ENS,emailCA
	if [[ "$V3SERVER" = no && "$V3CLIENT" = no && \
		"$V3EMAIL" = no && "$V3TIMESTAMP" = no ]]
	then
	    V3ENS=$V3ENS,sslCA,emailCA
	fi
    else
	[[ "$V3SERVER" = yes ]] && V3ENS=$V3ENS,server
	[[ "$V3CLIENT" = yes ]] && V3ENS=$V3ENS,client
	[[ "$V3EMAIL" = yes ]] && V3ENS=$V3ENS,email
	[[ "$V3CODESIGN" = yes ]] && V3ENS=$V3ENS,objsign
    fi

    [[ "$V3NS" = yes && "$V3ENS" != '' ]] &&
	V3OPTS="$V3OPTS${NL}nsCertType = ${V3ENS#,}"

    [[ "$V3CA" != '' && "$NOKEYID" != yes ]] && {
	V3CERTONLY="$V3CERTONLY${NL}subjectKeyIdentifier=hash"
	V3CERTONLY="$V3CERTONLY${NL}authorityKeyIdentifier=keyid,issuer${NL}"
    }

    [[ "$CRLURI" != "" ]] && {
	V3OPTS="$V3OPTS${NL}crlDistributionPoints=crl_uri_sect${NL}"

	# crlDistributionPoints ==> W.T.F.
	V3EXTRAS="$V3EXTRAS
	    ${NL}[ crl_uri_sect ]
	    ${NL}fullname=@crl_url_fn
	    ${NL}[ crl_url_fn ]
	    ${NL}$CRLURI$NL"
    }

    [[ "$POLICYTEXT" != "" || "$POLICYOID" != "" ]] && {
	POLICYOID="${POLICYOID#,}"
	[[ "$POLICYOID" = '' ]] && POLICYOID=2.5.29.32.0

	POLICYOID1="${POLICYOID%%,*}"
	POLICYOIDX="${POLICYOID#"$POLICYOID1"}"

	V3OPTS="$V3OPTS${NL}certificatePolicies=@x509_pol${POLICYOIDX}${NL}"

	build_poltext() {
	    echo '[ x509_pol ]'
	    echo "policyIdentifier = $POLICYOID1"
	    [[ "$POLICYTEXT" != "" ]] && {
		echo 'userNotice=@notice'
		echo '[ notice ]'
		echo "$POLICYTEXT" |
		tr -d '"'"'" |
		sed -e '1s/^/explicitText=/; $ b end; s:$:\\r\\n\\:; :end'
	    }
	    echo
	}
	V3EXTRAS="$V3EXTRAS${NL}$(build_poltext)$NL"
	unset -f build_poltext
    }

    [[ "$TLSFEATURE" != '' ]] && {
	V3OPTS="$V3OPTS${NL}${TLSFEATURE}${NL}"
    }

    return 0
}

mk_rand() {
    local RH RL=16
    RH="$(openssl rand -hex "$RL" 2>/dev/null ||:)"
    [[ "$RH" = '' ]] &&
	RH="$(openssl rand "$RL" | od -x | sed -n '1{s/^[^ ]*//;s/ //gp;}' )"
    echo "$RH"
}

default_options() {
    # If they want San names we need the CN
    [[ "$CSRFN" != '' && "$V3SAN" = yes  && "$CN" = '' ]] && {
	PUBKEYFN="$CSRFN"
	CSRFN=
    }

    [[ "$PUBKEYFN" != '' && "$PUBDATA" = '' ]] &&
	PUBDATA="$(cat -v "$PUBKEYFN")"

    [[ "$PUBDATA" != '' ]] && {
	FORCEPUB="$(extract_pubkey <(echo "$PUBDATA") "$PUBKEYFN")"
	DEFAULTCN="$(
	    {
		echo "$PUBDATA" |
		openssl req -subject -noout -nameopt multiline 2>/dev/null
		echo "$PUBDATA" |
		openssl x509 -subject -noout -nameopt multiline 2>/dev/null
	    } | sed -n 's/^  *commonName  *=  *\([^ ]*\) *$/\1/p' |
	    head -1 )"
    }

    [[ "$DEFAULTCN" != '' && "$SUBJTYPE" = '' ]] && {
	SUBJTYPE="conf"
	SUBJ_ID=$((SUBJ_ID+1))
	SUBJ_CN="$SUBJ_CN${NL}$SUBJ_ID.commonName=$DEFAULTCN"
	if [[ "$CN" = '' ]]
	then CN="$DEFAULTCN"
	else add_good_san "$DEFAULTCN" ||:
	fi
    }

    [[ "$DGST" = "" ]] && {
	if [[ "$NOPKEY" = no ]]
	then HAVESHA256=yes
	else HAVESHA256="$(:|openssl dgst -sha256 >/dev/null 2>&1 && echo yes || echo no)"
	fi
	if [[ "$HAVESHA256" = yes ]]
	then DGST=-sha256
	else DGST=-sha
	fi
    }

    case "$CERT_DAYS" in

    all )
	# Try to use faketime to set:
	# notBefore=Jan  1 12:00:00 1999 GMT
	# notAfter=Dec 31 12:00:00 9999 GMT
	CERT_DAYS=
	if [[ "$NOPKEY" = no ]]
	then
	    if faketime -h 2>/dev/null | grep -qi libfaketime
	    then
		ft() { TZ=UTC faketime -f '1999-01-01 12:00:00' "$@" ; }
		if [ "$(ft date +%Y-%m-%d 2>/dev/null)" = '1999-01-01' ]
		then CERT_DAYS=2922304
		else ft() { "$@"; }
		fi
	    fi
	fi

	# Otherwise just try to hit the right day.
	[ "$CERT_DAYS" = '' ] && {
	    END_OF_TIME=$(jdayjdat 31 12 9999)
	    CERT_DAYS=$((END_OF_TIME - JTODAY))
	}
	;;

    *-*-* )
	# YYYY-MM-DD
	Y="${CERT_DAYS%%-*}"
	M="${CERT_DAYS#*-}"
	M="${M%-*}"
	D="${CERT_DAYS##*-}"
	END_DATE=$(jdayjdat "$D" "$M" "$Y")
	CERT_DAYS=$((END_DATE - JTODAY))
	;;
    esac

    return 0
}

apply_options() {
    [[ "$MAKECSR" = yes ]] && X509= || X509=-x509

    if [[ "$NOPROMPT" = yes ]]
    then
	if [[ "$SUBJTYPE" = '' || "$SUBJTYPE.$SUBJ_ID" = conf.0 ]]
	then
	    if [[ "$ADDDNQ" = yes ]]
	    then SUBJTYPE=conf
	    else SUBJTYPE=arg ; SUBJ=/
	    fi
	fi
    elif [[ "$SUBJTYPE" = '' && "$ADDDNQ" != no ]]
    then ADDDNQ=yes
    fi

    [[ "$ADDDNQ" = yes ]] && {
	[[ "$SERIAL" = "" ]] && DNQ="$(mk_rand)" || DNQ="$SERIAL"

	[[ "$SERIAL" = "" && "$NOSETSERIAL" != yes ]] &&
	    SERIAL="$DNQ"

	case "$SUBJTYPE" in
	arg ) SUBJ="${SUBJ%/}/dnQualifier=$DNQ/" ;;
	conf ) SUBJ_DNQ="$SUBJ_DNQ${NL}dnQualifier=$DNQ" ;;
	esac
    }

    return 0
}

mkreqconf() {
    echo "# Configure file for WANTCSR=$1 MAKECSR=$2"
    echo 'oid_section = oid_section'
    echo '[req]'
    echo 'distinguished_name = req_distinguished_name'
    [[ "$SUBJTYPE" = conf ]] &&
	echo 'prompt = no'

    if [[ "$2" != no || "$1" = no ]]
    then
	if [[ "$V3OPTS$V3LIST$V3EXTRAS" != "" || "$1" != "yes" ]]
	then
	    echo "$V3HEAD"
	    echo "$V3OPTS"
	    [[ "$1" != yes ]] &&
		echo "$V3CERTONLY"
	    echo "$V3LIST"
	    echo "$V3EXTRAS"
	fi
    fi
    echo '[ req_distinguished_name ]'
    case "$SUBJTYPE" in
    conf )
	[[ "$ADDDNQ" = no ]] || echo "$SUBJ_DNQ"
	echo "$SUBJ_C"
	echo "$SUBJ_ST"
	echo "$SUBJ_L"
	echo "$SUBJ_O"
	echo "$SUBJ_DC"
	echo "$SUBJ_OU"
	echo "$SUBJ_CN"
	echo "$SUBJ_XX"
	;;
    "")
	echo 'commonName = Common Name'
	echo 'organizationalUnitName = Organizational Unit Name'
	echo "dnQualifier= Additional subject qualifier"
	if [[ "$SERIAL" != "" ]]
	then echo "dnQualifier_default=$SERIAL"
	else echo "dnQualifier_default=$(mk_rand)"
	fi
	;;
    esac
    echo '[oid_section]'
    echo "$EXTRA_OIDS"
    echo '#END'
}

create_main_cert() {
    if [[ "$CSRFN" != "" ]]
    then SSCERT="$(cat "$CSRFN")"
    elif [[ "$FORCEPUB" != "" ]]
    then :
    else
	test_enddate

	[[ "$SHOWCONF" = yes ]] && mkreqconf $MAKECSR $WANTCSR

	[[ "$SSKEY" = '' ]] &&
	    SSKEY="$(mkkey)"

	[[ "$KEYCLASS" = file ]] && {
	    # Decrypt if necesary.
	    [[ "$NOPKEY" = no ]] &&
		SSKEY=$(echo "$SSKEY" | openssl pkey)

	    clone_key_type "$SSKEY"
	}

	[[ "$SERIAL" = "" && "$NOSETSERIAL" != yes ]] && SERIAL="$(mk_rand)"

	# openssl complains about unused -days.
	if [[ "$MAKECSR" != yes ]]
	then CERT_DAYS_OPT="-days ${CERT_DAYS:-$DEFAULT_DAYS}"
	else CERT_DAYS_OPT=
	fi

	# shellcheck disable=SC2086 # Known to be correctly split.
	SSCERT="$(ft openssl req -new $UTF8 $X509 $DGST \
	    ${CERT_DAYS_OPT} \
	    ${SERIAL:+-set_serial 0x"$SERIAL"} \
	    ${SUBJ:+-subj "$SUBJ"} \
	    -key <(echo "$SSKEY") \
	    -config <(mkreqconf $MAKECSR $WANTCSR) )"

	[[ "$MAKECSR" = yes ]] && CSRTEXT="$SSCERT"
    fi

    return 0
}

create_suca_pem() {
    [[ "$SINGLEUSECA" != yes || "$SIGNPEM" != '' ]] && return 0

    mksucareqconf() {
	echo "# Configure file for a private CA"
	echo '[req]'
	echo 'distinguished_name = req_distinguished_name'
	echo 'prompt = no'
	if [[ "$V3" = yes && "$V3SUCA" != no ]] || [[ "$V3SUCA" = yes ]]
	then echo "$V3INIT"
	     if [[ "$V3CA" != yes ]]
	     then
		[[ "$V3CRITICAL" != yes ]] && CR= || CR=critical,
		echo "basicConstraints = ${CR}CA:TRUE,pathlen:0"
		if [[ "$V3CA" = no && "$NOKEYID" != yes ]]
		then
		    echo "subjectKeyIdentifier=hash"
		    echo "authorityKeyIdentifier=keyid,issuer"
		fi

		# Simple EKU to match the certificate.
		if [ "$NOSUCAEKU" != yes ]
		then
		    [[ "$V3CODESIGN" = yes ]] &&
			[[ "$V3SERVER" != yes ]] &&
			[[ "$V3CLIENT" != yes ]] &&
			[[ "$V3EMAIL" != yes ]] &&
			[[ "$V3TIMESTAMP" != yes ]] &&
			    echo extendedKeyUsage = codeSigning,msCodeInd,msCodeCom
		fi

	     else echo "basicConstraints = CA:TRUE"
	     fi
	fi
	echo '[ req_distinguished_name ]'

	if [[ "$CASUBJ" != '' ]]
	then
	    echo "$CASUBJ"
	    if [[ "$ADDDNQ" = yes ]]
	    then
		if [[ "$SERIAL" != '' ]]
		then echo "dnQualifier=$SERIAL"
		else echo "dnQualifier=$(mk_rand)"
		fi
	    fi
	else
	    if [[ "$WANTDVCERT" != yes || "$ADDDNQ" = yes ]]
	    then
		if [[ "$ADDDNQ" != no ]]
		then
		    if [[ "$SERIAL" != '' ]]
		    then echo "dnQualifier=$SERIAL"
		    else echo "dnQualifier=$(mk_rand)"
		    fi
		fi
	    fi

	    # DV certificates need the issuer subject to have a country
	    # code and organisation. The XX code is valid for a CA, the
	    # org is supposed to be the CA's company name.
	    if [[ "$WANTDVCERT" = yes ]]
	    then echo "C=XX"
		 echo "O=Above reproach CA"
		 echo "CN=${CN:-CA}"
	    elif [[ "$CN" != "" ]]
	    then echo "O=Above reproach CA"
		 echo "CN=$CN"
	    else echo "O=Above reproach CA"
		 echo "CN=Private CA"
	    fi
	fi

	echo '#END'
    }

    [[ "$SERIAL" = "" && "$NOSETSERIAL" != yes ]] && SERIAL="$(mk_rand)"
    CAKEY="$(mkkey)"

    [[ "$NOSETSERIAL" != yes ]] && CASER="$(mk_rand)"

    [[ "$SHOWCONF" = yes ]] && mksucareqconf

    SIGNPEM="$(ft openssl req -new $UTF8 -x509 "$DGST" \
	    -days "${CERT_DAYS:-$DEFAULT_DAYS}" \
	    ${CASER:+-set_serial 0x"$CASER"} \
	    -key <(echo "$CAKEY") \
	    -config <(mksucareqconf)
	echo "$CAKEY" )"

    unset -f mksucareqconf
}

sign_created_csr() {

    [[ "$SIGNPEM" = "" ]] && return 0

    [[ "$SERIAL" = "" ]] && SERIAL="$(mk_rand)"

    # Default to days left on CA certificate
    [[ "$CERT_DAYS" = "" ]] && {
	# shellcheck disable=SC2046 # I knooow
	ENDDAY="$(openssl x509 -noout -enddate -in <(echo "$SIGNPEM") |
		    sed 's/^[^=]*=//' |
		    jdayjdat $(awk '{print $2,$1,$4;}') )"
	CERT_DAYS=$((ENDDAY - JTODAY))
    }

    # Do we have to override the CSR's common name?
    if [[ "$CSRFN" != "" && "$SUBJTYPE" != "" ]] || [[ "$FORCEPUB" != '' ]]
    then
	if ! openssl x509 -help 2>&1 | grep -qie -force_pubkey
	then echo >&2 "ERROR: Cannot override public key with x509 $(openssl version)"
	     exit 1
	fi

	# First extract the public key from the existing CSR.
	[[ "$FORCEPUB" = '' ]] &&
	    FORCEPUB="$(echo "$SSCERT" | openssl req -pubkey -noout)"

	# Openssl req requires a key, make it something quick.
	TMPKEY="$(mktmpkey)"

	[[ "$SHOWCONF" = yes ]] && mkreqconf yes no

	# Make the new request with the new name.
	SSCERT="$(openssl req -new $UTF8 \
	    ${SUBJ:+-subj "$SUBJ"} \
	    -key <(echo "$TMPKEY") \
	    -config <(mkreqconf yes no) )"
    fi

    # Quite old versions of openssl ...
    test_enddate

    # Very old versions of openssl ...
    if [[ "$NOSETSERIAL" = yes && "$SERIAL" != '' ]]
    then
	SERIALFN=/tmp/_$$.tmp
	echo "$SERIAL" > "$SERIALFN"
	unset SERIAL
    else SERIALFN=
    fi

    [[ "$SHOWCONF" = yes && "$V3HEAD" != "" ]] && mkreqconf

    SSCERT="$(ft openssl x509 -req "$DGST" \
	    -days "${CERT_DAYS:-$DEFAULT_DAYS}" \
	    ${SERIAL:+-set_serial 0x"$SERIAL"} \
	    ${SERIALFN:+-CAserial "$SERIALFN"} \
	    -in <(echo "$SSCERT") \
	    -CA <(echo "$SIGNPEM") \
	    -CAkey <(echo "$SIGNPEM") \
	    ${FORCEPUB:+-force_pubkey <(echo "$FORCEPUB") } \
	    ${V3HEAD:+-extfile <(mkreqconf) -extensions "$X509SECT"} )"

    [[ "$SERIALFN" != '' ]] && rm "$SERIALFN" # Sigh

    return 0
}

create_crl_file() {
    [[ "$WANTCSR" = yes ]] && {
	echo >&2 "ERROR: Cannot make a CRL for a CSR"
	exit 1
    }

    if [[ "$SIGNPEM" != '' ]]
    then CRLSIGN="$SIGNPEM"
    elif [[ "$SSCERT" != '' && "$SSKEY" != '' ]]
    then CRLSIGN="$SSCERT$NL$SSKEY"
    else echo 'ERROR: No keys available to sign the CRL.' >&2
	 exit 1
    fi

    mkcacrlconf() {
	echo '[ca]'
	echo 'default_ca = CA_default'
	echo '[CA_default]'
	echo "database = $TMP/index.txt"
	if [[ "$NOPKEY" = no ]]
	then echo 'default_md = default'
	else echo 'default_md = sha256'
	fi
    }

    TMP=/tmp/ca_tmp.$$
    mkdir -m u=rwx "$TMP"
    touch $TMP/index.txt
    touch $TMP/index.txt.attr

    ft openssl ca \
	-config <(mkcacrlconf) \
	-gencrl \
	-crldays "${CERT_DAYS:-$DEFAULT_DAYS}" \
	-keyfile <(echo "$CRLSIGN") \
	-cert <(echo "$CRLSIGN")

    rm -fr "$TMP"

    unset -f mkcacrlconf
    return 0
}

create_pfx_file() {
    [[ "$PKCS12FN" = "" ]] && return 0

    [[ "$WANTCSR" = yes ]] && { echo >&2 "PKCS12 files can't store certificate signing requests."; exit 1;}

    [[ "$SSKEY" = '' ]] && {
	echo 'ERROR: A pfx file needs a private key' >&2
	exit 1
    }

    if [ "$PKCS12ASCII" != yes ]
    then do_pfx "$PKCS12FN"
    else
	(
	    umask 077
	    {
		echo -----BEGIN PKCS12-----
		do_pfx '' | openssl base64 -e
		echo -----END PKCS12-----
	    } > "$PKCS12FN"
	)
    fi

    return 0
}

do_pfx() {

    openssl pkcs12 -export -passout "${KEYPASS:-pass:}" \
	${1:+-out "$PKCS12FN"} \
	-name "$CN til: $(echo "$SSCERT" | openssl x509 -noout -enddate |
			  sed -n 's/.*= *//p')" \
	-inkey <(echo "$SSKEY") \
	-in <(echo "$SSCERT") \
	${SIGNPEM:+-certfile <(echo "$SIGNPEM" | openssl x509) } \
	${SIGNPEM:+-caname "$(echo "$SIGNPEM" | openssl x509 -noout \
		-subject -nameopt multiline | sed -n 's/ *commonName *= //p'
		) CA til: $(echo "$SIGNPEM" | openssl x509 -noout -enddate |
		  sed -n 's/.*= *//p' )"}
}

outp() {
    if [[ "$WANTCSR" = yes ]]
    then echo "$SSCERT" | openssl req $REQSUBJECT
    else echo "$SSCERT" | openssl x509 -subject -issuer -fingerprint -serial -dates
    fi

    [[ "$SINGLEUSECA" = yes || "$CAFN" != '' ]] && {
	if [[ "$SIGNPEM" = '' && "$CAFN" != '' && "$CAFN" != "$1" ]]
	then echo "$SSCERT" | openssl x509 -subject -serial -dates > "$CAFN"
	elif [[ "$CAFN" != '' && "$CAFN" != "$1" ]]
	then echo "$SIGNPEM" | openssl x509 -subject -serial -dates >"$CAFN"
	else echo "$SIGNPEM" | openssl x509 -subject -serial -dates
	fi
    }

    [[ "$ADDCERT" != '' ]] && echo "$ADDCERT"

    [[ "$CSRTEXT" != "" && "$SHOWCSR" = yes ]] &&
	echo "$CSRTEXT"

    if [[ "$KFN" = '/dev/null' ]]
    then :
    elif [[ "$KFN" != '' ]]
    then umask 077
	 outk > "$KFN"
    else outk
    fi

    [[ "$MAKECRL" = yes ]] && {
	if [[ "$CRLFN" = '' || "$CRLFN" = "$1" || "$CRLFN" = "$KFN" ]]
	then echo "$CRLPEM" | openssl crl -text
	else echo "$CRLPEM" | openssl crl -text > "$CRLFN"
	fi
    }

    return 0
}

outk() {
    if [[ "$KEYPASS" != "" && "$KEYPASS" != 'pass:' ]]
    then echo "$SSKEY" | openssl pkey ${KEYPASS:+$CIPHER -passout "$KEYPASS"}
	 echo 'Public key for above key is:'
	 echo "$SSKEY" | openssl pkey -pubout
    else echo "$SSKEY"
    fi
}

extract_pubkey() {
    local KFNAME KEYFILE PUBKEY ITEM PEMTYPE
    KFNAME="$1"
    KEYFILE="$(cat "$KFNAME")"

    for PEMTYPE in x509 req pkey pubkey rsa ec dsa
    do
	PUBKEY=
	if [ "$PEMTYPE" = 'pubkey' ]
	then ITEM="$(echo "$KEYFILE" | openssl pkey -pubin 2>/dev/null)"
	elif [[ "$PEMTYPE" = rsa || "$PEMTYPE" = dsa || "$PEMTYPE" = ec || "$PEMTYPE" = pkey ]]
	then ITEM="$(echo "$KEYFILE" | openssl "$PEMTYPE" -passin pass:0000 2>/dev/null)"
	else ITEM="$(echo "$KEYFILE" | openssl "$PEMTYPE" 2>/dev/null)"
	fi

	[ "$ITEM" = "" ] && continue

	case "$PEMTYPE" in
	x509 ) PUBKEY="$(echo "$ITEM" | openssl x509 -pubkey -noout 2>/dev/null)" ;;
	req ) PUBKEY="$(echo "$ITEM" | openssl req -pubkey -noout 2>/dev/null)" ;;
	pkey ) PUBKEY="$(echo "$ITEM" | openssl pkey -pubout 2>/dev/null)" ;;
	pubkey ) PUBKEY="$(echo "$ITEM" | openssl pkey -pubin 2>/dev/null)" ;;

	rsa|ec|dsa )
	    PUBKEY="$(echo "$ITEM" | openssl "$PEMTYPE" -pubout 2>/dev/null)" ;;
	esac

	[ "$PUBKEY" = "" ] || break
    done

    [ "$PUBKEY" = '' ] && {
	echo >&2 "Cannot find public key in ${2:-the file}, it needs to be unencrypted and in PEM format"
	exit 1
    }

    echo "$PUBKEY"
}

clone_key_type() {
    local INKEY="$1" ECTYPE RSABITS DSALEN DSABITS

    # Match a named EC curve using an ASN1 OID.
    # Recommend:
    #   secp256r1, secp384r1, secp521r1  Supported by browsers.

    ECTYPE=$(echo "$INKEY" | openssl ec -noout -text 2>&1 |
	awk '/^ASN1 OID:/ {print $3;}')

    # Do we have an EC curve name ?
    [ "$ECTYPE" != "" ] && {
	eval "mkkey() { openssl ecparam -name '$ECTYPE' -genkey -noout ; }"
	return
    }

    # Match the RSA bitsize of the key
    RSABITS=$(echo "$INKEY" | openssl rsa -text -noout 2>&1 |
	awk '/Key: .*bit/{sub("bit.*","",$0);gsub("[^0-9]","",$0); print $0;}')

    # Do we have an RSA bit size ?
    [ "$RSABITS" != "" ] && {
	eval "mkkey() { openssl genrsa '$RSABITS' ; }"
	return
    }

    # Match the DSA bitsize of the key
    DSABITS=$(echo "$INKEY" | openssl dsa -text -noout 2>&1 |
	awk '/Key: .*bit/{sub("bit.*","",$0);gsub("[^0-9]","",$0); print $0;}')

    DSALEN=$(echo "$INKEY" |
        openssl dsa -modulus -noout 2>/dev/null |
        sed -n 's/.*=//p' | wc -c)
    [ "$DSALEN" -gt 0 ] && DSABITS="$((DSALEN*4/8*8))"

    # Do we have a DSA bit size ?
    [ "$DSABITS" != "" ] && {
	eval "mkkey() { openssl dsaparam -noout -genkey '$DSABITS' ; }"
	return
    }

    # Humm, dunno what we had, hopefully this will do.
    mkkey() { openssl ecparam -name prime256v1 -genkey -noout ; }

    return 0
}

jdayjdat() {
    awk '#!/usr/bin/awk -f

    BEGIN{
	days[0] = "Sunday";
	days[1] = "Monday";
	days[2] = "Tuesday";
	days[3] = "Wednesday";
	days[4] = "Thursday";
	days[5] = "Friday";
	days[6] = "Saturday";

	months["jan"] = 1;
	months["feb"] = 2;
	months["mar"] = 3;
	months["apr"] = 4;
	months["may"] = 5;
	months["jun"] = 6;
	months["jul"] = 7;
	months["aug"] = 8;
	months["sep"] = 9;
	months["oct"] = 10;
	months["nov"] = 11;
	months["dec"] = 12;

	if(ARGC == 2) {
	    j = ARGV[1]+0;
	    if (j>0 && j<65536) j += 2400000
	    split(jdate(j),A);
	    print A[1];
	} else if(ARGC >= 4) {
	    d = ARGV[1]; m = ARGV[2]; y = ARGV[3];

	    if (d+0 > 999 && y < 100) { ms = d; d = y; y = ms; }
	    ms = tolower(substr(m, 1, 3));
	    if (ms in months) m = months[ms];
	    else {
		ms = tolower(substr(d, 1, 3));
		if (ms in months) {
		    d = m;
		    m = months[ms];
		}
	    }

	    if( y>31 && y<70 ) y+=2000;
	    if( y>31 && y<100) y+=1900;
	    if( m<1)  {m+=12; y--;}
	    if( m>12) {m-=12; y++;}

	    jd = jday(d,m,y);
	    if (ARGC > 4) {
		printf("Input: %04d-%02d-%02d\n", y, m, d);
		print jd
		js = jdate(jd);
		split(js,A,/[- ]/);
		print js;
		print A[1], A[2], A[3], days[A[4]];
	    } else
		print jd
	} else
	if(ARGC == 1) {
	    "date +%s" | getline t
	    t += 43200;
	    j = int(t / 86400); t -= j * 86400;
	    j = int(j + 2440587);
	    print jdate(j), t "s";
	} else
	    print "Incorrect arguments"
    }

    function jdate(j,  y,m,d,dow)
    {
	# Julian date converter. Takes a julian date (the number of days since
	# some distant epoch or other) and returns the broken out date.
	# d = day of month;
	# m = month;
	# y = year (actual year, like 1977, not 77 unless it was  77 a.d.);
	# dow = day of week (0->Sunday to 6->Saturday)
	# These are Gregorian.
	# Copied from Algorithm 199 in Collected algorithms of the CACM
	# Author: Robert G. Tantzen, Translators: Nat Howard, Robert de Bath

	j = j + 1
	dow = (j + 1)%7;
	j -= 1721119;
	# This should be a Euclidean division. But dates before 0001-01-01 dont
	# make much sense anyway. Or even Friday, 15 October 1582 when the
	# Gregorian calendar started.
	y = int((4 * j - 1)/146097);
	j = 4 * j - 1 - 146097 * y;
	d = int(j/4);
	j = int((4 * d + 3)/1461);
	d = 4 * d + 3 - 1461 * j;
	d = int((d + 4)/4);
	m = int((5 * d - 3)/153);
	d = 5 * d - 3 - 153 * m;
	d = int((d + 5) / 5);
	y = 100 * y + j;
	if(m < 10) m += 3; else { m -= 9; ++y; }

	return sprintf("%04d-%02d-%02d %d", y, m, d, dow);
    }

    function jday(d,m,y,  c,ya,j)
    {
	# Takes a date, and returns a Julian day. A Julian day is the number of
	# days since some base date  (in the very distant past).
	# Handy for getting date of x number of days after a given Julian date
	# (use jdate to get that from the Gregorian date).
	# Author: Robert G. Tantzen, translators: Nat Howard, Robert de Bath
	# Translated from the algol original in Collected Algorithms of CACM
	# (This and jdate are algorithm 199).

	if(m>2) m -=3; else { m +=9; --y; }
	c = int(y/100);
	ya = y - (100*c);
	j = int(146097*c/4) + int(1461*ya/4) + int((153*m+2)/5) + d + 1721119;

	return j - 1;
    }
    ' "$@"
}

test_enddate() {
    # Before this end dates may be bad.
    if [[ "$NOPKEY" = yes ]]; then
	TMPKEY=$(mktmpkey)
	TESTCRT=$(openssl req -new -x509 -nodes \
	    -days "${CERT_DAYS:-$DEFAULT_DAYS}" \
	    -key <(echo "$TMPKEY") \
	    -config <(
		echo "[req]" ; echo "distinguished_name = rdn"
		echo "prompt = no" ; echo "[rdn]" ; echo "CN=localhost"
	    ) )

	# shellcheck disable=SC2046 # jdayjdat again
	ENDDAY="$(openssl x509 -noout -enddate -in <(echo "$TESTCRT") |
                    sed 's/^[^=]*=//' |
                    jdayjdat $(awk '{print $2,$1,$4;}') )"

        TEST_DAYS=$((ENDDAY - JTODAY))

	[[ "$TEST_DAYS" -lt 0 ]] && {
	    echo >&2 Error setting certificate end date, \
		"${CERT_DAYS:-$DEFAULT_DAYS} days gives $(jdayjdat "$ENDDAY")"

	    echo >&2 \
		"You might try -days=2038-01-18 or a newer version of openssl"
	    exit 1
	}
    fi
    return 0
}

test_for_windows() {
    # MINGW has two copies of openssl, one compiled for Windows and one
    # compiled for Unix. The Windows version cannot be used with process
    # substitution ( the <(...) stuff ). Check to see if the default is
    # working, if not try to find the other one.
    local pgm

    if ! openssl no-req 2>&1 | grep -qie ^req
    then openssl() { echo >&2 "OpenSSL failed to run." ; return 1; }
    elif [ "$(openssl enc -a -in <(echo ok) 2>/dev/null )" != b2sK ]
    then
	for pgm in $(which -a openssl)
	do
	    eval "openssl() { command '$pgm' \"\$@\"; }"

	    if [ "$(openssl enc -a -in <(echo ok) 2>/dev/null )" = b2sK ]
	    then break
	    fi
	done
    fi
}

main "$@"