#!/bin/bash
#
# Create a self-signed certificate for exim4 and switch on TLS.
# Inspired by: /usr/share/doc/exim4-base/examples/exim-gencert
#

set -e

## Activate TLS:
FILE=/etc/exim4/conf.d/main/000_localmacros
ainsl -a $FILE "MAIN_TLS_ENABLE = yes"


## Create certificate:

DIR=/etc/exim4
CERT=$DIR/exim.crt
KEY=$DIR/exim.key

# valid for ten years:
DAYS=3650

if [ -f $target/$CERT ] && [ -f $target/$KEY ]; then
  echo "$CERT and $KEY exists, exiting!"
  exit 0
fi

SSLEAY="$(tempfile -m600 -pexi)"

cat > $target/$SSLEAY <<EOF
RANDOM=/dev/random
[ req ]
default_bits = 1024
default_keyfile = exim.key
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[ req_distinguished_name ]
O  = Debian-LAN SMTP server
OU = Automatically-generated SMTP SSL key
CN = mainserver.intern
emailAddress = postmaster@mail.intern
[ v3_req ]
nsCertType = server
subjectAltName=DNS:mainserver.intern,DNS:mainserver,DNS:mail.intern,DNS:mail,DNS:localhost
EOF

$ROOTCMD openssl req -config $SSLEAY -x509 -newkey rsa:1024 -keyout $KEY -out $CERT -days $DAYS -nodes
rm -f $SSLEAY

$ROOTCMD chown root:Debian-exim $KEY $CERT
$ROOTCMD chmod 640 $KEY $CERT
