#!/bin/bash

export SCRIPT_PATH=$( cd "$(dirname "${BASH_SOURCE}")" ; pwd -P )

# create an empty directory and execute this script.
# the initializer is demo(); @see end of this file

DEFAULT_DOMAIN='reverse.com'
DEFAULT_IP='192.168.0.42'

#local DEFAULT_CA_RSA_KEYSIZE_PASSWORD=8192
#local DEFAULT_CA_RSA_KEYSIZE_PRIVATE_KEY=8192
#local DEFAULT_CA_RSA_KEYSIZE_REQUEST=4096

DEFAULT_CA_RSA_KEYSIZE_PASSWORD=4096
DEFAULT_CA_PWD_GEN_PUBEXP=7
DEFAULT_CA_RSA_KEYSIZE_PRIVATE_KEY=8192
DEFAULT_CA_RSA_KEYSIZE_REQUEST=8192
DEFAULT_CA_MD_REQUEST=sha512
DEFAULT_CA_MD=sha512

DEFAULT_CRT_RSA_KEYSIZE_PRIVATE_KEY=4096
DEFAULT_CRT_PWD_GEN_PUBEXP=7
DEFAULT_CRT_RSA_KEYSIZE_REQUEST=2048
DEFAULT_CRT_MD_REQUEST=sha512

#rm -rf $SCRIPT_PATH/$DEFAULT_DOMAIN/* > /dev/null 2>&1
#exit 1
#find $SCRIPT_PATH/$DEFAULT_DOMAIN/ -name "*.*" -type f|xargs rm -f

##############################################################
#
# constants
#
##############################################################

declare -A DIR_NAME
DIR_NAME[cnf]='etc'
DIR_NAME[db]='db'
DIR_NAME[private]='private'
DIR_NAME[public]='public'
DIR_NAME[intermediateDir]='intermediate'
DIR_NAME[lookup]='lookup'
DIR_NAME[caRoot]='ca'
DIR_NAME[caEmail]='ca-email'
DIR_NAME[caSoftware]='ca-software'
DIR_NAME[caTls]='ca-tls'
DIR_NAME[crtEmail]='crt-email'
DIR_NAME[crtSoftware]='crt-software'
DIR_NAME[crtTls]='crt-tls'
DIR_NAME[email]='email'
DIR_NAME[software]='software'
DIR_NAME[tls]='tls'
declare -r DIR_NAME

declare -A FILE_NAME
FILE_NAME[cnf]='%s.%s.cnf'
FILE_NAME[csr]='%s.%s.csr'
FILE_NAME[p12]='%s.%s.p12'
FILE_NAME[crt]='%s.%s.crt'
FILE_NAME[crtPem]='%s.%s.crt.pem'
FILE_NAME[cer]='%s.%s.cer'
FILE_NAME[chainPem]='%s.%s.chain.pem'
FILE_NAME[chainP7c]='%s.%s.chain.p7c'
FILE_NAME[crtDb]='%s.%s.crt.db'
FILE_NAME[crtSrl]='%s.%s.crt.srl'
FILE_NAME[crl]='%s.%s.crl'
FILE_NAME[crlPem]='%s.%s.crl.pem'
FILE_NAME[crlSrl]='%s.%s.crl.srl'
FILE_NAME[key]='%s.%s.key'
FILE_NAME[keyPem]='%s.%s.key.pem'
FILE_NAME[password]='%s.%s.pwd'
declare -r FILE_NAME

declare -A DIRECTORIES_CA_ROOT
DIRECTORIES_CA_ROOT[caPath]=${DIR_NAME[caRoot]}
DIRECTORIES_CA_ROOT[dbPath]=${DIR_NAME[caRoot]}/${DIR_NAME[db]}
DIRECTORIES_CA_ROOT[cnfPath]=${DIR_NAME[caRoot]}/${DIR_NAME[cnf]}
DIRECTORIES_CA_ROOT[privatePath]=${DIR_NAME[caRoot]}/${DIR_NAME[private]}
declare -r DIRECTORIES_CA_ROOT

declare -A DIRECTORIES_CA_EMAIL
DIRECTORIES_CA_EMAIL[caPath]=${DIR_NAME[caEmail]}
DIRECTORIES_CA_EMAIL[dbPath]=${DIR_NAME[caEmail]}/${DIR_NAME[db]}
DIRECTORIES_CA_EMAIL[cnfPath]=${DIR_NAME[caEmail]}/${DIR_NAME[cnf]}
DIRECTORIES_CA_EMAIL[privatePath]=${DIR_NAME[caEmail]}/${DIR_NAME[private]}
declare -r DIRECTORIES_CA_EMAIL

declare -A DIRECTORIES_CRT_EMAIL
DIRECTORIES_CRT_EMAIL[crtPath]=${DIR_NAME[crtEmail]}
DIRECTORIES_CRT_EMAIL[cnfPath]=${DIR_NAME[crtEmail]}/${DIR_NAME[cnf]}
DIRECTORIES_CRT_EMAIL[privatePath]=${DIR_NAME[crtEmail]}/${DIR_NAME[private]}
declare -r DIRECTORIES_CRT_EMAIL

declare -A DIRECTORIES_CA_SOFTWARE
DIRECTORIES_CA_SOFTWARE[caPath]=${DIR_NAME[caSoftware]}
DIRECTORIES_CA_SOFTWARE[dbPath]=${DIR_NAME[caSoftware]}/${DIR_NAME[db]}
DIRECTORIES_CA_SOFTWARE[cnfPath]=${DIR_NAME[caSoftware]}/${DIR_NAME[cnf]}
DIRECTORIES_CA_SOFTWARE[privatePath]=${DIR_NAME[caSoftware]}/${DIR_NAME[private]}
declare -r DIRECTORIES_CA_SOFTWARE

declare -A DIRECTORIES_CRT_SOFTWARE
DIRECTORIES_CRT_SOFTWARE[crtPath]=${DIR_NAME[crtSoftware]}
DIRECTORIES_CRT_SOFTWARE[cnfPath]=${DIR_NAME[crtSoftware]}/${DIR_NAME[cnf]}
DIRECTORIES_CRT_SOFTWARE[privatePath]=${DIR_NAME[crtSoftware]}/${DIR_NAME[private]}
declare -r DIRECTORIES_CRT_SOFTWARE

declare -A DIRECTORIES_CA_TLS
DIRECTORIES_CA_TLS[caPath]=${DIR_NAME[caTls]}
DIRECTORIES_CA_TLS[dbPath]=${DIR_NAME[caTls]}/${DIR_NAME[db]}
DIRECTORIES_CA_TLS[cnfPath]=${DIR_NAME[caTls]}/${DIR_NAME[cnf]}
DIRECTORIES_CA_TLS[privatePath]=${DIR_NAME[caTls]}/${DIR_NAME[private]}
declare -r DIRECTORIES_CA_TLS

declare -A DIRECTORIES_CRT_TLS
DIRECTORIES_CRT_TLS[crtPath]=${DIR_NAME[crtTls]}
DIRECTORIES_CRT_TLS[cnfPath]=${DIR_NAME[crtTls]}/${DIR_NAME[cnf]}
DIRECTORIES_CRT_TLS[privatePath]=${DIR_NAME[crtTls]}/${DIR_NAME[private]}
declare -r DIRECTORIES_CRT_TLS

declare -A DIRECTORIES_PUB
DIRECTORIES_PUB[email]=${DIR_NAME[public]}/${DIR_NAME[email]}
DIRECTORIES_PUB[software]=${DIR_NAME[public]}/${DIR_NAME[software]}
DIRECTORIES_PUB[tls]=${DIR_NAME[public]}/${DIR_NAME[tls]}
declare -r DIRECTORIES_PUB

	
##############################################################
#
# consolol
#
##############################################################
writeNewCert()
{
	local domain=$1
	local x=$(printf '%-64s' "create certificates for")
	local y=$(printf '%-64s' "$domain")
	local z=$(printf '%-64s' '')
	
	echo -e "\e[90m$z\e[39m"
	echo -e "\e[92m$x\e[39m"
	echo -e "\e[96m$y\e[39m"
	echo -e "\e[90m$z\e[39m"
}

writeDelCert()
{
	local domain=$1
	local x=$(printf '%-64s' "delete certificates for")
	local y=$(printf '%-64s' "$domain")
	local z=$(printf '%-64s' '')
	
	echo -e "\e[90m$z\e[39m"
	echo -e "\e[91m$x\e[39m"
	echo -e "\e[96m$y\e[39m"
	echo -e "\e[90m$z\e[39m"
}

writeRevCert()
{
	local domain=$1
	local x=$(printf '%-64s' "revoke certificates for")
	local y=$(printf '%-64s' "$domain")
	local z=$(printf '%-64s' '')
	
	echo -e "\e[90m$z\e[39m"
	echo -e "\e[93m$x\e[39m"
	echo -e "\e[96m$y\e[39m"
	echo -e "\e[90m$z\e[39m"
}

writeNewType()
{
	local type=$1
	echo -e "\e[97m• \e[92mcreate\e[97m $type\e[39m"
}
writeDelType()
{
	local type=$1
	echo -e "\e[97m• \e[91mdelete\e[97m $type\e[39m"
}
writeRevType()
{
	local type=$1
	echo -e "\e[97m• \e[93mrevoke\e[97m $type\e[39m"
}

writeNewItem()
{
	local item=$1
	echo -e "\e[90m  \e[92m+\e[90m $item\e[39m"
}

writeNewItem2()
{
	local item=$1
	echo -e "\e[90m    \e[92m+\e[90m $item\e[39m"
}

writeDelItem()
{
	local item=$1
	echo -e "\e[90m  \e[91m-\e[90m $item\e[39m"
}

writeDelItem2()
{
	local item=$1
	echo -e "\e[90m    \e[91m-\e[90m $item\e[39m"
}

do_unlock()
{
	rm -rf "/var/lock/$DEFAULT_DOMAIN"
}

do_exit()
{
	if [ $1 -ne 30 ]; then
		do_unlock
	fi
	exit $1
}

check_result()
{
	if [ $1 -ne 0 ]; then
		echo -e "\e[91m        Error\e[39m $2"
		do_exit "$1"
	else
		echo -e "\e[92m        OK\e[39m"
	fi
}

idle_result()
{
	if [ $1 -ne 0 ]; then
		echo -e "\e[93m		Nothing to do.\e[39m $2"
		return $1
	fi
	echo -e "\e[92m		Ok\e[39m"
}

warn_result()
{
	if [ $1 -ne 0 ]; then
		echo -e "\e[93mWarning\e[39m $2"
	fi
}

check_prompt()
{
	if [ $1 -ne 0 ]; then
		warn_result "$@"
		read -p 'Would you like to continue [y/n]: ' answer
	    if [ "$answer" != 'y' ] && [ "$answer" != 'Y'  ]; then
	        echo 'Goodbye'
	        do_exit "$1"
	    fi
	fi
}






certificate()
{
	# entry point
	local reverseDomain=$1
	# registered domain; MUST avail in lookup folder
	local domain=$2
	# what you want to do; {create|delete|revoke}
	local action=$3
	# the certificate type; {email|tls-client|tls-client-external|tls-server|tls-server-external|code-signing}
	local configType=$4
	# infix/prefix... for new files.
	# the given name should be related to the cert; e.g. foo.com for tls-server-external
	local fileNameInfix=$5
	
	# optional named arg san
	# used for $ENV:SAN=$envVar in tls-server-external; if not present: $ENV:SAN="DNS:$fileNameInfix,DNS:*.$fileNameInfix"
	local san
	# optional named arg password
	# used for personal certificates and is required for email, tls-client, and tls-client-external
	local password
	
	# subj defaults
	# we have to redefine the common name in tls-server as $domain
	declare -A SUBJ_DEFAULT
	SUBJ_DEFAULT[C]='BE'
	SUBJ_DEFAULT[ST]='Antwerp'
	SUBJ_DEFAULT[L]='Antwerp'
	SUBJ_DEFAULT[O]="### Network $domain"
	SUBJ_DEFAULT[OU]=''
	SUBJ_DEFAULT[CN]="### Network $domain"
	
	# subjects cust
	declare -A SUBJ
	
	while [[ ${6} ]]; do
		case "${6}" in
			-san)
				# used for $ENV:SAN=$envVar in tls-server-external; if not present: $ENV:SAN="DNS:$fileNameInfix,DNS:*.$fileNameInfix"
				local san=${7}
				shift
			;;
			-password)
				# used for personal certificates and is required for email, tls-client, and tls-client-external
				local password=${7}
				shift
			;;
			# certificate subjects
			-C)
				SUBJ[C]=${7}
				shift
			;;
			-ST)
				SUBJ[ST]=${7}
				shift
			;;
			-L)
				SUBJ[L]=${7}
				shift
			;;
			-O)
				SUBJ[O]=${7}
				shift
			;;
			-OU)
				SUBJ[OU]=${7}
				shift
			;;
			-CN)
				SUBJ[CN]=${7}
				shift
			;;
			-emailAddress)
				SUBJ[emailAddress]=${7}
				shift
			;;
			*)
			echo "Unknown parameter: ${6}" >&2
				return 1
		esac
		
		if ! shift; then
				echo 'Missing parameter argument.' >&2
				return 1
		fi
	done
	
	local lookupPath="$SCRIPT_PATH/$reverseDomain/lookup"
	
	if [ ! -d $lookupPath ]; then
		check_result 1 "Lookup directory for $reverseDomain is not here."
	fi
	
	if [ ! -f "$lookupPath/$domain" ]; then
		check_result 1 "$domain is not here :("
	fi
	
	##############################################################
	#
	# bootstrap
	#
	##############################################################
	
	local fileName="$fileNameInfix;;$domain"
		
	getDomainPath()
	{
		local lookupPath=$1
		local domain=$2
		echo $(head -n 1 $lookupPath/$domain)
	}
	
	getBaseType()
	{
		local type=$1
		case "$type" in
				email)
					echo 'email'
					;;
				tls-server|tls-server-external|tls-client|tls-client-external)
					echo 'tls'
					;;
				code-signing)
					echo 'software'
					;;
				*)
					check_result 1 "invalid request type $type; {email|tls-client|tls-client-external|tls-server|tls-server-external|code-signing}"
		esac
	}
	
	declare -A FILES
	declare -A DIRS
	getFiles()
	{
		local domain=$1
		local domainPath=$2
		local baseType=$3
		local configType=$4
		local fileName=$5
		
		local caType
		local crtType
		
		DIRS[ca]=$domainPath
		DIRS[pub]=$domainPath/${DIR_NAME[public]}
		
		case "$baseType" in
				email)
					local caType=${DIR_NAME[caEmail]}
					local crtType=${DIR_NAME[crtEmail]}
					
					DIRS[caDb]=$domainPath/${DIRECTORIES_CA_EMAIL[dbPath]}
					DIRS[caCnf]=$domainPath/${DIRECTORIES_CA_EMAIL[cnfPath]}
					DIRS[caPrivate]=$domainPath/${DIRECTORIES_CA_EMAIL[privatePath]}
					
					DIRS[crt]=$domainPath/${DIRECTORIES_CRT_EMAIL[crtPath]}
					DIRS[crtCnf]=$domainPath/${DIRECTORIES_CRT_EMAIL[cnfPath]}
					DIRS[crtPrivate]=$domainPath/${DIRECTORIES_CRT_EMAIL[privatePath]}
					
					DIRS[pubCrt]=$domainPath/${DIRECTORIES_PUB[email]}
				;;
				tls)
					local caType=${DIR_NAME[caTls]}
					local crtType=${DIR_NAME[crtTls]}
					
					DIRS[caDb]=$domainPath/${DIRECTORIES_CA_TLS[dbPath]}
					DIRS[caCnf]=$domainPath/${DIRECTORIES_CA_TLS[cnfPath]}
					DIRS[caPrivate]=$domainPath/${DIRECTORIES_CA_TLS[privatePath]}
					
					DIRS[crt]=$domainPath/${DIRECTORIES_CRT_TLS[crtPath]}
					DIRS[crtCnf]=$domainPath/${DIRECTORIES_CRT_TLS[cnfPath]}
					DIRS[crtPrivate]=$domainPath/${DIRECTORIES_CRT_TLS[privatePath]}
					
					DIRS[pubCrt]=$domainPath/${DIRECTORIES_PUB[tls]}
				;;
				software)
					local caType=${DIR_NAME[caSoftware]}
					local crtType=${DIR_NAME[crtSoftware]}
					
					DIRS[caDb]=$domainPath/${DIRECTORIES_CA_SOFTWARE[dbPath]}
					DIRS[caCnf]=$domainPath/${DIRECTORIES_CA_SOFTWARE[cnfPath]}
					DIRS[caPrivate]=$domainPath/${DIRECTORIES_CA_SOFTWARE[privatePath]}
					
					DIRS[crt]=$domainPath/${DIRECTORIES_CRT_SOFTWARE[crtPath]}
					DIRS[crtCnf]=$domainPath/${DIRECTORIES_CRT_SOFTWARE[cnfPath]}
					DIRS[crtPrivate]=$domainPath/${DIRECTORIES_CRT_SOFTWARE[privatePath]}
					
					DIRS[pubCrt]=$domainPath/${DIRECTORIES_PUB[software]}
				;;
				*)
					check_result 1 "invalid request baseType '$baseType' {email|tls|software}"
		esac
		
		# the directories are always present
		for index in "${!DIRS[@]}"
		do
			if [ ! -d "${DIRS[$index]}" ]; then
				check_result 1 'directory not found'
			fi
		done
		
		FILES[caChainPem]=${DIRS[ca]}/$(printf ${FILE_NAME[chainPem]} $domain $caType)
		FILES[caCrl]=${DIRS[caDb]}/$(printf ${FILE_NAME[crl]} $domain $caType)
		FILES[caCnf]=${DIRS[caCnf]}/$(printf ${FILE_NAME[cnf]} $domain $caType)
		FILES[caPwd]=${DIRS[caPrivate]}/$(printf ${FILE_NAME[password]} $domain $caType)
		
		# the CA files are always present
		for index in "${!FILES[@]}"
		do
			if [ ! -f "${FILES[$index]}" ]; then
				check_result 1 "Required CA file ${FILES[$index]} not found"
			fi
		done
		
		FILES[crt]=${DIRS[crt]}/$(printf ${FILE_NAME[crt]} $fileName $configType)
		FILES[crtCsr]=${DIRS[crt]}/$(printf ${FILE_NAME[csr]} $fileName $configType)
		FILES[crtP12]=${DIRS[crt]}/$(printf ${FILE_NAME[p12]} $fileName $configType)
		FILES[crtChainPem]=${DIRS[crt]}/$(printf ${FILE_NAME[chainPem]} $fileName $configType)
		FILES[crtCnf]=${DIRS[crtCnf]}/$(printf ${FILE_NAME[cnf]} $domain $configType)
		FILES[crtKey]=${DIRS[crtPrivate]}/$(printf ${FILE_NAME[key]} $fileName $configType)
		
		FILES[pubCaCrl]=${DIRS[pub]}/$(printf ${FILE_NAME[crl]} $domain $caType)
		
		FILES[pubCer]=${DIRS[pubCrt]}/$(printf ${FILE_NAME[cer]} $fileName $configType)
		FILES[pubChainP7c]=${DIRS[pubCrt]}/$(printf ${FILE_NAME[chainP7c]} $fileName $configType)
		FILES[pubKeyPem]=${DIRS[pubCrt]}/$(printf ${FILE_NAME[keyPem]} $fileName $configType)
		FILES[pubCrtPem]=${DIRS[pubCrt]}/$(printf ${FILE_NAME[crtPem]} $fileName $configType)
	}
	
	local domainPath=$(getDomainPath $lookupPath $domain)
	local baseType=$(getBaseType $configType)
	
	getFiles $domain $domainPath $baseType $configType $fileName
	
	local lvl=$(grep -o '/intermediate/' <<< "$domainPath" | wc -l)
	case "$lvl" in
		0)
			export CA_0_SCRIPT_PATH="$domainPath"
		;;
		1)
			export CA_1_SCRIPT_PATH="$domainPath"
		;;
		2)
			export CA_2_SCRIPT_PATH="$domainPath"
		;;
	esac
	
	testPassword()
	{
		local password=$1
		if [ -z "$password" ]; then
			check_result 1 "A password is required but was not set or ist empty.\n You can add it with parameter -password"
		fi
	}
	
	testSubject()
	{
		local type=$1
		local name=$2
		local insert=$3
		local default=$4
		
		case "$type" in
			match)
				if [ ! -z "$insert" ]; then
					if [ "$default" != "$insert" ]; then
						check_result 1 "Invalid data for subject /$name=$insert\nThis field must match with the CA policy /$name=$default\nRemove the argument -$name and I will set it for you."
					fi
				fi
			;;
			supplied)
				if [ -z "$insert" ]; then
					check_result 1 "Invalid data for subject /$name=\nThis field must be present and can not be empty.\nYou have to add the parameter -$name"
				fi
			;;
		esac
	}
	
    concatSubj()
    {
    	declare -A MERGED
		local result=""
		
		for index in "${!SUBJ_DEFAULT[@]}"
		do
			MERGED[$index]=${SUBJ_DEFAULT[$index]}
		done
		
		for index in "${!SUBJ[@]}"
		do
			MERGED[$index]=${SUBJ[$index]}
		done
		
		for index in "${!MERGED[@]}"
		do
			result="${result}/${index}=${MERGED[$index]}"
		done
		
		echo $result
    }
	
	##############################################################
	#
	# actions
	#
	##############################################################
	
	case "$action" in
		create)
			local subject=$(concatSubj)
			
			writeNewCert "$configType: $fileNameInfix"
			
			revokeAfterValidation()
			{
				if [ -e ${FILES[crt]} ]; then
					writeRevType "This certificate exists. We have to revoke it."
					certificate "$reverseDomain" "$domain" revoke "$configType" "$fileNameInfix"
					writeNewType "$subject"
				fi
			}
			
			writeNewType "new $subject"
			case "$configType" in
				code-signing)
					# see CA policy
				    testSubject 'match' 'C' "${SUBJ[C]}" "${SUBJ_DEFAULT[C]}"
				    testSubject 'match' 'O' "${SUBJ[O]}" "${SUBJ_DEFAULT[O]}"
				    testSubject 'supplied' 'CN' "${SUBJ[CN]}" "${SUBJ_DEFAULT[CN]}"
				    testPassword $password
				    
				    revokeAfterValidation
				    
					writeNewItem 'key'
					openssl genpkey \
						-algorithm RSA \
						-out ${FILES[crtKey]} \
						-pkeyopt rsa_keygen_bits:$DEFAULT_CRT_RSA_KEYSIZE_PRIVATE_KEY \
						-pkeyopt rsa_keygen_pubexp:$DEFAULT_CRT_PWD_GEN_PUBEXP
					check_result $? 'unable to create key'
					
					writeNewItem 'csr'
					openssl req -new \
						-config ${FILES[crtCnf]} \
						-out ${FILES[crtCsr]} \
						-key ${FILES[crtKey]} \
						-subj "$subject" \
						-passout pass:$password
					check_result $? 'unable to create csr'
					
					writeNewItem 'create crt'
					openssl ca \
						-batch \
						-config ${FILES[caCnf]} \
						-in ${FILES[crtCsr]} \
						-out ${FILES[crt]} \
						-passin file:${FILES[caPwd]} \
						-extensions codesign_ext \
							> /dev/null 2>&1
					check_result $? 'unable to create crt'
					
					writeNewItem 'verify sslclient'
					openssl verify -purpose sslclient -CAfile ${FILES[caChainPem]} ${FILES[crt]}
					
					writeNewItem 'publish as p12'
					openssl pkcs12 -export \
						-name "$domain: $fileNameInfix (Software Certificate)" \
						-inkey ${FILES[crtKey]} \
						-in ${FILES[crt]} \
						-certfile ${FILES[caChainPem]} \
						-out ${FILES[crtP12]} \
						-passout pass:$password \
						-passin pass:$password \
							> /dev/null 2>&1
					check_result $? 'unable to create p12'
				;;
				email)
					# see CA policy
				    testSubject 'match' 'C' "${SUBJ[C]}" "${SUBJ_DEFAULT[C]}"
				    testSubject 'match' 'O' "${SUBJ[O]}" "${SUBJ_DEFAULT[O]}"
				    testSubject 'supplied' 'CN' "${SUBJ[CN]}" "${SUBJ_DEFAULT[CN]}"
				    testSubject 'supplied' 'emailAddress' "${SUBJ[emailAddress]}"
				    testPassword $password
				    
				    revokeAfterValidation
				    
					writeNewItem 'key'
					openssl genpkey \
						-algorithm RSA \
						-out ${FILES[crtKey]} \
						-pkeyopt rsa_keygen_bits:$DEFAULT_CRT_RSA_KEYSIZE_PRIVATE_KEY \
						-pkeyopt rsa_keygen_pubexp:$DEFAULT_CRT_PWD_GEN_PUBEXP
					check_result $? 'unable to create key'
					
					writeNewItem 'csr'
					openssl req -new \
						-config ${FILES[crtCnf]} \
						-out ${FILES[crtCsr]} \
						-key ${FILES[crtKey]} \
						-subj "$subject" \
						-passout pass:$password
					check_result $? 'unable to create csr'
					
					writeNewItem 'create crt'
					openssl ca \
						-batch \
						-config ${FILES[caCnf]} \
						-notext \
						-in ${FILES[crtCsr]} \
						-out ${FILES[crt]} \
						-passin file:${FILES[caPwd]} \
						-extensions email_ext
					check_result $? 'unable to create crt'
					
					writeNewItem 'verify sslclient'
					openssl verify -purpose sslclient -CAfile ${FILES[caChainPem]} ${FILES[crt]}
					
					writeNewItem 'publish as p12'
					openssl pkcs12 -export \
						-name "${SUBJ[emailAddress]} (Email Address)" \
						-inkey ${FILES[crtKey]} \
						-in ${FILES[crt]} \
						-certfile ${FILES[caChainPem]} \
						-out ${FILES[crtP12]} \
						-passout pass:$password \
						-passin pass:$password \
							> /dev/null 2>&1
					check_result $? 'unable to create p12'
				;;
				tls-client|tls-client-external)
					
					case "$configType" in
						tls-client)
							# see CA policy
						    testSubject 'match' 'C' "${SUBJ[C]}" "${SUBJ_DEFAULT[C]}"
						    testSubject 'match' 'O' "${SUBJ[O]}" "${SUBJ_DEFAULT[O]}"
						    testSubject 'supplied' 'CN' "${SUBJ[CN]}" "${SUBJ_DEFAULT[CN]}"
				    		testPassword $password
				    		
							revokeAfterValidation
				    		
							writeNewItem 'key'
							openssl genpkey \
								-algorithm RSA \
								-out ${FILES[crtKey]} \
								-pkeyopt rsa_keygen_bits:$DEFAULT_CRT_RSA_KEYSIZE_PRIVATE_KEY \
								-pkeyopt rsa_keygen_pubexp:$DEFAULT_CRT_PWD_GEN_PUBEXP
							check_result $? 'unable to create key'
							
							writeNewItem 'csr'
							openssl req -new \
								-config ${FILES[crtCnf]} \
								-out ${FILES[crtCsr]} \
								-key ${FILES[crtKey]} \
								-subj "$subject" \
								-passout pass:$password
							check_result $? 'unable to create csr'
							
							writeNewItem 'create crt'
							openssl ca \
								-batch \
								-config ${FILES[caCnf]} \
								-in ${FILES[crtCsr]} \
								-out ${FILES[crt]} \
								-passin file:${FILES[caPwd]} \
								-extensions client_ext \
									> /dev/null 2>&1
							check_result $? 'unable to create crt'
						;;
						tls-client-external)
							# see CA policy
						    testSubject 'supplied' 'C' "${SUBJ[C]}" "${SUBJ_DEFAULT[C]}"
						    testSubject 'supplied' 'O' "${SUBJ[O]}" "${SUBJ_DEFAULT[O]}"
						    testSubject 'supplied' 'CN' "${SUBJ[CN]}" "${SUBJ_DEFAULT[CN]}"
				    		testPassword $password
				    		
							revokeAfterValidation
				    		
							writeNewItem 'key'
							openssl genpkey \
								-algorithm RSA \
								-out ${FILES[crtKey]} \
								-pkeyopt rsa_keygen_bits:$DEFAULT_CRT_RSA_KEYSIZE_PRIVATE_KEY \
								-pkeyopt rsa_keygen_pubexp:$DEFAULT_CRT_PWD_GEN_PUBEXP
							check_result $? 'unable to create key'
							
							writeNewItem 'csr'
							openssl req -new \
								-config ${FILES[crtCnf]} \
								-out ${FILES[crtCsr]} \
								-key ${FILES[crtKey]} \
								-subj "$subject" \
								-passout pass:$password
							check_result $? 'unable to create csr'
							
							writeNewItem 'create crt'
							openssl ca \
								-batch \
								-config ${FILES[caCnf]} \
								-in ${FILES[crtCsr]} \
								-out ${FILES[crt]} \
								-passin file:${FILES[caPwd]} \
								-extensions client_ext \
								-policy extern_pol \
									> /dev/null 2>&1
							check_result $? 'unable to create crt'
						;;
					esac
					
					writeNewItem 'verify sslclient'
					openssl verify -purpose sslclient -CAfile ${FILES[caChainPem]} ${FILES[crt]}
					
					writeNewItem 'publish as p12'
					openssl pkcs12 -export \
						-name "$fileNameInfix (TLS Network Access)" \
						-inkey ${FILES[crtKey]} \
						-in ${FILES[crt]} \
						-certfile ${FILES[caChainPem]} \
						-out ${FILES[crtP12]} \
						-passout pass:$password \
						-passin pass:$password \
							> /dev/null 2>&1
					check_result $? 'unable to create p12'
					
					#???
					#writeNewItem 'pem key from p12'
					#openssl pkcs12 -nocerts \
					#	-in ${FILES[crtP12]} \
					#	-out ${FILES[pubKeyPem]} \
					#		> /dev/null 2>&1
					#check_result $? 'unable to create pem key'
					#
					#writeNewItem 'pem crt from p12'
					#openssl pkcs12 -clcerts -nokeys \
					#	-in ${FILES[crtP12]} \
					#	-out ${FILES[pubCrtPem]} \
					#		> /dev/null 2>&1
					#check_result $? 'unable to create p12'
				;;
				tls-server|tls-server-external)
					case "$configType" in
						tls-server)
							SUBJ_DEFAULT[CN]=$domain
							# see CA policy
						    testSubject 'match' 'C' "${SUBJ[C]}" "${SUBJ_DEFAULT[C]}"
						    testSubject 'match' 'O' "${SUBJ[O]}" "${SUBJ_DEFAULT[O]}"
						    testSubject 'match' 'CN' "${SUBJ[CN]}" "${SUBJ_DEFAULT[CN]}"
							
							revokeAfterValidation
							
							export SAN="DNS:$domain,DNS:*.$domain"
				    		
							writeNewItem 'key'
							openssl genpkey \
								-algorithm RSA \
								-out ${FILES[crtKey]} \
								-pkeyopt rsa_keygen_bits:$DEFAULT_CRT_RSA_KEYSIZE_PRIVATE_KEY \
								-pkeyopt rsa_keygen_pubexp:$DEFAULT_CRT_PWD_GEN_PUBEXP
							check_result $? 'unable to create key'
							
							writeNewItem 'csr'
							openssl req -new \
								-config ${FILES[crtCnf]} \
								-out ${FILES[crtCsr]} \
								-key ${FILES[crtKey]} \
								-subj "$subject"
							check_result $? 'unable to create csr'
							
							writeNewItem 'create crt'
							openssl ca \
								-batch \
								-config ${FILES[caCnf]} \
								-in ${FILES[crtCsr]} \
								-out ${FILES[crt]} \
								-passin file:${FILES[caPwd]} \
								-extensions server_ext
							check_result $? 'unable to create crt'
						;;
						tls-server-external)
							# see CA policy
						    testSubject 'supplied' 'C' "${SUBJ[C]}" "${SUBJ_DEFAULT[C]}"
						    testSubject 'supplied' 'O' "${SUBJ[O]}" "${SUBJ_DEFAULT[O]}"
						    testSubject 'supplied' 'CN' "${SUBJ[CN]}" "${SUBJ_DEFAULT[CN]}"
							
							revokeAfterValidation
							
							if [ -z $san ]; then
								local san="DNS:$fileNameInfix,DNS:*.$fileNameInfix"
							fi
							export SAN="$san"
				    		
							writeNewItem 'key'
							openssl genpkey \
								-algorithm RSA \
								-out ${FILES[crtKey]} \
								-pkeyopt rsa_keygen_bits:$DEFAULT_CRT_RSA_KEYSIZE_PRIVATE_KEY \
								-pkeyopt rsa_keygen_pubexp:$DEFAULT_CRT_PWD_GEN_PUBEXP
							check_result $? 'unable to create key'
							
							writeNewItem 'csr'
							openssl req -new \
								-config ${FILES[crtCnf]} \
								-out ${FILES[crtCsr]} \
								-key ${FILES[crtKey]} \
								-subj "$subject"
							check_result $? 'unable to create csr'
							
							writeNewItem 'create crt'
							openssl ca \
								-batch \
								-config ${FILES[caCnf]} \
								-in ${FILES[crtCsr]} \
								-out ${FILES[crt]} \
								-passin file:${FILES[caPwd]} \
								-extensions server_ext \
								-policy extern_pol \
									> /dev/null 2>&1
							check_result $? 'unable to create crt'
						;;
					esac
					
					writeNewItem 'verify sslclient'
					openssl verify -purpose sslclient -CAfile ${FILES[caChainPem]} ${FILES[crt]}
					
					writeNewItem 'publish as p12'
					openssl pkcs12 -export \
						-name "$fileNameInfix (TLS Network Component)" \
						-inkey ${FILES[crtKey]} \
						-passout pass:\
						-in ${FILES[crt]} \
						-certfile ${FILES[caChainPem]} \
						-out ${FILES[crtP12]} \
							> /dev/null 2>&1
					check_result $? 'unable to create p12'
					
					writeNewItem 'pem key from p12'
					openssl pkcs12 -nocerts -nodes \
						-in ${FILES[crtP12]} \
						-passin pass:\
						-out ${FILES[pubKeyPem]} \
							> /dev/null 2>&1
					check_result $? 'unable to create pem key'
					
					writeNewItem 'passfree pem key'
					openssl rsa \
						-in ${FILES[pubKeyPem]} \
						-out ${FILES[pubKeyPem]} \
							> /dev/null 2>&1
					check_result $? 'unable to create passfree pem key'
					
					writeNewItem 'pem crt from p12'
					openssl pkcs12 -clcerts -nokeys \
						-in ${FILES[crtP12]} \
						-passin pass:\
						-out ${FILES[pubCrtPem]} \
							> /dev/null 2>&1
					check_result $? 'unable to create p12'
					
					cat ${FILES[crt]} ${FILES[caChainPem]} > ${FILES[crtChainPem]}
				
					writeNewItem 'publish crt as application/pkix-cert'
					openssl x509 \
						-in ${FILES[crt]} \
						-out ${FILES[pubCer]} \
						-outform der
				
					writeNewItem 'publish pem chain as application/pkcs7-mime'
					openssl crl2pkcs7 -nocrl \
						-certfile ${FILES[crtChainPem]} \
						-out ${FILES[pubChainP7c]} \
						-outform der
					
				;;
			esac
		;;
		delete)
			writeDelCert "$configType: $fileNameInfix"
			declare -A REMOVE
			
			for type in crt crtCsr crtP12 crtKey pubCrtPem pubKeyPem pubCer pubChainP7c
			do
				if [ -e ${FILES[$type]} ]; then
					writeDelItem ${FILES[$type]}
					REMOVE[$type]=${FILES[$type]}
				fi
			done
			
			check_prompt 1 'Files will be permanently removed from disk!'
			
			if [ -e ${FILES[crt]} ]; then
				writeRevType "existing $configType: $fileNameInfix"
				certificate "$reverseDomain" "$domain" revoke "$configType" "$fileNameInfix"
			fi
			
			writeDelType 'files'
			for index in "${!REMOVE[@]}"
			do
				writeDelItem ${REMOVE[$index]}
				rm ${REMOVE[$index]} > /dev/null 2>&1
				check_result $? 'unable to delete file'
			done
		;;
		revoke)
			writeRevCert "$configType: $fileNameInfix"
			if [ -e ${FILES[crt]} ]; then
				local lastSrl=$(openssl x509 -in ${FILES[crt]} -serial -noout)
				local lastFnr=$(openssl x509 -in ${FILES[crt]} -fingerprint -noout)
				local revokationReason
				
				case "$configType" in
					email)
						local revokationReason=affiliationChanged
					;;
					tls-server|tls-server-external|tls-client|tls-client-external)
						local revokationReason=affiliationChanged
					;;
					code-signing)
						local revokationReason=affiliationChanged
					;;
				esac
				
				check_prompt 1 "certificate $fileName.$configType.crt exists as \n\t$lastSrl\n\t$lastFnr\n"
				
				echo ""
				echo -e "Please set the revokation reason. Default CRL reason for type $configType is $revokationReason."
				echo -e "	[1] unspecified"
				echo -e "	[2] keyCompromise"
				echo -e "	[3] CACompromise"
				echo -e "	[4] affiliationChanged"
				echo -e "	[5] superseded"
				echo -e "	[6] cessationOfOperation"
				echo -e "	[7] certificateHold"
				echo -e "	[8] removeFromCRL"
				echo -e "	[n] set no reason"
				echo ""
				read -p "Please set the revokation reason or nothing for default: " answer
				echo ""
				
				case "$answer" in
					1)
						local revokationReason=unspecified
					;;
					2)
						local revokationReason=keyCompromise
					;;
					3)
						local revokationReason=CACompromise
					;;
					4)
						local revokationReason=affiliationChanged
					;;
					5)
						local revokationReason=superseded
					;;
					6)
						local revokationReason=cessationOfOperation
					;;
					7)
						local revokationReason=certificateHold
					;;
					8)
						local revokationReason=removeFromCRL
					;;
					'n'|'N')
						local revokationReason=no
					;;
				esac
				
				writeNewType 'revokation'
				if [ $revokationReason == 'no' ]; then
					writeNewItem "revoke without reason"
					openssl ca \
						-config ${FILES[caCnf]} \
						-revoke ${FILES[crt]} \
						-passin file:${FILES[caPwd]} \
							 > /dev/null 2>&1
					idle_result $? 'unable to revoke'
				else
					writeNewItem "revoke with $revokationReason"
					openssl ca \
						-config ${FILES[caCnf]} \
						-revoke ${FILES[crt]} \
						-passin file:${FILES[caPwd]} \
						-crl_reason $revokationReason \
							 > /dev/null 2>&1
					idle_result $? 'unable to revoke'
				fi
				
				writeNewItem 'update crl'
				openssl ca -gencrl \
					-config ${FILES[caCnf]} \
					-out ${FILES[caCrl]} \
					-passin file:${FILES[caPwd]} \
						> /dev/null 2>&1
				check_result $? 'unable to update crl'
					
				writeNewItem 'publish crl as application/pkix-crl'
				openssl crl \
					-in ${FILES[caCrl]} \
					-out ${FILES[pubCaCrl]} \
					-outform der \
						> /dev/null 2>&1
				check_result $? 'unable to publish crl'
			fi
		;;
		*)
			check_result 1 "invalid action '$action' {create|delete|revoke}"
	esac
}








##############################################################
#
# asynch?
#
##############################################################
if [ -d "/var/lock/$DEFAULT_DOMAIN" ]; then
	check_result 30 "Already locked"
fi

mkdir "/var/lock/$DEFAULT_DOMAIN"
check_result $? "Lock failed"



##
# Create a simple CA-chain.
#
# create some CAs
# root_ca 'reverse.com' 'domain1.com;domain2.com' 'sub1;sub2'
# root_ca 'reverse.com' 'domain1.com' 'sub3'
# root_ca 'reverse.com' 'domain2.com' 'sub4'
# root_ca 'reverse.com' 'domain3.com'
#
# result
# 	- ./reverse.com
#		- reverse.com.ca.crt (root CA)
#		- reverse.com.ca-tls.crt
#		- ./intermediate
#			- ./domain1.com
#				- domain1.com.ca.crt (sub root CA)
#				- domain1.com.ca-tls.crt
#				- domain1.com.ca-email.crt
#				- domain1.com.ca-software.crt
#				- ./intermediate
#					- ./sub1.domain1.com
#						- sub1.domain1.com.ca.crt (sub sub root CA)
#						- sub1.domain1.com.ca-tls.crt
#						- sub1.domain1.com.ca-email.crt
#						- sub1.domain1.com.ca-software.crt
#					- ./sub2.domain1.com
#						- sub2.domain1.com.ca.crt (sub sub root CA)
#						- sub2.domain1.com.ca-tls.crt
#						- sub2.domain1.com.ca-email.crt
#						- sub2.domain1.com.ca-software.crt
#					- ./sub3.domain1.com
#						- sub3.domain1.com.ca.crt (sub sub root CA)
#						- sub3.domain1.com.ca-tls.crt
#						- sub3.domain1.com.ca-email.crt
#						- sub3.domain1.com.ca-software.crt
#			- ./domain2.com
#				- domain2.com.ca.crt (sub root CA)
#				- domain2.com.ca-tls.crt
#				- domain2.com.ca-email.crt
#				- domain2.com.ca-software.crt
#				- ./intermediate
#					- ./sub1.domain1.com
#						- sub1.domain2.com.ca.crt (sub sub root CA)
#						- sub1.domain2.com.ca-tls.crt
#						- sub1.domain2.com.ca-email.crt
#						- sub1.domain2.com.ca-software.crt
#					- ./sub2.domain1.com
#						- sub2.domain2.com.ca.crt (sub sub root CA)
#						- sub2.domain2.com.ca-tls.crt
#						- sub2.domain2.com.ca-email.crt
#						- sub2.domain2.com.ca-software.crt
#					- ./sub4.domain1.com
#						- sub4.domain2.com.ca.crt (sub sub root CA)
#						- sub4.domain2.com.ca-tls.crt
#						- sub4.domain2.com.ca-email.crt
#						- sub4.domain2.com.ca-software.crt
#			- ./domain3.com
#				- domain3.com.ca.crt (sub root CA)
#				- domain3.com.ca-tls.crt
#				- domain3.com.ca-email.crt
#				- domain3.com.ca-software.crt
# 
#
#
# root_ca reverse-domain [public-domain [subdomain-prefix]]
root_ca()
{
	# the base; the IP or reverse host address.
	# this allows us to use this function for multiple servers on same host.
	# this is the network root CA.
	# this function creates also the reverse host based CA for TLS - signed by the root CA.
	local reverseHost=$1
	
	# list of domains separated by ;
	# 	root_ca reverse.tld foo.tld;bar.tld;alice.tld	- for foo.tld, bar.tld, and alice.tld
	#
	# this function creates an intermediate CA for each domain.
	# the intermediate CAs will be signed by the Root CA of reverse host.
	# this function creates also domain based CAs for TLS, email and code signing - signed by the domain based intermediate CA.
	local domainList=$2
	
	# list of subdomain names separated by ;
	# 	mail;smtp
	#
	# note that all names in this list will be applied to each given domain.
	# to avoid this you must call this function multiple times.
	# root_ca will not destroy, delete or override previous created CAs
	# 	root_ca reverse.tld foo.tld;bar.tld mail;smtp	- for mail.foo.tld, smtp.foo.tld, mail.bar.tld, and smtp.bar.tld
	# 	root_ca reverse.tld foo.tld;alice.tld imap		- for imap.foo.tld, and imap.alice.tld
	#
	# this function creates an intermediate CA for each subdomain.
	# the intermediate CAs will be signed by the intermediate CA of their owner domain
	# this function creates also sub domain based CAs for TLS, email and code signing - signed by the subdomain based intermediate CA.
	local subDomainNameList=$3

	
	##############################################################
	#
	# CRT config partial factories
	#
	##############################################################
	
	makeModulCsrConfigBlock_title()
	{
		local outputFile=$1
		local domain=$2
		local title=$3
		
		{
			echo "# $title certificate request for $domain"
			echo ''
		} >> $outputFile
	}
	
	##############################################################
	#
	# CRT config factories
	#
	##############################################################
	
	modulCsrEmailConfig()
	{
		local outputFile=$1
		local domain=$2
		
		{
			makeModulCsrConfigBlock_title $outputFile $domain 'Email'
			echo '[ req ]'
			echo "default_bits            = $DEFAULT_CRT_RSA_KEYSIZE_REQUEST                  # RSA key size"
			echo 'encrypt_key             = yes                   # Protect private key'
			echo "default_md              = $DEFAULT_CRT_MD_REQUEST                # MD to use"
			echo 'utf8                    = yes                   # Input is UTF-8'
			echo 'string_mask             = utf8only              # Emit UTF-8 strings'
			echo 'prompt                  = yes                   # Prompt for DN'
			echo 'distinguished_name      = email_dn              # DN template'
			echo 'req_extensions          = email_reqext          # Desired extensions'
			echo ''
			echo "[ email_dn ]"
			echo 'countryName             = "1. Country Name (2 letters) (eg, US)       "'
			echo 'countryName_max         = 2'
			echo 'countryName_default     = "BE"'
			echo 'stateOrProvinceName     = "2. State or Province Name   (eg, region)   "'
			echo 'localityName            = "3. Locality Name            (eg, city)     "'
			echo 'organizationName        = "4. Organization Name        (eg, company)  "'
			echo "organizationName_default = \""### Network $domain\"""
			echo 'organizationalUnitName  = "5. Organizational Unit Name (eg, section)  "'
			echo 'commonName              = "6. Common Name              (eg, full name)"'
			echo 'commonName_max          = 64'
			echo 'emailAddress            = "7. Email Address            (eg, name@fqdn)"'
			echo 'emailAddress_max        = 40'
			echo ''
			echo '[ email_reqext ]'
			echo 'keyUsage                = critical,digitalSignature,keyEncipherment'
			echo 'extendedKeyUsage        = critical,emailProtection,clientAuth'
			echo 'subjectKeyIdentifier    = hash'
			echo 'subjectAltName          = email:move'
		} >> $outputFile
	}
	
	modulCsrTlsClientConfig()
	{
		local outputFile=$1
		local domain=$2
		
		{
			makeModulCsrConfigBlock_title $outputFile $domain 'TLS Client'
			echo '[ req ]'
			echo "default_bits            = $DEFAULT_CRT_RSA_KEYSIZE_REQUEST                  # RSA key size"
			echo 'encrypt_key             = yes                   # Protect private key'
			echo "default_md              = $DEFAULT_CRT_MD_REQUEST                # MD to use"
			echo 'utf8                    = yes                   # Input is UTF-8'
			echo 'string_mask             = utf8only              # Emit UTF-8 strings'
			echo 'prompt                  = yes                   # Prompt for DN'
			echo 'distinguished_name      = client_dn             # DN template'
			echo 'req_extensions          = client_reqext         # Desired extensions'
			echo ''
			echo "[ client_dn ]"
			echo 'countryName             = "1. Country Name (2 letters) (eg, US)       "'
			echo 'countryName_max         = 2'
			echo 'countryName_default     = "BE"'
			echo 'stateOrProvinceName     = "2. State or Province Name   (eg, region)   "'
			echo 'localityName            = "3. Locality Name            (eg, city)     "'
			echo 'organizationName        = "4. Organization Name        (eg, company)  "'
			echo "organizationName_default = \""### Network $domain\"""
			echo 'organizationalUnitName  = "5. Organizational Unit Name (eg, section)  "'
			echo 'commonName              = "6. Common Name              (eg, full name)"'
			echo 'commonName_max          = 64'
			echo 'emailAddress            = "7. Email Address            (eg, name@fqdn)"'
			echo 'emailAddress_max        = 40'
			echo ''
			echo '[ client_reqext ]'
			echo 'keyUsage                = critical,digitalSignature'
			echo 'extendedKeyUsage        = critical,clientAuth'
			echo 'subjectKeyIdentifier    = hash'
			echo 'subjectAltName          = email:move'
		} >> $outputFile
	}
	
	modulCsrTlsClientExternalConfig()
	{
		local outputFile=$1
		local domain=$2
		
		{
			makeModulCsrConfigBlock_title $outputFile $domain 'TLS External Client'
			echo '[ req ]'
			echo "default_bits            = $DEFAULT_CRT_RSA_KEYSIZE_REQUEST                  # RSA key size"
			echo 'encrypt_key             = yes                   # Protect private key'
			echo "default_md              = $DEFAULT_CRT_MD_REQUEST                # MD to use"
			echo 'utf8                    = yes                   # Input is UTF-8'
			echo 'string_mask             = utf8only              # Emit UTF-8 strings'
			echo 'prompt                  = yes                   # Prompt for DN'
			echo 'distinguished_name      = client_dn             # DN template'
			echo 'req_extensions          = client_reqext         # Desired extensions'
			echo ''
			echo "[ client_dn ]"
			echo 'countryName             = "1. Country Name (2 letters) (eg, US)       "'
			echo 'countryName_max         = 2'
			echo 'stateOrProvinceName     = "2. State or Province Name   (eg, region)   "'
			echo 'localityName            = "3. Locality Name            (eg, city)     "'
			echo 'organizationName        = "4. Organization Name        (eg, company)  "'
			echo 'organizationalUnitName  = "5. Organizational Unit Name (eg, section)  "'
			echo 'commonName              = "6. Common Name              (eg, full name)"'
			echo 'commonName_max          = 64'
			echo 'emailAddress            = "7. Email Address            (eg, name@fqdn)"'
			echo 'emailAddress_max        = 40'
			echo ''
			echo '[ client_reqext ]'
			echo 'keyUsage                = critical,digitalSignature'
			echo 'extendedKeyUsage        = critical,clientAuth'
			echo 'subjectKeyIdentifier    = hash'
			echo 'subjectAltName          = email:move'
		} >> $outputFile
	}
	
	modulCsrTlsServerConfig()
	{
		local outputFile=$1
		local domain=$2
		
		{
			makeModulCsrConfigBlock_title $outputFile $domain 'TLS Server'
			echo '[ req ]'
			echo "default_bits            = $DEFAULT_CRT_RSA_KEYSIZE_REQUEST                  # RSA key size"
			echo 'encrypt_key             = no                    # Protect private key'
			echo "default_md              = $DEFAULT_CRT_MD_REQUEST                # MD to use"
			echo 'utf8                    = yes                   # Input is UTF-8'
			echo 'string_mask             = utf8only              # Emit UTF-8 strings'
			echo 'prompt                  = yes                   # Prompt for DN'
			echo 'distinguished_name      = server_dn             # DN template'
			echo 'req_extensions          = server_reqext         # Desired extensions'
			echo ''
			echo "[ server_dn ]"
			echo 'countryName             = "1. Country Name (2 letters) (eg, US)       "'
			echo 'countryName_max         = 2'
			echo 'countryName_default     = "BE"'
			echo 'stateOrProvinceName     = "2. State or Province Name   (eg, region)   "'
			echo 'localityName            = "3. Locality Name            (eg, city)     "'
			echo 'organizationName        = "4. Organization Name        (eg, company)  "'
			echo "organizationName_default = \""### Network $domain\"""
			echo 'organizationalUnitName  = "5. Organizational Unit Name (eg, section)  "'
			echo 'commonName              = "6. Common Name              (eg, full name)"'
			echo 'commonName_max          = 64'
			echo "commonName_default      = \""$domain\"""
			echo 'emailAddress            = "7. Email Address            (eg, name@fqdn)"'
			echo 'emailAddress_max        = 40'
			echo ''
			echo '[ server_reqext ]'
			echo 'keyUsage                = critical,digitalSignature,keyEncipherment'
			echo 'extendedKeyUsage        = serverAuth,clientAuth'
			echo 'subjectKeyIdentifier    = hash'
			echo 'subjectAltName          = $ENV::SAN'
		} >> $outputFile
	}
	
	modulCsrTlsServerExternalConfig()
	{
		local outputFile=$1
		local domain=$2
		
		{
			makeModulCsrConfigBlock_title $outputFile $domain 'TLS External Server'
			echo '[ req ]'
			echo "default_bits            = $DEFAULT_CRT_RSA_KEYSIZE_REQUEST                  # RSA key size"
			echo 'encrypt_key             = no                    # Protect private key'
			echo "default_md              = $DEFAULT_CRT_MD_REQUEST                # MD to use"
			echo 'utf8                    = yes                   # Input is UTF-8'
			echo 'string_mask             = utf8only              # Emit UTF-8 strings'
			echo 'prompt                  = yes                   # Prompt for DN'
			echo 'distinguished_name      = server_dn             # DN template'
			echo 'req_extensions          = server_reqext         # Desired extensions'
			echo ''
			echo "[ server_dn ]"
			echo 'countryName             = "1. Country Name (2 letters) (eg, US)       "'
			echo 'countryName_max         = 2'
			echo 'stateOrProvinceName     = "2. State or Province Name   (eg, region)   "'
			echo 'localityName            = "3. Locality Name            (eg, city)     "'
			echo 'organizationName        = "4. Organization Name        (eg, company)  "'
			echo 'organizationalUnitName  = "5. Organizational Unit Name (eg, section)  "'
			echo 'commonName              = "6. Common Name              (eg, full name)"'
			echo 'commonName_max          = 64'
			echo 'emailAddress            = "7. Email Address            (eg, name@fqdn)"'
			echo 'emailAddress_max        = 40'
			echo ''
			echo '[ server_reqext ]'
			echo 'keyUsage                = critical,digitalSignature,keyEncipherment'
			echo 'extendedKeyUsage        = serverAuth,clientAuth'
			echo 'subjectKeyIdentifier    = hash'
			echo 'subjectAltName          = $ENV::SAN'
		} >> $outputFile
	}
		
	
	modulCsrSoftwareConfig()
	{
		local outputFile=$1
		local domain=$2
		
		{
			makeModulCsrConfigBlock_title $outputFile $domain 'Software'
			echo '[ req ]'
			echo "default_bits            = $DEFAULT_CRT_RSA_KEYSIZE_REQUEST                  # RSA key size"
			echo 'encrypt_key             = yes                   # Protect private key'
			echo "default_md              = $DEFAULT_CRT_MD_REQUEST                # MD to use"
			echo 'utf8                    = yes                   # Input is UTF-8'
			echo 'string_mask             = utf8only              # Emit UTF-8 strings'
			echo 'prompt                  = yes                   # Prompt for DN'
			echo 'distinguished_name      = codesign_dn           # DN template'
			echo 'req_extensions          = codesign_reqext       # Desired extensions'
			echo ''
			echo '[ codesign_dn ]'
			echo 'countryName             = "1. Country Name (2 letters) (eg, US)       "'
			echo 'countryName_max         = 2'
			echo 'stateOrProvinceName     = "2. State or Province Name   (eg, region)   "'
			echo 'localityName            = "3. Locality Name            (eg, city)     "'
			echo 'organizationName        = "4. Organization Name        (eg, company)  "'
			echo 'organizationalUnitName  = "5. Organizational Unit Name (eg, section)  "'
			echo 'commonName              = "6. Common Name              (eg, full name)"'
			echo 'commonName_max          = 64'
			echo ''
			echo '[ codesign_reqext ]'
			echo 'keyUsage                = critical,digitalSignature'
			echo 'extendedKeyUsage        = critical,codeSigning'
			echo 'subjectKeyIdentifier    = hash'
		} >> $outputFile
	}
	
	##############################################################
	#
	# CA config partial factories
	#
	##############################################################
	
	makeModulCaConfigBlock_title()
	{
		local outputFile=$1
		local title=$2
		
		{
			echo "# $title"
			echo ''
		} >> $outputFile
	}
	
	makeModulCaConfigBlock_section()
	{
		local outputFile=$1
		local title=$2
		
		{
			echo ''
			echo ''
			echo "# $title"
			echo ''
		} >> $outputFile
	}
	
	makeModulCaConfigBlock_default()
	{
		local outputFile=$1
		local domain=$2
		local level=$3
		local type=$4
		
		{
			echo '[ default ]'
			echo "ca                      = $domain"
			echo "ca_type                 = $type"
			echo 'ca_dir                  = $ca_type'
			echo "db_dir                  = \$ca_dir/${DIR_NAME[db]}"
			echo "private_dir             = \$ca_dir/${DIR_NAME[private]}"
			echo "dir                     = \$ENV::CA_${level}_SCRIPT_PATH  # Top dir"
			echo "base_url                = http://$domain # CA base URL"
			echo "ip_url                  = http://$DEFAULT_IP # CA base URL on IP"
			echo 'aia_url                 = $base_url/$ca.$ca_type.cer       # CA certificate URL'
			echo 'ip_aia_url              = $ip_url/$ca.$ca_type.cer         # CA certificate URL'
			echo 'crl_url                 = $base_url/$ca.$ca_type.crl       # CRL distribution point'
			echo 'ip_crl_url              = $ip_url/$ca.$ca_type.cer         # CRL distribution point'
			echo 'name_opt                = multiline,-esc_msb,utf8 # Display UTF-8 characters'
			echo ''
		} >> $outputFile
	}
	
	
	makeModulCaConfigBlock_req()
	{
		local outputFile=$1
		
		{
			echo '[ req ]'
			echo "default_bits            = $DEFAULT_CA_RSA_KEYSIZE_REQUEST                 # RSA key size"
			echo 'encrypt_key             = yes                   # Protect private key'
			echo "default_md              = $DEFAULT_CA_MD_REQUEST                # MD to use"
			echo 'utf8                    = yes                   # Input is UTF-8'
			echo 'string_mask             = utf8only              # Emit UTF-8 strings'
			echo 'prompt                  = no                    # Dont prompt for DN'
			echo 'distinguished_name      = ca_dn                 # DN section'
			echo 'req_extensions          = ca_reqext             # Desired extensions'
			echo ''
		} >> $outputFile
	}
	
	makeModulCaConfigBlock_ca_dn()
	{
		local outputFile=$1
		local oN=$2
		local cN=$3
		
		{
			echo '[ ca_dn ]'
			echo 'countryName             = "BE"'
			echo "organizationName        = \""### Network $oN\"""
			echo 'organizationalUnitName  = "interop"'
			echo "commonName              = \""### Network $cN\"""
			echo ''
		} >> $outputFile
	}
	
	makeModulCaConfigBlock_ca_reqext()
	{
		local outputFile=$1
		local case=$2
		
		if [ "$case" == 'signing' ]; then
			{
				echo '[ ca_reqext ]'
				echo 'keyUsage                = critical,keyCertSign,cRLSign'
				echo 'basicConstraints        = critical,CA:true,pathlen:0'
				echo 'subjectKeyIdentifier    = hash'
				echo ''
			} >> $outputFile
		else
			{
				echo '[ ca_reqext ]'
				echo 'keyUsage                = critical,keyCertSign,cRLSign'
				echo 'basicConstraints        = critical,CA:true'
				echo 'subjectKeyIdentifier    = hash'
				echo ''
			} >> $outputFile
		fi
	}
	
	makeModulCaConfigBlock_ca()
	{
		local outputFile=$1
		local defaultCa=$2
		local x509_extensions=$3
		local copy_extensions=$4
		local policy=$5
		local days=$6
		local crlDays=$7
		
		local keyFileFormat=$(printf ${FILE_NAME[key]} '$ca' '$ca_type')
		local crtSrlFileFormat=$(printf ${FILE_NAME[crtSrl]} '$ca' '$ca_type')
		local crlSrlFileFormat=$(printf ${FILE_NAME[crlSrl]} '$ca' '$ca_type')
		local crtDbFileFormat=$(printf ${FILE_NAME[crtDb]} '$ca' '$ca_type')
		local crtFileFormat=$(printf ${FILE_NAME[crt]} '$ca' '$ca_type')
		
		local pDir='$dir/$private_dir'
		local dDir='$dir/$db_dir'
		
		{
			echo '[ ca ]'
			echo "default_ca              = $defaultCa # The default CA section"
			echo ''
			echo "[ $defaultCa ]"
			echo "certificate             = \$dir/$crtFileFormat                   # The CA cert"
			echo 'new_certs_dir           = $dir/$ca_dir                            # Certificate archive'
			echo "private_key             = $pDir/$keyFileFormat 		# CA private key"
			echo "serial                  = $dDir/$crtSrlFileFormat       # Serial number file"
			echo "crlnumber               = $dDir/$crlSrlFileFormat       # CRL number file"
			echo "database                = $dDir/$crtDbFileFormat        # Index file"
			echo 'unique_subject          = yes                  # Require unique subject'
			echo "default_days            = $days          # How long to certify for"
			echo "default_md              = $DEFAULT_CA_MD                  # MD to use"
			echo "policy                  = $policy             # Default naming policy"
			echo 'email_in_dn             = no                    # Add email to cert DN'
			echo 'preserve                = yes                    # Keep passed DN ordering'
			echo 'name_opt                = $name_opt             # Subject DN display options'
			echo 'cert_opt                = ca_default            # Certificate display options'
			echo "copy_extensions         = $copy_extensions                  # Copy extensions from CSR"
			echo "x509_extensions         = $x509_extensions          # Default cert extensions"
			echo "default_crl_days        = $crlDays                    # How long before next CRL"
			echo 'crl_extensions          = crl_ext               # CRL extensions'
			echo ''
		} >> $outputFile
	}
	
	
	
	##############################################################
	#
	# CA config factories
	#
	##############################################################
	
	# args: out file, domain, nesting level (required for $ENV)
	modulCaConfig()
	{
		local outputFile=$1
		local domain=$2
		local level=$3
		
		if [ -z "$3" ]; then
			level=0
		fi
		
		local suffix='Certificate Authority'
		if [ $level == '0' ]; then
			suffix="Root $suffix"
		fi
		
		makeModulCaConfigBlock_title			$outputFile "Network $domain $suffix"
		makeModulCaConfigBlock_default			$outputFile $domain $level 'ca'
		makeModulCaConfigBlock_section			$outputFile 'CA certificate request'
		makeModulCaConfigBlock_req				$outputFile
		makeModulCaConfigBlock_ca_dn			$outputFile $domain "$domain $suffix"
		makeModulCaConfigBlock_ca_reqext		$outputFile
		makeModulCaConfigBlock_section			$outputFile 'CA operational settings'
		makeModulCaConfigBlock_ca				$outputFile 'root_ca' 'server_ext' 'none' 'root_ca_pol' '730' '365'
		
		{
			echo '[ root_ca_pol ]'
			echo 'countryName             = match                 # Must match'
			echo 'stateOrProvinceName     = optional              # Included if present'
			echo 'localityName            = optional              # Included if present'
			echo 'organizationName        = match                 # Must match'
			echo 'organizationalUnitName  = optional              # Included if present'
			echo 'commonName              = match                 # Must match'
			echo ''
			echo '[ extension_ca_pol ]'
			echo 'countryName             = match                 # Must match'
			echo 'stateOrProvinceName     = optional              # Included if present'
			echo 'localityName            = optional              # Included if present'
			echo 'organizationName        = match                 # Must match'
			echo 'organizationalUnitName  = optional              # Included if present'
			echo 'commonName              = supplied              # Must be present'
			echo ''
			echo '[ intermediate_ca_pol ]'
			echo 'countryName             = supplied              # Must be present'
			echo 'stateOrProvinceName     = optional              # Included if present'
			echo 'localityName            = optional              # Included if present'
			echo 'organizationName        = supplied              # Must be present'
			echo 'organizationalUnitName  = optional              # Included if present'
			echo 'commonName              = supplied              # Must be present'
			echo ''
			echo ''
			echo '# Extensions'
			echo ''
			echo '[ root_ca_ext ]'
			echo 'keyUsage                = critical,keyCertSign,cRLSign'
			echo 'basicConstraints        = critical,CA:true'
			echo 'subjectKeyIdentifier    = hash'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo ''
			echo '[ signing_ca_ext ]'
			echo 'keyUsage                = critical,keyCertSign,cRLSign'
			echo 'basicConstraints        = critical,CA:true,pathlen:0'
			echo 'subjectKeyIdentifier    = hash'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo 'authorityInfoAccess     = @issuer_info'
			echo 'crlDistributionPoints   = @crl_info'
			echo ''
			echo '[ crl_ext ]'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo 'authorityInfoAccess     = @issuer_info'
			echo ''
			echo '[ issuer_info ]'
			echo 'caIssuers;URI.0         = $aia_url'
			echo 'caIssuers;URI.1         = $ip_aia_url'
			echo ''
			echo '[ crl_info ]'
			echo 'URI.0                   = $crl_url'
			echo 'URI.1                   = $ip_crl_url'
		} >> $outputFile
	}
	
	# args: out file, domain, nesting level (required for $ENV)
	modulCaTlsConfig()
	{
		local outputFile=$1
		local domain=$2
		local level=$3
		
		makeModulCaConfigBlock_title			$outputFile "Network $domain TLS Registration Authority"
		makeModulCaConfigBlock_default			$outputFile $domain $level 'ca-tls'
		makeModulCaConfigBlock_section			$outputFile 'CA certificate request'
		makeModulCaConfigBlock_req				$outputFile
		makeModulCaConfigBlock_ca_dn			$outputFile $domain "$domain TLS Registration Authority"
		makeModulCaConfigBlock_ca_reqext		$outputFile 'signing'
		makeModulCaConfigBlock_section			$outputFile 'CA operational settings'
		makeModulCaConfigBlock_ca				$outputFile 'tls_ca' 'server_ext' 'copy' 'match_pol' '730' '1'
		
		{
			echo '[ match_pol ]'
			echo 'countryName             = match                 # Must match NO'
			echo 'stateOrProvinceName     = optional              # Included if present'
			echo 'localityName            = optional              # Included if present'
			echo 'organizationName        = match                 # Must match Green AS'
			echo 'organizationalUnitName  = optional              # Included if present'
			echo 'commonName              = supplied              # Must be present'
			echo ''
			echo '[ extern_pol ]'
			echo 'countryName             = supplied              # Must be present'
			echo 'stateOrProvinceName     = optional              # Included if present'
			echo 'localityName            = optional              # Included if present'
			echo 'organizationName        = supplied              # Must be present'
			echo 'organizationalUnitName  = optional              # Included if present'
			echo 'commonName              = supplied              # Must be present'
			echo ''
			echo '[ any_pol ]'
			echo 'domainComponent         = optional'
			echo 'countryName             = optional'
			echo 'stateOrProvinceName     = optional'
			echo 'localityName            = optional'
			echo 'organizationName        = optional'
			echo 'organizationalUnitName  = optional'
			echo 'commonName              = optional'
			echo 'emailAddress            = optional'
			echo ''
			echo ''
			echo '# Extensions'
			echo ''
			echo '[ server_ext ]'
			echo 'keyUsage                = critical,digitalSignature,keyEncipherment'
			echo 'basicConstraints        = critical,CA:false'
			echo 'extendedKeyUsage        = serverAuth,clientAuth'
			echo 'subjectKeyIdentifier    = hash'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo 'authorityInfoAccess     = @issuer_info'
			echo 'crlDistributionPoints   = @crl_info'
			echo ''
			echo '[ client_ext ]'
			echo 'keyUsage                = critical,digitalSignature'
			echo 'basicConstraints        = critical,CA:false'
			echo 'extendedKeyUsage        = clientAuth'
			echo 'subjectKeyIdentifier    = hash'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo 'authorityInfoAccess     = @issuer_info'
			echo 'crlDistributionPoints   = @crl_info'
			echo ''
			echo '[ crl_ext ]'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo 'authorityInfoAccess     = @issuer_info'
			echo ''
			echo '[ issuer_info ]'
			echo 'caIssuers;URI.0         = $aia_url'
			echo ''
			echo '[ crl_info ]'
			echo 'URI.0                   = $crl_url'
		} >> $outputFile
	}
	
	# args: out file, domain, nesting level (required for $ENV)
	modulCaEmailConfig()
	{
		local outputFile=$1
		local domain=$2
		local level=$3
		
		makeModulCaConfigBlock_title			$outputFile "Network $domain Email Registration Authority"
		makeModulCaConfigBlock_default			$outputFile $domain $level 'ca-email'
		makeModulCaConfigBlock_section			$outputFile 'CA certificate request'
		makeModulCaConfigBlock_req				$outputFile
		makeModulCaConfigBlock_ca_dn			$outputFile $domain "$domain Email Registration Authority"
		makeModulCaConfigBlock_ca_reqext		$outputFile 'signing'
		makeModulCaConfigBlock_section			$outputFile 'CA operational settings'
		makeModulCaConfigBlock_ca				$outputFile 'email_ca' 'email_ext' 'copy' 'match_pol' '730' '1'
		
		{
			echo '[ match_pol ]'
			echo 'countryName             = match                 # Must match NO'
			echo 'stateOrProvinceName     = optional              # Included if present'
			echo 'localityName            = optional              # Included if present'
			echo 'organizationName        = match                 # Must match Green AS'
			echo 'organizationalUnitName  = optional              # Included if present'
			echo 'commonName              = supplied              # Must be present'
			echo ''
			echo '[ any_pol ]'
			echo 'domainComponent         = optional'
			echo 'countryName             = optional'
			echo 'stateOrProvinceName     = optional'
			echo 'localityName            = optional'
			echo 'organizationName        = optional'
			echo 'organizationalUnitName  = optional'
			echo 'commonName              = optional'
			echo 'emailAddress            = optional'
			echo ''
			echo ''
			echo '# Extensions'
			echo ''
			echo '[ email_ext ]'
			echo 'keyUsage                = critical,digitalSignature,keyEncipherment'
			echo 'basicConstraints        = CA:false'
			echo 'extendedKeyUsage        = emailProtection,clientAuth,anyExtendedKeyUsage'
			echo 'subjectKeyIdentifier    = hash'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo 'authorityInfoAccess     = @issuer_info'
			echo 'crlDistributionPoints   = @crl_info'
			echo ''
			echo '[ crl_ext ]'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo 'authorityInfoAccess     = @issuer_info'
			echo ''
			echo '[ issuer_info ]'
			echo 'caIssuers;URI.0         = $aia_url'
			echo ''
			echo '[ crl_info ]'
			echo 'URI.0                   = $crl_url'
		} >> $outputFile
	}
	
	# args: out file, domain, nesting level (required for $ENV)
	modulCaSoftwareConfig()
	{
		local outputFile=$1
		local domain=$2
		local level=$3
		
		makeModulCaConfigBlock_title			$outputFile "Network $domain Software Registration Authority"
		makeModulCaConfigBlock_default			$outputFile $domain $level 'ca-software'
		makeModulCaConfigBlock_section			$outputFile 'CA certificate request'
		makeModulCaConfigBlock_req				$outputFile
		makeModulCaConfigBlock_ca_dn			$outputFile $domain "$domain Software Registration Authority"
		makeModulCaConfigBlock_ca_reqext		$outputFile 'signing'
		makeModulCaConfigBlock_section			$outputFile 'CA operational settings'
		makeModulCaConfigBlock_ca				$outputFile 'software_ca' 'codesign_ext' 'copy' 'match_pol' '1826' '30'
		
		{
			echo '[ match_pol ]'
			echo 'countryName             = match                 # Must match NO'
			echo 'stateOrProvinceName     = optional              # Included if present'
			echo 'localityName            = optional              # Included if present'
			echo 'organizationName        = match                 # Must match Green AS'
			echo 'organizationalUnitName  = optional              # Included if present'
			echo 'commonName              = supplied              # Must be present'
			echo ''
			echo '[ any_pol ]'
			echo 'domainComponent         = optional'
			echo 'countryName             = optional'
			echo 'stateOrProvinceName     = optional'
			echo 'localityName            = optional'
			echo 'organizationName        = optional'
			echo 'organizationalUnitName  = optional'
			echo 'commonName              = optional'
			echo 'emailAddress            = optional'
			echo ''
			echo ''
			echo '# Extensions'
			echo ''
			echo '[ codesign_ext ]'
			echo 'keyUsage                = critical,digitalSignature'
			echo 'basicConstraints        = CA:false'
			echo 'extendedKeyUsage        = critical,codeSigning'
			echo 'subjectKeyIdentifier    = hash'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo 'authorityInfoAccess     = @issuer_info'
			echo 'crlDistributionPoints   = @crl_info'
			echo ''
			echo '[ crl_ext ]'
			echo 'authorityKeyIdentifier  = keyid:always'
			echo 'authorityInfoAccess     = @issuer_info'
			echo ''
			echo '[ issuer_info ]'
			echo 'caIssuers;URI.0         = $aia_url'
			echo ''
			echo '[ crl_info ]'
			echo 'URI.0                   = $crl_url'
		} >> $outputFile
	}
	
	##############################################################
	#
	# more factories!!!
	#
	##############################################################
	
	makeConfigFile()
	{
		local domain=$1
		local modul=$2
		local outputFile=$3
		local level=$4
		
		if [ ! -e "$outputFile" ]; then
			writeNewItem "CA config $modul"
			eval $modul $outputFile $domain $level
			check_result $? 'unable to create config'
		fi
	}
	
	makeCsrConfigFile()
	{
		local domain=$1
		local modul=$2
		local outputFile=$3
		
		if [ ! -e "$outputFile" ]; then
			writeNewItem "certificate request config $modul"
			eval $modul $outputFile $domain
			check_result $? 'unable to create config'
		fi
	}
	
	makeUserTlsCsrFiles()
	{
		local domain=$1
		local cnfPath=$2
		
		makeCsrConfigFile \
			$domain \
			'modulCsrTlsClientConfig' \
			$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'tls-client')
		
		makeCsrConfigFile \
			$domain \
			'modulCsrTlsClientExternalConfig' \
			$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'tls-client-external')
			
		makeCsrConfigFile \
			$domain \
			'modulCsrTlsServerConfig' \
			$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'tls-server')
			
		makeCsrConfigFile \
			$domain \
			'modulCsrTlsServerExternalConfig' \
			$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'tls-server-external')
	}
	
	makeUserSoftwareCsrFiles()
	{
		local domain=$1
		local cnfPath=$2
		
		makeCsrConfigFile \
			$domain \
			'modulCsrSoftwareConfig' \
			$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'code-signing')
	}
	
	makeUserEmailCsrFiles()
	{
		local domain=$1
		local cnfPath=$2
		
		makeCsrConfigFile \
			$domain \
			'modulCsrEmailConfig' \
			$cnfPath/$(printf ${FILE_NAME[cnf]} $domain 'email')
	}
	
	makePasswordFile()
	{
		local domain=$1
		local pwdFile=$2
		
		if [ ! -e $pwdFile ]; then
			writeNewItem 'pass'
			openssl genpkey \
				-algorithm RSA \
				-out $pwdFile \
				-pkeyopt rsa_keygen_bits:$DEFAULT_CA_RSA_KEYSIZE_PASSWORD \
				-pkeyopt rsa_keygen_pubexp:$DEFAULT_CA_PWD_GEN_PUBEXP
			check_result $? 'unable to create password'
		fi
	}
	
	makeKeyFile()
	{
		local domain=$1
		local keyFile=$2
		local pwdFile=$3
		
		if [ ! -e $keyFile ]; then
			writeNewItem 'key'
			openssl genrsa -aes256 \
				-passout file:$pwdFile \
				-out $keyFile $DEFAULT_CA_RSA_KEYSIZE_PRIVATE_KEY
			check_result $? 'unable to create private key'
		fi
	}
	
	makeDbFiles()
	{
		local domain=$1
		local database=$2
		local crtSerial=$3
		local crlSerial=$4
		
		local time=$(date +%Y%m%d%H%M%S)001
		local hex=$(echo "obase=16; $time" | bc)
		
		if [ ! -e $database ]; then
			writeNewItem 'database files'
			touch $database
			check_result $? 'unable to create database index'
			writeNewItem 'crt serial'
			echo $hex > $crtSerial
			check_result $? 'unable to create crt serial'
			writeNewItem 'crl serial'
			echo $hex > $crlSerial
			check_result $? 'unable to create crl serial'
		fi
	}
	
	makeCsrFile()
	{
		local domain=$1
		local cnfFile=$2
		local csrFile=$3
		local keyFile=$4
		local pwdFile=$5
		
		if [ ! -e $csrFile ]; then
			writeNewItem 'csr'
			openssl req -new \
				-config $cnfFile \
				-out $csrFile \
				-key $keyFile -passin file:$pwdFile \
					> /dev/null 2>&1
			check_result $? 'unable to create csr'
		fi
	}
	
	makeCrtFile()
	{
		local domain=$1
		local cnfFile=$2
		local csrFile=$3
		local crtFile=$4
		local pwdFile=$5
		local case=$6
		
		if [ ! -e $crtFile ]; then
			writeNewItem 'crt'
			
			if [ "$case" == 'root_ca' ]; then
				openssl ca -selfsign -batch \
					-config $cnfFile \
					-in $csrFile \
					-passin file:$pwdFile \
					-out $crtFile \
					-extensions root_ca_ext \
					-enddate 20820508235959Z \
						> /dev/null 2>&1
				check_result $? 'unable to create crt'
			fi
			
			if [ "$case" == 'intermediate_ca' ]; then
				openssl ca -batch \
					-config $cnfFile \
					-in $csrFile \
					-passin file:$pwdFile \
					-out $crtFile \
					-extensions root_ca_ext \
					-policy intermediate_ca_pol \
					-enddate 20820508235959Z \
						> /dev/null 2>&1
				check_result $? 'unable to create crt'
			fi
			
			if [ "$case" == 'signing_ca' ]; then
				openssl ca -batch \
					-config $cnfFile \
					-in $csrFile \
					-passin file:$pwdFile \
					-out $crtFile \
					-extensions signing_ca_ext \
					-policy extension_ca_pol \
					-enddate 20820508235959Z \
						> /dev/null 2>&1
				check_result $? 'unable to create crt'
			fi
	    fi
	}
	
	makeCrlFile()
	{
		local domain=$1
		local cnfFile=$2
		local crlFile=$3
		local pwdFile=$4
		
		if [ ! -e $crlFile ]; then
			writeNewItem 'crl'
			openssl ca -gencrl \
				-config $cnfFile \
				-passin file:$pwdFile \
				-out $crlFile \
					> /dev/null 2>&1
				check_result $? 'unable to create crl'
			
		fi
	}
	
	makeChain()
	{
		local domain=$1
		local child=$2
		local parents=$3
		local chainPemFile=$4
		local chainP7cFile=$5
		
		if [ ! -e $chainPemFile ]; then
			writeNewItem 'pem chain'
			cat $child $parents > $chainPemFile
			check_result $? 'unable to create pem chain'
		fi
		
	}
	
	# All published certificates must be in DER format.
	# MIME type: application/pkix-cert. [RFC 2585#section-4.1]
	publishCrt()
	{
		local fromCrt=$1
		local toDer=$2
		
		rm $toDer > /dev/null 2>&1
		
		writeNewItem 'publish crt as application/pkix-cert'
		openssl x509 \
			-in $fromCrt \
			-out $toDer \
			-outform der
		check_result $? 'unable to create cer file'
	}
	
	# All published CRLs must be in DER format.
	# MIME type: application/pkix-crl. [RFC 2585#section-4.2]
	publishCACrl()
	{
		local fromCrl=$1
		local toDer=$2
		
		rm $toDer > /dev/null 2>&1
		
		writeNewItem 'publish crl as application/pkix-crl'
		openssl crl \
				-in $fromCrl \
				-out $toDer \
				-outform der
		check_result $? 'unable to create der crl file'
	}
	
	# PKCS#7 is used to bundle two or more certificates.
	# MIME type: application/pkcs7-mime. [RFC 5273#page-3]
	publishCAChain()
	{
		local fromChainPem=$1
		local toChainP7c=$2
		
		rm $toChainP7c > /dev/null 2>&1
		
		writeNewItem 'publish pem chain as application/pkcs7-mime'
		openssl crl2pkcs7 -nocrl \
			-certfile $fromChainPem \
			-out $toChainP7c \
			-outform der
		check_result $? 'unable to create p7c chain file'
	}
	
	##############################################################
	#
	# CA factories
	#
	##############################################################
	
	#
	# the root! rooooooooooot!
	#
	# note: we need the env var for openssl config
	#
	# ./reverse root CA
	#
	makeRootCa()
	{
		local domain=$1
		local baseDir=$2
		local cnfFile=$3
		local csrFile=$4
		local keyFile=$5
		local pwdFile=$6
		local crtFile=$7
		local crlFile=$8
		
		export CA_0_SCRIPT_PATH="$baseDir"
		
		makeCsrFile $domain $cnfFile $csrFile $keyFile $pwdFile
		makeCrtFile $domain $cnfFile $csrFile $crtFile $pwdFile 'root_ca'
		makeCrlFile $domain $cnfFile $crlFile $pwdFile
	}
	
	#
	# intermediate CA level 1
	#
	# note: we need the env vars for openssl config
	#
	# ./reverse/domain root CA
	#
	makeIntermediateCa()
	{
		local domain=$1
		local baseDir=$2
		local cnfFile=$3
		local csrFile=$4
		local keyFile=$5
		local pwdFile=$6
		local crtFile=$7
		local crlFile=$8
		local chainPemFile=$9
		local rootBaseDir=${10}
		local rootCnfFile=${11}
		local rootPwdFile=${12}
		local rootCrtFile=${13}
		
		export CA_1_SCRIPT_PATH="$baseDir"
		export CA_0_SCRIPT_PATH="$rootBaseDir"
		
		makeCsrFile	$domain $cnfFile $csrFile $keyFile $pwdFile
		makeCrtFile	$domain $rootCnfFile $csrFile $crtFile $rootPwdFile 'intermediate_ca'
		makeCrlFile	$domain $cnfFile $crlFile $pwdFile
		makeChain	$domain $crtFile $rootCrtFile $chainPemFile
	}
	
	#
	# intermediate CA level 2
	#
	# note: we need the env vars for openssl config
	#
	# ./reverse/domain/subdomain root CA
	#
	makeIntermediateIntermediateCa()
	{
		local domain=$1
		local baseDir=$2
		local cnfFile=$3
		local csrFile=$4
		local keyFile=$5
		local pwdFile=$6
		local crtFile=$7
		local crlFile=$8
		local chainPemFile=$9
		local rootBaseDir=${10}
		local rootCnfFile=${11}
		local rootPwdFile=${12}
		local rootCrtFile=${13}
		
		export CA_2_SCRIPT_PATH="$baseDir"
		export CA_1_SCRIPT_PATH="$rootBaseDir"
		
		makeCsrFile	$domain $cnfFile $csrFile $keyFile $pwdFile
		makeCrtFile	$domain $rootCnfFile $csrFile $crtFile $rootPwdFile 'intermediate_ca'
		makeCrlFile	$domain $cnfFile $crlFile $pwdFile
		makeChain	$domain $crtFile $rootCrtFile $chainPemFile
	}
	
	#
	# signing CA
	#
	# note: we need the env var for openssl config
	#
	# ./reverse-tls
	# ./reverse/domain-[tls|email|software]
	# ./reverse/domain/subdomain-[tls|email|software]
	#
	makeSigningCa()
	{
		local domain=$1
		local baseDir=$2
		local cnfFile=$3
		local csrFile=$4
		local keyFile=$5
		local pwdFile=$6
		local crtFile=$7
		local crlFile=$8
		local chainPemFile=$9
		local rootCnfFile=${10}
		local rootPwdFile=${11}
		local rootCrtFile=${12}
		
		export CA_0_SCRIPT_PATH="$baseDir"
		
		makeCsrFile	$domain $cnfFile $csrFile $keyFile $pwdFile
		makeCrtFile	$domain $rootCnfFile $csrFile $crtFile $rootPwdFile 'signing_ca'
		makeCrlFile	$domain $cnfFile $crlFile $pwdFile
		makeChain	$domain $crtFile $rootCrtFile $chainPemFile
	}
	
	
	##############################################################
	#
	# output
	#
	##############################################################
	
	#
	# LEVEL 0 (reverse)
	#
	
	declare -A LEVEL0
	LEVEL0[domain]=$reverseHost
	LEVEL0[path]="$SCRIPT_PATH/$reverseHost"
	
	declare -A LEVEL0_PATH
	# lookup table
	LEVEL0_PATH[lookup]=${LEVEL0[path]}/${DIR_NAME[lookup]}
	# root ca
	LEVEL0_PATH[caPath]=${LEVEL0[path]}/${DIRECTORIES_CA_ROOT[caPath]}
	LEVEL0_PATH[caDbPath]=${LEVEL0[path]}/${DIRECTORIES_CA_ROOT[dbPath]}
	LEVEL0_PATH[caCnfPath]=${LEVEL0[path]}/${DIRECTORIES_CA_ROOT[cnfPath]}
	LEVEL0_PATH[caPrvPath]=${LEVEL0[path]}/${DIRECTORIES_CA_ROOT[privatePath]}
	# tls ca
	LEVEL0_PATH[caTlsPath]=${LEVEL0[path]}/${DIRECTORIES_CA_TLS[caPath]}
	LEVEL0_PATH[caTlsDbPath]=${LEVEL0[path]}/${DIRECTORIES_CA_TLS[dbPath]}
	LEVEL0_PATH[caTlsCnfPath]=${LEVEL0[path]}/${DIRECTORIES_CA_TLS[cnfPath]}
	LEVEL0_PATH[caTlsPrvPath]=${LEVEL0[path]}/${DIRECTORIES_CA_TLS[privatePath]}
	# domains
	LEVEL0_PATH[intermediatePath]=${LEVEL0[path]}/${DIR_NAME[intermediateDir]}
	# tls crt
	LEVEL0_PATH[crtTlsPath]=${LEVEL0[path]}/${DIRECTORIES_CRT_TLS[crtPath]}
	LEVEL0_PATH[crtTlsCnfPath]=${LEVEL0[path]}/${DIRECTORIES_CRT_TLS[cnfPath]}
	LEVEL0_PATH[crtTlsPrvPath]=${LEVEL0[path]}/${DIRECTORIES_CRT_TLS[privatePath]}
	# pub
	LEVEL0_PATH[pub]=${LEVEL0[path]}/${DIR_NAME[public]}
	LEVEL0_PATH[pubTls]=${LEVEL0[path]}/${DIRECTORIES_PUB[tls]}
	
	writeNewCert ${LEVEL0[domain]}
	
	writeNewType 'directories'
	for index in "${!LEVEL0_PATH[@]}"
	do
		writeNewItem ${LEVEL0_PATH[$index]}
		mkdir -p "${LEVEL0_PATH[$index]}" > /dev/null 2>&1
		check_result $? 'unable to create directory'
	done
	
	##############################################################
	#
	# lookup
	#
	# ca=$(head -n 1 $lookup/$domain)
	#
	##############################################################
	lookupAdd()
	{
		local domain=$1
		local path=$2
		local lookup=${LEVEL0_PATH[lookup]}
		
		writeNewItem "add $domain"
		rm $lookup/$domain > /dev/null 2>&1
		echo $path >> $lookup/$domain
		check_result $? 'unable to add $domain'
	}
	
	
	writeNewType 'lookup'
	lookupAdd ${LEVEL0[domain]} ${LEVEL0[path]}

	writeNewType 'user request configs'
	makeUserTlsCsrFiles \
		${LEVEL0[domain]} \
		${LEVEL0_PATH[crtTlsCnfPath]}
	
	#
	# The following part is the worst thing you've ever seen. \o/
	# Thanks to openssl's path party.
	#
	
	#
	# root CA
	#
	writeNewType 'Root CA'
	# ./
	local __0__caCsr=${LEVEL0[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	local __0__caCrt=${LEVEL0[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	# ./ca/db
	local __0__caCrtDb=${LEVEL0_PATH[caDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	local __0__caCrtSrl=${LEVEL0_PATH[caDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	local __0__caCrlSrl=${LEVEL0_PATH[caDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	local __0__caCrl=${LEVEL0_PATH[caDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	# ./ca/etc
	local __0__caConfig=${LEVEL0_PATH[caCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	# ./ca/private
	local __0__caPwd=${LEVEL0_PATH[caPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	local __0__caKey=${LEVEL0_PATH[caPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	# ./public
	local __0__caCrtDer=${LEVEL0_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	local __0__caCrlDer=${LEVEL0_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL0[domain]} ${DIR_NAME[caRoot]})
	
	makeConfigFile \
		${LEVEL0[domain]} \
		'modulCaConfig' \
		$__0__caConfig \
		'0'
	
	makePasswordFile \
		${LEVEL0[domain]} \
		$__0__caPwd
	
	makeKeyFile \
		${LEVEL0[domain]} \
		$__0__caKey \
		$__0__caPwd
		
	makeDbFiles \
		${LEVEL0[domain]} \
		$__0__caCrtDb \
		$__0__caCrtSrl \
		$__0__caCrlSrl
		
	makeRootCa \
		${LEVEL0[domain]} \
		${LEVEL0[path]} \
		$__0__caConfig \
		$__0__caCsr \
		$__0__caKey \
		$__0__caPwd \
		$__0__caCrt \
		$__0__caCrl
	
	publishCrt		$__0__caCrt			$__0__caCrtDer
	publishCACrl	$__0__caCrl			$__0__caCrlDer
	
	#
	# tls CA
	#
	writeNewType 'TLS CA'
	# ./
	local __0__tlsCsr=${LEVEL0[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	local __0__tlsCrt=${LEVEL0[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	local __0__tlsChainPem=${LEVEL0[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	# ./ca-tls/db
	local __0__tlsCrtDb=${LEVEL0_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	local __0__tlsCrtSrl=${LEVEL0_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	local __0__tlsCrlSrl=${LEVEL0_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	local __0__tlsCrl=${LEVEL0_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	# ./ca-tls/etc
	local __0__tlsConfig=${LEVEL0_PATH[caTlsCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	# ./ca-tls/private
	local __0__tlsPwd=${LEVEL0_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	local __0__tlsKey=${LEVEL0_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	# ./public
	local __0__tlsChainP7c=${LEVEL0_PATH[pub]}/$(printf ${FILE_NAME[chainP7c]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	local __0__tlsCrtDer=${LEVEL0_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	local __0__tlsCrlDer=${LEVEL0_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL0[domain]} ${DIR_NAME[caTls]})
	
	makeConfigFile \
		${LEVEL0[domain]} \
		'modulCaTlsConfig' \
		$__0__tlsConfig \
		'0'
	
	makePasswordFile \
		${LEVEL0[domain]} \
		$__0__tlsPwd
	
	makeKeyFile \
		${LEVEL0[domain]} \
		$__0__tlsKey \
		$__0__tlsPwd
		
	makeDbFiles \
		${LEVEL0[domain]} \
		$__0__tlsCrtDb \
		$__0__tlsCrtSrl \
		$__0__tlsCrlSrl
	
	makeSigningCa \
		${LEVEL0[domain]} \
		${LEVEL0[path]} \
		$__0__tlsConfig \
		$__0__tlsCsr \
		$__0__tlsKey \
		$__0__tlsPwd \
		$__0__tlsCrt \
		$__0__tlsCrl \
		$__0__tlsChainPem \
		$__0__caConfig \
		$__0__caPwd \
		$__0__caCrt
	
	publishCrt		$__0__tlsCrt		$__0__tlsCrtDer
	publishCACrl	$__0__tlsCrl		$__0__tlsCrlDer
	publishCAChain	$__0__tlsChainPem	$__0__tlsChainP7c
	
	certificate ${LEVEL0[domain]} ${LEVEL0[domain]} create tls-server ssl
	
	#
	# LEVEL 1 (domain)
	#
	
	# intermediate CA for domain level
	# ./intermediate
	if [ ! -z "$domainList" ]; then
		level1domains=$(echo $domainList | tr ";" "\n")
		for level1domain in $level1domains
		do
			#
			# LEVEL 1 (domain)
			#
			declare -A LEVEL1
			LEVEL1[domain]=$level1domain
			LEVEL1[path]="${LEVEL0_PATH[intermediatePath]}/$level1domain"
			
			declare -A LEVEL1_PATH
			# sub root ca
			LEVEL1_PATH[caPath]=${LEVEL1[path]}/${DIRECTORIES_CA_ROOT[caPath]}
			LEVEL1_PATH[caDbPath]=${LEVEL1[path]}/${DIRECTORIES_CA_ROOT[dbPath]}
			LEVEL1_PATH[caCnfPath]=${LEVEL1[path]}/${DIRECTORIES_CA_ROOT[cnfPath]}
			LEVEL1_PATH[caPrvPath]=${LEVEL1[path]}/${DIRECTORIES_CA_ROOT[privatePath]}
			# email ca
			LEVEL1_PATH[caEmailPath]=${LEVEL1[path]}/${DIRECTORIES_CA_EMAIL[caPath]}
			LEVEL1_PATH[caEmailDbPath]=${LEVEL1[path]}/${DIRECTORIES_CA_EMAIL[dbPath]}
			LEVEL1_PATH[caEmailCnfPath]=${LEVEL1[path]}/${DIRECTORIES_CA_EMAIL[cnfPath]}
			LEVEL1_PATH[caEmailPrvPath]=${LEVEL1[path]}/${DIRECTORIES_CA_EMAIL[privatePath]}
			# software ca
			LEVEL1_PATH[caSoftwarePath]=${LEVEL1[path]}/${DIRECTORIES_CA_SOFTWARE[caPath]}
			LEVEL1_PATH[caSoftwareDbPath]=${LEVEL1[path]}/${DIRECTORIES_CA_SOFTWARE[dbPath]}
			LEVEL1_PATH[caSoftwareCnfPath]=${LEVEL1[path]}/${DIRECTORIES_CA_SOFTWARE[cnfPath]}
			LEVEL1_PATH[caSoftwarePrvPath]=${LEVEL1[path]}/${DIRECTORIES_CA_SOFTWARE[privatePath]}
			# tls ca
			LEVEL1_PATH[caTlsPath]=${LEVEL1[path]}/${DIRECTORIES_CA_TLS[caPath]}
			LEVEL1_PATH[caTlsDbPath]=${LEVEL1[path]}/${DIRECTORIES_CA_TLS[dbPath]}
			LEVEL1_PATH[caTlsCnfPath]=${LEVEL1[path]}/${DIRECTORIES_CA_TLS[cnfPath]}
			LEVEL1_PATH[caTlsPrvPath]=${LEVEL1[path]}/${DIRECTORIES_CA_TLS[privatePath]}
			# email crt
			LEVEL1_PATH[crtEmailPath]=${LEVEL1[path]}/${DIRECTORIES_CRT_EMAIL[crtPath]}
			LEVEL1_PATH[crtEmailCnfPath]=${LEVEL1[path]}/${DIRECTORIES_CRT_EMAIL[cnfPath]}
			LEVEL1_PATH[crtEmailPrvPath]=${LEVEL1[path]}/${DIRECTORIES_CRT_EMAIL[privatePath]}
			# software crt
			LEVEL1_PATH[crtSoftwarePath]=${LEVEL1[path]}/${DIRECTORIES_CRT_SOFTWARE[crtPath]}
			LEVEL1_PATH[crtSoftwareCnfPath]=${LEVEL1[path]}/${DIRECTORIES_CRT_SOFTWARE[cnfPath]}
			LEVEL1_PATH[crtSoftwarePrvPath]=${LEVEL1[path]}/${DIRECTORIES_CRT_SOFTWARE[privatePath]}
			# tls crt
			LEVEL1_PATH[crtTlsPath]=${LEVEL1[path]}/${DIRECTORIES_CRT_TLS[crtPath]}
			LEVEL1_PATH[crtTlsCnfPath]=${LEVEL1[path]}/${DIRECTORIES_CRT_TLS[cnfPath]}
			LEVEL1_PATH[crtTlsPrvPath]=${LEVEL1[path]}/${DIRECTORIES_CRT_TLS[privatePath]}
			# subdomains
			LEVEL1_PATH[intermediatePath]=${LEVEL1[path]}/${DIR_NAME[intermediateDir]}
			# pub
			LEVEL1_PATH[pub]=${LEVEL1[path]}/${DIR_NAME[public]}
			LEVEL1_PATH[pubTls]=${LEVEL1[path]}/${DIRECTORIES_PUB[tls]}
			LEVEL1_PATH[pubSoftware]=${LEVEL1[path]}/${DIRECTORIES_PUB[software]}
			LEVEL1_PATH[pubEmail]=${LEVEL1[path]}/${DIRECTORIES_PUB[email]}
			
			writeNewCert ${LEVEL1[domain]}
			
			writeNewType 'directories'
			for index in "${!LEVEL1_PATH[@]}"
			do
				writeNewItem ${LEVEL1_PATH[$index]}
				mkdir -p "${LEVEL1_PATH[$index]}" > /dev/null 2>&1
				check_result $? 'unable to create directory'
			done
			
			writeNewType 'lookup'
			lookupAdd ${LEVEL1[domain]} ${LEVEL1[path]}
			
			writeNewType 'user request configs'
			makeUserSoftwareCsrFiles \
				${LEVEL1[domain]} \
				${LEVEL1_PATH[crtSoftwareCnfPath]}
				
			makeUserEmailCsrFiles \
				${LEVEL1[domain]} \
				${LEVEL1_PATH[crtEmailCnfPath]}
			
			makeUserTlsCsrFiles \
				${LEVEL1[domain]} \
				${LEVEL1_PATH[crtTlsCnfPath]}
			
			#
			# sub root CA
			#
			writeNewType 'Intermediate CA'
			# ./
			local __1__caCsr=${LEVEL1[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			local __1__caCrt=${LEVEL1[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			local __1__caChainPem=${LEVEL1[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			# ./ca/db
			local __1__caCrtDb=${LEVEL1_PATH[caDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			local __1__caCrtSrl=${LEVEL1_PATH[caDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			local __1__caCrlSrl=${LEVEL1_PATH[caDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			local __1__caCrl=${LEVEL1_PATH[caDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			# ./ca/etc
			local __1__caConfig=${LEVEL1_PATH[caCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			# ./ca/private
			local __1__caPwd=${LEVEL1_PATH[caPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			local __1__caKey=${LEVEL1_PATH[caPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			# ./public
			local __1__caChainP7c=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[chainP7c]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			local __1__caCrtDer=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			local __1__caCrlDer=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caRoot]})
			
			makeConfigFile \
				${LEVEL1[domain]} \
				'modulCaConfig' \
				$__1__caConfig \
				'1'
			
			makePasswordFile \
				${LEVEL1[domain]} \
				$__1__caPwd
			
			makeKeyFile \
				${LEVEL1[domain]} \
				$__1__caKey \
				$__1__caPwd
				
			makeDbFiles \
				${LEVEL1[domain]} \
				$__1__caCrtDb \
				$__1__caCrtSrl \
				$__1__caCrlSrl
			
			makeIntermediateCa \
				${LEVEL1[domain]} \
				${LEVEL1[path]} \
				$__1__caConfig \
				$__1__caCsr \
				$__1__caKey \
				$__1__caPwd \
				$__1__caCrt \
				$__1__caCrl \
				$__1__caChainPem \
				${LEVEL0[path]} \
				$__0__caConfig \
				$__0__caPwd \
				$__0__caCrt
				
			publishCrt		$__1__caCrt				$__1__caCrtDer
			publishCACrl	$__1__caCrl				$__1__caCrlDer
			publishCAChain	$__1__caChainPem		$__1__caChainP7c
				
			#
			# tls CA
			#
			writeNewType 'TLS CA'
			# ./
			local __1__tlsCsr=${LEVEL1[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			local __1__tlsCrt=${LEVEL1[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			local __1__tlsChainPem=${LEVEL1[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			# ./ca-tls/db
			local __1__tlsCrtDb=${LEVEL1_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			local __1__tlsCrtSrl=${LEVEL1_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			local __1__tlsCrlSrl=${LEVEL1_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			local __1__tlsCrl=${LEVEL1_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			# ./ca-tls/etc
			local __1__tlsConfig=${LEVEL1_PATH[caTlsCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			# ./ca-tls/private
			local __1__tlsPwd=${LEVEL1_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			local __1__tlsKey=${LEVEL1_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			# ./public
			local __1__tlsChainP7c=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[chainP7c]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			local __1__tlsCrtDer=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			local __1__tlsCrlDer=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caTls]})
			
			makeConfigFile \
				${LEVEL1[domain]} \
				'modulCaTlsConfig' \
				$__1__tlsConfig \
				'1'
			
			makePasswordFile \
				${LEVEL1[domain]} \
				$__1__tlsPwd
			
			makeKeyFile \
				${LEVEL1[domain]} \
				$__1__tlsKey \
				$__1__tlsPwd
				
			makeDbFiles \
				${LEVEL1[domain]} \
				$__1__tlsCrtDb \
				$__1__tlsCrtSrl \
				$__1__tlsCrlSrl
			
			makeSigningCa \
				${LEVEL1[domain]} \
				${LEVEL1[path]} \
				$__1__tlsConfig \
				$__1__tlsCsr \
				$__1__tlsKey \
				$__1__tlsPwd \
				$__1__tlsCrt \
				$__1__tlsCrl \
				$__1__tlsChainPem \
				$__1__caConfig \
				$__1__caPwd \
				$__1__caChainPem
			
			publishCrt		$__1__tlsCrt			$__1__tlsCrtDer
			publishCACrl	$__1__tlsCrl			$__1__tlsCrlDer
			publishCAChain	$__1__tlsChainPem		$__1__tlsChainP7c
			
			certificate ${LEVEL0[domain]} ${LEVEL1[domain]} create tls-server ssl
	
			#
			# email CA
			#
			writeNewType 'Email CA'
			# ./
			local __1__emailCsr=${LEVEL1[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			local __1__emailCrt=${LEVEL1[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			local __1__emailChainPem=${LEVEL1[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			# ./ca-email/db
			local __1__emailCrtDb=${LEVEL1_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			local __1__emailCrtSrl=${LEVEL1_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			local __1__emailCrlSrl=${LEVEL1_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			local __1__emailCrl=${LEVEL1_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			# ./ca-email/etc
			local __1__emailConfig=${LEVEL1_PATH[caEmailCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			# ./ca-email/private
			local __1__emailPwd=${LEVEL1_PATH[caEmailPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			local __1__emailKey=${LEVEL1_PATH[caEmailPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			# ./public
			local __1__emailChainP7c=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[chainP7c]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			local __1__emailCrtDer=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			local __1__emailCrlDer=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caEmail]})
			
			makeConfigFile \
				${LEVEL1[domain]} \
				'modulCaEmailConfig' \
				$__1__emailConfig \
				'1'
			
			makePasswordFile \
				${LEVEL1[domain]} \
				$__1__emailPwd
			
			makeKeyFile \
				${LEVEL1[domain]} \
				$__1__emailKey \
				$__1__emailPwd
				
			makeDbFiles \
				${LEVEL1[domain]} \
				$__1__emailCrtDb \
				$__1__emailCrtSrl \
				$__1__emailCrlSrl
			
			makeSigningCa \
				${LEVEL1[domain]} \
				${LEVEL1[path]} \
				$__1__emailConfig \
				$__1__emailCsr \
				$__1__emailKey \
				$__1__emailPwd \
				$__1__emailCrt \
				$__1__emailCrl \
				$__1__emailChainPem \
				$__1__caConfig \
				$__1__caPwd \
				$__1__caChainPem
			
			publishCrt		$__1__emailCrt			$__1__emailCrtDer
			publishCACrl	$__1__emailCrl			$__1__emailCrlDer			
			publishCAChain	$__1__emailChainPem		$__1__emailChainP7c

			#
			# software CA
			#
			writeNewType 'Software CA'
			# ./
			local __1__softwareCsr=${LEVEL1[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			local __1__softwareCrt=${LEVEL1[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			local __1__softwareChainPem=${LEVEL1[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			# ./ca-software/db
			local __1__softwareCrtDb=${LEVEL1_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			local __1__softwareCrtSrl=${LEVEL1_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			local __1__softwareCrlSrl=${LEVEL1_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			local __1__softwareCrl=${LEVEL1_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			# ./ca-software/etc
			local __1__softwareConfig=${LEVEL1_PATH[caSoftwareCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			# ./ca-software/private
			local __1__softwarePwd=${LEVEL1_PATH[caSoftwarePrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			local __1__softwareKey=${LEVEL1_PATH[caSoftwarePrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			# ./public
			local __1__softwareChainP7c=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[chainP7c]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			local __1__softwareCrtDer=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			local __1__softwareCrlDer=${LEVEL1_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL1[domain]} ${DIR_NAME[caSoftware]})
			
			makeConfigFile \
				${LEVEL1[domain]} \
				'modulCaSoftwareConfig' \
				$__1__softwareConfig \
				'1'
			
			makePasswordFile \
				${LEVEL1[domain]} \
				$__1__softwarePwd
			
			makeKeyFile \
				${LEVEL1[domain]} \
				$__1__softwareKey \
				$__1__softwarePwd
				
			makeDbFiles \
				${LEVEL1[domain]} \
				$__1__softwareCrtDb \
				$__1__softwareCrtSrl \
				$__1__softwareCrlSrl
			
			makeSigningCa \
				${LEVEL1[domain]} \
				${LEVEL1[path]} \
				$__1__softwareConfig \
				$__1__softwareCsr \
				$__1__softwareKey \
				$__1__softwarePwd \
				$__1__softwareCrt \
				$__1__softwareCrl \
				$__1__softwareChainPem \
				$__1__caConfig \
				$__1__caPwd \
				$__1__caChainPem

			publishCrt		$__1__softwareCrt		$__1__softwareCrtDer
			publishCACrl	$__1__softwareCrl		$__1__softwareCrlDer
			publishCAChain	$__1__softwareChainPem	$__1__softwareChainP7c

			#
			# LEVEL 2 (subdomains)
			#
			
			# intermediate intermediate CA for subdomain level
			# ./intermediate/domain/intermediate
			if [ ! -z "$subDomainNameList" ]; then
				level2domains=$(echo $subDomainNameList | tr ";" "\n")
				for level2domain in $level2domains
				do
					#
					# LEVEL 2 (subs)
					#
					# I don't split anything by '.' - a mail.foo.tld is like bob.mail.foo.tld.
					# feel free to create the third level for bob.
					# 
					# in that case
					# - intermediate CA @ level 3:
					# 	- you MUST fork the makeIntermediateIntermediateCa function as makeIntermediateIntermediateIntermediateCa (or whatever);
					# 	- you MUST redefine export CA_2_SCRIPT_PATH="$baseDir" and export CA_1_SCRIPT_PATH="$rootBaseDir"
					# 	                 as export CA_3_SCRIPT_PATH="$baseDir" and export CA_2_SCRIPT_PATH="$rootBaseDir"
					# 	- you MUST call makeConfigFile with '4' as the fourth parameter
					#   otherwise openssl fails on relative paths. you can walk through the directories - but that's also nasty.
					#   @see makeModulCaConfigBlock_default::$level
					# - signing CAs @ level 3 are fun: s/2/3/ && s/1/2/
					# 
					declare -A LEVEL2
					LEVEL2[domain]="$level2domain.${LEVEL1[domain]}"
					LEVEL2[path]="${LEVEL1_PATH[intermediatePath]}/$level2domain"
					
					declare -A LEVEL2_PATH
					# sub sub root ca
					LEVEL2_PATH[caPath]=${LEVEL2[path]}/${DIRECTORIES_CA_ROOT[caPath]}
					LEVEL2_PATH[caDbPath]=${LEVEL2[path]}/${DIRECTORIES_CA_ROOT[dbPath]}
					LEVEL2_PATH[caCnfPath]=${LEVEL2[path]}/${DIRECTORIES_CA_ROOT[cnfPath]}
					LEVEL2_PATH[caPrvPath]=${LEVEL2[path]}/${DIRECTORIES_CA_ROOT[privatePath]}
					# email ca
					LEVEL2_PATH[caEmailPath]=${LEVEL2[path]}/${DIRECTORIES_CA_EMAIL[caPath]}
					LEVEL2_PATH[caEmailDbPath]=${LEVEL2[path]}/${DIRECTORIES_CA_EMAIL[dbPath]}
					LEVEL2_PATH[caEmailCnfPath]=${LEVEL2[path]}/${DIRECTORIES_CA_EMAIL[cnfPath]}
					LEVEL2_PATH[caEmailPrvPath]=${LEVEL2[path]}/${DIRECTORIES_CA_EMAIL[privatePath]}
					# software ca
					LEVEL2_PATH[caSoftwarePath]=${LEVEL2[path]}/${DIRECTORIES_CA_SOFTWARE[caPath]}
					LEVEL2_PATH[caSoftwareDbPath]=${LEVEL2[path]}/${DIRECTORIES_CA_SOFTWARE[dbPath]}
					LEVEL2_PATH[caSoftwareCnfPath]=${LEVEL2[path]}/${DIRECTORIES_CA_SOFTWARE[cnfPath]}
					LEVEL2_PATH[caSoftwarePrvPath]=${LEVEL2[path]}/${DIRECTORIES_CA_SOFTWARE[privatePath]}
					# tls ca
					LEVEL2_PATH[caTlsPath]=${LEVEL2[path]}/${DIRECTORIES_CA_TLS[caPath]}
					LEVEL2_PATH[caTlsDbPath]=${LEVEL2[path]}/${DIRECTORIES_CA_TLS[dbPath]}
					LEVEL2_PATH[caTlsCnfPath]=${LEVEL2[path]}/${DIRECTORIES_CA_TLS[cnfPath]}
					LEVEL2_PATH[caTlsPrvPath]=${LEVEL2[path]}/${DIRECTORIES_CA_TLS[privatePath]}
					# email crt
					LEVEL2_PATH[crtEmailPath]=${LEVEL2[path]}/${DIRECTORIES_CRT_EMAIL[crtPath]}
					LEVEL2_PATH[crtEmailCnfPath]=${LEVEL2[path]}/${DIRECTORIES_CRT_EMAIL[cnfPath]}
					LEVEL2_PATH[crtEmailPrvPath]=${LEVEL2[path]}/${DIRECTORIES_CRT_EMAIL[privatePath]}
					# software crt
					LEVEL2_PATH[crtSoftwarePath]=${LEVEL2[path]}/${DIRECTORIES_CRT_SOFTWARE[crtPath]}
					LEVEL2_PATH[crtSoftwareCnfPath]=${LEVEL2[path]}/${DIRECTORIES_CRT_SOFTWARE[cnfPath]}
					LEVEL2_PATH[crtSoftwarePrvPath]=${LEVEL2[path]}/${DIRECTORIES_CRT_SOFTWARE[privatePath]}
					# tls crt
					LEVEL2_PATH[crtTlsPath]=${LEVEL2[path]}/${DIRECTORIES_CRT_TLS[crtPath]}
					LEVEL2_PATH[crtTlsCnfPath]=${LEVEL2[path]}/${DIRECTORIES_CRT_TLS[cnfPath]}
					LEVEL2_PATH[crtTlsPrvPath]=${LEVEL2[path]}/${DIRECTORIES_CRT_TLS[privatePath]}
					# pub
					LEVEL2_PATH[pub]=${LEVEL2[path]}/${DIR_NAME[public]}
					LEVEL2_PATH[pubTls]=${LEVEL2[path]}/${DIRECTORIES_PUB[tls]}
					LEVEL2_PATH[pubSoftware]=${LEVEL2[path]}/${DIRECTORIES_PUB[software]}
					LEVEL2_PATH[pubEmail]=${LEVEL2[path]}/${DIRECTORIES_PUB[email]}
			
					writeNewCert ${LEVEL2[domain]}
					
					writeNewType 'directories'
					for index in "${!LEVEL2_PATH[@]}"
					do
						writeNewItem ${LEVEL1_PATH[$index]}
						mkdir -p "${LEVEL2_PATH[$index]}" > /dev/null 2>&1
						check_result $? 'unable to create directory'
					done
					
					writeNewType 'lookup'
					lookupAdd ${LEVEL2[domain]} ${LEVEL2[path]}
			
					writeNewType 'user request configs'
					makeUserSoftwareCsrFiles \
						${LEVEL2[domain]} \
						${LEVEL2_PATH[crtSoftwareCnfPath]}
						
					makeUserEmailCsrFiles \
						${LEVEL2[domain]} \
						${LEVEL2_PATH[crtEmailCnfPath]}
					
					makeUserTlsCsrFiles \
						${LEVEL2[domain]} \
						${LEVEL2_PATH[crtTlsCnfPath]}
					
					#
					# sub sub root CA
					#
					writeNewType 'Intermediate CA'
					# ./
					local __2__caCsr=${LEVEL2[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					local __2__caCrt=${LEVEL2[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					local __2__caChainPem=${LEVEL2[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					# ./ca/db
					local __2__caCrtDb=${LEVEL2_PATH[caDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					local __2__caCrtSrl=${LEVEL2_PATH[caDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					local __2__caCrlSrl=${LEVEL2_PATH[caDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					local __2__caCrl=${LEVEL2_PATH[caDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					# ./ca/etc
					local __2__caConfig=${LEVEL2_PATH[caCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					# ./ca/private
					local __2__caPwd=${LEVEL2_PATH[caPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					local __2__caKey=${LEVEL2_PATH[caPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					# ./public
					local __2__caChainP7c=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[chainP7c]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					local __2__caCrtDer=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					local __2__caCrlDer=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caRoot]})
					
					makeConfigFile \
						${LEVEL2[domain]} \
						'modulCaConfig' \
						$__2__caConfig \
						'2'
					
					makePasswordFile \
						${LEVEL2[domain]} \
						$__2__caPwd
					
					makeKeyFile \
						${LEVEL2[domain]} \
						$__2__caKey \
						$__2__caPwd
						
					makeDbFiles \
						${LEVEL2[domain]} \
						$__2__caCrtDb \
						$__2__caCrtSrl \
						$__2__caCrlSrl
					
					makeIntermediateIntermediateCa \
						${LEVEL2[domain]} \
						${LEVEL2[path]} \
						$__2__caConfig \
						$__2__caCsr \
						$__2__caKey \
						$__2__caPwd \
						$__2__caCrt \
						$__2__caCrl \
						$__2__caChainPem \
						${LEVEL1[path]} \
						$__1__caConfig \
						$__1__caPwd \
						$__1__caChainPem
					
					publishCrt		$__2__caCrt				$__2__caCrtDer
					publishCACrl	$__2__caCrl				$__2__caCrlDer
					publishCAChain	$__2__caChainPem		$__2__caChainP7c
					
					#
					# tls CA
					#
					writeNewType 'TLS CA'
					# ./
					local __2__tlsCsr=${LEVEL2[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					local __2__tlsCrt=${LEVEL2[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					local __2__tlsChainPem=${LEVEL2[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					# ./ca-tls/db
					local __2__tlsCrtDb=${LEVEL2_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					local __2__tlsCrtSrl=${LEVEL2_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					local __2__tlsCrlSrl=${LEVEL2_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					local __2__tlsCrl=${LEVEL2_PATH[caTlsDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					# ./ca-tls/etc
					local __2__tlsConfig=${LEVEL2_PATH[caTlsCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					# ./ca-tls/private
					local __2__tlsPwd=${LEVEL2_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					local __2__tlsKey=${LEVEL2_PATH[caTlsPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					# ./public
					local __2__tlsChainP7c=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[chainP7c]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					local __2__tlsCrtDer=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					local __2__tlsCrlDer=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caTls]})
					
					makeConfigFile \
						${LEVEL2[domain]} \
						'modulCaTlsConfig' \
						$__2__tlsConfig \
						'2'
					
					makePasswordFile \
						${LEVEL2[domain]} \
						$__2__tlsPwd
					
					makeKeyFile \
						${LEVEL2[domain]} \
						$__2__tlsKey \
						$__2__tlsPwd
						
					makeDbFiles \
						${LEVEL2[domain]} \
						$__2__tlsCrtDb \
						$__2__tlsCrtSrl \
						$__2__tlsCrlSrl
					
					makeSigningCa \
						${LEVEL2[domain]} \
						${LEVEL2[path]} \
						$__2__tlsConfig \
						$__2__tlsCsr \
						$__2__tlsKey \
						$__2__tlsPwd \
						$__2__tlsCrt \
						$__2__tlsCrl \
						$__2__tlsChainPem \
						$__2__caConfig \
						$__2__caPwd \
						$__2__caChainPem
					
					publishCrt		$__2__tlsCrt			$__2__tlsCrtDer
					publishCACrl	$__2__tlsCrl			$__2__tlsCrlDer
					publishCAChain	$__2__tlsChainPem		$__2__tlsChainP7c
			
					certificate ${LEVEL0[domain]} ${LEVEL2[domain]} create tls-server ssl
					
					#
					# email CA
					#
					writeNewType 'Email CA'
					# ./
					local __2__emailCsr=${LEVEL2[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					local __2__emailCrt=${LEVEL2[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					local __2__emailChainPem=${LEVEL2[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					# ./ca-email/db
					local __2__emailCrtDb=${LEVEL2_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					local __2__emailCrtSrl=${LEVEL2_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					local __2__emailCrlSrl=${LEVEL2_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					local __2__emailCrl=${LEVEL2_PATH[caEmailDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					# ./ca-email/etc
					local __2__emailConfig=${LEVEL2_PATH[caEmailCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					# ./ca-email/private
					local __2__emailPwd=${LEVEL2_PATH[caEmailPrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					local __2__emailKey=${LEVEL2_PATH[caEmailPrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					# ./public
					local __2__emailChainP7c=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[chainP7c]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					local __2__emailCrtDer=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					local __2__emailCrlDer=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caEmail]})
					
					makeConfigFile \
						${LEVEL2[domain]} \
						'modulCaEmailConfig' \
						$__2__emailConfig \
						'2'
					
					makePasswordFile \
						${LEVEL2[domain]} \
						$__2__emailPwd
					
					makeKeyFile \
						${LEVEL2[domain]} \
						$__2__emailKey \
						$__2__emailPwd
						
					makeDbFiles \
						${LEVEL2[domain]} \
						$__2__emailCrtDb \
						$__2__emailCrtSrl \
						$__2__emailCrlSrl
					
					makeSigningCa \
						${LEVEL2[domain]} \
						${LEVEL2[path]} \
						$__2__emailConfig \
						$__2__emailCsr \
						$__2__emailKey \
						$__2__emailPwd \
						$__2__emailCrt \
						$__2__emailCrl \
						$__2__emailChainPem \
						$__2__caConfig \
						$__2__caPwd \
						$__2__caChainPem
					
					publishCrt		$__2__emailCrt			$__2__emailCrtDer
					publishCACrl	$__2__emailCrl			$__2__emailCrlDer					
					publishCAChain	$__2__emailChainPem		$__2__emailChainP7c

					#
					# software CA
					#
					writeNewType 'Software CA'
					# ./
					local __2__softwareCsr=${LEVEL2[path]}/$(printf ${FILE_NAME[csr]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					local __2__softwareCrt=${LEVEL2[path]}/$(printf ${FILE_NAME[crt]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					local __2__softwareChainPem=${LEVEL2[path]}/$(printf ${FILE_NAME[chainPem]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					# ./ca-software/db
					local __2__softwareCrtDb=${LEVEL2_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crtDb]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					local __2__softwareCrtSrl=${LEVEL2_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crtSrl]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					local __2__softwareCrlSrl=${LEVEL2_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crlSrl]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					local __2__softwareCrl=${LEVEL2_PATH[caSoftwareDbPath]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					# ./ca-software/etc
					local __2__softwareConfig=${LEVEL2_PATH[caSoftwareCnfPath]}/$(printf ${FILE_NAME[cnf]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					# ./ca-software/private
					local __2__softwarePwd=${LEVEL2_PATH[caSoftwarePrvPath]}/$(printf ${FILE_NAME[password]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					local __2__softwareKey=${LEVEL2_PATH[caSoftwarePrvPath]}/$(printf ${FILE_NAME[key]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					# ./public
					local __2__softwareChainP7c=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[chainP7c]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					local __2__softwareCrtDer=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[cer]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					local __2__softwareCrlDer=${LEVEL2_PATH[pub]}/$(printf ${FILE_NAME[crl]} ${LEVEL2[domain]} ${DIR_NAME[caSoftware]})
					
					makeConfigFile \
						${LEVEL2[domain]} \
						'modulCaSoftwareConfig' \
						$__2__softwareConfig \
						'2'
					
					makePasswordFile \
						${LEVEL2[domain]} \
						$__2__softwarePwd
					
					makeKeyFile \
						${LEVEL2[domain]} \
						$__2__softwareKey \
						$__2__softwarePwd
						
					makeDbFiles \
						${LEVEL2[domain]} \
						$__2__softwareCrtDb \
						$__2__softwareCrtSrl \
						$__2__softwareCrlSrl
					
					makeSigningCa \
						${LEVEL2[domain]} \
						${LEVEL2[path]} \
						$__2__softwareConfig \
						$__2__softwareCsr \
						$__2__softwareKey \
						$__2__softwarePwd \
						$__2__softwareCrt \
						$__2__softwareCrl \
						$__2__softwareChainPem \
						$__2__caConfig \
						$__2__caPwd \
						$__2__caChainPem
					
					publishCrt		$__2__softwareCrt		$__2__softwareCrtDer
					publishCACrl	$__2__softwareCrl		$__2__softwareCrlDer
					publishCAChain	$__2__softwareChainPem	$__2__softwareChainP7c
				done
			fi
		done
	fi
	
	do_unlock
}


demo()
{
	local pass='UDUslpOy:lsp.amsCw,Z09o&ooYx:lko123---0'
	root_ca $DEFAULT_DOMAIN 'example.com;example2.com' 'mail;smtp'
	certificate $DEFAULT_DOMAIN example.com create code-signing fruffi -CN 'fruffi IRC BOT' -password $pass
	certificate $DEFAULT_DOMAIN example.com create email lucas -password $pass -CN 'lucas' -emailAddress 'lucas@example.com'
	certificate $DEFAULT_DOMAIN example.com create tls-client lucas -CN 'Luc' -password $pass
	certificate $DEFAULT_DOMAIN example.com create tls-client-external luc-external -CN 'Luc' -O 'frufflwochen' -C 'NL' -password $pass
	certificate $DEFAULT_DOMAIN example.com create tls-server 1337
	certificate $DEFAULT_DOMAIN example.com create tls-server-external example.com -CN 'external.com' -O 'frufflwochen' -C 'NL' -password $pass
}