#!/bin/sh
# Download AtlasHorizon CAs from pki.atlashorizon.net/certs/ and write PEM files.
# Never fetch /root.crt — that path is deprecated.
set -eu

ROOT="$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)"
DEST="${ROOT}/certs"
PKI="http://pki.atlashorizon.net/certs"

if ! command -v curl >/dev/null 2>&1; then
  echo "curl is required" >&2
  exit 1
fi
if ! command -v openssl >/dev/null 2>&1; then
  echo "openssl is required" >&2
  exit 1
fi

mkdir -p "${DEST}"

# Convert DER or PEM input to a normalized PEM certificate.
to_pem() {
  src="$1"
  dest="$2"
  if grep -q "BEGIN CERTIFICATE" "${src}"; then
    openssl x509 -in "${src}" -out "${dest}"
  else
    openssl x509 -inform DER -in "${src}" -out "${dest}"
  fi
}

fetch_pem() {
  url="$1"
  dest="$2"
  tmp="${dest}.tmp"
  echo "Fetching ${url}"
  curl -fsSL "${url}" -o "${tmp}"
  to_pem "${tmp}" "${dest}"
  rm -f "${tmp}"
  openssl x509 -in "${dest}" -noout -subject -issuer
}

fetch_pem "${PKI}/AtlasHorizonRootCA.crt" "${DEST}/AtlasHorizon-Root-CA.crt"
fetch_pem "${PKI}/AtlasHorizon%20Enterprise%20CA.crt" "${DEST}/AtlasHorizon-Enterprise-CA.crt"
fetch_pem "${PKI}/AtlasHorizon%20Issuing%20CA.crt" "${DEST}/AtlasHorizon-Issuing-CA.crt"

echo "Wrote AtlasHorizon CAs to ${DEST}"