#!/bin/sh

###
# @author areazero <dev@areazero.de>
# @version 2019.05.15.01
# @copyright 2016 - 2019 areazero
###

BASE_DIR='/etc/ssl/domains'
SSL_BINARY='/usr/bin/openssl'
SSL_BITS=4096
SSL_GROUP='ssl-cert'
SSL_PERM=0640
PARAM_FILE="${BASE_DIR}/dh${SSL_BITS}.pem"
TEMP_FILE=$(/bin/mktemp)

if [ ! -e "${BASE_DIR}" -o ! -d "${BASE_DIR}/." ] ; then
  echo 'directory not found: '${BASE_DIR} >&2
  exit 1
fi

if [ ! -x "${SSL_BINARY}" ] ; then
  echo 'ssl binary not executable: '${SSL_BINARY} >&2
  exit 1
fi

getent group "${SSL_GROUP}" >/dev/null 2>&1

if [ $? -ne 0 ] ; then
  echo 'ssl group not found: '${SSL_GROUP} >&2
  exit 1
fi

${SSL_BINARY} dhparam -out "${TEMP_FILE}" ${SSL_BITS} >/dev/null \
  && /bin/chmod ${SSL_PERM} ${TEMP_FILE} \
  && /bin/chgrp ${SSL_GROUP} ${TEMP_FILE} \
  && mv -f ${TEMP_FILE} ${PARAM_FILE} \
  && echo 'file updated: '${PARAM_FILE}

