executor: extract_certificates_http
input:
  cn: ""
  cn_ca: ""
  cert_path: ""
  serial_number: ""
steps:
- type: exec
  script: "mktemp -d"
  vars:
    temp_dir:
      from: result.systemout

# download_p12_file
- type: exec
  script: |
    curl -k --output {{.temp_dir}}/{{.input.cn}}.p12 \
    http://127.0.0.1:22225/api/v1/pki/cert/{{.input.serial_number}}/download/secret

# extract_ca_certificate
- type: exec
  script: |
    openssl pkcs12 -in {{.temp_dir}}/{{.input.cn}}.p12 -cacerts -nokeys \
    -out {{.temp_dir}}/{{.input.cn_ca}}.crt -passin pass:secret $(. /etc/os-release; if [ "${ID}_${VERSION_ID%.*}" != "rhel_8" ]; then echo "-legacy"; fi) 

# extract_certificate
- type: exec
  script: |
    openssl pkcs12 -in {{.temp_dir}}/{{.input.cn}}.p12 -clcerts -nokeys \
    -out {{.temp_dir}}/{{.input.cn}}.crt -passin pass:secret $(. /etc/os-release; if [ "${ID}_${VERSION_ID%.*}" != "rhel_8" ]; then echo "-legacy"; fi)

# extract_key
- type: exec
  script: |
    openssl pkcs12 -in {{.temp_dir}}/{{.input.cn}}.p12 -nocerts -nodes \
    -out {{.temp_dir}}/{{.input.cn}}.key -passin pass:secret $(. /etc/os-release; if [ "${ID}_${VERSION_ID%.*}" != "rhel_8" ]; then echo "-legacy"; fi)

# install_ca_cert
- type: exec
  script: "yes | cp -r {{.temp_dir}}/{{.input.cn_ca}}.crt {{.input.cert_path}}/ca.pem"

# install_cert
- type: exec
  script: "yes | cp -r {{.temp_dir}}/{{.input.cn}}.crt {{.input.cert_path}}/server.crt"

# add ca.pem in server.crt
- type: exec
  script: "cat {{.input.cert_path}}/ca.pem >> {{.input.cert_path}}/server.crt"

# install_key
- type: exec
  script: "yes | cp -r {{.temp_dir}}/{{.input.cn}}.key {{.input.cert_path}}/server.key"

# generate server.pem
- type: exec
  script: "cat {{.input.cert_path}}/server.crt {{.input.cert_path}}/server.key >> {{.input.cert_path}}/server.pem"
