#!/bin/bash 

set -e

if [ -f /var/lib/openvpn-server/ca-store ]
then
    if grep -q ca-store /proc/mounts
    then
        echo "ca-store mounted"
    else
        echo "ca-store not mounted, or your session has expired."
        echo "Use ovs mount-ca-store to mount your ca-store"
        exit 1
    fi

fi


. /usr/share/openvpn-server/functions.sh
. /etc/openvpn-server/config.sh

echo "The following certificates are available to revoke:"
echo

get_current_certificates

read -p "Enter the index of the certificate to revoke: " OVPN_REVOKE_ID

if [ ! -f "/var/lib/openvpn-server/openssl/${OVPN_REVOKE_ID}.pem" ]; then
	echo "Index '${OVPN_REVOKE_ID}' is invalid"
	exit 1
fi

KEY_EMAIL= KEY_NAME=						\
openssl ca -revoke /var/lib/openvpn-server/openssl/${OVPN_REVOKE_ID}.pem	\
	-config /etc/openvpn-server/openssl/openssl.cnf			\
#	>/dev/null 2>&1

KEY_EMAIL= KEY_NAME=						\
openssl ca -gencrl -crldays 3650				\
	-out /etc/openvpn/$OVPN_ORGNICK-ca.crl		\
	-config /etc/openvpn-server/openssl/openssl.cnf			\
#	>/dev/null 2>&1

echo "Remember to copy /etc/openvpn/$OVPN_ORGNICK-ca.crl to all the other OpenVPN servers!"
if [ -f /etc/openvpn-server/servers.conf ]
        then for server in `cat /etc/openvpn-server/servers.conf`
                do scp -i "/var/lib/openvpn-server/openssl/ssh-keys/id_rsa" /etc/openvpn/$OVPN_ORGNICK-ca.crl $server:/etc/openvpn/$OVPN_ORGNICK-ca.crl 
                done

fi




echo "The certificate has been revoked."

# if ofirewalled, then remove the param
# need to get the key name first, so I can remove it from the params in /etc/shorewall/openvpn.params
if [ "$FIREWALLED" == "yes" ]
then sed -i "/$KEY_NAME.$/d" /etc/shorewall/openvpn.params
fi

# need to do this and copy it to the other servers for multi server mode too
if [ -f /etc/openvpn-server/servers.conf ]
        then for server in `cat /etc/openvpn-server/servers.conf`
                do scp -i "/var/lib/openvpn-server/openssl/ssh-keys/id_rsa" /etc/shorewall/openvpn.params $server:/etc/shorewall/openvpn.params
                done

fi


