#!/usr/bin/env python3
# Generate a self signed certificate with unlimited expire time

import argparse

from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.backends import default_backend
from datetime import datetime, timedelta

# Generate private key
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048,
    backend=default_backend()

)

parser = argparse.ArgumentParser(description="Generate a self signed certificate")
parser.add_argument('--country', required=True, help="Set country")
parser.add_argument('--state', required=True, help="Set state or province name")
parser.add_argument('--city', required=True, help="Set city name")
parser.add_argument('--organisation', required=True, help="Set organisation name")
parser.add_argument('--organisation-unit', required=True, help="Set organisation unit name")
parser.add_argument('--common-name', required=True, help="Set common name")
parser.add_argument('--out-certificate', required=True, help="Output certificate")
parser.add_argument('--out-key', required=True, help="Output key")

args = parser.parse_args()

 # Builder for certificate
subject = issuer = x509.Name([
    x509.NameAttribute(NameOID.COUNTRY_NAME, args.country),
    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, args.state),
    x509.NameAttribute(NameOID.LOCALITY_NAME, args.city),
    x509.NameAttribute(NameOID.ORGANIZATION_NAME, args.organisation),
    x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, args.organisation_unit),
    x509.NameAttribute(NameOID.COMMON_NAME, args.common_name),
])
certificate = x509.CertificateBuilder().subject_name(
    subject
).issuer_name(
    issuer
).public_key(
    private_key.public_key()
).serial_number(
    x509.random_serial_number()
).not_valid_before(
    datetime(2000, 1, 1)
).not_valid_after(
    datetime(9999, 1, 1)
).add_extension(
    x509.SubjectAlternativeName([x509.DNSName(args.common_name)]),
    critical=False,
).sign(private_key, hashes.SHA256(), default_backend())

# Serialize certificate and private key
with open(args.out_certificate, "wb") as f:
    f.write(certificate.public_bytes(serialization.Encoding.PEM))
with open(args.out_key, "wb") as f:
    f.write(private_key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption()
    ))
