generate_certs.sh

#!/bin/sh

# Create certs directory if it doesn't exist and set permissions
mkdir -p certs
chmod 700 certs

# Generate CA key and certificate
openssl genpkey -algorithm RSA -out certs/ca-key.pem
openssl req -new -x509 -key certs/ca-key.pem -out certs/ca-cert.pem -days 3650 -subj "/CN=MySQL CA"

# Generate server key and certificate
openssl genpkey -algorithm RSA -out certs/server-key.pem
openssl req -new -key certs/server-key.pem -out certs/server-req.pem -subj "/CN=MySQL Server"
openssl x509 -req -in certs/server-req.pem -CA certs/ca-cert.pem -CAkey certs/ca-key.pem -CAcreateserial -out certs/server-cert.pem -days 3650

# Generate client key and certificate (optional)
openssl genpkey -algorithm RSA -out certs/client-key.pem
openssl req -new -key certs/client-key.pem -out certs/client-req.pem -subj "/CN=MySQL Client"
openssl x509 -req -in certs/client-req.pem -CA certs/ca-cert.pem -CAkey certs/ca-key.pem -CAcreateserial -out certs/client-cert.pem -days 3650

# Verify the certificates
openssl verify -CAfile certs/ca-cert.pem certs/server-cert.pem certs/client-cert.pem

# Optionally generate PKCS#12 certificate for server if enabled via env
if [ "$GENERATE_P12" = "true" ]; then
    echo "Generating PKCS#12 certificate..."
    openssl pkcs12 -export \
      -in certs/server-cert.pem \
      -inkey certs/server-key.pem \
      -certfile certs/ca-cert.pem \
      -out certs/server.p12 \
      -passout pass:${P12_PASSWORD:-password}
    echo "PKCS#12 certificate generated: certs/server.p12"
fi

echo "Certificates generated successfully and stored in the 'certs' directory."