generate.php

<?php
/**
 * this File is part of xTLS - (c) 20225 xTLS
 *
 * NOTICE OF LICENSE
 *
 * EUROPEAN UNION PUBLIC LICENCE v. 1.2
 * that is bundled with this package in the file LICENSE.md.
 * It is also available through the world-wide-web at this URL:
 * https://eupl.eu/
 *
 * 
 * @author      Micro
 * @copyright   2025 xTLS
 * @link
 * @see         Internal Documentation ~/doc/
 * @version     1.0.0
 * @todo
 */


define('REAL_BASE_DIR', dirname(__FILE__));
require_once(REAL_BASE_DIR."/config/config.php");
//loadEnv();
require_once(REAL_BASE_DIR . "/create_san_config.php");
require_once(REAL_BASE_DIR . "/create_domain_config.php");
require_once(REAL_BASE_DIR."/functions.php");

HTML_HEAD($bgcolor);

?>
<h1>📜 Zertifikatsverwaltung</h1>

<?php

// Hilfsfunktion zur Domainvalidierung
function validateDomains(array $domains): array {
    return array_filter($domains, function($domain) {
        return preg_match('/^[a-z0-9.-]+$/i', $domain);
    });
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    if ($_POST['mode'] === 'san') {
        // SAN-Modus: mehrere Domains in EINEM Zertifikat
        $domains = array_map('trim', explode(',', $_POST['domains']));
        $domains = validateDomains($domains);
        if (count($domains) < 1) {
            echo "❌ Ungültige Domains für SAN-Zertifikat.";
            exit;
        }

        $primaryDomain = $domains[0];
        $domainDir = "$certsDir/$primaryDomain";
        if (!is_dir($domainDir)) mkdir($domainDir, 0775, true);

        $keyFile = "$domainDir/key.pem";
        $csrFile = "$domainDir/csr.pem";
        $certFile = "$domainDir/cert.pem";
        $bundleFile = "$domainDir/bundle.crt";
        $verifyFile = "$domainDir/verify.txt";
        $confFile = "$domainDir/$primaryDomain.cnf";
        $zipFile = "$domainDir/{$primaryDomain}_SAN.zip";
        $fullchainFile = "$domainDir/fullchain.pem";
        $postfixPem = "$domainDir/postfix.pem";

        if (!file_exists($keyFile)) {
            exec("openssl genrsa -out $keyFile 4096");
        }

        $conf = createOpenSSLConfigForSAN($opensslCnf, $domains);

        copy($conf, $confFile);
        exec("openssl req -new -key $keyFile -out $csrFile -config $conf -reqexts v3_req", $out, $ret);
        if ($ret !== 0) {
            echo "Fehler beim Erstellen der CSR für SAN-Zertifikat.";
            exit;
        }

        exec("openssl ca -batch -config $confFile -in $csrFile -out $certFile -extensions v3_req -passin pass:$caPass", $out, $ret);
        if ($ret !== 0) {
            echo "Fehler beim Signieren des SAN-Zertifikats.";
            exit;
        }

        file_put_contents($bundleFile, file_get_contents($certFile) . file_get_contents("$caDir/rootCA.pem"));

        exec("openssl x509 -in $certFile -noout -text", $verifyOut);
        file_put_contents($verifyFile, implode(PHP_EOL, $verifyOut));

        // Mailserver sollen das lieben
        file_put_contents($fullchainFile, file_get_contents($certFile) . file_get_contents("$caDir/rootCA.pem"));
        file_put_contents($postfixPem, file_get_contents($keyFile) . file_get_contents($certFile) . file_get_contents("$caDir/rootCA.pem"));

        $zip = new ZipArchive();
        if ($zip->open($zipFile, ZipArchive::CREATE | ZipArchive::OVERWRITE)) {
            foreach (['key.pem', 'csr.pem', 'cert.pem', 'bundle.crt', 'verify.txt', 'fullchain.pem', 'postfix.pem'] as $f) {
                $zip->addFile("$domainDir/$f", $f);
            }
            $zusatzfile = $caDir.'/'.$ROOTCA;
            $zip->addFile($zusatzfile, $ROOTCA);
            $zip->close();
        }

        echo "✔ SAN-Zertifikat für Domains erstellt: <strong>" . implode(", ", $domains) . "</strong>.<br>";
        echo "<a href='index.php'>Zurück</a>";
        HTML_FOOT();
        exit;

    } elseif ($_POST['mode'] === 'single') {
        // Einzelzertifikate-Modus: Für jede Domain eigenes Zertifikat
        $domains = array_map('trim', explode(',', $_POST['domains']));
        $domains = validateDomains($domains);

        if (count($domains) < 1) {
            echo "❌ Keine gültigen Domains angegeben.";
            HTML_FOOT();
            exit;
        }

        foreach ($domains as $domain) {
            $domainDir = "$certsDir/$domain";
            if (!is_dir($domainDir)) mkdir($domainDir, 0775, true);

            $keyFile = "$domainDir/key.pem";
            $csrFile = "$domainDir/csr.pem";
            $certFile = "$domainDir/cert.pem";
            $bundleFile = "$domainDir/bundle.crt";
            $verifyFile = "$domainDir/verify.txt";
            $confFile = "$domainDir/$domain.cnf";
            $zipFile = "$domainDir/$domain.zip";
            $fullchainFile = "$domainDir/fullchain.pem";
            $postfixPem = "$domainDir/postfix.pem";

            if (!file_exists($keyFile)) {
                exec("openssl genrsa -out $keyFile 4096");
            }

            $conf = createOpenSSLConfigForDomain($opensslCnf, $domain);

            copy($conf, $confFile);
            exec("openssl req -new -key $keyFile -out $csrFile -config $conf -reqexts v3_req", $out, $ret);
            if ($ret !== 0) {
                echo "Fehler beim Erstellen der CSR für Domain: $domain<br>";
                continue;
            }

            //exec("openssl ca -batch -config $confFile -in $csrFile -out $certFile -extensions v3_req -passin pass:$caPass", $out, $ret);
            exec("openssl ca -batch -config $confFile -in $csrFile -out $certFile -extensions v3_req -passin pass:$caPass 2>&1", $out, $ret);
            if ($ret !== 0) {
                echo "Fehler beim Signieren des Zertifikats für Domain: $domain<br>";
                echo "<pre>Fehler beim Signieren:\n" . htmlspecialchars(implode("\n", $out)) . "</pre>";
                continue;
            }

            file_put_contents($bundleFile, file_get_contents($certFile) . file_get_contents("$caDir/rootCA.pem"));

            exec("openssl x509 -in $certFile -noout -text", $verifyOut);
            file_put_contents($verifyFile, implode(PHP_EOL, $verifyOut));

            // Mailserver sollen das lieben
            file_put_contents($fullchainFile, file_get_contents($certFile) . file_get_contents("$caDir/rootCA.pem"));
            file_put_contents($postfixPem, file_get_contents($keyFile) . file_get_contents($certFile) . file_get_contents("$caDir/rootCA.pem"));

            $zip = new ZipArchive();
            if ($zip->open($zipFile, ZipArchive::CREATE | ZipArchive::OVERWRITE)) {
                foreach (['key.pem', 'csr.pem', 'cert.pem', 'bundle.crt', 'verify.txt', 'fullchain.pem', 'postfix.pem'] as $f) {
                    $zip->addFile("$domainDir/$f", $f);
                }
                $zusatzfile = $caDir.'/'.$ROOTCA;
                $zip->addFile($zusatzfile, $ROOTCA);
                $zip->close();
            }

            echo "✔ Zertifikat für <strong>$domain</strong> erstellt.<br>";
        }

        echo "<br><a href='index.php'>Zurück</a>";
        HTML_FOOT();
        exit;
    }
}

echo "<p>Keine Domains angegeben.</p>";
HTML_FOOT();