#!/bin/bash
set -e

# this creates a trust store based on a single specific cert chain
# you will need to define trust store password
# use e.g. kafbat's truststore_password from vault

[[ -z $1 ]] && echo "usage: ${0##*/} <certificate chain file>" && exit 1
chainfile=$1

# dirty hack - assuming _chain.crt extension
alias=${chainfile%_chain.crt}
dest=$alias.jks

[[ ! -f $chainfile ]] && echo cannot find $chainfile && exit 1

[[ -f $dest ]] && echo $dest already exists, delete it first && exit 1

echo writing to $dest
keytool -importcert -keystore $dest \
	-noprompt -trustcacerts \
	-file $chainfile -alias ${chainfile%_chain.crt}

echo all done