#!/usr/bin/env bash
set -euo pipefail
cd /tmp/lead-25730-r1/evidence-2/20261028T012100Z
umask 077
openssl req -x509 -newkey rsa:2048 -nodes -keyout root.key -out root.crt -days 2 -subj '/CN=Android CA proof 25730' -addext 'basicConstraints=critical,CA:TRUE' -addext 'keyUsage=critical,keyCertSign,cRLSign'
openssl req -newkey rsa:2048 -nodes -keyout leaf.key -out leaf.csr -subj '/CN=fs-13.tail131df4.ts.net'
cat > leaf.ext <<'EXT'
basicConstraints=critical,CA:FALSE
keyUsage=critical,digitalSignature,keyEncipherment
extendedKeyUsage=serverAuth
subjectAltName=DNS:fs-13.tail131df4.ts.net,IP:100.122.65.41
EXT
openssl x509 -req -in leaf.csr -CA root.crt -CAkey root.key -CAcreateserial -out leaf.crt -days 2 -extfile leaf.ext
openssl x509 -in root.crt -outform DER -out android-ca-proof.crt
openssl verify -CAfile root.crt leaf.crt