--- CA.org	2016-03-16 23:05:13.000000000 +0900
+++ CA	2016-03-21 20:48:32.000000000 +0900
@@ -55,13 +55,14 @@
 }
 
 usage() {
- echo "usage: $0 -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify" >&2
+ echo "usage: $0 -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify|-newwebclient|-revoke" >&2
 }
 
 if [ -z "$OPENSSL" ]; then OPENSSL=openssl; fi
 
-if [ -z "$DAYS" ] ; then DAYS="-days 365" ; fi	# 1 year
-CADAYS="-days 1095"	# 3 years
+if [ -z "$DAYS" ] ; then DAYS="-days 730" ; fi
+if [ -z "$CERTTOP" ] ; then CERTTOP=/etc/pki/webclient ; fi
+CADAYS="-days 3650"
 REQ="$OPENSSL req $SSLEAY_CONFIG"
 CA="$OPENSSL ca $SSLEAY_CONFIG"
 VERIFY="$OPENSSL verify"
@@ -75,6 +76,11 @@
 
 RET=0
 
+if [ -z "$1" ]; then
+    usage
+    exit 0
+fi
+
 while [ "$1" != "" ] ; do
 case $1 in
 -\?|-h|-help)
@@ -99,6 +105,103 @@
     RET=$?
     echo "Request (and private key) is in newreq.pem"
     ;;
+-newwebclient)
+    : ${SSLEAY_CONFIG:="-config /etc/pki/tls/openssl-webclient.cnf"}
+    shift
+    CLIENTID=$1
+    shift
+    CNAME="$1"
+    shift
+    if [ -z "$CLIENTID" ]; then
+        cat <<EOM
+Creates a set of webclient keys.
+usage: $(basename $0) -newwebclient CLIENTID
+EOM
+        exit 0
+    fi
+    : ${CNAME:="My Certificate"}
+    if [ ! -d $CERTTOP ]; then
+        # create the directory hierarchy
+        mkdir -p ${CERTTOP}
+        mkdir -p ${CERTTOP}/certs
+        mkdir -p ${CERTTOP}/newcerts
+        mkdir -p ${CERTTOP}/private
+    fi
+    if [ -f ${CERTTOP}/certs/${CLIENTID}.pem ]; then
+        cat <<EOM
+Client certificate ${CLIENTID}.pem already exists!
+Please run \`$(basename $0) -revoke $CLIENTID' and then try again
+EOM
+        exit 1
+    fi
+    cd ${CERTTOP}/newcerts
+    # create a certificate request with a private key
+    $REQ $SSLEAY_CONFIG -new -nodes -keyout newkey.key -out newreq.pem $DAYS
+    if [ $? -ne 0 ]; then
+        echo "Request (and private key) generation failed"
+        exit 1
+    fi
+    echo "Request (and private key) is in newkey.key"
+    # sign the certificate request
+    $OPENSSL ca $SSLEAY_CONFIG -out newcert.pem $DAYS -infiles newreq.pem
+    if [ $? -ne 0 ]; then
+        echo "Signing of certificate failed"
+        exit 1
+    fi
+    echo "Signed certificate is in newcert.pem"
+    # create a PKCS#12 file from the signed cert and key
+    [ -f ${CERTTOP}/private/exportpw ] && PASSOPT="-passout file:${CERTTOP}/private/exportpw"
+    $PKCS12 -in newcert.pem -inkey newkey.key -certfile ${CATOP}/$CACERT \
+     -out newcert.p12 $PASSOPT -export -name "$CNAME"
+    RET=$?
+    if [ $RET -ne 0 ]; then
+        echo "Creation of PKCS#12 failed"
+        exit 1
+    fi
+    # tidy up the keys
+    mv -f newcert.p12 ../private/${CLIENTID}.p12
+    mv -f newkey.key  ../private/${CLIENTID}.key
+    mv -f newcert.pem ../certs/${CLIENTID}.pem
+    rm -f newreq.pem
+    cat <<EOM
+Keys generated successfully:
+${CERTTOP}/certs/${CLIENTID}.pem     Client public key(signed)
+${CERTTOP}/private/${CLIENTID}.key   Client private key
+${CERTTOP}/private/${CLIENTID}.p12   Client PFX(above two combined)
+${CATOP}/cacert.crt              Private-CA public key
+EOM
+    ;;
+-revoke)
+    shift
+    CLIENTID=$1
+    shift
+    if [ -z "$CLIENTID" ]; then
+        cat <<EOM
+Revoke and delete a set of keys.
+usage: $(basename $0) -revoke CLIENTID
+EOM
+        exit 0
+    fi
+    if [ ! -f ${CERTTOP}/certs/${CLIENTID}.pem ]; then
+        echo "No such file ${CLIENTID}.pem"
+        exit 1
+    fi
+    # revoke the certificate
+    $CA -revoke ${CERTTOP}/certs/${CLIENTID}.pem &&
+     $CA -gencrl -out ${CATOP}/crl/crl.pem
+    RET=$?
+    if [ $RET -ne 0 ]; then
+        echo "Failed to revoke ${CLIENTID}.pem"
+        exit 1
+    fi
+    # remove the revoked key set
+    rm -i ${CERTTOP}/certs/${CLIENTID}.pem
+    rm -i ${CERTTOP}/private/${CLIENTID}.key
+    rm -i ${CERTTOP}/private/${CLIENTID}.p12
+    echo "CLIENTID ${CLIENTID} successfully revoked"
+    # notify httpd of the revocation
+    #cd ${CERTTOP} && make
+    ;;
 -newca)
     # if explicitly asked for or it doesn't exist then setup the directory
     # structure that Eric likes to manage things
