generate-cert.sh

#!/bin/bash
#
# Generate a self-signed TLS certificate for the LLM proxy.
#
# The certificate includes Subject Alternative Names (SANs) for:
#   - localhost
#   - Common private network IPs (192.168.x.x, 10.x.x.x)
#   - The machine's current local IP address
#
# Usage:
#   ./generate-cert.sh [days]
#
# Arguments:
#   days  - Certificate validity in days (default: 3650 = ~10 years)
#

set -euo pipefail

DAYS="${1:-3650}"
CERT_DIR="$(dirname "$0")/certs"
mkdir -p "$CERT_DIR"

# Detect local IP
LOCAL_IP=""
if command -v ip &>/dev/null; then
  LOCAL_IP=$(ip route get 1.1.1.1 2>/dev/null | grep -oP 'src \K[\d.]+' || true)
fi
if [ -z "$LOCAL_IP" ] && command -v ifconfig &>/dev/null; then
  LOCAL_IP=$(ifconfig | grep 'inet ' | grep -v '127.0.0.1' | head -1 | awk '{print $2}')
fi
if [ -z "$LOCAL_IP" ]; then
  LOCAL_IP="192.168.1.100"
  echo "  Warning: Could not detect local IP, using $LOCAL_IP as fallback"
fi

echo ""
echo "  Generating self-signed certificate..."
echo "  Local IP detected: $LOCAL_IP"
echo "  Valid for: $DAYS days"
echo ""

# Build SAN list
SAN="[SAN]
subjectAltName=DNS:localhost,IP:127.0.0.1,IP:$LOCAL_IP"

# Generate key + cert in one command
openssl req -x509 \
  -newkey rsa:2048 \
  -keyout "$CERT_DIR/key.pem" \
  -out "$CERT_DIR/cert.pem" \
  -days "$DAYS" \
  -nodes \
  -subj "/CN=LLM Proxy/O=Agile-V Studio/OU=Local Development" \
  -extensions SAN \
  -config <(cat /etc/ssl/openssl.cnf 2>/dev/null || echo "[req]
distinguished_name = req_distinguished_name
[req_distinguished_name]"; echo ""; echo "$SAN") \
  2>/dev/null

# Also create a combined PEM for tools that want it
cat "$CERT_DIR/cert.pem" "$CERT_DIR/key.pem" > "$CERT_DIR/combined.pem"

echo "  Certificates generated:"
echo "    $CERT_DIR/cert.pem  (certificate)"
echo "    $CERT_DIR/key.pem   (private key)"
echo "    $CERT_DIR/combined.pem (both)"
echo ""
echo "  Fingerprint:"
openssl x509 -in "$CERT_DIR/cert.pem" -fingerprint -sha256 -noout 2>/dev/null | sed 's/^/    /'
echo ""
echo "  IMPORTANT: Since this is a self-signed cert, you must trust it"
echo "  in your browser. Open https://$LOCAL_IP:8443 in your browser,"
echo "  accept the security warning, and the proxy will work."
echo ""

# macOS: offer to add to system keychain
if [[ "$(uname)" == "Darwin" ]]; then
  echo "  On macOS, you can also trust it system-wide:"
  echo "    sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain $CERT_DIR/cert.pem"
  echo ""
fi