#! /bin/bash

##
#  generate the proper certificate and CA certificate formats and 
#  upload the SSL certificates to a Brother MFC-9340CDW's web
#  management interface.
#
#  ## generation ##
#  Required input is private key as a .pem and 
#  the full certificate chain as a .pem
#
#  Default values are privkey.pem (-k) and fullchain.pem (-f)
#
#  You can also specify the path (-p) to the certificates
#  and where your .p12 file will be written. 
#  Default path is the local directory
#
#  You can also over ride the file name of the .p12 file.
#  Default file name is derived from the CN= record of the cert.
#
#  ## upload ##
#  Required input is the printer address (-a) either FQDN or IP address
#  and the login password (-l [lower case 'ell'] ).  
# 
#  Written by Jason Schiller for the Brother MFC-9340 printer.
#  Script is made freely available provided you follow these simple 
#  rules:
#  1. don't critize how ugly the shell script is... I'm not a coder.
#  2. freely give back any updates or modifications.
#  3. provide approprate credit.
##

# Default values
FULLCHAIN="fullchain.pem" 
# file name of the full chain of SSL certs.
# value can be passed as a -f arguement,
# or can be hard coded here as a default.

PRIVKEY="privkey.pem"
# file name of the private key.
# value can be passed as a -k arguement,
# or can be hard coded here as a default. 

PRINTER=""
###################
# address of the printer, IP address or FQDN.
# value can be passed as a -a arguement, 
# or value can be hard coded here as a default.

PASS="initpass"
######################
# Password to the Admin login to the printer web
# management interface.  Value can be set here,
# or value can be passed as a -l [lowercase 'ell']
# arguement.  initpass is the default admin password.

# optional values
CERT_PATH=""
# full or relative path to where all certificates
# are stored.  This is also the place where newly
# generated certificates will be saved.

P12=""
# optional value to force the file name of the p12 file.
# Do NOT inclue the file extension.  Default value is 
# extracted from the certificate CN.  This can be over
# written by adding a value here, or using -o to specify
# a preferred out put file name for the .p12 certificate

LPWD="$HOME/bin/"
# path to local cache; for storing session cookie and 
# current printer certificate (which may be invalid
# or self signed, and thus prevent connection)

##
# Reference values
# For URLs you should't have to change them as long as
# Brother doesn't change the interface
LOGON_PATH="general/status.html"

CERT_CHECK="net/security/certificate/certificate.html"
CA_CERT_CHECK="net/security/certificate/ca.html"

CERT_DEL="net/security/certificate/delete.html"
CA_CERT_DEL="net/security/certificate/delete_ca.html"
CERT_UPLOAD_PATH="net/security/certificate/import.html"
CA_CERT_UPLOAD_PATH="net/security/certificate/import_ca.html?pageid=1075"
CERT_LOAD="net/net/certificate/http.html"

PWD=""
# SSL certificate password is blank

shopt -s expand_aliases

alias grep="/bin/grep"
alias egrep="/bin/egrep"
alias wc="/usr/bin/wc"
alias openssl="/usr/bin/openssl"
alias curl="/bin/curl"

while [ -n "$1" ]
do
case "$1" in
-h|--help|-help) HELP=true  ;;
-f|--full|--fullchain) FULLCHAIN=$2;;
-k|--key|--private_key|--privatekey|--privkey|--priv_key) PRIVKEY=$2;;
-p|--path|--certpath|--cert_path) CERT_PATH=$2;;
-o|--output|--p12|--p12_name) OVERRIDE=true; P12=$2;;
-v|--verbose) VERBOSE=true;;
-a|--adress|--ip|--IP|--ip_address|--IP_address|--fqdn|__FQDN) PRINTER=$2;;
-l|--login|--login_password|--login_pass|--login-pass| \
    --login-password|--pwd|--pass|--passwd) PASS=$2;;
-g|--generate_only|--generate-only|--gen|--gen_only|--gen-only) GEN_ONLY=true;;
-u|--upload_only|--upload-only|--upload|--up|--up_only|--up-only) UP_ONLY=true;;
esac
shift
done

if [ $HELP ];then
 echo "Usage:"
 echo "make_ssl_bro_mfc9340.sh [-f <fullchain>] [-k <privkey>] [-p <path>]"
 echo "                        [-o <out.pk12>] [ -a <printer_fqdn>]"
 echo "                        [ -l <login_pass>] [-g|-u] [-v]"
 echo
 echo "e.g. make_ssl_bro_mfc9340.sh -f fullchain.pem -k privkey.pem \\"
 echo"      -p /etc/letsencrypt/live/domain.com -o domain.pem \\"
 echo"      -a 192.168.100.100 -l initpass "
 exit 1
fi

if [ $GEN_ONLY ] && [ $UP_ONLY ];then
    GEN_ONLY=fales
    UP_ONLY=false
    if [ $VERBOSE ];then 
        echo "mutually exclusive flags; generating and uploading"
    fi
fi


hash grep 2>/dev/null || { echo >&2 "Can not find grep"; exit 1; }
if ! hash grep 2>/dev/null;then
    ERROR="${ERROR} Can not find grep\n"
    HAS_ERR=true
fi

hash egrep 2>/dev/null || { echo >&2 "Can not find egrep"; exit 1; }
if ! hash grep 2>/dev/null;then
    ERROR="${ERROR} Can not find egrep\n"
    HAS_ERR=true
fi

hash wc 2>/dev/null || { echo >&2 "Can not find wc"; exit 1; }
if ! hash grep 2>/dev/null;then
    ERROR="${ERROR} Can not find wc\n"
    HAS_ERR=true
fi

hash openssl 2>/dev/null || { echo >&2 "Can not find openssl"; exit 1; }
if ! hash grep 2>/dev/null;then
    ERROR="${ERROR} Can not find openssl\n"
    HAS_ERR=true
fi

hash curl 2>/dev/null || { echo >&2 "Can not find openssl"; exit 1; }
if ! hash grep 2>/dev/null;then
    ERROR="${ERROR} Can not find openssl\n"
    HAS_ERR=true
fi

if [ $HAS_ERR ]; then
    echo -e "\nERROR: $ERROR"
fi

##
# check that open ssl is configured to support unsecure TLS
#

if [ ! -f ~/.openssl_allow_tls1.0.cnf ];then
echo "openssl_conf = openssl_init

[openssl_init]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
CipherString = DEFAULT@SECLEVEL=1" >> ~/.openssl_allow_tls1.0.cnf
fi

export OPENSSL_CONF=~/.openssl_allow_tls1.0.cnf



##
# Generate proper SSL certificate formats
#
# 1. check that we have a full chain certificate in .PEM format
# 2. check that we have a private key in .PEM format
# 3. Get the names of each certificate from the full chain
# 4. extract each seperate certificate and save it
# 5. Generate the .p12 certificate from the host certificate
#    which was extracted from the full chain certificate, and
#    from the full chain certificate.

if [ ! $UP_ONLY ];then
    # if cert path is specified, make sure it has a trailing /

    if [ ! -z "$CERT_PATH" ] && [[ ! $CERT_PATH =~ ^.*/$ ]];then
        CERT_PATH="${CERT_PATH}/"
	if [ $VERBOSE ];then
	    echo "added trailing slash to cert path"
	fi
    fi

    if [ ! -z "$LPWD" ] && [[ ! $LPWD =~ ^.*/$ ]];then
        CERT_PATH="${LPWD}/"
	if [ $VERBOSE ];then
	    echo "added trailing slash to local cache path"
	fi
    fi

    CNAMES=()

    if [ ! -f "${CERT_PATH}${FULLCHAIN}" ] ;then
       ERROR="${ERROR} full cert chain file: ${CERT_PATH}${FULLCHAIN} does not exist.\n"
       HAS_ERR=true
    fi 

    if [ ! -f ${CERT_PATH}${PRIVKEY} ];then
       ERROR="${ERROR} private key file: ${CERT_PATH}${PRIVKEY} does not exist.\n"
       HAS_ERR=true
    fi 

    if [ $HAS_ERR ];then
        echo -e "\nERROR: ${ERROR}"
        exit 128
    fi

    # strip out certificates names 
    echo "Retrieving Certificate names from ${CERT_PATH}${FULLCHAIN}."
    R="$(openssl crl2pkcs7 -nocrl -certfile ${CERT_PATH}${FULLCHAIN} | openssl pkcs7 -print_certs | grep subject | sed -e 's/.*subject=.*CN = //g'|tr -d " "|tr "\n" " " 2>&1)"
    if [ $? -ne 0 ];then 
        echo -e "\nERROR: ${ERROR} openssl error while retreiving certificate names:\n$R\n"
        exit 128
    fi  

    if [ -z "$R"  ];then
        ERROR="${ERROR} openssl found no certificates in the full chain certfile ${CERT_PATH}${FULLCHAIN}.\n"
        echo -e "\nERROR: ${ERROR}" 
        exit 128
    fi


    for CNAME in $R;do
       CNAMES+=("${CNAME}.pem")
       if [ $VERBOSE ];then
           echo "adding ${CNAME}.pem to certificate list."
       fi
    done

    if [ $? -ne 0 ];then 
        ERROR="${ERROR} error making cert name list: $?"
        echo -e "\nERROR: ${ERROR}"
        exit 128
    fi


    if (( "${#CNAMES[@]}" < "2" ));then
        ERROR="${ERROR} fullchain file: ${CERT_PATH}${FULLCHAIN} has less than 2 certificates.\n"
        echo -e "\nERROR: ${ERROR}"${CERT_PATH}${FULLCHAIN}
        exit 128
    fi

    # write each of the certificates to the cert file path.
    # files names are extracted from the certificate CN

    C=0
    POS="end"
    echo "extracting each certificate from the ${CERT_PATH}${FULLCHAIN}."
    while read line; do
        if [ -n "$(echo $line | egrep "\-BEGIN CERTIFICATE\-")" ] ; then
            echo "Processing ${CNAMES[$C]}"
	    if [ "$POS" == "end" ];then
	        echo $line > "$(echo ${CERT_PATH}${CNAMES[$C]})"
	        POS="mid"
            else
	        ERROR="${ERROR} Certificate ${CNAMES[( $C-1 )]} is incomplete"
	        echo -e "\nERROR: ${ERROR}"
                exit 65 
	    fi
        elif [ -n "$(echo $line | egrep "\-END CERTIFICATE\-")" ] ; then
	    if [ "$POS" == "mid" ];then
	        echo $line >> "$(echo ${CERT_PATH}${CNAMES[$C]})"
	        C=$C+1
	        POS="end"
	    else
	        ERROR="${ERROR} Certificate ${CNAMES[$C]} is incomplete"
                echo -e "\nERROR: ${ERROR}"
                exit 65 
	    fi
        elif [ ! -z "$line" ] ; then
	    if [ "$POS" == "mid" ]; then
	        echo $line >> "$(echo ${CERT_PATH}${CNAMES[$C]})"
            else
                ERROR="${ERROR} Certificate ${CNAMES[$C]} is incomplete"
                echo -e "\nERROR: ${ERROR}"
                exit 65
	    fi
        fi
    done < ${CERT_PATH}${FULLCHAIN}

    if [ ! $OVERRIDE ] || [ -z "$p12" ];then
	P12="$(echo "${CNAMES[0]}"| rev | cut -d"." -f2- | rev).p12"
    fi


    CERT="${CNAMES[0]}"
    CERT_NAME="$(echo "${CNAMES[0]}" | rev  | cut -d"." -f2- | rev)"

    # get the CA from the certificate
    echo "extracting CA Certificate name from ${CERT_PATH}${CERT}"

    CA_NAME=$(openssl crl2pkcs7 -nocrl -certfile ${CERT_PATH}${CERT} | openssl pkcs7 -print_certs | grep issuer | sed -e 's/.*, O = //g'|sed -e 's/, CN = //g')


    # generate P12 file for uploading to printer

    echo "Generating certificate ${CERT_PATH}${P12}."

    CMD='openssl pkcs12 -export -in '${CERT_PATH}${CERT}' -inkey '${CERT_PATH}${PRIVKEY}' -out '${CERT_PATH}${P12}' -name "'${CERT_NAME}'" -CAfile '${CERT_PATH}${FULLCHAIN}' -caname "'${CA_NAME}'" -passin pass:"" -passout pass:""'

    if [ $VERBOSE ];then
         echo "$CMD"
    fi

    ERR="$(eval $CMD 2>&1)"

    if [ $? -ne 0 ];then
        echo -e "\nERROR: ${ERROR} openssl error while making ${CERT_PATH}${P12}:\n$ERR\n"
        exit 128
    fi
fi
echo

##
# UPLOAD certificate to printer Web interface.
# 
# 1. cache the current CA Certificate the printer is using.
#    This will force trusting this CA Certification in case it is expired,
#    self signed, or belongs to a CA which is no longer trusted.
#
# 2. login and get cookie
#
# 3. Remove old Certificate and key
#    Network > Security > Certificate > Delete
#
# 4. Import new certificate and key (.p12)
#    Network > Security > Certificate Import Certificate and Private Key
#              > ${DOMAIN.COM}.p12
#
# 5. Remove old CA Certs
#    Network > Security > CA Certificate > Delete
#
# 6. Import CA Cert and Cert Chain
#    Network > Security > CA Certificate
#              > a ${CERT_NAME}.pem for each certificate in fullchain.pem
#              (these are named based on the CN of the cert)
#
# 7. Apply new certificate
#    Network > Network > Protocol > HTTP Server Settings > Slect the Certificte
#              > ${domain.com}
#   note: you must have the correct serial number for the certificate
#         when posting by hand.
#

if [ ! $GEN_ONLY ];then
    ### 1. get CA_cert in case it is a self signed untrusted cert.

    echo "getting ${PRINTER}'s current certificate"
    TMPCRT=$(echo quit | openssl s_client -showcerts -servername ${PRINTER} -connect ${PRINTER}:443 | sed -n '/BEGIN.*-/,/END.*-/p')

    if [ $? -ne 0 ];then
        echo "CAUTON: could not cache ${PRINTER}'s current certificate."
	echo "This could be a problem if the certificate is not trusted."
    else
        echo "Writing temporary certificate"
	POS="no"
	while read -r line; do
	   if [ -n "$(echo "$line" | egrep "\-BEGIN CERTIFICATE\-")" ];then
	       if [ "$POS" == "no" ];then
		   echo "-----BEGIN CERTIFICATE-----" >  "${LPWD}"temp.pem    
                   echo "$line" > "${LPWD}"temp.pem
                   POS="mid"
		   C=1
	       elif [ "$POS" = "end" ];then 
	               echo "$line" >> "${LPWD}"temp.pem
		       echo "-----END CERTIFICATE-----" >> "${LPWD}"temp.pem
                       POS="mid"
               else
	           ERROR="${ERROR} temporary certificate is incomplete"
		   echo -e "\nERROR: ${ERROR}" 
                   exit 1 
	       fi
           elif [ -n "$(echo $line | egrep "\-END CERTIFICATE\-")" ] ; then
               if [ "$POS" == "mid" ];then
                   echo "$line" >> "${LPWD}"temp.pem
                   POS="end"
               else
                   ERROR="${ERROR} Temporary certificate is incomplete"
                   echo -e "\nERROR: ${ERROR}" 
                   exit 1
               fi
           elif [ ! -z "$line" ] ; then
               if [ "$POS" == "mid" ]; then
                   echo "$line" >> "${LPWD}"temp.pem
	       fi
	   elif [ "$POS" = "no" ] || [ "$POS" = "end" ];then
               :
           else
             ERROR="${ERROR} Temporary certificate is incomplete"
             echo -e "\nERROR: ${ERROR}" 
             exit 1
           fi
        done <<< "$TMPCRT"
    fi

    ### 2. login in and get cookie
    #ERR="$(eval $CMD 2>&1)"
    R=$(curl -s -S -c "${LPWD}"cookie.txt --cacert "${LPWD}"temp.pem --data 'loginurl=/'"$LOGON_PATH"'&Nfa='$PASS -k https://$PRINTER/$LOGON_PATH |grep "logout" | wc -l)

    if [ $VERBOSE ];then
        echo $R
    fi
    if [ "$R"  -ne "0" ]; then
        echo "*** photon Login sucessful ***"
        echo "    cookie aquired            "
	    cat "${LPWD}"cookie.txt | grep -i authcookie
        else
	    ERR=$(curl -s -S -c "${LPWD}"cookie.txt --cacert "${LPWD}"temp.pem --data 'loginurl=/'"$LOGON_PATH"'&Nfa='$PASS -k https://$PRINTER/$LOGON_PATH 2>&1)
	    ERROR="${ERROR} !!! login failed\ncurl error: $ERR\n"
            echo -e "ERROR: $ERROR" 
	    exit 126
        fi
    fi

    ### 3. Remove old Certificate and key
    R=$(curl -s -S -b ~/bin/cookie.txt --cacert ~/bin/temp.pem  -L -k https://$PRINTER/$CERT_CHECK)
    if [ $VERBOSE ]; then
        echo $R
    fi

    IDXS=$(echo $R | tr ' ' '\n' | egrep "delete.html" | sed -nE 's/.*idx=([0-9]{1,3})">.*/\1/pg'| sed -e 's/\s+$//g')
    # IDXS=$(echo $R | tr ' ' '\n' | egrep "delete.html" | sed -nE 's/.*idx=([0-9][0-9])">.*/\1/pg'| sed -e 's/\s+$//g') 
    if [ $VERBOSE ]; then
        echo $R
    fi

    NUMDEL=$(echo $IDXS | tr ' ' '\n' | egrep "[0-9]{1,3}" | wc -l)
    # echo "IDXS: $IDXS"
    # echo "NUMDEL: $NUMDEL"
    
    if [ "$NUMDEL" -eq 0 ];then
        echo "No Certificate currently installed"
    else
    C=6
        while (( $NUMDEL > 0 )); do
            C=$(($C-1))
	        if [ $VERBOSE ]; then
                    echo $R
                fi

            # echo "Count = $C"
            if (( $C <= 0 ));then
                echo "to many tries deleting Certs and Keys"
                exit 255
            fi

            echo "found $NUMDEL deletes:"
  	    for IDX in $(echo $IDXS);do
                echo "delete.html?idx=$IDX"
	        R=$(curl -k -s -zS -b ~/bin/cookie.txt --cacert ~/bin/temp.pem --request POST https://$PRINTER/$CERT_DEL -H "Content-Type:multipart/form-data" -F pageid="1063" -F N10b="" -F N11d="" -F hidden_certificate_process_control="1" -F hidden_certificate_idx=$IDX)
            done 

            IDXS=$(curl -s -S -b ~/bin/cookie.txt --cacert ${LPWD}temp.pem  -L -k https://$PRINTER/$CERT_CHECK | tr ' ' '\n' | egrep "delete.html" | sed -nE 's/.*idx=([0-9][0-9])">.*/\1/pg')
	    if [ $VERBOSE ]; then
                echo $IDXS
            fi

            NUMDEL=$(echo $IDXS | tr ' ' '\n' | egrep "[0-9][0-9]" | wc -l)
            if [ $VERBOSE ]; then
                echo $IDXS
                echo "found $NUMDEL CA certs to delete from router"
            fi
        done
        ###
        echo "waiting for old certs to be removed"
        sleep 1
        echo "Zzz..."
        sleep 1
    fi

    ### 4. updating cert with private key [1070]

    echo "Uploading $P12 to https://$PRINTER/$CERT_UPLOAD_PATH"
    R=$(curl -k -s -zS -b ~/bin/cookie.txt --cacert ~/bin/temp.pem  --request POST https://$PRINTER/net/security/certificate/import.html?pageid-1070 -H 'Expect:' -H "Content-Type:multipart/form-data" -F pageid="1070" -F N10b="" -F N119="" -F hidden_certificate_process_control="1" -F N12=@${P12} -F N13="" -F hidden_cert_import_password="")

    if [ $VERBOSE ];then echo $R ;fi

    if (( `echo  $R | grep "cert_wait_countdown_post" | wc -l` != 0 )); then
        echo
        echo  "**** waiting for ${PRINTER} to process $P12 certificate ****"
	sleep 1
	for (( S=1; S<3; S++ ));do
	    echo -ne "Zzz"
	    sleep 2
	    for (( s=1; s<4; s++ ));do
	        echo -ne "."
	        sleep 1
            done
        done

    elif  (( `echo -e $R | egrep 'Specify.*the.*File' | wc -l` != 0 ));then
        echo "!!! File missing !!!"
        ls -al ${P12}
        # echo -e $R

    elif (( `echo -e $R | egrep 'There.*is.*not.*enough.*space' | wc -l` != 0 ))
        then 
        echo "!!! Not Enough space! Delete CERTS !!!"
        # echo -e $R

    elif (( `echo -e $R | egrep -i 'PKCS.*too.*large' | wc -l` != 0 ))
        then 
        echo "!!! The size of PKCS#12 file is too large !!!"
        ls -al ${P12}
        # echo -e $R
    elif (( `echo -e $R | egrep -i 'file.*cannot.*be.*found.*' | wc -l` != 0 ))
        then 
        echo "!!! File ${P12} can not be found or is not recognizedas a valid PKCS#12 file"
        ls -al $PRIVKEY
    else 
        ERROR="${ERROR} Certificate failed to upload\n"
	echo -e "ERROR: ${ERROR}"
	exit 128
    fi

    ### 4.B. confirming certificate upload
    echo "confirming cert upload"
    RELOAD_IDX=$(curl -s -S -b ${LPWD}/cookie.txt --cacert ${LPWD}temp.pem  -L -k https://$PRINTER/$CERT_CHECK | tr ' ' '\n' | egrep "delete.html" | sed -nE 's/.*idx=([0-9][0-9])">.*/\1/pg')
    echo "Cert ${P12} has IDX: [${RELOAD_IDX}]"

    ### 5. Remove old CA cert and certificate chain

    R=$(curl -s -S -b ${LPWD}/cookie.txt --cacert ~/bin/temp.pem  -L -k https://$PRINTER/$CA_CERT_CHECK)
    if [ $VERBOSE ];then
        echo $R | grep -i idx | more
	echo
    fi
        IDXS=$(echo $R | tr ' ' '\n' | egrep "delete_ca.html" | sed -nE 's/.*idx=([0-9]{1,3})">.*/\1/pg')
    NUMDEL=$(echo $IDXS | tr ' ' '\n' | egrep "[0-9]{1,3}" | wc -l)
    echo "NUMDEL is: ${NUMDEL}"
    if [ "$NUMDEL" -eq 0 ];then
        echo "No CA certificates currently installed"
    else
        C=6
        while (( $NUMDEL > 0 )); do
            C=$(($C-1))
            # echo "C = $C"
            if (( $C <= 0 ));then
                echo "to many tries deleting CA Certs and Cert chains"
            exit 255
            fi

            echo "found $NUMDEL CA cert deletes:"
            for IDX in $(echo $IDXS);do
	       echo "delete_ca.html?idx=$IDX"
	       R=$(curl -k -s -zS -b "${LPWD}"/cookie.txt --cacert "${LPWD}"temp.pem --request POST https://$PRINTER/$CA_CERT_DEL -H "Content-Type:multipart/form-data" -F pageid="1073" -F N10b="" -F N11e="" -F hidden_certificate_process_control="1" -F hidden_certificate_idx=$IDX)
	       if [ $VERBOSE ];then echo "$R";fi

               IDXS=$(curl -s -S -b u~/bin/cookie.txt --cacert ~/bin/temp.pem  -L -k https://$PRINTER/$CA_CERT_CHECK | tr ' ' '\n' | egrep "delete.html" | sed -nE 's/.*idx=([-5-9][0-9])">.*/\1/pg')
               NUMDEL=$(echo $IDXS | tr ' ' '\n' | egrep "[0-9][0-9]" | wc -l)
            done
        echo "waiting for old CA certs and cert chains to be removed"
        sleep 1
        echo "Zzz..."
        sleep 2
        done
    fi
    ### 6. updating CA cert [1075]
    for CNAME in "${CNAMES[@]}"; do
        echo -e "Uploading $CNAME to https://$PRINTER/$CA_CERT_UPLOAD_PATH"

        R=$(curl -k -s -zS -b "${LPWD}"cookie.txt --cacert "${LPWD}"temp.pem --request POST https://$PRINTER/$CA_CERT_UPLOAD_PATH -H "Content-Type:multipart/form-data" -F pageid="1075" -F N10b="" -F N11a="" -F hidden_certificate_process_control="1"  -F N12=@${CERT_PATH}$CNAME)
        if [ $VERBOSE ];then echo "$R";fi


 	if [ `echo -e $R | grep "cert_wait_countdown_post" | wc -l` -ne "0" ]; then
  	    echo "updating CA certificate: $CNAME"

        elif [ `echo -e $R | egrep 'Specify.*the.*File' | wc -l` -ne "0" ]
	    then 
	    echo "!!! File missing or not a proper PEM !!!"
	    ls -al ${CERT_PATH}$CNAME
	else 
	    if [ ! $VERBOSE ];then
	        echo "resuts:"
                echo -e $R
	    fi
        fi
    done
    echo "CA $CNAME cert done"
    echo
    #
    ### 7. updating  cert chain [1075]
    echo -e "Uploading $CA_PEM to https://$PRINTER/$CA_CERT_UPLOAD_PATH"


    R=$(curl -k -s -zS -b "${LPWD}cookie.txt --cacert "${LPWD}bin/temp.pem --request POST https://$PRINTER/$CA_CERT_UPLOAD_PATH   -H "Content-Type:multipart/form-data" -F pageid="1075" -F N10b="" -F N11a="" -F hidden_certificate_process_control="1"  -F N12=@$CA_PEM)
    if [ $VERBOSE ];then echo "$R";fi

    if [ `echo -e $R | grep "cert_wait_countdown_post" | wc -l` -ne "0" ]; then
        echo "updating CA certificate"
    elif  [ `echo -e $R | egrep 'Specify.*the.*File' | wc -l` -ne "0" ]
	then 
        echo "!!! File missing !!!"
        ls -al $CA_PEM
    else 
	if [ ! $VERBOSE ];then
            echo "resuts:"
	    echo -e $R
        fi
    fi
    echo "CA CA_PEM cert done"
    echo

    ### 8. Apply the cert
    echo "Need to reload the new ${P12} CERT cert IDXS=$RELOAD_IDX"
    R=$(curl -k -s -zS -b "${LPWD}"cookie.txt --cacert "${LPWD}"temp.pem --request POST https://$PRINTER/$CERT_LOAD -H "Content-Type:multipart/form-data" -F pageid="1009" -F N121="" -F N124="$RELOAD_IDX" -F N122="" -F N5c="1" -F N5d="1" -F N6a="1" -F N13d="1" -F http_page_mode="0" )

    if [ $VERBOSE ];then echo "$R";fi

    if [ `echo -e $R | egrep "Would.*you.*like.*to.*restart.*immediately" | wc -l` -ne "0" ]; then
        echo "To activate the new settings, the printer needs to restat"
        echo "restarting the printer"
	R=$(curl -k -s -zS -b "${LPWD}"cookie.txt --cacert "${LPWD}"temp.pem --request POST https://$PRINTER/$CERT_LOAD -H "Content-Type:multipart/form-data" -F pageid="1008" -F active_other_protocol="1" -F http_page_mode="4" )
        if [ `echo -e $R | egrep "Device.*will.*reset.*in.*60.*seconds" | wc -l` -ne "0" ]; then
	    echo "Device will restart in 60 seconds"
	    ping -i 10 -O -c 8 -w 80 ${PRINTER}
	    echo "done.  Printer should be back up."
        fi
    else
        echo $R|tr ">" "\n"|sed 's/$/>/g'
    fi
echo "Cleaning up cookie file"
rm ${LPWD}cookie.txt
exit 0