#!/bin/sh
#
# Usage: deletevpnprofile.sh [Number] [email]
#

export EASYRSA=/etc/openvpn/easy-rsa

revokeclient () {
	# revoke client by name
	cd $EASYRSA
	easyrsa --vars=/etc/easy-rsa/vars --batch revoke $1
	EASYRSA_CRL_DAYS=3650 easyrsa --vars=/etc/easy-rsa/vars gen-crl
	rm -f pki/reqs/$1.req
	rm -f pki/private/$1.key
	rm -f pki/issued/$1.crt
	rm -f /etc/openvpn/crl.pem
	cp $EASYRSA/pki/crl.pem /etc/openvpn/crl.pem
	# CRL is read with each client connection, when OpenVPN is dropped to nobody
	chown nobody:nogroup /etc/openvpn/crl.pem
	echo
	echo "Revoked certificate for client $1."
	return 0
}

if [ -d /etc/openvpn/easy-rsa ]; then
	if [ "$1" != "" ]; then
		rm -f /etc/openvpn/clientprofiles/$1.ovpn
		echo "Revoked profile $1."
		if [ "$2" != "" ]; then
			revokeclient $2
		else
			echo "No email given - could not delete certificate!"
			exit -2
		fi
		exit 0
	else
		echo "No profile number given!"
		exit -2
	fi
else
	echo "OpenVPN not configured!"
	exit -1
fi
