module Porkadot::Assets::CertsUtils

def _ca_cert(path, name, root_key)
  root_ca = unsigned_cert(name, root_key, nil, 2 * 365 * 24 * 60 * 60)
  ef = OpenSSL::X509::ExtensionFactory.new
  ef.subject_certificate = root_ca
  ef.issuer_certificate = root_ca
  root_ca.add_extension(ef.create_extension("basicConstraints","CA:TRUE",true))
  root_ca.add_extension(ef.create_extension("keyUsage","keyCertSign, cRLSign", true))
  root_ca.add_extension(ef.create_extension("subjectKeyIdentifier","hash",false))
  root_ca.add_extension(ef.create_extension("authorityKeyIdentifier","keyid:always",false))
  root_ca.sign(root_key, OpenSSL::Digest::SHA256.new)
  File.open path, 'wb' do |f|
    f.write root_ca.to_pem
  end
  return root_ca
end