foxhunt/services/trading_agent_service/scripts/verify_tls.sh

#!/bin/bash
# Trading Agent Service TLS Verification Script
#
# This script verifies that the TLS implementation is correct

set -e

echo "========================================"
echo "Trading Agent Service TLS Verification"
echo "========================================"
echo ""

# Colors for output
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m' # No Color

# Check if certificate directory exists
echo "1. Checking certificate directory..."
CERT_DIR="/tmp/foxhunt/certs"

if [ -d "$CERT_DIR" ]; then
    echo -e "${GREEN}✓${NC} Certificate directory exists: $CERT_DIR"
else
    echo -e "${YELLOW}⚠${NC} Certificate directory not found: $CERT_DIR"
    echo "   Creating directory..."
    mkdir -p "$CERT_DIR"
    echo -e "${GREEN}✓${NC} Certificate directory created"
fi

echo ""

# Check for required certificates
echo "2. Checking for certificates..."

CERTS_MISSING=0

if [ -f "$CERT_DIR/server.crt" ]; then
    echo -e "${GREEN}✓${NC} Server certificate found"
else
    echo -e "${RED}✗${NC} Server certificate missing: $CERT_DIR/server.crt"
    CERTS_MISSING=1
fi

if [ -f "$CERT_DIR/server.key" ]; then
    echo -e "${GREEN}✓${NC} Server private key found"
else
    echo -e "${RED}✗${NC} Server private key missing: $CERT_DIR/server.key"
    CERTS_MISSING=1
fi

if [ -f "$CERT_DIR/ca.crt" ]; then
    echo -e "${GREEN}✓${NC} CA certificate found"
else
    echo -e "${YELLOW}⚠${NC} CA certificate missing: $CERT_DIR/ca.crt"
    echo "   (Required for mTLS only)"
fi

echo ""

# Verify certificate validity
if [ $CERTS_MISSING -eq 0 ]; then
    echo "3. Verifying certificate validity..."

    # Check server certificate
    if openssl x509 -in "$CERT_DIR/server.crt" -noout -text &>/dev/null; then
        echo -e "${GREEN}✓${NC} Server certificate is valid"

        # Check expiration
        EXPIRY=$(openssl x509 -in "$CERT_DIR/server.crt" -noout -enddate | cut -d= -f2)
        echo "   Expires: $EXPIRY"

        # Check subject
        SUBJECT=$(openssl x509 -in "$CERT_DIR/server.crt" -noout -subject | cut -d= -f2-)
        echo "   Subject: $SUBJECT"
    else
        echo -e "${RED}✗${NC} Server certificate is invalid or corrupted"
    fi

    echo ""

    # Check CA certificate if it exists
    if [ -f "$CERT_DIR/ca.crt" ]; then
        if openssl x509 -in "$CERT_DIR/ca.crt" -noout -text &>/dev/null; then
            echo -e "${GREEN}✓${NC} CA certificate is valid"

            # Verify chain
            if openssl verify -CAfile "$CERT_DIR/ca.crt" "$CERT_DIR/server.crt" &>/dev/null; then
                echo -e "${GREEN}✓${NC} Server certificate is signed by CA"
            else
                echo -e "${RED}✗${NC} Server certificate is NOT signed by CA"
            fi
        else
            echo -e "${RED}✗${NC} CA certificate is invalid or corrupted"
        fi
    fi
else
    echo "3. Certificate verification skipped (certificates missing)"
    echo ""
    echo -e "${YELLOW}⚠${NC} To generate test certificates, run:"
    echo ""
    echo "   # Generate CA"
    echo "   openssl genrsa -out $CERT_DIR/ca.key 4096"
    echo "   openssl req -new -x509 -days 365 -key $CERT_DIR/ca.key \\"
    echo "       -out $CERT_DIR/ca.crt \\"
    echo "       -subj \"/CN=Foxhunt Trading Agent CA\""
    echo ""
    echo "   # Generate server certificate"
    echo "   openssl genrsa -out $CERT_DIR/server.key 4096"
    echo "   openssl req -new -key $CERT_DIR/server.key \\"
    echo "       -out $CERT_DIR/server.csr \\"
    echo "       -subj \"/CN=trading-agent-service\""
    echo ""
    echo "   # Sign server certificate"
    echo "   openssl x509 -req -days 365 \\"
    echo "       -in $CERT_DIR/server.csr \\"
    echo "       -CA $CERT_DIR/ca.crt \\"
    echo "       -CAkey $CERT_DIR/ca.key \\"
    echo "       -CAcreateserial \\"
    echo "       -out $CERT_DIR/server.crt"
    echo ""
fi

echo ""

# Check environment variables
echo "4. Checking TLS environment variables..."

if [ -n "$TLS_ENABLED" ]; then
    if [ "$TLS_ENABLED" = "true" ]; then
        echo -e "${GREEN}✓${NC} TLS_ENABLED=true (TLS is enabled)"
    else
        echo -e "${YELLOW}⚠${NC} TLS_ENABLED=$TLS_ENABLED (TLS is disabled)"
    fi
else
    echo -e "${YELLOW}⚠${NC} TLS_ENABLED not set (defaults to disabled)"
fi

if [ -n "$MTLS_ENABLED" ]; then
    if [ "$MTLS_ENABLED" = "true" ]; then
        echo -e "${GREEN}✓${NC} MTLS_ENABLED=true (Mutual TLS is enabled)"
    else
        echo "   MTLS_ENABLED=$MTLS_ENABLED (Mutual TLS is disabled)"
    fi
else
    echo "   MTLS_ENABLED not set (defaults to disabled)"
fi

if [ -n "$TLS_CERT_PATH" ]; then
    echo "   TLS_CERT_PATH=$TLS_CERT_PATH"
else
    echo "   TLS_CERT_PATH not set (using default: $CERT_DIR/server.crt)"
fi

if [ -n "$TLS_KEY_PATH" ]; then
    echo "   TLS_KEY_PATH=$TLS_KEY_PATH"
else
    echo "   TLS_KEY_PATH not set (using default: $CERT_DIR/server.key)"
fi

if [ -n "$TLS_CA_PATH" ]; then
    echo "   TLS_CA_PATH=$TLS_CA_PATH"
else
    echo "   TLS_CA_PATH not set (using default: $CERT_DIR/ca.crt)"
fi

echo ""

# Final summary
echo "========================================"
echo "Verification Summary"
echo "========================================"
echo ""

if [ $CERTS_MISSING -eq 0 ]; then
    echo -e "${GREEN}✓${NC} All required certificates present"
    echo -e "${GREEN}✓${NC} Trading Agent Service is ready for TLS"
    echo ""
    echo "To start the service with TLS:"
    echo "   export TLS_ENABLED=true"
    echo "   export MTLS_ENABLED=true  # Optional"
    echo "   cargo run --bin trading_agent_service"
else
    echo -e "${RED}✗${NC} Missing required certificates"
    echo "   Please generate certificates using the commands above"
fi

echo ""
echo "For more information, see:"
echo "   AGENT_S6_TLS_TRADING_AGENT_SERVICE_COMPLETE.md"
echo ""