using System;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;

namespace Crysome.Common.Network.Transport;

public static class QuicCertificateHelper
{
	public static X509Certificate2 CreateServerCertificate()
	{
		using RSA key = RSA.Create(2048);
		using X509Certificate2 x509Certificate = new CertificateRequest(new X500DistinguishedName("CN=Crysome QUIC"), key, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1)
		{
			CertificateExtensions = 
			{
				(X509Extension)new X509BasicConstraintsExtension(certificateAuthority: false, hasPathLengthConstraint: false, 0, critical: false),
				(X509Extension)new X509KeyUsageExtension(X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DigitalSignature, critical: false),
				(X509Extension)new X509EnhancedKeyUsageExtension(new OidCollection
				{
					new Oid("1.3.6.1.5.5.7.3.1")
				}, critical: false)
			}
		}.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1.0), DateTimeOffset.UtcNow.AddYears(10));
		return new X509Certificate2(x509Certificate.Export(X509ContentType.Pfx, (string?)null), (string?)null, X509KeyStorageFlags.Exportable | X509KeyStorageFlags.EphemeralKeySet);
	}
}