export async function createSomeCertificate(certName: string): Promise<Buffer> {

    if (!tmpGroup) {
        tmpGroup = new CertificateManager({
            location: path.join(_tempFolder, "tmp")
        });
        await tmpGroup.initialize();
    }
    const certFile = path.join(_tempFolder, certName);

    const fileExists: boolean = await promisify(fs.exists)(certFile);
    if (!fileExists) {

        await tmpGroup.createSelfSignedCertificate({
            applicationUri: "applicationUri",
            subject: "CN=TOTO",

            dns: [],

            startDate: new Date(),
            validity: 365,

            outputFile: certFile
        });
    }

    const content = await promisify(fs.readFile)(certFile, "ascii");
    const certificate = convertPEMtoDER(content);
    return certificate;
}

    it("updateCertificate should return BadSecurityChecksFailed if certificate doesn't match private key ", async () => {

        // Given a certificate created for a different Private keuy
        const wrongCertificateManager = new CertificateManager({
            location: path.join(_tempFolder, "wrong")
        });
        await wrongCertificateManager.initialize();
        const filename = await wrongCertificateManager.createCertificateRequest({
            startDate: new Date(),
            validity: 365
        });
        const certificateSigningRequestPEM = await promisify(fs.readFile)(filename, "ascii");
        const certificateSigningRequest = convertPEMtoDER(certificateSigningRequestPEM);
        const wrongCertificate = await produceCertificate(certificateSigningRequest);

        // When I call updateCertificate with a certificate that do not match the private key
        const certificateChain = split_der(wrongCertificate);
        const certificate = certificateChain[0];
        const issuerCertificates = certificateChain.slice(1);
        const result: UpdateCertificateResult = await pushManager.updateCertificate(
          "DefaultApplicationGroup",
          "",
          certificate,
          issuerCertificates
        );
        // Then I should receive BadSecurityChecksFailed
        result.statusCode.should.eql(StatusCodes.BadSecurityChecksFailed);
    });

    function verifyServer(server: OPCUAServer) {

        debugLog("---------------------------------------------------------------");
        const certificateChain1 = server.getCertificateChain();
        debugLog("server.getCertificateChain() =",
          makeSHA1Thumbprint(certificateChain1).toString("hex") + " l=" + certificateChain1.length);
        const privateKey1 = convertPEMtoDER(server.getPrivateKey());
        debugLog("server.getPrivateKey()       =",
          makeSHA1Thumbprint(privateKey1).toString("hex"));

        const match = certificateMatchesPrivateKey(certificateChain1, privateKey1);
        debugLog("math                         =", match);

        for (const endpoint of server.endpoints) {
            debugLog("endpoint ", endpoint.toString());

            for (const e of endpoint.endpointDescriptions()) {
                const certificateChain3 = e.serverCertificate;
                debugLog("endpoint certificate =",
                  makeSHA1Thumbprint(certificateChain3).toString("hex") + " l=" + certificateChain3.length);
                // xx console.log(e.toString());
            }

        }
        debugLog("---------------------------------------------------------------");

    }

function getCertificateChainEP(this: OPCUAServerEndPoint): Certificate {

    const certificateFile = path.join(this.certificateManager.rootDir, "own/certs/certificate.pem");
    const certificatePEM = fs.readFileSync(certificateFile, "utf8");
    const $$certificateChain = convertPEMtoDER(certificatePEM);
    const thumbprint = makeSHA1Thumbprint($$certificateChain);

    return $$certificateChain;
}

    it("SCT-1 should modify a server to support push certificate management", async () => {

        const server = new OPCUAServer({
            port: 20000,
            serverCertificateManager: certificateManager,
            userCertificateManager: certificateManager
        });

        await server.initialize();

        await installPushCertificateManagementOnServer(server);

        const privateKey1PEM = await promisify(fs.readFile)(server.serverCertificateManager.privateKey, "utf8");
        const privateKey1 = convertPEMtoDER(privateKey1PEM);
        const privateKey2 = convertPEMtoDER(server.getPrivateKey());
        privateKey1.toString("base64").should.eql(privateKey2.toString("base64"));

        // now start the server
        await server.start();

        // now stop the server
        await server.shutdown();
    });

async function install(this: OPCUAServerPartial): Promise<void> {
    if (!this.$$privateKeyPEM) {
        this.$$privateKeyPEM =
          await promisify(fs.readFile)(this.serverCertificateManager.privateKey, "utf8");
    }

    if (!this.$$certificateChain) {

        const certificateFile = path.join(this.serverCertificateManager.rootDir, "own/certs/certificate.pem");
        const exists = await (promisify(fs.exists)(certificateFile));
        if (!exists) {

            // this is the first time server is launch
            // let's create a default self signed certificate with limited validity

            const fqdn = await getFullyQualifiedDomainName();
            const ipAddresses = await getIpAddresses();

            const applicationUri =
              (this.serverInfo ? this.serverInfo!.applicationUri! : null) || "uri:MISSING";

            const options = {

                applicationUri: this.serverInfo!.applicationUri!,

                dns: [fqdn],
                ip: ipAddresses,

                subject: "/CN=MyCommonName;/L=Paris",

                startDate: new Date(),

                validity: 365 * 5, // five year

                /* */
                outputFile: certificateFile

            };

            debugLog("creating self signed certificate", options);
            await this.serverCertificateManager.createSelfSignedCertificate(options);

        }
        const certificatePEM =
          await promisify(fs.readFile)(certificateFile, "utf8");
        this.$$certificateChain = convertPEMtoDER(certificatePEM);

    }
}

export async function produceCertificateAndPrivateKey()
  : Promise<{ certificate: Certificate, privateKey: PrivateKey }> {

    // Given a Certificate Authority
    const certificateManager = new CertificateManager({
        keySize: 2048,
        location: path.join(_tempFolder, "tmpPKI")
    });
    await certificateManager.initialize();

    const certFile = path.join(_tempFolder, "tmpPKI/certificate.pem");
    const fileExists: boolean = await promisify(fs.exists)(certFile);

    await certificateManager.createSelfSignedCertificate({
        applicationUri: "applicationUri",
        subject: "CN=TOTO",

        dns: [
            getFullyQualifiedDomainName()
        ],

        startDate: new Date(),
        validity: 365,

        outputFile: certFile
    });

    const content = await promisify(fs.readFile)(certFile, "ascii");
    const certificate = convertPEMtoDER(content);

    const privateKeyFile = certificateManager.privateKey;
    const privateKeyPEM = await promisify(fs.readFile)(privateKeyFile, "ascii");
    const privateKey = convertPEMtoDER(privateKeyPEM);

    return { certificate, privateKey };
}

async function getCertificateDER(manager: CertificateManager): Promise<Certificate> {

    const certificateFilename = path.join(manager.rootDir, "own/certs/certificate.pem");
    const exists = await promisify(fs.exists)(certificateFilename);
    if (!exists) {
        await manager.createSelfSignedCertificate({
            applicationUri: "SomeText",
            dns: ["localhost"],
            outputFile: certificateFilename,
            startDate: new Date(),
            subject: "/CN=fake",
            validity: 100
        });
    }
    const certificatePEM = await promisify(fs.readFile)(certificateFilename, "utf8");
    const certificate = convertPEMtoDER(certificatePEM);
    return certificate;
}

async function _produceCertificate(
  certificateSigningRequest: Buffer,
  startDate: Date,
  validity: number
): Promise<Buffer> {
    // Given a Certificate Authority
    const certificateAuthority = new CertificateAuthority({
        keySize: 2048,
        location: path.join(_tempFolder, "CA")
    });
    await certificateAuthority.initialize();

    // --- now write the certificate signing request to the disc
    const csrFilename = "signing_request.csr";
    const csrFile = path.join(certificateAuthority.rootDir, csrFilename);

    await promisify(fs.writeFile)(csrFile,
      toPem(certificateSigningRequest,
        "CERTIFICATE REQUEST"), "utf8");

    // --- generate the certificate

    const certificate = path.join(certificateAuthority.rootDir, "newCertificate.pem");
    if (fs.existsSync(certificate)) {
        // delete existing file
        await promisify(fs.unlink)(certificate);
    }

    await certificateAuthority.signCertificateRequest(
      certificate,
      csrFile, {
          applicationUri: "urn:MACHINE:MyApplication",
          dns: [os.hostname()],
          startDate,
          validity
      });

    const certificatePEM = await promisify(fs.readFile)(certificate, "utf8");
    return convertPEMtoDER(certificatePEM);
}

/**
 * onCertificateChange is called when the serverConfiguration notifies
 * that the server certificate and/or private key has changed.
 *
 * this function suspends all endpoint listeners and stop all existing channels
 * then start all endpoint listener
 *
 * @param server
 */
async function onCertificateChange(server: OPCUAServer) {

    debugLog("on CertificateChanged");

    const _server = server as any as OPCUAServerPartial;

    _server.$$privateKeyPEM = fs.readFileSync(server.serverCertificateManager.privateKey, "utf8");
    const certificateFile = path.join(server.serverCertificateManager.rootDir, "own/certs/certificate.pem");
    const certificatePEM = fs.readFileSync(certificateFile, "utf8");

    const privateKeyFile = server.serverCertificateManager.privateKey;
    const privateKeyPEM = fs.readFileSync(privateKeyFile, "utf8");
    // also reread the private key

    _server.$$certificateChain = convertPEMtoDER(certificatePEM);
    _server.$$privateKeyPEM = privateKeyPEM;
    // note : $$certificate will be reconstructed on demand
    _server.$$certificate = undefined;

    setTimeout(async () => {
        try {
            debugLog(chalk.yellow(" onCertificateChange => shutting down channels"));
            await server.shutdownChannels();
            debugLog(chalk.yellow(" onCertificateChange => channels shut down"));

            debugLog(chalk.yellow(" onCertificateChange => resuming end points"));
            await server.resumeEndPoints();
            debugLog(chalk.yellow(" onCertificateChange => end points resumed"));

            debugLog(chalk.yellow("channels have been closed -> client should reconnect "));

        } catch (err) {
            // tslint:disable:no-console
            errorLog("Error in CertificateChanged handler ", err.message);
            debugLog("err = ", err);
        }
    }, 2000);
}