param(
    [string]$CaUrl = "https://ca.konrad.home"
)

$ErrorActionPreference = "Stop"

if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Host "Fehler: Dieses Skript muss als Administrator ausgeführt werden." -ForegroundColor Red
    Write-Host "Starte PowerShell als Administrator neu und versuche es erneut." -ForegroundColor Yellow
    exit 1
}

$certs = @("site-a-root.crt", "site-b-root.crt")
$store = [System.Security.Cryptography.X509Certificates.X509Store]::new(
    [System.Security.Cryptography.X509Certificates.StoreName]::Root,
    [System.Security.Cryptography.X509Certificates.StoreLocation]::LocalMachine
)
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)

foreach ($certFile in $certs) {
    $url = "$CaUrl/$certFile"
    $tmpFile = [System.IO.Path]::GetTempFileName()
    try {
        Write-Host "Lade $url herunter..." -ForegroundColor Cyan
        Invoke-WebRequest -Uri $url -OutFile $tmpFile -UseBasicParsing

        $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($tmpFile)

        $existing = $store.Certificates.Find(
            [System.Security.Cryptography.X509Certificates.X509FindType]::FindByThumbprint,
            $cert.Thumbprint,
            $false
        )

        if ($existing.Count -gt 0) {
            Write-Host "$($cert.Subject) — bereits installiert, überspringe." -ForegroundColor Yellow
        } else {
            $store.Add($cert)
            Write-Host "$($cert.Subject) — installiert." -ForegroundColor Green
        }
    } catch {
        Write-Host "Fehler bei $certFile : $_" -ForegroundColor Red
        exit 1
    } finally {
        if (Test-Path $tmpFile) { Remove-Item $tmpFile -Force }
    }
}

$store.Close()

Write-Host "`nAlle CA-Zertifikate installiert. Browser neustarten damit Änderungen wirksam werden." -ForegroundColor Green
Write-Host "Danach sind https://*.konrad.home und https://*.mini.konrad.home ohne Zertifikatswarnung erreichbar." -ForegroundColor Cyan