#!/usr/bin/env bash
set -euo pipefail
mkdir -p ca
openssl genrsa -out ca/root.key 4096
openssl req -x509 -new -nodes -key ca/root.key -sha256 -days 3650 -subj "/CN=Exosysteme-Root" -out ca/root.crt
echo "[✓] CA created in scripts/certs/ca"