CERTSDIR=/usr/share/ca-certificates
USERCERTSDIR=/usr/syno/etc/security-profile/ca-bundle-profile/ca-certificates
AUTOUPDATECERTSDIR=/var/db/ca-certificates
AUTOUPDATECERTSBACKUPDIR=/var/db/backups/ca-certificates
CERTBUNDLE=ca-certificates.crt
ETCCERTSDIR=/etc/ssl/certs

cleanup() {
  rm -f "$TEMPBUNDLE"
  rm -f "$ADDED"
  rm -f "$REMOVED"
}
trap cleanup 0

TEMPBUNDLE="${ETCCERTSDIR}/${CERTBUNDLE}.new"
ADDED="$(mktemp -p "${TMPDIR:-/tmp}" "ca-certificates.tmp.XXXXXX")"
REMOVED="$(mktemp -p "${TMPDIR:-/tmp}" "ca-certificates.tmp.XXXXXX")"

add() {
  CERT="$1"
  PEM="$ETCCERTSDIR/$(basename "$CERT" .crt | sed -e 's/ /_/g' \
                                                  -e 's/[()]/=/g' \
                                                  -e 's/,/_/g').pem"
  if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "$CERT" ]
  then
    ln -sf "$CERT" "$PEM"
    echo "+$PEM" >> "$ADDED"
  fi
  # Add trailing newline to certificate, if it is missing (#635570)
  sed -e '$a\' "$CERT" >> "$TEMPBUNDLE"
}

remove() {
  CERT="$1"
  PEM="$ETCCERTSDIR/$(basename "$CERT" .crt).pem"
  if test -L "$PEM"
  then
    rm -f "$PEM"
    echo "-$PEM" >> "$REMOVED"
  fi
}

cd "$ETCCERTSDIR"

# NOTE: remove all symbolic link first
find . -type l -print | while read -r symlink
do
  rm -f "$symlink"
done

# NOTE: create user uploaded certificate
if [ -d "$USERCERTSDIR" ]
then
  find -L "$USERCERTSDIR" -type f -name '*.crt' | sort | while read -r crt
  do
    add "$crt"
  done
fi

# NOTE: if autoupdate certificate dir exist, and has *.crt use AUTOUPDATECERTSDIR
#       otherwiese, use DSM default version
/bin/ls "$AUTOUPDATECERTSDIR"/*.crt 2> /dev/null 1> /dev/null
if [ $? -eq 0 ]
then
  valid=true
  # check certificates in AUTOUPDATECERTSDIR are valid
  for crt in "$AUTOUPDATECERTSDIR"/*.crt; do
    if ! openssl x509 -in "$crt" -noout > /dev/null 2>&1; then
      echo "Invalid certificate found: $crt"
      # Restore from backup if invalid certificate found
      if [ -d "$AUTOUPDATECERTSBACKUPDIR" ]; then
        echo "Trying to restore from backup..."
        cp -a "$AUTOUPDATECERTSBACKUPDIR"/. "$AUTOUPDATECERTSDIR"
        rm -rf "$AUTOUPDATECERTSBACKUPDIR"
        echo "Restored from backup."
      else
        echo "Backup directory not found. Skipping restoration and autoupdate."
        valid=false
      fi
    fi
  done
  if [ "$valid" = true ]; then
    CERTSDIR=$AUTOUPDATECERTSDIR
    rm -rf "$AUTOUPDATECERTSBACKUPDIR"
  else
    echo "Using default certificate directory due to invalid autoupdate ca-certificates."
  fi
fi

# NOTE: create DSM system certificate symbolic link
#       if filename duplicate, use system certificate instead of user uploaded
find -L "$CERTSDIR" -type f -name '*.crt' | sort | while read -r crt
do
  add "$crt"
done

openssl rehash . > /dev/null

chmod 0644 "$TEMPBUNDLE"
mv -f "$TEMPBUNDLE" "$CERTBUNDLE"

ADDED_CNT=$(wc -l < "$ADDED")
REMOVED_CNT=$(wc -l < "$REMOVED")
echo "$ADDED_CNT added, $REMOVED_CNT removed; done."