# SLU CA certificate installer

Downloads SLU CA certificates from `https://pki.slu.se/`, installs them
in `/usr/local/share/ca-certificates/SLU`, and updates the system trust store.

## Install

Requires Linux with Debian-compatible `update-ca-certificates`, Bash 4.4+,
GNU coreutils/findutils, `flock`, Wget, OpenSSL, and awk.

From the script directory, run:

```bash
sudo bash install_slu_certs.sh
```

Rerun the same command to download and reinstall the current certificate set.
Avoid running other trust-store updates at the same time.
Wget's crawl log is kept in a temporary directory and removed after the run;
download errors are printed if Wget fails.

The trust-store rebuild may print lines such as `Replacing debian:...`. These
are expected: the updater is regenerating system CA links, not overwriting the
Debian certificate files.

Files are checked for PEM format only; certificate identity, trust, validity
dates, and completeness of the downloaded set are not verified. HTTPS server
verification remains enabled. Existing SLU certificates absent from the download
are removed when the new set is installed.

## Recover after a failure

The script attempts automatic rollback. After resolving the reported error,
recover without downloading by running:

```bash
sudo bash install_slu_certs.sh --recover-only
```

Do not delete `/usr/local/share/.install-slu-certs` after failed recovery;
it may contain the only previous certificate copy.

If installation reports legacy `.SLU.backup.*` or `.SLU.new.*` entries, preserve
and move them outside `/usr/local/share/ca-certificates` before retrying.