#!/bin/sh
set -eu

resolver=1.1.1.1
candidate=${CERTIFICATE_HOST:?Set CERTIFICATE_HOST to the certificate hostname}
candidate=${candidate%.}

if [ -z "$candidate" ]; then
    printf 'CERTIFICATE_HOST must not be empty.\n' >&2
    exit 2
fi

resolve_cname() {
    query_name=$1
    while :; do
        alias=$(dig "@$resolver" +short +nocookie "$query_name" CNAME)
        [ -n "$alias" ] || break
        printf 'CNAME %s -> %s\n' "$query_name" "$alias"
        query_name=${alias%.}
    done
}

while [ "$candidate" != "." ]; do
    resolve_cname "$candidate"
    printf 'Checking %s\n' "$candidate"

    rrset=$(dig "@$resolver" +short +nocookie "$query_name" CAA)
    if [ -n "$rrset" ]; then
        relevant_name=$query_name
        break
    fi

    case "$candidate" in
        *.*) candidate=${candidate#*.} ;;
        *) candidate=. ;;
    esac
done

if [ -n "${rrset:-}" ]; then
    printf 'Relevant CAA RRset at %s:\n%s\n' "$relevant_name" "$rrset"
    exit 0
fi

printf 'No Relevant CAA RRset before the DNS root.\n'