@echo off
setlocal
title PiCall LAN Certificate Installer

set "CERT_URL=http://192.168.10.252/picall/picall-lan-rootCA.crt"
set "CERT_FILE=%TEMP%\picall-lan-rootCA.crt"
set "PICALL_URL=https://192.168.10.252/picall/login.php"

echo PiCall LAN Certificate Installer
echo ================================
echo.
echo This window will stay open so you can read any success or error message.
echo.

fltmc >nul 2>&1
if not "%errorlevel%"=="0" (
    echo Administrator permission is required to install the trusted root certificate.
    echo A Windows security prompt will open now. Choose Yes to continue.
    echo.
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath 'cmd.exe' -ArgumentList '/c \"\"%~f0\"\"' -Verb RunAs"
    echo.
    pause
    exit /b 0
)

powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "try { $ErrorActionPreference = 'Stop'; $certUrl = '%CERT_URL%'; $certFile = '%CERT_FILE%'; $picallUrl = '%PICALL_URL%'; Write-Host 'Downloading PiCall root certificate from' $certUrl; Invoke-WebRequest -Uri $certUrl -OutFile $certFile -UseBasicParsing; $certificate = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certFile); Write-Host ''; Write-Host ('Certificate subject: ' + $certificate.Subject); Write-Host ('Certificate thumbprint: ' + $certificate.Thumbprint); Write-Host ''; Write-Host 'Installing certificate into Local Machine Trusted Root Certification Authorities...'; Import-Certificate -FilePath $certFile -CertStoreLocation 'Cert:\LocalMachine\Root' | Out-Null; Write-Host ''; Write-Host 'Success. PiCall LAN certificate is installed.'; Write-Host 'Close and reopen Chrome or Edge, then open:'; Write-Host $picallUrl; try { Start-Process $picallUrl } catch {}; exit 0 } catch { Write-Host ''; Write-Host 'Certificate installation failed.'; Write-Host $_.Exception.Message; Write-Host ''; Write-Host 'Make sure the PiCall server is reachable at 192.168.10.252 and run this installer as Administrator.'; exit 1 }"

echo.
pause
endlocal