using Alkami.Ops.Certificates.Data;
using Alkami.Ops.Certificates.SecretServer;
using Alkami.Ops.Certificates.Utilities;
using Alkami.Ops.Common.Cryptography;
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.IO.Compression;
using System.Linq;
using System.Management.Automation;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text.RegularExpressions;
using System.Threading.Tasks;

namespace Alkami.Ops.Certificates
{
    internal class SecretServerImporter : IDisposable
    {
        private readonly string _tempPath;
        private readonly string _globalPassword;

        private readonly SecretServerClient _secretServerClient;

        private const string CertificateTemplateTypeName = "Automated_Certificate";
        private readonly string ExportCertificatesScript;
        private static long certCount = 0;

        /// <summary>
        /// Constructor.
        /// </summary>
        /// <param name="secretSite">The base URL of the secret server site.</param>
        /// <param name="secretUser">Secret Server username with API access.</param>
        /// <param name="secretPassword">Secret server user password.</param>
        public SecretServerImporter(string secretSite, string secretUser, string secretPassword)
        {
            _tempPath = Path.Combine(Path.GetTempPath(), "CertificateExport");
            if (Directory.Exists(_tempPath))
            {
                Extensions.ClearDirectory(_tempPath);
            }
            else
            {
                Directory.CreateDirectory(_tempPath);
            }

            _globalPassword = GeneratePassword();

            _secretServerClient = new SecretServerClient(secretSite, secretUser, secretPassword);

            // Read in powershell scripts.
            ExportCertificatesScript = Resources.ExportRemoteCertificates;
        }

        /// <summary>
        /// Cleanup
        /// </summary>
        public void Dispose()
        {
            if (Directory.Exists(_tempPath))
            {
                Directory.Delete(_tempPath, true);
            }

            _secretServerClient?.Dispose();
        }

        /// <summary>
        /// Creates machine-friendly per-pod secrets, so a server can download 4 secrets instead of 200.
        /// </summary>
        /// <param name="friendlySecretBaseFolderPath"></param>
        /// <param name="machineSecretBaseFolderPath"></param>
        public void CreatePodSecrets(string friendlySecretBaseFolderPath, string machineSecretBaseFolderPath, string[] importableUsers)
        {
            var baseFolder = _secretServerClient.GetOrAddFolderAsync(friendlySecretBaseFolderPath).GetAwaiter().GetResult();

            // The secret server will only return -all- folders under a subfolder. Can't just query for folders at a time.
            var folders = _secretServerClient.GetFoldersByParentFolder(baseFolder.ID);

            // Parse apart the paths of the folders to strip off the base path.
            friendlySecretBaseFolderPath = friendlySecretBaseFolderPath.Replace('/', '\\');
            var folderPaths = folders.Select(folder => folder.FolderPath)
                .Select(path => path.Substring(path.IndexOf(friendlySecretBaseFolderPath) + friendlySecretBaseFolderPath.Length));

            // Parse apart the environment types, and pods that exist (+ common)
            // Levels:
            // 1) EnvironmentType
            // 2) Environment (or Common)
            // 3) Web / App / All
            var splitPaths = folderPaths.Select(path => path.Split(new char[] { '\\' }, StringSplitOptions.RemoveEmptyEntries)).ToArray();

            var environmentTypes = splitPaths
                .Where(split => split.Length >= 1)
                .Select(split => split[0])
                .Distinct();

            foreach (var environmentType in environmentTypes)
            {
                var environments = splitPaths
                    .Where(split => split.Length >= 2)
                    .Where(split => string.Equals(split[0], environmentType, StringComparison.OrdinalIgnoreCase))
                    .Select(split => split[1])
                    .Distinct();

                foreach (var environment in environments)
                {
                    CreatePodSecrets(friendlySecretBaseFolderPath, machineSecretBaseFolderPath, environmentType, environment, importableUsers);
                }
            }
        }

        /// <summary>
        /// Creates machine-friendly per-pod secrets, so a server can download 4 secrets instead of 200.
        /// </summary>
        /// <param name="friendlySecretBaseFolderPath">Secret server path of the friendly secrets folder.</param>
        /// <param name="machineSecretBaseFolderPath">Secret server path of the machine per-pod secrets folder.</param>
        /// <param name="environmentType">The type of environment.</param>
        /// <param name="environment">The name of the environment. (Or "Common")</param>
        private void CreatePodSecrets(string friendlySecretBaseFolderPath, string machineSecretBaseFolderPath, string environmentType, string environment, string[] importableUsers)
        {
            using (PowerShell powerShellSession = PowerShell.Create())
            {
                var environmentPath = Path.Combine(friendlySecretBaseFolderPath, environmentType, environment);
                string[] serverTypes = new string[] { "All", "Web", "App" };

                // Get the secret template type.
                var secretTemplateType = _secretServerClient.GetSecretTemplateByName(CertificateTemplateTypeName);

                foreach (var serverType in serverTypes)
                {
                    // Clear out the temp path directory. Only one of these processes should run at a time.
                    // TODO: Rewrite the function to be pathed by environment type and environment so multiple of them can be run in parallel.
                    if (Directory.Exists(_tempPath) && Directory.EnumerateFiles(_tempPath).Any())
                    {
                        Extensions.ClearDirectory(_tempPath);
                    }

                    var secretsPath = Path.Combine(environmentPath, serverType);

                    var folder = _secretServerClient.GetOrAddFolderAsync(secretsPath).GetAwaiter().GetResult();
                    var secrets = _secretServerClient.GetSecretsByFolder(folder);

                    // Load the full secrets.
                    var fullSecrets = secrets.Select(secret => _secretServerClient.GetSecretByID(secret.ID).GetAwaiter().GetResult());

                    // Download each secret to a separate folder by ID.
                    foreach (var secret in fullSecrets)
                    {
                        // Download the zip.
                        Console.WriteLine($"Attempting to download {secret.ID}");
                        var zipName = $"{secret.ID}.zip";
                        var zipDownloadLocation = Path.Combine(_tempPath, zipName);
                        if (!_secretServerClient.DownloadFile(zipDownloadLocation, secret).GetAwaiter().GetResult())
                        {
                            Console.WriteLine($"Failed to download secret ID {secret.ID}");
                            continue;
                        }

                        // Unzip the file to a per-secret folder.
                        var outputFolder = Path.Combine(_tempPath, secret.ID.ToString());
                        if (!Directory.Exists(outputFolder))
                        {
                            Directory.CreateDirectory(outputFolder);
                        }

                        // Unzip it.
                        ZipFile.ExtractToDirectory(zipDownloadLocation, outputFolder);

                        var pfxFiles = Directory.GetFiles(outputFolder, "*.pfx", SearchOption.AllDirectories);
                        foreach (var file in pfxFiles)
                        {
                            // re-export secret password with global password
                            var cert = new X509Certificate2(file, secret["Import Password"], X509KeyStorageFlags.Exportable);
                            byte[] exportedBytes = cert.Export(X509ContentType.Pkcs12, _globalPassword);
                            File.WriteAllBytes(file, exportedBytes);
                        }
                    }

                    // Copy all of the certificates together, preserving folder paths.
                    var podSecretOutputFolder = Path.Combine(_tempPath, "PodSecretOutputFolder");
                    if (!Directory.Exists(podSecretOutputFolder))
                    {
                        Directory.CreateDirectory(podSecretOutputFolder);
                    }
                    var secretFolders = Directory.GetDirectories(_tempPath);
                    foreach (var sourceFolder in secretFolders)
                    {
                        // Source directories, a folder for each secret server secret.
                        var sourceDirectories = Directory.GetDirectories(sourceFolder, "*", SearchOption.AllDirectories);

                        // Create folders in the destination folder
                        foreach (string dirPath in sourceDirectories)
                        {
                            var dstPath = dirPath.Replace(sourceFolder, podSecretOutputFolder);
                            if (!Directory.Exists(dstPath))
                            {
                                Directory.CreateDirectory(dstPath);
                            }
                        }

                        // Copy over the secrets.
                        foreach (string newPath in Directory.GetFiles(sourceFolder, "*.*", SearchOption.AllDirectories))
                        {
                            // If the file already exists in the combined secret, and it isn't the same file, come up with a new non-duplicate name and copy the secret over.
                            var podSecretDestinationPath = newPath.Replace(sourceFolder, podSecretOutputFolder);

                            int counter = 1;
                            bool doCopy = true;
                            do
                            {
                                // Copy over the file if it doesn't exist.
                                if (!File.Exists(podSecretDestinationPath))
                                {
                                    break;
                                }

                                // If the files are equal, the cert already exists in the combined folder, so break out.
                                if (Extensions.FilesAreEqual(new FileInfo(newPath), new FileInfo(podSecretDestinationPath)))
                                {
                                    doCopy = false;
                                    break;
                                }

                                // Otherwise we're going to try to come up with a unique filename.
                                // This loop is going to keep going until we either find the exact same cert, or we arrive on a unique file name.
                                string nonConflictingPath = Path.Combine(
                                        Path.GetDirectoryName(newPath),
                                        Path.GetFileNameWithoutExtension(newPath),
                                        counter.ToString(),
                                        Path.GetExtension(newPath));
                                podSecretDestinationPath = nonConflictingPath;
                                counter++;
                            } while (true);

                            if (doCopy)
                            {
                                File.Copy(newPath, podSecretDestinationPath, true);
                            }
                        }
                    }

                    // Zip up the combined certs.
                    var podSecretName = serverType;
                    var podSecretZipPath = Path.Combine(_tempPath, $"{podSecretName}.zip");
                    ZipFile.CreateFromDirectory(podSecretOutputFolder, podSecretZipPath);

                    // Create secret with combined zip.
                    var secretPath = Path.Combine(machineSecretBaseFolderPath, environmentType, environment);
                    var destinationSecretFolder = _secretServerClient.GetOrAddFolderAsync(secretPath).GetAwaiter().GetResult();

                    // See if a secret already exists, and if it does, delete it.
                    var existingSecret = _secretServerClient.FindSecretByName(serverType, destinationSecretFolder.ID);
                    if (existingSecret != null)
                    {
                        _secretServerClient.DeleteSecret(existingSecret.ID).GetAwaiter().GetResult();
                    }

                    // Create the new secret stub by template ID.
                    var secretStub = _secretServerClient.CreateSecretStubByTemplateIDAsync(secretTemplateType.ID, podSecretName + "-" + destinationSecretFolder.ID, destinationSecretFolder.ID).GetAwaiter().GetResult();

                    var currentZipHash = "";
                    using (var stream = File.OpenRead(podSecretZipPath))
                    {
                        currentZipHash = Extensions.GetMd5HashString(stream);
                    }

                    // Fill out secret details.
                    secretStub["Import Password"] = _globalPassword;
                    secretStub["Certificate Name"] = podSecretName;
                    secretStub["Thumbprint"] = "N/A";
                    secretStub["ExpirationDate"] = "";
                    secretStub["File Hash"] = currentZipHash;

                    // Create the secret.
                    var newSecret = _secretServerClient.CreateSecret(secretStub).GetAwaiter().GetResult();

                    // Upload the zip.
                    _secretServerClient.UploadFile(newSecret, podSecretZipPath).GetAwaiter().GetResult();
                }
            }
        }

        /// <summary>
        /// Imports certificates from all of the given servers into the secret server.
        /// </summary>
        /// <param name="servers">List of server hostnames.</param>
        /// <param name="baseSecretFolder">Secret server folder path to drop the secrets in.</param>
        public void Import(IEnumerable<string> servers, string baseSecretFolder)
        {
            // Make sure the servers are unique just in case.
            servers = servers.Select(s => s.ToLower()).Distinct();

            var serverData = new Dictionary<string, ServerInfo>();
            var environmentData = new Dictionary<string, EnvironmentInfo>();
            var certificateData = new Dictionary<string, CertificateInfo>();

            if (Directory.Exists(_tempPath))
            {
                // Remove directories and files under _tempPath.
                foreach (var directory in Directory.GetDirectories(_tempPath))
                {
                    Directory.Delete(directory, true);
                }

                foreach (var file in Directory.GetFiles(_tempPath))
                {
                    File.Delete(file);
                }
            }

            // Gather server/environment data from the servers.
            using (var timer = new QuickWatch("GatherEnvironmentData"))
            {
                GatherEnvironmentData(servers, ref environmentData, ref serverData);
            }

            // Download certificates from each server.
            using (var timer = new QuickWatch("DownloadCertificatesFromServers"))
            {
                DownloadCertificatesFromServers(servers, _tempPath);
            }

            // Build the tree of certificate information, to weed out unique certificates that need uploading.
            using (var timer = new QuickWatch("BuildCertificateData"))
            {
                BuildCertificateData(_tempPath, ref serverData, ref certificateData);
            }

            // Upload the secrets to the secret server.
            using (var timer = new QuickWatch("UploadCertificatesToSecretServer"))
            {
                UploadCertificatesToSecretServer(baseSecretFolder, ref environmentData, ref certificateData);
            }
        }

        /// <summary>
        /// Gathers environment data from each of the servers, and tracks the data in _environmentData and _serverData
        /// </summary>
        /// <param name="servers"></param>
        private void GatherEnvironmentData(IEnumerable<string> servers, ref Dictionary<string, EnvironmentInfo> environmentData, ref Dictionary<string, ServerInfo> serverData)
        {
            // Read server/environment data from all of the servers.
            foreach (var server in servers)
            {
                // Grab the server name/type/envType/host from the server's machine config.
                var serverInfo = Extensions.GetServerInfo(server);

                // Look up the environment.
                var environmentNameLower = serverInfo.EnvironmentName.ToLower();
                EnvironmentInfo environment = null;
                if (!environmentData.TryGetValue(environmentNameLower, out environment))
                {
                    environment = new EnvironmentInfo(serverInfo.EnvironmentName, serverInfo.EnvironmentType);
                    environmentData[environmentNameLower] = environment;
                }

                // Recreate the server to include the environment.
                serverInfo = new ServerInfo(serverInfo, environment);
                serverData[server] = serverInfo;

                // Record the server in the environment.
                environment.Servers.Add(serverInfo);
            }
        }

        /// <summary>
        /// Generates a strong password of [length] characters.
        /// </summary>
        /// <param name="length">The length of the password</param>
        /// <returns></returns>
        private string GeneratePassword(int length = 32)
        {
            RNGCryptoServiceProvider cryptRNG = new RNGCryptoServiceProvider();
            byte[] tokenBuffer = new byte[length];
            cryptRNG.GetBytes(tokenBuffer);
            return Convert.ToBase64String(tokenBuffer);
        }

        /// <summary>
        /// Aliases store string names to the Alkami certificate import folder names.
        /// </summary>
        /// <param name="storename">String name of the store.</param>
        /// <returns></returns>
        private string GetStoreFolderName(string storename)
        {
            switch (storename.ToLower())
            {
                case "my":
                    return "Personal";

                case "ca":
                    return "IA";

                case "root":
                    return "Root";

                case "trustedpeople":
                    return "TrustedPeople";

                default:
                    throw new Exception("Unknown Store Name Type");
            }
        }

        /// <summary>
        /// Downloads certificates from servers and unzips them to the output directory.
        /// </summary>
        /// <param name="servers"></param>
        /// <param name="outputDirectory"></param>
        private void DownloadCertificatesFromServers(IEnumerable<string> servers, string outputDirectory)
        {
            // Export certs from every server.
            var serverString = string.Join(",", servers);
            using (PowerShell instance = PowerShell.Create())
            {
                instance.AddScript(ExportCertificatesScript);
                instance.AddParameter("serverString", serverString);
                instance.AddParameter("exportPassword", _globalPassword);
                instance.AddParameter("importPath", outputDirectory);
                var psOutput = instance.Invoke();

                if (instance.Streams.Error.Any())
                {
                    Console.WriteLine("There were Errors executing powershell:");
                    foreach (var error in instance.Streams.Error)
                    {
                        Console.WriteLine(error);
                    }
                }
            }
        }

        /// <summary>
        /// Loads all certificates into memory, builds certificate chains, and determines certificate cert/server/environment relationships.
        /// </summary>
        /// <param name="serverCertificateDirectory">The directory of certificates, per server folder.</param>
        private void BuildCertificateData(string serverCertificateDirectory, ref Dictionary<string, ServerInfo> serverData, ref Dictionary<string, CertificateInfo> certificateData)
        {
            var certificateFiles = Directory.GetFiles(serverCertificateDirectory, "*", SearchOption.AllDirectories).Select(p => Path.GetFullPath(p)).ToArray();
            var certificateFileHasPrivateKey = new Dictionary<string, bool>();
            var fileToCertificate = new ConcurrentDictionary<string, CertificateInfo>();

            // Load all of the certificates into memory so we can make sense of them.
            var options = new ParallelOptions();
            options.MaxDegreeOfParallelism = 32;
            foreach (var file in certificateFiles)
            {
                var extension = Path.GetExtension(file);

                string newPassword = null;
                X509Certificate2 cert = null;
                if (extension == ".cer")
                {
                    cert = new X509Certificate2(file);
                }
                else if (extension == ".pfx")
                {
                    cert = new X509Certificate2(file, _globalPassword, X509KeyStorageFlags.Exportable);

                    // Generate a unique password for this cert going forward.
                    newPassword = GeneratePassword();
                }
                else
                {
                    throw new Exception($"Unhandled certificate extension {extension}");
                }

                // Store if the particular cert has a private key.
                certificateFileHasPrivateKey[file] = cert.HasPrivateKey;

                var certInfo = new CertificateInfo(cert, file, newPassword);
                if (!fileToCertificate.TryAdd(file, certInfo))
                {
                    throw new Exception($"Was unable to track certificate {file}. Investigate.");
                }
            };

            // Identify unique certificates from the list of certs from every server which includes duplicates.
            // Prefer to select unique certs that include private keys.
            var uniqueCertificates = new Dictionary<string, CertificateInfo>();
            var fileToCertificateEnum = fileToCertificate.Where(cert => cert.Value.Password != null).Concat(fileToCertificate);
            foreach (var certInfoKV in fileToCertificateEnum)
            {
                var certInfo = certInfoKV.Value;
                if (!uniqueCertificates.ContainsKey(certInfo.Thumbprint))
                {
                    uniqueCertificates.Add(certInfo.Thumbprint, certInfo);
                }
            }

            // Run back through each non-unique certificate, and assign servers/environments to each unique cert.
            // This is tracked by the folder that the certificate was loaded from. File paths in the form of:
            // "basePath\serverName\certificateStore\certificateName.pfx"
            foreach (var file in certificateFiles)
            {
                // Select the server/store out of the folder path.
                var fileSplit = file.Split(new char[] { '\\' });
                var serverName = fileSplit[fileSplit.Length - 3].ToLower();
                var storeName = fileSplit[fileSplit.Length - 2].ToLower();

                // Look up the unique certificate by the thumbprint of the non-unique certificate.
                var nonUniqueCertInfo = fileToCertificate[file];
                var uniqueCertInfo = uniqueCertificates[nonUniqueCertInfo.Thumbprint];

                // Add the server/environment that the cert is in to the unique cert info object.
                var serverInfo = serverData[serverName];
                var environmentName = serverInfo.EnvironmentName.ToLower();
                uniqueCertInfo.Servers.TryAdd(serverName, serverInfo);
                uniqueCertInfo.Environments.TryAdd(environmentName, serverInfo.Environment);

                // Record the store that the certificate belongs in, if it does not already exist.
                if (!uniqueCertInfo.Stores.Any(certStore => string.Equals(certStore.StoreName, storeName, StringComparison.OrdinalIgnoreCase)))
                {
                    bool storeHasPrivateKey = certificateFileHasPrivateKey[file];
                    StoreInfo store = new StoreInfo(storeName, storeHasPrivateKey);
                    uniqueCertInfo.Stores.Add(store);
                }
            }

            // Copy all of the unique certificates up to _certificateData, which will be the store of certs for other functions.
            foreach (var certInfoKV in uniqueCertificates)
            {
                certificateData.Add(certInfoKV.Key, certInfoKV.Value);
            }

            // For each unique certificate, build out the certificate chain and figure out which certs require which other certs.
            // Later we will use this data to create secrets for the "leaf certificates" that are not intermediates of other certificates.
            foreach (var certificateInfo in uniqueCertificates)
            {
                var certificate = certificateInfo.Value.Certificate;

                X509Chain chain = new X509Chain();
                chain.Build(certificate);

                List<X509Certificate2> chainCerts = chain.ChainElements.ToList();

                // Exit if there's no chain to walk.
                if (chainCerts.Count <= 1)
                {
                    continue;
                }

                // Build the tree of parent/child certificate associations.
                for (int i = 1; i < chainCerts.Count; i++)
                {
                    var parentCert = chainCerts[i];
                    var childCert = chainCerts[i - 1];

                    // Apparently certificates in the chain can exist and validate WITHOUT being loaded into the stores of the remote machines.
                    // They are most likely getting validated through the domain controller.
                    if (!certificateData.ContainsKey(parentCert.Thumbprint))
                    {
                        string filename = null; // No filename because it wasn't exported from a cert store.
                        var info = new CertificateInfo(parentCert, filename);
                        certificateData[parentCert.Thumbprint] = info;
                    }

                    // Attach the parent/child info to certificates for tracking.
                    var parentInfo = certificateData[parentCert.Thumbprint];
                    var childInfo = certificateData[childCert.Thumbprint];
                    childInfo.Parent = parentInfo;
                    parentInfo.Children.Add(childInfo);
                }
            }
        }

        /// <summary>
        /// Uploads tracked certificates in _certificateData to the secret server at the base path.
        /// </summary>
        /// <param name="baseSecretFolder">The base folder path in the secret server to upload certs to.</param>
        private void UploadCertificatesToSecretServer(string baseSecretFolder, ref Dictionary<string, EnvironmentInfo> environmentData, ref Dictionary<string, CertificateInfo> certificateData)
        {
            // Grab the list of certificates to create secrets for.
            var certsToExport = certificateData.Select(x => x.Value).ToList();

            var secretImportZipPath = Path.Combine(_tempPath, "SecretImportTemp");
            if (!Directory.Exists(secretImportZipPath))
            {
                Directory.CreateDirectory(secretImportZipPath);
            }

            // Create folders on the secret server for every environment, so we can multithread the certificate uploads without fear of stomping.
            var majorPodRegex = @"[^\.](\d+)";
            foreach (var environment in environmentData)
            {
                var type = environment.Value.EnvironmentType;
                type = char.ToUpper(type[0]) + type.Substring(1);

                var path = Path.Combine(baseSecretFolder, type);

                // Define the server types.
                var serverTypeFolders = new string[] { "Web", "App", "All" };

                // Create the common folder for the environment type.
                foreach (var serverType in serverTypeFolders)
                {
                    var serverTypePath = Path.Combine(path, "Common", serverType);
                    var folder = _secretServerClient.GetOrAddFolderAsync(serverTypePath).GetAwaiter().GetResult();
                }

                // Only production cares about separate cert folders per environment.
                if (type == "Production")
                {
                    var matches = Regex.Matches(environment.Value.Name, majorPodRegex);
                    string majorPod = matches[0].Captures[0].Value.Trim();
                    path = Path.Combine(path, majorPod);
                }

                // Server type folders inside the pod.
                foreach (var serverType in serverTypeFolders)
                {
                    var serverTypePath = Path.Combine(path, serverType);
                    var folder = _secretServerClient.GetOrAddFolderAsync(serverTypePath).GetAwaiter().GetResult();
                }
            }

            // Fetch all the secrets from the base folder, so we can check for secrets we've already loaded.
            bool includeSubfolders = true;
            var baseFolder = _secretServerClient.GetOrAddFolderAsync(baseSecretFolder).GetAwaiter().GetResult();
            var allSecrets = _secretServerClient.GetSecretsByFolder(baseFolder, includeSubfolders);

            try
            {
                var secretTemplateType = _secretServerClient.GetSecretTemplateByName(CertificateTemplateTypeName);

                // Create separate .zip individual files for each certificate being uploaded.
                var options = new ParallelOptions();
                options.MaxDegreeOfParallelism = 32;
                Parallel.ForEach(certsToExport, options, (cert) =>
                {
                    // Create a folder for the cert.
                    var certFolderPath = Path.Combine(secretImportZipPath, cert.Thumbprint);
                    if (!Directory.Exists(certFolderPath))
                    {
                        Directory.CreateDirectory(certFolderPath);
                    }

                    // Copy all of the certs for the chain
                    var currentCert = cert;
                    Console.WriteLine($"Working on {cert.Name}");
                    do
                    {
                        // Don't export this cert because it didn't exist in the stores of the remote machines.
                        if (cert.FileName == null)
                        {
                            currentCert = currentCert.Parent;
                            continue;
                        }

                        // For each store the cert belongs in.
                        foreach (var store in cert.Stores)
                        {
                            // Export certificates to the appropriate place and store folder.
                            var outputDirectory = Path.Combine(certFolderPath, store.StoreName);
                            if (!Directory.Exists(outputDirectory))
                            {
                                Directory.CreateDirectory(outputDirectory);
                            }

                            var password = store.HasPrivateKey ? cert.Password : null;
                            CertificateHelper.ExportCertificate(cert.Certificate, outputDirectory, password);
                        }

                        // Move along to the next cert in the chain.
                        currentCert = currentCert.Parent;
                    } while (currentCert != null);

                    // Zip up the cert for upload to secret.
                    var outputZipPath = Path.Combine(secretImportZipPath, $"{cert.Thumbprint}.zip");
                    ZipFile.CreateFromDirectory(certFolderPath, outputZipPath);

                    var currentZipHash = "";
                    using (var stream = File.OpenRead(outputZipPath))
                    {
                        currentZipHash = Extensions.GetMd5HashString(stream);
                    }

                    // Figure out what environment subfolder the certificate is going in on the secret server.
                    var serverNames = cert.Servers.Select(serverInfoKV => serverInfoKV.Key.ToLower());

                    var appServerNames = new string[] { "vma", "app", "fab", "mic" };
                    var webServerNames = new string[] { "vmw", "web" };
                    bool onApps = appServerNames.Any(type => serverNames.Any(serverName => serverName.Contains(type)));
                    bool onWebs = webServerNames.Any(type => serverNames.Any(serverName => serverName.Contains(type)));
                    bool onBothWebsAndApps = onApps && onWebs;

                    // Determine the types of environments that this cert exists in.
                    // We duplicate certs for each environment. It's too reckless to have a "every environment type" common folder.
                    var environmentTypes = cert.Environments
                        .Select(e => e.Value.EnvironmentType.ToLower())
                        .Distinct()
                        .Select(et => char.ToUpper(et.ElementAt(0)) + et.Substring(1)); // Upper case environment type names.

                    foreach (var environmentType in environmentTypes)
                    {
                        // Build secret server folder path to create the secret.

                        // Determine if the cert is on multiple pods within an environment type.
                        var environments = cert.Environments.Where(e => e.Value.EnvironmentType.ToLower() == environmentType.ToLower());
                        bool onMultiplePods = environments.Count() >= 2;

                        var secretServerFolderPath = Path.Combine(baseSecretFolder, environmentType);

                        if (onMultiplePods)
                        {
                            secretServerFolderPath = Path.Combine(secretServerFolderPath, "Common");
                        }
                        else if (environmentType == "Production")
                        {
                            var matches = Regex.Matches(environments.First().Value.Name, majorPodRegex);
                            string majorPod = matches[0].Captures[0].Value.Trim();

                            secretServerFolderPath = Path.Combine(secretServerFolderPath, majorPod);
                        }

                        string serverFolder = string.Empty;
                        if (onBothWebsAndApps)
                        {
                            serverFolder = "All";
                        }
                        else if (onWebs)
                        {
                            serverFolder = "Web";
                        }
                        else
                        {
                            serverFolder = "App";
                        }

                        secretServerFolderPath = Path.Combine(secretServerFolderPath, serverFolder);

                        var fullSecretPath = Path.Combine(secretServerFolderPath, cert.UniqueName);
                        var folder = _secretServerClient.GetOrAddFolderAsync(secretServerFolderPath).GetAwaiter().GetResult();

                        // Figure out if the secret already exists for the cert.
                        var secretName = cert.UniqueName;
                        if (allSecrets.Any(existingSecret => existingSecret.FolderID == folder.ID && string.Equals(existingSecret.Name, secretName, StringComparison.OrdinalIgnoreCase)))
                        {
                            continue;
                        }

                        // Create the secret.
                        var secretStub = _secretServerClient.CreateSecretStubByTemplateIDAsync(secretTemplateType.ID, secretName + "-" + folder.ID, folder.ID).GetAwaiter().GetResult();
                        var expiration = cert.Certificate.NotAfter.ToString();

                        // Fill out details about the cert.
                        secretStub["Import Password"] = cert.Password;
                        secretStub["Certificate Name"] = secretName;
                        secretStub["Thumbprint"] = cert.Thumbprint;
                        secretStub["ExpirationDate"] = expiration;
                        secretStub["File Hash"] = currentZipHash;

                        var foundCert = _secretServerClient.FindSecretByName(secretName);
                        if (foundCert != null)
                        {
                            Console.WriteLine($"Secret exists {secretName}");
                        }
                        else
                        {
                            try
                            {
                                // Create the secret.
                                var secret = _secretServerClient.CreateSecret(secretStub).GetAwaiter().GetResult();

                                // Upload the cert .zip.
                                _secretServerClient.UploadFile(secret, outputZipPath).GetAwaiter().GetResult();
                            }
                            catch (Exception e)
                            {
                                Console.WriteLine("{0} Exception caught.", e.Message);
                            }
                        }
                    }
                });
            }
            finally
            {
                // Clean up the cert directory.
                if (Directory.Exists(secretImportZipPath))
                {
                    Directory.Delete(secretImportZipPath, true);
                }
            }
        }
    }
}