v.licheni.net
/
stack
/
cam.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
ensure that the generated CRL is in DER format
[stack/cam.git]
/
cam
/
ca.py
diff --git
a/cam/ca.py
b/cam/ca.py
index
a14075c
..
72ae773
100644
(file)
--- a/
cam/ca.py
+++ b/
cam/ca.py
@@
-34,7
+34,7
@@
class CA(object):
conf='conf/ca.conf',
public_key='public/ca.pem',
private_key='private/ca.key',
conf='conf/ca.conf',
public_key='public/ca.pem',
private_key='private/ca.key',
- crl='public/c
rl.pem
',
+ crl='public/c
a.crl
',
serial='serial',
crlnumber='crlnumber',
index='index')
serial='serial',
crlnumber='crlnumber',
index='index')
@@
-101,12
+101,14
@@
class CA(object):
csr_file = os.path.join(tmpdir, 'ca.csr')
log.info('creating new RSA CA CSR')
openssl_wrap.run_with_config(
csr_file = os.path.join(tmpdir, 'ca.csr')
log.info('creating new RSA CA CSR')
openssl_wrap.run_with_config(
- self.files.conf, 'req', '-new',
+ self.basedir, self.files.conf,
+ 'req', '-new',
'-passout', 'pass:%s' % self._getpw(),
'-keyout', self.files.private_key, '-out', csr_file)
log.info('self-signing RSA CA certificate')
openssl_wrap.run_with_config(
'-passout', 'pass:%s' % self._getpw(),
'-keyout', self.files.private_key, '-out', csr_file)
log.info('self-signing RSA CA certificate')
openssl_wrap.run_with_config(
- self.files.conf, 'ca', '-keyfile', self.files.private_key,
+ self.basedir, self.files.conf,
+ 'ca', '-keyfile', self.files.private_key,
'-key', self._getpw(),
'-extensions', 'v3_ca', '-out', self.files.public_key,
'-days', self.config.get('days', self.config['default_days']),
'-key', self._getpw(),
'-extensions', 'v3_ca', '-out', self.files.public_key,
'-days', self.config.get('days', self.config['default_days']),
@@
-126,15
+128,24
@@
class CA(object):
def gencrl(self):
log.info('generating CRL')
def gencrl(self):
log.info('generating CRL')
+ # Write the CRL in PEM format to a temporary file.
+ tmpf = self.files.crl + '.tmp'
openssl_wrap.run_with_config(
openssl_wrap.run_with_config(
- self.files.conf, 'ca', '-gencrl', '-out', self.files.crl,
+ self.basedir, self.files.conf,
+ 'ca', '-gencrl', '-out', tmpf,
'-key', self._getpw())
'-key', self._getpw())
+ # Convert to DER format for distribution.
+ openssl_wrap.run(
+ 'crl', '-inform', 'PEM', '-outform', 'DER',
+ '-in', tmpf, '-out', self.files.crl)
+ os.remove(tmpf)
os.chmod(self.files.crl, 0644)
def revoke(self, cert):
log.info('revoking certificate %s', cert.name)
openssl_wrap.run_with_config(
os.chmod(self.files.crl, 0644)
def revoke(self, cert):
log.info('revoking certificate %s', cert.name)
openssl_wrap.run_with_config(
- self.files.conf, 'ca', '-revoke', cert.public_key_file,
+ self.basedir, self.files.conf,
+ 'ca', '-revoke', cert.public_key_file,
'-key', self._getpw())
self.gencrl()
'-key', self._getpw())
self.gencrl()
@@
-162,11
+173,13
@@
class CA(object):
utils.render(conf_file, 'openssl_config', conf)
utils.render(ext_file, 'ext_config', conf)
openssl_wrap.run_with_config(
utils.render(conf_file, 'openssl_config', conf)
utils.render(ext_file, 'ext_config', conf)
openssl_wrap.run_with_config(
- conf_file, 'req', '-new', '-keyout', cert.private_key_file,
+ self.basedir, conf_file,
+ 'req', '-new', '-keyout', cert.private_key_file,
'-nodes', '-out', csr_file)
os.chmod(cert.private_key_file, 0600)
openssl_wrap.run_with_config(
'-nodes', '-out', csr_file)
os.chmod(cert.private_key_file, 0600)
openssl_wrap.run_with_config(
- conf_file, 'ca', '-days', conf['days'],
+ self.basedir, conf_file,
+ 'ca', '-days', conf['days'],
'-key', self._getpw(),
'-policy', 'policy_anything', '-out', cert.public_key_file,
'-extfile', ext_file, '-infiles', csr_file)
'-key', self._getpw(),
'-policy', 'policy_anything', '-out', cert.public_key_file,
'-extfile', ext_file, '-infiles', csr_file)