always revoke the certificate, even if it is already expired

[stack/cam.git] / cam / ca.py

diff --git a/cam/ca.py b/cam/ca.py
index f8a202f..0bf7fcf 100644 (file)
--- a/cam/ca.py
+++ b/cam/ca.py
@@ -160,7 +160,10 @@ class CA(object):
 
         expiry = cert.get_expiration_date()
         if expiry and expiry > time.time():
-            log.warn('certificate is still valid, revoking previous version')
+            log.warn('certificate is still valid')
+
+        if cert.exists():
+            log.warn('revoking previous version')
             self.revoke(cert)
 
         log.info('generating new certificate %s', cert.name)