v.licheni.net
/
stack
/
cam.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
always revoke the certificate, even if it is already expired
[stack/cam.git]
/
cam
/
ca.py
diff --git
a/cam/ca.py
b/cam/ca.py
index
84e9b4c
..
0bf7fcf
100644
(file)
--- a/
cam/ca.py
+++ b/
cam/ca.py
@@
-34,7
+34,7
@@
class CA(object):
conf='conf/ca.conf',
public_key='public/ca.pem',
private_key='private/ca.key',
conf='conf/ca.conf',
public_key='public/ca.pem',
private_key='private/ca.key',
- crl='public/c
rl.pem
',
+ crl='public/c
a.crl
',
serial='serial',
crlnumber='crlnumber',
index='index')
serial='serial',
crlnumber='crlnumber',
index='index')
@@
-66,6
+66,10
@@
class CA(object):
fcntl.lockf(self._lockfd, fcntl.LOCK_UN)
self._lockfd.close()
fcntl.lockf(self._lockfd, fcntl.LOCK_UN)
self._lockfd.close()
+ def _update_config(self):
+ # Create the OpenSSL configuration file.
+ utils.render(self.files.conf, 'openssl_config', self.config)
+
def close(self):
self._unlock()
def close(self):
self._unlock()
@@
-92,8
+96,7
@@
class CA(object):
with open(self.files.crlnumber, 'w') as fd:
fd.write('01\n')
with open(self.files.crlnumber, 'w') as fd:
fd.write('01\n')
- # Create the OpenSSL configuration file.
- utils.render(self.files.conf, 'openssl_config', self.config)
+ self._update_config()
# Generate keys if they do not exist.
if not os.path.exists(self.files.public_key):
# Generate keys if they do not exist.
if not os.path.exists(self.files.public_key):
@@
-128,10
+131,20
@@
class CA(object):
def gencrl(self):
log.info('generating CRL')
def gencrl(self):
log.info('generating CRL')
+
+ self._update_config()
+
+ # Write the CRL in PEM format to a temporary file.
+ tmpf = self.files.crl + '.tmp'
openssl_wrap.run_with_config(
self.basedir, self.files.conf,
openssl_wrap.run_with_config(
self.basedir, self.files.conf,
- 'ca', '-gencrl', '-out',
self.files.crl
,
+ 'ca', '-gencrl', '-out',
tmpf
,
'-key', self._getpw())
'-key', self._getpw())
+ # Convert to DER format for distribution.
+ openssl_wrap.run(
+ 'crl', '-inform', 'PEM', '-outform', 'DER',
+ '-in', tmpf, '-out', self.files.crl)
+ os.remove(tmpf)
os.chmod(self.files.crl, 0644)
def revoke(self, cert):
os.chmod(self.files.crl, 0644)
def revoke(self, cert):
@@
-143,9
+156,14
@@
class CA(object):
self.gencrl()
def generate(self, cert):
self.gencrl()
def generate(self, cert):
+ self._update_config()
+
expiry = cert.get_expiration_date()
if expiry and expiry > time.time():
expiry = cert.get_expiration_date()
if expiry and expiry > time.time():
- log.warn('certificate is still valid, revoking previous version')
+ log.warn('certificate is still valid')
+
+ if cert.exists():
+ log.warn('revoking previous version')
self.revoke(cert)
log.info('generating new certificate %s', cert.name)
self.revoke(cert)
log.info('generating new certificate %s', cert.name)
@@
-154,7
+172,7
@@
class CA(object):
csr_file = os.path.join(tmpdir, '%s.csr' % cert.name)
conf_file = os.path.join(tmpdir, '%s.conf' % cert.name)
ext_file = os.path.join(tmpdir, '%s-ext.conf' % cert.name)
csr_file = os.path.join(tmpdir, '%s.csr' % cert.name)
conf_file = os.path.join(tmpdir, '%s.conf' % cert.name)
ext_file = os.path.join(tmpdir, '%s-ext.conf' % cert.name)
- conf = {}
+ conf = {
'usage': 'client, server'
}
conf.update(self.config)
conf['cn'] = cert.cn
conf['days'] = cert.days or self.config['default_days']
conf.update(self.config)
conf['cn'] = cert.cn
conf['days'] = cert.days or self.config['default_days']