give README a proper file extension so that it renders correctly

[stack/cam.git] / cam / ca.py

diff --git a/cam/ca.py b/cam/ca.py
index a19835f..f870389 100644 (file)
--- a/cam/ca.py
+++ b/cam/ca.py
@@ -28,7 +28,7 @@ class CA(object):
         self.basedir = basedir
         self.config = {'basedir': basedir, 'default_days': '365', 'ou': 'CA',
                        'days': '3650', 'country': 'XX', 'crl_url': '',
-                       'bits': '4096'}
+                       'signature_algorithm': 'sha1', 'bits': '2048'}
         self.config.update(config)
         self.files = _CAFiles(basedir, 
                               conf='conf/ca.conf',
@@ -113,6 +113,7 @@ class CA(object):
                 self.basedir, self.files.conf,
                 'ca', '-keyfile', self.files.private_key,
                 '-key', self._getpw(),
+                '-md', self.config['signature_algorithm'],
                 '-extensions', 'v3_ca', '-out', self.files.public_key,
                 '-days', self.config.get('days', self.config['default_days']),
                 '-selfsign', '-infiles', csr_file)
@@ -160,7 +161,10 @@ class CA(object):
 
         expiry = cert.get_expiration_date()
         if expiry and expiry > time.time():
-            log.warn('certificate is still valid, revoking previous version')
+            log.warn('certificate is still valid')
+
+        if cert.exists():
+            log.warn('revoking previous version')
             self.revoke(cert)
 
         log.info('generating new certificate %s', cert.name)
@@ -169,7 +173,7 @@ class CA(object):
             csr_file = os.path.join(tmpdir, '%s.csr' % cert.name)
             conf_file = os.path.join(tmpdir, '%s.conf' % cert.name)
             ext_file = os.path.join(tmpdir, '%s-ext.conf' % cert.name)
-            conf = {}
+            conf = {'usage': 'client, server'}
             conf.update(self.config)
             conf['cn'] = cert.cn
             conf['days'] = cert.days or self.config['default_days']
@@ -189,6 +193,7 @@ class CA(object):
                 self.basedir, conf_file,
                 'ca', '-days', conf['days'],
                 '-key', self._getpw(),
+                '-md', self.config['signature_algorithm'],
                 '-policy', 'policy_anything', '-out', cert.public_key_file,
                 '-extfile', ext_file, '-infiles', csr_file)
         finally: