self.basedir = basedir
self.config = {'basedir': basedir, 'default_days': '365', 'ou': 'CA',
'days': '3650', 'country': 'XX', 'crl_url': '',
- 'bits': '4096'}
+ 'signature_algorithm': 'sha1', 'bits': '2048'}
self.config.update(config)
self.files = _CAFiles(basedir,
conf='conf/ca.conf',
self.basedir, self.files.conf,
'ca', '-keyfile', self.files.private_key,
'-key', self._getpw(),
+ '-md', self.config['signature_algorithm'],
'-extensions', 'v3_ca', '-out', self.files.public_key,
'-days', self.config.get('days', self.config['default_days']),
'-selfsign', '-infiles', csr_file)
expiry = cert.get_expiration_date()
if expiry and expiry > time.time():
- log.warn('certificate is still valid, revoking previous version')
+ log.warn('certificate is still valid')
+
+ if cert.exists():
+ log.warn('revoking previous version')
self.revoke(cert)
log.info('generating new certificate %s', cert.name)
csr_file = os.path.join(tmpdir, '%s.csr' % cert.name)
conf_file = os.path.join(tmpdir, '%s.conf' % cert.name)
ext_file = os.path.join(tmpdir, '%s-ext.conf' % cert.name)
- conf = {}
+ conf = {'usage': 'client, server'}
conf.update(self.config)
conf['cn'] = cert.cn
conf['days'] = cert.days or self.config['default_days']
self.basedir, conf_file,
'ca', '-days', conf['days'],
'-key', self._getpw(),
+ '-md', self.config['signature_algorithm'],
'-policy', 'policy_anything', '-out', cert.public_key_file,
'-extfile', ext_file, '-infiles', csr_file)
finally: