always revoke the certificate, even if it is already expired

[stack/cam.git] / cam / ca.py

diff --git a/cam/ca.py b/cam/ca.py
index 72ae773..0bf7fcf 100644 (file)
--- a/cam/ca.py
+++ b/cam/ca.py
@@ -66,6 +66,10 @@ class CA(object):
         fcntl.lockf(self._lockfd, fcntl.LOCK_UN)
         self._lockfd.close()
 
+    def _update_config(self):
+        # Create the OpenSSL configuration file.
+        utils.render(self.files.conf, 'openssl_config', self.config)
+
     def close(self):
         self._unlock()
 
@@ -92,8 +96,7 @@ class CA(object):
             with open(self.files.crlnumber, 'w') as fd:
                 fd.write('01\n')
 
-        # Create the OpenSSL configuration file.
-        utils.render(self.files.conf, 'openssl_config', self.config)
+        self._update_config()
 
         # Generate keys if they do not exist.
         if not os.path.exists(self.files.public_key):
@@ -128,6 +131,9 @@ class CA(object):
 
     def gencrl(self):
         log.info('generating CRL')
+
+        self._update_config()
+
         # Write the CRL in PEM format to a temporary file.
         tmpf = self.files.crl + '.tmp'
         openssl_wrap.run_with_config(
@@ -150,9 +156,14 @@ class CA(object):
         self.gencrl()
 
     def generate(self, cert):
+        self._update_config()
+
         expiry = cert.get_expiration_date()
         if expiry and expiry > time.time():
-            log.warn('certificate is still valid, revoking previous version')
+            log.warn('certificate is still valid')
+
+        if cert.exists():
+            log.warn('revoking previous version')
             self.revoke(cert)
 
         log.info('generating new certificate %s', cert.name)
@@ -161,7 +172,7 @@ class CA(object):
             csr_file = os.path.join(tmpdir, '%s.csr' % cert.name)
             conf_file = os.path.join(tmpdir, '%s.conf' % cert.name)
             ext_file = os.path.join(tmpdir, '%s-ext.conf' % cert.name)
-            conf = {}
+            conf = {'usage': 'client, server'}
             conf.update(self.config)
             conf['cn'] = cert.cn
             conf['days'] = cert.days or self.config['default_days']