support relocatable ca roots

[stack/cam.git] / cam / ca.py

diff --git a/cam/ca.py b/cam/ca.py
index a14075c..84e9b4c 100644 (file)
--- a/cam/ca.py
+++ b/cam/ca.py
@@ -101,12 +101,14 @@ class CA(object):
             csr_file = os.path.join(tmpdir, 'ca.csr')
             log.info('creating new RSA CA CSR')
             openssl_wrap.run_with_config(
-                self.files.conf, 'req', '-new',
+                self.basedir, self.files.conf,
+                'req', '-new',
                 '-passout', 'pass:%s' % self._getpw(),
                 '-keyout', self.files.private_key, '-out', csr_file)
             log.info('self-signing RSA CA certificate')
             openssl_wrap.run_with_config(
-                self.files.conf, 'ca', '-keyfile', self.files.private_key,
+                self.basedir, self.files.conf,
+                'ca', '-keyfile', self.files.private_key,
                 '-key', self._getpw(),
                 '-extensions', 'v3_ca', '-out', self.files.public_key,
                 '-days', self.config.get('days', self.config['default_days']),
@@ -127,14 +129,16 @@ class CA(object):
     def gencrl(self):
         log.info('generating CRL')
         openssl_wrap.run_with_config(
-            self.files.conf, 'ca', '-gencrl', '-out', self.files.crl,
+            self.basedir, self.files.conf,
+            'ca', '-gencrl', '-out', self.files.crl,
             '-key', self._getpw())
         os.chmod(self.files.crl, 0644)
 
     def revoke(self, cert):
         log.info('revoking certificate %s', cert.name)
         openssl_wrap.run_with_config(
-            self.files.conf, 'ca', '-revoke', cert.public_key_file,
+            self.basedir, self.files.conf,
+            'ca', '-revoke', cert.public_key_file,
             '-key', self._getpw())
         self.gencrl()
 
@@ -162,11 +166,13 @@ class CA(object):
             utils.render(conf_file, 'openssl_config', conf)
             utils.render(ext_file, 'ext_config', conf)
             openssl_wrap.run_with_config(
-                conf_file, 'req', '-new', '-keyout', cert.private_key_file,
+                self.basedir, conf_file,
+                'req', '-new', '-keyout', cert.private_key_file,
                 '-nodes', '-out', csr_file)
             os.chmod(cert.private_key_file, 0600)
             openssl_wrap.run_with_config(
-                conf_file, 'ca', '-days', conf['days'],
+                self.basedir, conf_file,
+                'ca', '-days', conf['days'],
                 '-key', self._getpw(),
                 '-policy', 'policy_anything', '-out', cert.public_key_file,
                 '-extfile', ext_file, '-infiles', csr_file)