ensure that the generated CRL is in DER format

[stack/cam.git] / cam / ca.py

diff --git a/cam/ca.py b/cam/ca.py
index 84e9b4c..72ae773 100644 (file)
--- a/cam/ca.py
+++ b/cam/ca.py
@@ -34,7 +34,7 @@ class CA(object):
                               conf='conf/ca.conf',
                               public_key='public/ca.pem',
                               private_key='private/ca.key',
-                              crl='public/crl.pem',
+                              crl='public/ca.crl',
                               serial='serial',
                               crlnumber='crlnumber',
                               index='index')
@@ -128,10 +128,17 @@ class CA(object):
 
     def gencrl(self):
         log.info('generating CRL')
+        # Write the CRL in PEM format to a temporary file.
+        tmpf = self.files.crl + '.tmp'
         openssl_wrap.run_with_config(
             self.basedir, self.files.conf,
-            'ca', '-gencrl', '-out', self.files.crl,
+            'ca', '-gencrl', '-out', tmpf,
             '-key', self._getpw())
+        # Convert to DER format for distribution.
+        openssl_wrap.run(
+            'crl', '-inform', 'PEM', '-outform', 'DER',
+            '-in', tmpf, '-out', self.files.crl)
+        os.remove(tmpf)
         os.chmod(self.files.crl, 0644)
 
     def revoke(self, cert):