X-Git-Url: https://v.licheni.net/stack/cam.git/blobdiff_plain/112c04e3926d62291efd902a1dcb0b2d24feeb59..2397de7d1d5a2617b9a72e087d4514c7203a3e21:/cam/ca.py

diff --git a/cam/ca.py b/cam/ca.py
index a14075c..f8a202f 100644
--- a/cam/ca.py
+++ b/cam/ca.py
@@ -34,7 +34,7 @@ class CA(object):
                               conf='conf/ca.conf',
                               public_key='public/ca.pem',
                               private_key='private/ca.key',
-                              crl='public/crl.pem',
+                              crl='public/ca.crl',
                               serial='serial',
                               crlnumber='crlnumber',
                               index='index')
@@ -66,6 +66,10 @@ class CA(object):
         fcntl.lockf(self._lockfd, fcntl.LOCK_UN)
         self._lockfd.close()
 
+    def _update_config(self):
+        # Create the OpenSSL configuration file.
+        utils.render(self.files.conf, 'openssl_config', self.config)
+
     def close(self):
         self._unlock()
 
@@ -92,8 +96,7 @@ class CA(object):
             with open(self.files.crlnumber, 'w') as fd:
                 fd.write('01\n')
 
-        # Create the OpenSSL configuration file.
-        utils.render(self.files.conf, 'openssl_config', self.config)
+        self._update_config()
 
         # Generate keys if they do not exist.
         if not os.path.exists(self.files.public_key):
@@ -101,12 +104,14 @@ class CA(object):
             csr_file = os.path.join(tmpdir, 'ca.csr')
             log.info('creating new RSA CA CSR')
             openssl_wrap.run_with_config(
-                self.files.conf, 'req', '-new',
+                self.basedir, self.files.conf,
+                'req', '-new',
                 '-passout', 'pass:%s' % self._getpw(),
                 '-keyout', self.files.private_key, '-out', csr_file)
             log.info('self-signing RSA CA certificate')
             openssl_wrap.run_with_config(
-                self.files.conf, 'ca', '-keyfile', self.files.private_key,
+                self.basedir, self.files.conf,
+                'ca', '-keyfile', self.files.private_key,
                 '-key', self._getpw(),
                 '-extensions', 'v3_ca', '-out', self.files.public_key,
                 '-days', self.config.get('days', self.config['default_days']),
@@ -126,19 +131,33 @@ class CA(object):
 
     def gencrl(self):
         log.info('generating CRL')
+
+        self._update_config()
+
+        # Write the CRL in PEM format to a temporary file.
+        tmpf = self.files.crl + '.tmp'
         openssl_wrap.run_with_config(
-            self.files.conf, 'ca', '-gencrl', '-out', self.files.crl,
+            self.basedir, self.files.conf,
+            'ca', '-gencrl', '-out', tmpf,
             '-key', self._getpw())
+        # Convert to DER format for distribution.
+        openssl_wrap.run(
+            'crl', '-inform', 'PEM', '-outform', 'DER',
+            '-in', tmpf, '-out', self.files.crl)
+        os.remove(tmpf)
         os.chmod(self.files.crl, 0644)
 
     def revoke(self, cert):
         log.info('revoking certificate %s', cert.name)
         openssl_wrap.run_with_config(
-            self.files.conf, 'ca', '-revoke', cert.public_key_file,
+            self.basedir, self.files.conf,
+            'ca', '-revoke', cert.public_key_file,
             '-key', self._getpw())
         self.gencrl()
 
     def generate(self, cert):
+        self._update_config()
+
         expiry = cert.get_expiration_date()
         if expiry and expiry > time.time():
             log.warn('certificate is still valid, revoking previous version')
@@ -150,7 +169,7 @@ class CA(object):
             csr_file = os.path.join(tmpdir, '%s.csr' % cert.name)
             conf_file = os.path.join(tmpdir, '%s.conf' % cert.name)
             ext_file = os.path.join(tmpdir, '%s-ext.conf' % cert.name)
-            conf = {}
+            conf = {'usage': 'client, server'}
             conf.update(self.config)
             conf['cn'] = cert.cn
             conf['days'] = cert.days or self.config['default_days']
@@ -162,11 +181,13 @@ class CA(object):
             utils.render(conf_file, 'openssl_config', conf)
             utils.render(ext_file, 'ext_config', conf)
             openssl_wrap.run_with_config(
-                conf_file, 'req', '-new', '-keyout', cert.private_key_file,
+                self.basedir, conf_file,
+                'req', '-new', '-keyout', cert.private_key_file,
                 '-nodes', '-out', csr_file)
             os.chmod(cert.private_key_file, 0600)
             openssl_wrap.run_with_config(
-                conf_file, 'ca', '-days', conf['days'],
+                self.basedir, conf_file,
+                'ca', '-days', conf['days'],
                 '-key', self._getpw(),
                 '-policy', 'policy_anything', '-out', cert.public_key_file,
                 '-extfile', ext_file, '-infiles', csr_file)