From 85e20677448e1e8f2216d5c0d884ece08ab0cbd7 Mon Sep 17 00:00:00 2001 From: ale Date: Mon, 10 Dec 2012 19:51:32 +0000 Subject: [PATCH] ensure that the generated CRL is in DER format --- cam/ca.py | 11 +++++++++-- cam/tests/test_ca.py | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/cam/ca.py b/cam/ca.py index 84e9b4c..72ae773 100644 --- a/cam/ca.py +++ b/cam/ca.py @@ -34,7 +34,7 @@ class CA(object): conf='conf/ca.conf', public_key='public/ca.pem', private_key='private/ca.key', - crl='public/crl.pem', + crl='public/ca.crl', serial='serial', crlnumber='crlnumber', index='index') @@ -128,10 +128,17 @@ class CA(object): def gencrl(self): log.info('generating CRL') + # Write the CRL in PEM format to a temporary file. + tmpf = self.files.crl + '.tmp' openssl_wrap.run_with_config( self.basedir, self.files.conf, - 'ca', '-gencrl', '-out', self.files.crl, + 'ca', '-gencrl', '-out', tmpf, '-key', self._getpw()) + # Convert to DER format for distribution. + openssl_wrap.run( + 'crl', '-inform', 'PEM', '-outform', 'DER', + '-in', tmpf, '-out', self.files.crl) + os.remove(tmpf) os.chmod(self.files.crl, 0644) def revoke(self, cert): diff --git a/cam/tests/test_ca.py b/cam/tests/test_ca.py index c443fe4..35c61a3 100644 --- a/cam/tests/test_ca.py +++ b/cam/tests/test_ca.py @@ -54,4 +54,4 @@ class CATest(unittest.TestCase): cert = CertStub('test', 'www.test.com', self.tmpdir) self.ca.generate(cert) self.ca.revoke(cert) - self.assertTrue(os.path.exists(os.path.join(self.tmpdir, 'public/crl.pem'))) + self.assertTrue(os.path.exists(os.path.join(self.tmpdir, 'public/ca.crl'))) -- 2.20.1