Commit c378f69c authored by ale's avatar ale

add a method to renew a CA certificate

parent 0bce6d0c
......@@ -20,17 +20,7 @@ class CA(object):
self._init_ca()
self._load_crl()
def _init_ca(self):
key_str, crt_str = self.storage.get_ca()
if key_str:
self.ca_key = crypto.load_privatekey(
crypto.FILETYPE_PEM, key_str)
self.ca_crt = crypto.load_certificate(
crypto.FILETYPE_PEM, crt_str)
self.public_ca_pem = crt_str
else:
log.info('initializing CA certificate and private key')
self.ca_key = certutil.create_rsa_key_pair(self.bits)
def _generate_ca_cert(self):
ca_req = certutil.create_cert_request(
self.ca_key, **(self.ca_subject))
self.ca_crt = certutil.sign_certificate(
......@@ -52,6 +42,26 @@ class CA(object):
crt_str)
self.public_ca_pem = crt_str
def _init_ca(self):
key_str, crt_str = self.storage.get_ca()
if key_str:
self.ca_key = crypto.load_privatekey(
crypto.FILETYPE_PEM, key_str)
self.ca_crt = crypto.load_certificate(
crypto.FILETYPE_PEM, crt_str)
self.public_ca_pem = crt_str
else:
log.info('initializing CA certificate and private key')
self.ca_key = certutil.create_rsa_key_pair(self.bits)
self._generate_ca_cert()
def renew_ca(self):
if not self.ca_key:
log.error('CA private key not available')
return
log.info('renewing CA certificate')
self._generate_ca_cert()
def get_ca(self):
return self.public_ca_pem
......@@ -77,7 +87,7 @@ class CA(object):
crypto.X509Extension('extendedKeyUsage', False,
server and 'serverAuth' or 'clientAuth'),
crypto.X509Extension('nsCertType', False,
server and 'server' or 'client'),
server and 'client, server' or 'client'),
]
cert = certutil.sign_certificate(
req, self.ca_key, self.ca_crt, new_serial, days,
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment