ensure that the generated CRL is in DER format

cam/ca.py

@@ -34,7 +34,7 @@ class CA(object):
                               conf='conf/ca.conf',
                               public_key='public/ca.pem',
                               private_key='private/ca.key',
-                              crl='public/crl.pem',
+                              crl='public/ca.crl',
                               serial='serial',
                               crlnumber='crlnumber',
                               index='index')
@@ -128,10 +128,17 @@ class CA(object):
 
     def gencrl(self):
         log.info('generating CRL')
+        # Write the CRL in PEM format to a temporary file.
+        tmpf = self.files.crl + '.tmp'
         openssl_wrap.run_with_config(
             self.basedir, self.files.conf,
-            'ca', '-gencrl', '-out', self.files.crl,
+            'ca', '-gencrl', '-out', tmpf,
             '-key', self._getpw())
+        # Convert to DER format for distribution.
+        openssl_wrap.run(
+            'crl', '-inform', 'PEM', '-outform', 'DER',
+            '-in', tmpf, '-out', self.files.crl)
+        os.remove(tmpf)
         os.chmod(self.files.crl, 0644)
 
     def revoke(self, cert):

cam/tests/test_ca.py

@@ -54,4 +54,4 @@ class CATest(unittest.TestCase):
         cert = CertStub('test', 'www.test.com', self.tmpdir)
         self.ca.generate(cert)
         self.ca.revoke(cert)
-        self.assertTrue(os.path.exists(os.path.join(self.tmpdir, 'public/crl.pem')))
+        self.assertTrue(os.path.exists(os.path.join(self.tmpdir, 'public/ca.crl')))