Commit 85e20677 authored by ale's avatar ale

ensure that the generated CRL is in DER format

parent ff933c36
......@@ -34,7 +34,7 @@ class CA(object):
conf='conf/ca.conf',
public_key='public/ca.pem',
private_key='private/ca.key',
crl='public/crl.pem',
crl='public/ca.crl',
serial='serial',
crlnumber='crlnumber',
index='index')
......@@ -128,10 +128,17 @@ class CA(object):
def gencrl(self):
log.info('generating CRL')
# Write the CRL in PEM format to a temporary file.
tmpf = self.files.crl + '.tmp'
openssl_wrap.run_with_config(
self.basedir, self.files.conf,
'ca', '-gencrl', '-out', self.files.crl,
'ca', '-gencrl', '-out', tmpf,
'-key', self._getpw())
# Convert to DER format for distribution.
openssl_wrap.run(
'crl', '-inform', 'PEM', '-outform', 'DER',
'-in', tmpf, '-out', self.files.crl)
os.remove(tmpf)
os.chmod(self.files.crl, 0644)
def revoke(self, cert):
......
......@@ -54,4 +54,4 @@ class CATest(unittest.TestCase):
cert = CertStub('test', 'www.test.com', self.tmpdir)
self.ca.generate(cert)
self.ca.revoke(cert)
self.assertTrue(os.path.exists(os.path.join(self.tmpdir, 'public/crl.pem')))
self.assertTrue(os.path.exists(os.path.join(self.tmpdir, 'public/ca.crl')))
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment