Commit 85e20677 authored by ale's avatar ale

ensure that the generated CRL is in DER format

parent ff933c36
...@@ -34,7 +34,7 @@ class CA(object): ...@@ -34,7 +34,7 @@ class CA(object):
conf='conf/ca.conf', conf='conf/ca.conf',
public_key='public/ca.pem', public_key='public/ca.pem',
private_key='private/ca.key', private_key='private/ca.key',
crl='public/crl.pem', crl='public/ca.crl',
serial='serial', serial='serial',
crlnumber='crlnumber', crlnumber='crlnumber',
index='index') index='index')
...@@ -128,10 +128,17 @@ class CA(object): ...@@ -128,10 +128,17 @@ class CA(object):
def gencrl(self): def gencrl(self):
log.info('generating CRL') log.info('generating CRL')
# Write the CRL in PEM format to a temporary file.
tmpf = self.files.crl + '.tmp'
openssl_wrap.run_with_config( openssl_wrap.run_with_config(
self.basedir, self.files.conf, self.basedir, self.files.conf,
'ca', '-gencrl', '-out', self.files.crl, 'ca', '-gencrl', '-out', tmpf,
'-key', self._getpw()) '-key', self._getpw())
# Convert to DER format for distribution.
openssl_wrap.run(
'crl', '-inform', 'PEM', '-outform', 'DER',
'-in', tmpf, '-out', self.files.crl)
os.remove(tmpf)
os.chmod(self.files.crl, 0644) os.chmod(self.files.crl, 0644)
def revoke(self, cert): def revoke(self, cert):
......
...@@ -54,4 +54,4 @@ class CATest(unittest.TestCase): ...@@ -54,4 +54,4 @@ class CATest(unittest.TestCase):
cert = CertStub('test', 'www.test.com', self.tmpdir) cert = CertStub('test', 'www.test.com', self.tmpdir)
self.ca.generate(cert) self.ca.generate(cert)
self.ca.revoke(cert) self.ca.revoke(cert)
self.assertTrue(os.path.exists(os.path.join(self.tmpdir, 'public/crl.pem'))) self.assertTrue(os.path.exists(os.path.join(self.tmpdir, 'public/ca.crl')))
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment