summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--etc/ca.conf3
-rwxr-xr-xsign-request.in9
2 files changed, 11 insertions, 1 deletions
diff --git a/etc/ca.conf b/etc/ca.conf
index aa8b4ba..2dccb42 100644
--- a/etc/ca.conf
+++ b/etc/ca.conf
@@ -3,6 +3,9 @@
# how long do we keep the old signature of the root-ca (days)
ca_keep_duration=60
+# how long do we wait before using the new root-ca (days)
+ca_min_duration=10
+
# which system user owns the ca
ca_user='erich'
diff --git a/sign-request.in b/sign-request.in
index 52b481e..0185cf4 100755
--- a/sign-request.in
+++ b/sign-request.in
@@ -14,6 +14,13 @@ remove_leading_spaces() {
'
}
+if [ -f '#ETCDIR#/simple-pki/ca/root-ca.old.crt' ] \
+&& [ "$(stat -c%Y '#ETCDIR#/simple-pki/ca/root-ca.old.crt')" -ge "$(($(date +%s)-60*60*24*ca_min_duration))" ]; then
+ export CA=signing-ca.old
+else
+ export CA=signing-ca
+fi
+
tmp_dir=$(mktemp -d)
trap 'rm -rf --one-file-system "${tmp_dir}"' EXIT
@@ -95,7 +102,7 @@ while read -r csr; do
rm "${csr_local}"
continue
fi
- if ! CA=signing-ca openssl ca -batch -name signing_ca \
+ if ! openssl ca -batch -name signing_ca \
-config '#ETCDIR#/simple-pki/ca-ssl.conf' \
-in "${csr_local}" \
-out "${csr_local%.csr}.crt" \