diff options
| -rw-r--r-- | Makefile | 12 | ||||
| -rwxr-xr-x | sign-ca.in | 26 |
2 files changed, 28 insertions, 10 deletions
@@ -46,16 +46,8 @@ install-ca: install -D -m0755 -t $(DESTDIR)$(BINDIR) sign-ca sign-request install -D -m0644 -t $(DESTDIR)$(ETCDIR)/simple-pki etc/ca.conf etc/ca-ssl.conf install -D -m0644 -t $(DESTDIR)$(LIBDIR)/systemd/system sign-ca.service sign-ca.timer - install -d -m0755 $(DESTDIR)$(ETCDIR)/simple-pki/ca/root-ca/db $(DESTDIR)$(ETCDIR)/simple-pki/ca/signing-ca/db $(DESTDIR)$(ETCDIR)/simple-pki/crl $(DESTDIR)$(ETCDIR)/simple-pki/certs - install -d -m0700 $(DESTDIR)$(ETCDIR)/simple-pki/ca/root-ca/private $(DESTDIR)$(ETCDIR)/simple-pki/ca/signing-ca/private - install -D -m0644 /dev/null $(DESTDIR)$(ETCDIR)/simple-pki/ca/root-ca/db/root-ca.db - install -D -m0644 /dev/null $(DESTDIR)$(ETCDIR)/simple-pki/ca/signing-ca/db/signing-ca.db - install -D -m0644 /dev/null $(DESTDIR)$(ETCDIR)/simple-pki/ca/root-ca/db/root-ca.db.attr - install -D -m0644 /dev/null $(DESTDIR)$(ETCDIR)/simple-pki/ca/signing-ca/db/signing-ca.db.attr - echo 01 | install -D -m0644 /dev/stdin $(DESTDIR)$(ETCDIR)/simple-pki/ca/root-ca/db/root-ca.crt.srl - echo 01 | install -D -m0644 /dev/stdin $(DESTDIR)$(ETCDIR)/simple-pki/ca/signing-ca/db/signing-ca.crt.srl - echo 01 | install -D -m0644 /dev/stdin $(DESTDIR)$(ETCDIR)/simple-pki/ca/root-ca/db/root-ca.crl.srl - echo 01 | install -D -m0644 /dev/stdin $(DESTDIR)$(ETCDIR)/simple-pki/ca/signing-ca/db/signing-ca.crl.srl + install -d -m0755 $(DESTDIR)$(ETCDIR)/simple-pki/ca/signing-ca/db $(DESTDIR)$(ETCDIR)/simple-pki/crl $(DESTDIR)$(ETCDIR)/simple-pki/certs + install -d -m0700 $(DESTDIR)$(ETCDIR)/simple-pki/ca/signing-ca/private install-cb: install -D -m0755 -t $(DESTDIR)$(BINDIR) rotate-keys @@ -20,6 +20,19 @@ if [ -f '#ETCDIR#/simple-pki/ca/root-ca.crt' ]; then mv \ '#ETCDIR#/simple-pki/ca/root-ca.crt' \ '#ETCDIR#/simple-pki/ca/root-ca.crt.old' + rm -rf --one-file-system \ + '#ETCDIR#/simple-pki/ca/root-ca.old' + mv \ + '#ETCDIR#/simple-pki/ca/root-ca' \ + '#ETCDIR#/simple-pki/ca/root-ca.old' + install -d -m0755 '#ETCDIR#/simple-pki/ca/root-ca/db' + install -d -m0700 '#ETCDIR#/simple-pki/ca/root-ca/private' + touch \ + '#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.db' \ + '#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.db.attr' + echo '01' \ + |tee '#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.crt.srl' \ + >'#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.crl.srl' else >&2 echo 'nothing to do: "old" root certificate is too new' exit @@ -30,6 +43,19 @@ if [ -f '#ETCDIR#/simple-pki/ca/signing-ca.crt' ]; then mv \ '#ETCDIR#/simple-pki/ca/signing-ca.crt' \ '#ETCDIR#/simple-pki/ca/signing-ca.crt.old' + rm -rf --one-file-system \ + '#ETCDIR#/simple-pki/ca/signing-ca.old' + mv \ + '#ETCDIR#/simple-pki/ca/signing-ca' \ + '#ETCDIR#/simple-pki/ca/signing-ca.old' + install -d -m0755 '#ETCDIR#/simple-pki/ca/signing-ca/db' + install -d -m0700 '#ETCDIR#/simple-pki/ca/signing-ca/private' + touch \ + '#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.db' \ + '#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.db.attr' + echo '01' \ + |tee '#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.crt.srl' \ + >'#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.crl.srl' fi CA=root-ca openssl req -new \ |