diff options
Diffstat (limited to 'sign-ca.in')
| -rwxr-xr-x | sign-ca.in | 71 |
1 files changed, 37 insertions, 34 deletions
@@ -14,50 +14,53 @@ if [ -n "${ca_user}" ] \ exec su "${ca_user}" -c "$0" fi +move_old_ca() { + mv \ + '#ETCDIR#/simple-pki/ca/'"$1"'.crt' \ + '#ETCDIR#/simple-pki/ca/'"$1"'.old.crt' + rm -rf --one-file-system \ + '#ETCDIR#/simple-pki/ca/'"$1"'.old' + mv \ + '#ETCDIR#/simple-pki/ca/'"$1" \ + '#ETCDIR#/simple-pki/ca/'"$1"'.old' + find '#ETCDIR#/simple-pki/ca/'"$1"'.old' \ + -type f \ + -name "$1"'.*' \ + | sed 's@^\(.*/'"$1"'\)\(\..*\)$@\0 \1.old\2@' \ + | while read -r from to; do + mv "${from}" "${to}" + done +} + +level_ground_for_new_ca() { + install -d -m0755 '#ETCDIR#/simple-pki/ca/'"$1"'/db' + install -d -m0700 '#ETCDIR#/simple-pki/ca/'"$1"'/private' + touch \ + '#ETCDIR#/simple-pki/ca/'"$1"'/db/'"$1"'.db' \ + '#ETCDIR#/simple-pki/ca/'"$1"'/db/'"$1"'.db.attr' + echo '01' \ + |tee '#ETCDIR#/simple-pki/ca/'"$1"'/db/'"$1"'.crt.srl' \ + >'#ETCDIR#/simple-pki/ca/'"$1"'/db/'"$1"'.crl.srl' +} + if [ -f '#ETCDIR#/simple-pki/ca/root-ca.crt' ]; then - if [ ! -f '#ETCDIR#/simple-pki/ca/root-ca.crt.old' ] \ - || [ "$(stat -c%Y '#ETCDIR#/simple-pki/ca/root-ca.crt.old')" -lt "$(($(date +%s)-60*60*24*ca_keep_duration))" ]; then - mv \ - '#ETCDIR#/simple-pki/ca/root-ca.crt' \ - '#ETCDIR#/simple-pki/ca/root-ca.crt.old' - rm -rf --one-file-system \ - '#ETCDIR#/simple-pki/ca/root-ca.old' - mv \ - '#ETCDIR#/simple-pki/ca/root-ca' \ - '#ETCDIR#/simple-pki/ca/root-ca.old' - install -d -m0755 '#ETCDIR#/simple-pki/ca/root-ca/db' - install -d -m0700 '#ETCDIR#/simple-pki/ca/root-ca/private' - touch \ - '#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.db' \ - '#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.db.attr' - echo '01' \ - |tee '#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.crt.srl' \ - >'#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.crl.srl' + if [ ! -f '#ETCDIR#/simple-pki/ca/root-ca.old.crt' ] \ + || [ "$(stat -c%Y '#ETCDIR#/simple-pki/ca/root-ca.old.crt')" -lt "$(($(date +%s)-60*60*24*ca_keep_duration))" ]; then + move_old_ca 'root-ca' else >&2 echo 'nothing to do: "old" root certificate is too new' exit fi fi +level_ground_for_new_ca 'root-ca' + if [ -f '#ETCDIR#/simple-pki/ca/signing-ca.crt' ]; then - mv \ - '#ETCDIR#/simple-pki/ca/signing-ca.crt' \ - '#ETCDIR#/simple-pki/ca/signing-ca.crt.old' - rm -rf --one-file-system \ - '#ETCDIR#/simple-pki/ca/signing-ca.old' - mv \ - '#ETCDIR#/simple-pki/ca/signing-ca' \ - '#ETCDIR#/simple-pki/ca/signing-ca.old' - install -d -m0755 '#ETCDIR#/simple-pki/ca/signing-ca/db' - install -d -m0700 '#ETCDIR#/simple-pki/ca/signing-ca/private' - touch \ - '#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.db' \ - '#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.db.attr' - echo '01' \ - |tee '#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.crt.srl' \ - >'#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.crl.srl' + move_old_ca 'signing-ca' fi +level_ground_for_new_ca 'signing-ca' + CA=root-ca openssl req -new \ -config '#ETCDIR#/simple-pki/ca-ssl.conf' \ -out '#ETCDIR#/simple-pki/ca/root-ca.csr' \ |