From 7764d70477823876fdebb9dcd7586d26beeee80c Mon Sep 17 00:00:00 2001
From: Erich Eckner <git@eckner.net>
Date: Mon, 9 Dec 2019 10:11:59 +0100
Subject: sign-ca.in: old root-ca and old signing-ca should get .old suffix
 behind "ca" to be still operable

---
 sign-ca.in | 71 ++++++++++++++++++++++++++++++++------------------------------
 1 file changed, 37 insertions(+), 34 deletions(-)

diff --git a/sign-ca.in b/sign-ca.in
index 9d1bb43..f383e44 100755
--- a/sign-ca.in
+++ b/sign-ca.in
@@ -14,50 +14,53 @@ if [ -n "${ca_user}" ] \
   exec su "${ca_user}" -c "$0"
 fi
 
+move_old_ca() {
+  mv \
+    '#ETCDIR#/simple-pki/ca/'"$1"'.crt' \
+    '#ETCDIR#/simple-pki/ca/'"$1"'.old.crt'
+  rm -rf --one-file-system \
+    '#ETCDIR#/simple-pki/ca/'"$1"'.old'
+  mv \
+    '#ETCDIR#/simple-pki/ca/'"$1" \
+    '#ETCDIR#/simple-pki/ca/'"$1"'.old'
+  find '#ETCDIR#/simple-pki/ca/'"$1"'.old' \
+    -type f \
+    -name "$1"'.*' \
+  | sed 's@^\(.*/'"$1"'\)\(\..*\)$@\0 \1.old\2@' \
+  | while read -r from to; do
+    mv "${from}" "${to}"
+  done
+}
+
+level_ground_for_new_ca() {
+  install -d -m0755 '#ETCDIR#/simple-pki/ca/'"$1"'/db'
+  install -d -m0700 '#ETCDIR#/simple-pki/ca/'"$1"'/private'
+  touch \
+    '#ETCDIR#/simple-pki/ca/'"$1"'/db/'"$1"'.db' \
+    '#ETCDIR#/simple-pki/ca/'"$1"'/db/'"$1"'.db.attr'
+  echo '01' \
+    |tee '#ETCDIR#/simple-pki/ca/'"$1"'/db/'"$1"'.crt.srl' \
+    >'#ETCDIR#/simple-pki/ca/'"$1"'/db/'"$1"'.crl.srl'
+}
+
 if [ -f '#ETCDIR#/simple-pki/ca/root-ca.crt' ]; then
-  if [ ! -f '#ETCDIR#/simple-pki/ca/root-ca.crt.old' ] \
-  || [ "$(stat -c%Y '#ETCDIR#/simple-pki/ca/root-ca.crt.old')" -lt "$(($(date +%s)-60*60*24*ca_keep_duration))" ]; then
-    mv \
-      '#ETCDIR#/simple-pki/ca/root-ca.crt' \
-      '#ETCDIR#/simple-pki/ca/root-ca.crt.old'
-    rm -rf --one-file-system \
-      '#ETCDIR#/simple-pki/ca/root-ca.old'
-    mv \
-      '#ETCDIR#/simple-pki/ca/root-ca' \
-      '#ETCDIR#/simple-pki/ca/root-ca.old'
-    install -d -m0755 '#ETCDIR#/simple-pki/ca/root-ca/db'
-    install -d -m0700 '#ETCDIR#/simple-pki/ca/root-ca/private'
-    touch \
-      '#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.db' \
-      '#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.db.attr'
-    echo '01' \
-      |tee '#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.crt.srl' \
-      >'#ETCDIR#/simple-pki/ca/root-ca/db/root-ca.crl.srl'
+  if [ ! -f '#ETCDIR#/simple-pki/ca/root-ca.old.crt' ] \
+  || [ "$(stat -c%Y '#ETCDIR#/simple-pki/ca/root-ca.old.crt')" -lt "$(($(date +%s)-60*60*24*ca_keep_duration))" ]; then
+    move_old_ca 'root-ca'
   else
     >&2 echo 'nothing to do: "old" root certificate is too new'
     exit
   fi
 fi
 
+level_ground_for_new_ca 'root-ca'
+
 if [ -f '#ETCDIR#/simple-pki/ca/signing-ca.crt' ]; then
-  mv \
-    '#ETCDIR#/simple-pki/ca/signing-ca.crt' \
-    '#ETCDIR#/simple-pki/ca/signing-ca.crt.old'
-  rm -rf --one-file-system \
-    '#ETCDIR#/simple-pki/ca/signing-ca.old'
-  mv \
-    '#ETCDIR#/simple-pki/ca/signing-ca' \
-    '#ETCDIR#/simple-pki/ca/signing-ca.old'
-  install -d -m0755 '#ETCDIR#/simple-pki/ca/signing-ca/db'
-  install -d -m0700 '#ETCDIR#/simple-pki/ca/signing-ca/private'
-  touch \
-    '#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.db' \
-    '#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.db.attr'
-  echo '01' \
-    |tee '#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.crt.srl' \
-    >'#ETCDIR#/simple-pki/ca/signing-ca/db/signing-ca.crl.srl'
+  move_old_ca 'signing-ca'
 fi
 
+level_ground_for_new_ca 'signing-ca'
+
 CA=root-ca openssl req -new \
   -config '#ETCDIR#/simple-pki/ca-ssl.conf' \
   -out '#ETCDIR#/simple-pki/ca/root-ca.csr' \
-- 
cgit v1.2.3-54-g00ecf