nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add 'show-renew' - List of renewed but not revoked certificates

Browse Source 
Signed-off-by: Richard T Bonhomme <tincantech@protonmail.com>
This commit is contained in:
Richard T Bonhomme 2022-05-07 09:20:28 +01:00
parent 89a5aeedaf
commit 06078cad43
No known key found for this signature in database
GPG Key ID: 2D767DB92FB6C246
1 changed files with 53 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
easyrsa3/easyrsa
View File

@ -2609,8 +2609,15 @@ read_db() {
# do status report for this record
# TODO: renewed-not-revoked
case "$report" in
expire) if [ "$crt_status" = V ]; then expire_status; fi ;;
revoke) if [ "$crt_status" = R ]; then revoke_status; fi ;;
expire) # Certs which expire before EASYRSA_CERT_RENEW days
if [ "$crt_status" = V ]; then expire_status; fi
;;
revoke) # Certs which have been revoked
if [ "$crt_status" = R ]; then revoke_status; fi
;;
renew) # Certs which have been renewed but not revoked
if [ "$crt_status" = V ]; then renew_status; fi
;;
*) die "Unrecognised report: $report"
esac
done < "$db_in"
@ -2653,6 +2660,34 @@ revoke_status() {
"Revoked: $ff_date | Reason: $crt_reason | CN: $crt_cn"
} # => revoke_status()
# Renewed status
renew_status() {
build_ff_date_string "$crt_notAfter"
crt_file="$EASYRSA_PKI/renewed/issued/${crt_cn}.crt"
if [ -e "$crt_file" ]; then
# Use cert date
cert_dates "$crt_file"
# get the serial number of the certificate -> serial=XXXX
renewed_crt_serial="$(easyrsa_openssl x509 -in "$crt_file" -noout -serial)"
# remove the serial= part -> we only need the XXXX part
renewed_crt_serial="${renewed_crt_serial##*=}"
if [ "$crt_serial" = "$renewed_crt_serial" ]; then
# Renewed cert must exist always
printf '%s%s\n' "$crt_status | Serial: $crt_serial | " \
"Expires: $ff_date | CN: $crt_cn"
else
# Cert is valid but not renewed
: # ok - ignore
fi
else
# Cert is valid but no renewed cert exists
: # ok - ignore
fi
} # => renew_status()
# cert status reports
status() {
report="$1"
@ -2684,6 +2719,15 @@ status() {
*) print "Coming soon.."
esac
;;
renew)
case "$in_crt" in
all)
print "Showing certificates which have been renewed but not revoked:"
print
read_db renew ;;
*) print "Coming soon.."
esac
;;
*)
# TODO: renewed-not-revoked
warn "Unrecognised report: $report"
@ -3864,6 +3908,13 @@ case "$cmd" in
status revoke "$@"
fi
;;
show-renew)
if [ -z "$*" ]; then
status renew all
else
status renew "$@"
fi
;;
upgrade)
up23_manage_upgrade_23 "$@"
;;