nik/easyrsa
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make cert renew grace period configurable (default: 30 days)

Browse Source 
Signed-off-by: Xavier Bachelot <xavier@bachelot.org>
This commit is contained in:
Xavier Bachelot 2019-01-28 16:11:57 +01:00
parent 6eff1118f8
commit ff87fb1812
Failed to extract signature
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
easyrsa3/easyrsa
View File

@ -1010,10 +1010,10 @@ at: $crt_in"
)
expire_date=$(date -d "$expire_date" +%s)
allow_renew_date=$(date -d '+30day' +%s)
allow_renew_date=$(date -d "+${EASYRSA_CERT_RENEW}day" +%s)
[ "$expire_date" -lt "$allow_renew_date" ] || die "\
Certificate expires in more than 30 days.
Certificate expires in more than $EASYRSA_CERT_RENEW days.
Renewal not allowed."
# Extract certificate usage from old cert
@ -1488,6 +1488,7 @@ Note: using Easy-RSA configuration from: $vars"
set_var EASYRSA_EC_DIR "$EASYRSA_PKI/ecparams"
set_var EASYRSA_CA_EXPIRE 3650
set_var EASYRSA_CERT_EXPIRE 1080 # new default of 36 months
set_var EASYRSA_CERT_RENEW 30
set_var EASYRSA_CRL_DAYS 180
set_var EASYRSA_NS_SUPPORT no
set_var EASYRSA_NS_COMMENT "Easy-RSA (~VER~) Generated Certificate"

4
easyrsa3/vars.example
View File

@ -127,6 +127,10 @@ fi
# parsed after this timeframe passes. It is only used for an expected next
# publication date.
# How many days before its expiration date a certificate is allowed to be
# renewed?
#set_var EASYRSA_CERT_RENEW 30
#set_var EASYRSA_CRL_DAYS 180
# Support deprecated "Netscape" extensions? (choices "yes" or "no".) The default