Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Status reports: Additional check, Use SSL to determine expiration #940

Merged
merged 1 commit into from
Apr 18, 2023
Merged

Status reports: Additional check, Use SSL to determine expiration #940

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion easyrsa3/easyrsa
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4405,7 +4405,12 @@ read_db() {

# Expire status
expire_status() {
# The certificate for CN ahould exist but may not
unset -v expire_status_cert_exists
pre_expire_window_s="$((
EASYRSA_PRE_EXPIRY_WINDOW * 60*60*24
))"

# The certificate for CN should exist but may not
unset -v expire_status_cert_exists
if [ -e "$cert_issued" ]; then

Expand Down Expand Up @@ -4461,6 +4466,22 @@ expire_status: FALL-BACK completed"
# Only verify if there is a certificate
if [ "$expire_status_cert_exists" ]; then

# Check cert expiry against window
# openssl direct call because error is expected
if "$EASYRSA_OPENSSL" x509 -in "$cert_issued" \
-noout -checkend "$pre_expire_window_s" \
1>/dev/null
then
expire_msg="will NOT expire"
will_not_expire=1
unset -v will_expire
else
expire_msg="will expire"
will_expire=1
unset -v will_not_expire
fi
easyrsa_debug "expire_status: SSL checkend: $expire_msg"

# Get timestamp seconds for certificate expiry date
# Redirection for errout is not necessary here
cert_expire_date_s=
Expand Down Expand Up @@ -4564,6 +4585,10 @@ expire_status: FALL-BACK completed"
# Compare and print output
if [ "$cert_expire_date_s" -lt "$cutoff_date_s" ]; then
# Cert expires in less than grace period
if [ "$will_not_expire" ]; then
die "\
EasyRSA: will expire - SSL: will NOT expire"
fi
if [ "$cert_expire_date_s" -gt "$now_date_s" ]; then
verbose "expire_status: Valid -> expiring"
printf '%s%s\n' \
Expand All @@ -4576,6 +4601,10 @@ expire_status: FALL-BACK completed"
"Expired: $cert_not_after_date | CN: $db_cn"
fi
else
if [ "$will_expire" ]; then
die "\
EasyRSA: will NOT expire - SSL: will expire"
fi
verbose "expire_status: Valid -> NOT expiring"
fi
} # => expire_status()
Expand Down