Don't make root CA if it exists

To support multinode testing where we just copy the CA to all the
instances don't remake the CA if it already exists.

The end result is that you can trusty a single chain and all your
clients will be happy regardless of which host they are talking to.

Change-Id: I90892e6828a59fa37af717361a2f1eed15a87ae4
This commit is contained in:
Clark Boylan 2016-09-23 13:33:40 -07:00 committed by Sean Dague
parent a2d1848419
commit 323b726783

22
lib/tls
View File

@ -322,15 +322,17 @@ function make_root_CA {
create_CA_base $ca_dir create_CA_base $ca_dir
create_CA_config $ca_dir 'Root CA' create_CA_config $ca_dir 'Root CA'
# Create a self-signed certificate valid for 5 years if [ ! -r "$ca_dir/cacert.pem" ]; then
$OPENSSL req -config $ca_dir/ca.conf \ # Create a self-signed certificate valid for 5 years
-x509 \ $OPENSSL req -config $ca_dir/ca.conf \
-nodes \ -x509 \
-newkey rsa \ -nodes \
-days 21360 \ -newkey rsa \
-keyout $ca_dir/private/cacert.key \ -days 21360 \
-out $ca_dir/cacert.pem \ -keyout $ca_dir/private/cacert.key \
-outform PEM -out $ca_dir/cacert.pem \
-outform PEM
fi
} }
# If a non-system python-requests is installed then it will use the # If a non-system python-requests is installed then it will use the
@ -507,7 +509,7 @@ function cleanup_CA {
sudo update-ca-certificates sudo update-ca-certificates
fi fi
rm -rf "$DATA_DIR/CA" "$DEVSTACK_CERT" rm -rf "$INT_CA_DIR" "$ROOT_CA_DIR" "$DEVSTACK_CERT"
} }
# Tell emacs to use shell-script-mode # Tell emacs to use shell-script-mode