diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-06-04 16:43:54 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-06-04 16:43:54 +0200 |
| commit | 53445ee4e56f8dd73c23ca81cee54fe3319fdc88 (patch) | |
| tree | fcdcc47a976e6c4de6dc67f43e77725eadfd12f8 /python | |
| parent | 88dfc8cd43521ae489900fb9746c56545140df54 (diff) | |
| parent | 0284f31bb99bbe2fad9fda9cf99d73e4fa3d2dfd (diff) | |
| download | vyos-1x-53445ee4e56f8dd73c23ca81cee54fe3319fdc88.tar.gz vyos-1x-53445ee4e56f8dd73c23ca81cee54fe3319fdc88.zip | |
Merge pull request #5195 from natali-rs1985/T8492
T8492: CRL generated by VyOS PKI lacks X.509 extensions required for strongSwan validation
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/pki.py | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/python/vyos/pki.py b/python/vyos/pki.py index 4598c5daa..17fa97223 100644 --- a/python/vyos/pki.py +++ b/python/vyos/pki.py @@ -207,7 +207,16 @@ def create_certificate_revocation_list(ca_cert, ca_private_key, serial_numbers=[ builder = x509.CertificateRevocationListBuilder() \ .issuer_name(ca_cert.subject) \ .last_update(datetime.datetime.today()) \ - .next_update(datetime.datetime.today() + datetime.timedelta(1, 0, 0)) + .next_update(datetime.datetime.today() + datetime.timedelta(1, 0, 0)) \ + .add_extension(add_key_identifier(ca_cert), critical=False) \ + .add_extension( + x509.CRLNumber( + int( + datetime.datetime.now(datetime.timezone.utc).timestamp() * 1_000_000 + ) + ), + critical=False, + ) for serial_number in serial_numbers: revoked_cert = x509.RevokedCertificateBuilder() \ |