Function rekeyCertificateAction

command/ca/rekey.go:234–398

(ctx *cli.Context)

}

func rekeyCertificateAction(ctx *cli.Context) error {
	err := errs.NumberOfArguments(ctx, 2)
	if err != nil {
		return err
	}

	args := ctx.Args()
	certFile := args.Get(0)
	keyFile := args.Get(1)
	passFile := ctx.String("password-file")
	isDaemon := ctx.Bool("daemon")
	execCmd := ctx.String("exec")
	givenPrivate := ctx.String("private-key")
	kmsURI := ctx.String("kms")

	// For now, if the --kms flag is given, do not allow to generate a new key
	// and write it on disk. We can't use the daemon mode because we
	// cannot generate new keys.
	if kmsURI != "" || cryptoutil.IsKMS(keyFile) {
		switch {
		case givenPrivate == "":
			return errs.RequiredWithFlag(ctx, "kms", "private-key")
		case ctx.IsSet("out-key"):
			return errs.IncompatibleFlagWithFlag(ctx, "kms", "out-key")
		case isDaemon:
			return errs.IncompatibleFlagWithFlag(ctx, "kms", "daemon")
		}
	}

	outCert := ctx.String("out-cert")
	if outCert == "" {
		outCert = certFile
	}
	outKey := ctx.String("out-key")
	if outKey == "" {
		outKey = keyFile
	}

	rootFile := ctx.String("root")
	if rootFile == "" {
		rootFile = pki.GetRootCAPath()
	}

	caURL, err := flags.ParseCaURL(ctx)
	if err != nil {
		return err
	}

	var expiresIn, rekeyPeriod time.Duration
	if s := ctx.String("expires-in"); s != "" {
		if expiresIn, err = time.ParseDuration(s); err != nil {
			return errs.InvalidFlagValue(ctx, "expires-in", s, "")
		}
	}
	if s := ctx.String("rekey-period"); s != "" {
		if rekeyPeriod, err = time.ParseDuration(s); err != nil {
			return errs.InvalidFlagValue(ctx, "rekey-period", s, "")
		}