From e238ad358e1ff1916d266e6364e6120e52b12c24 Mon Sep 17 00:00:00 2001
From: joe miller <joeym@joeym.net>
Date: Mon, 10 Nov 2014 07:16:16 -0800
Subject: [PATCH] assign root-crl-url to root-ca.crt and crl-url to ca.crt

This fixes issue #17.
---
 bin/certified-ca | 3 ++-
 test.sh          | 5 ++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/bin/certified-ca b/bin/certified-ca
index a1df632..0c3c3c0 100755
--- a/bin/certified-ca
+++ b/bin/certified-ca
@@ -130,6 +130,7 @@ prompt = no
 [x509_extensions]
 EOF
     echo "basicConstraints = critical, CA:TRUE, pathlen:1"
+    if_echo "$ROOT_CRL_URL" "crlDistributionPoints = URI:$ROOT_CRL_URL"
     cat <<EOF
 keyUsage = critical, cRLSign, keyCertSign, nonRepudiation
 subjectKeyIdentifier = hash
@@ -156,7 +157,7 @@ then
     fi
 fi
 
-certified-csr --bits="$BITS" --ca --crl-url="$ROOT_CRL_URL" --days="$DAYS" --db="." $ENCRYPT --issuer="$CN" --issuer-name="root-ca" --name="ca" --ocsp-url="$OCSP_URL" --password="$INTERMEDIATE_PASSWORD" C="$C" CN="$CN" L="$L" O="$O" ST="$ST"
+certified-csr --bits="$BITS" --ca --crl-url="$CRL_URL" --days="$DAYS" --db="." $ENCRYPT --issuer="$CN" --issuer-name="root-ca" --name="ca" --ocsp-url="$OCSP_URL" --password="$INTERMEDIATE_PASSWORD" C="$C" CN="$CN" L="$L" O="$O" ST="$ST"
 certified-crt --ca-password="$ROOT_PASSWORD" --days="$DAYS" --db="." --name="ca" CN="$CN"
 
 git init -q
diff --git a/test.sh b/test.sh
index 6119774..3cd7818 100644
--- a/test.sh
+++ b/test.sh
@@ -49,6 +49,9 @@ openssl x509 -in "etc/ssl/certs/ca.crt" -noout -text |
 grep -E -q '(RSA )?Public[ -]Key: \(4096 bit\)'
 openssl x509 -in "etc/ssl/certs/ca.crt" -noout -text |
 grep -A"3" "X509v3 CRL Distribution Points" |
+grep -q "http://example.com/ca.crl"
+openssl x509 -in "etc/ssl/certs/root-ca.crt" -noout -text |
+grep -A"3" "X509v3 CRL Distribution Points" |
 grep -q "http://example.com/root-ca.crl"
 openssl x509 -in "etc/ssl/certs/ca.crt" -noout -text |
 grep -q "OCSP - URI:http://ocsp.example.com"
@@ -189,7 +192,7 @@ certified CN="Intermediate Revoked" && false
 certified-ca --root-password="root-password" CN="Certified CA"
 openssl x509 -in "etc/ssl/certs/ca.crt" -noout -text |
 grep -A"3" "X509v3 CRL Distribution Points" |
-grep -q "http://example.com/root-ca.crl"
+grep -q "http://example.com/ca.crl"
 certified CN="Intermediate Regenerated"
 openssl x509 -in "etc/ssl/certs/intermediate-regenerated.crt" -noout -text |
 grep -A"3" "X509v3 CRL Distribution Points" |