From 629095e0d83a5606cfc7bbb55f5bc5c83f51368f Mon Sep 17 00:00:00 2001 From: Vlad Doloman Date: Wed, 24 Jun 2026 00:33:23 +0300 Subject: [PATCH] fix: show explicit half-done warning when build-client-full fails after revoke Split revoke_issued and build_client_full into separate try/except blocks. When renewal is in progress and build-client-full fails after a successful revoke, display an explicit warning that the old certificate has been revoked but no new one was built, and advise re-running the renewal. Co-Authored-By: Claude Sonnet 4.6 --- openvpncertupdate.py | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/openvpncertupdate.py b/openvpncertupdate.py index 237f8e0..675ccc7 100644 --- a/openvpncertupdate.py +++ b/openvpncertupdate.py @@ -799,13 +799,26 @@ class CursesApp: final_cn = form.cn self._msg(stdscr, f"Generating certificate for {final_cn}…") - try: - if is_renewal: + if is_renewal: + try: revoke_issued(EASYRSA_DIR, EASYRSA_PKI_DIR, final_cn, CA_PASSPHRASE) + except EasyRSAError as exc: + self._error(stdscr, f"EasyRSA error during revoke:\n{exc}") + return True + + try: build_client_full(EASYRSA_DIR, EASYRSA_PKI_DIR, final_cn, form.password, CA_PASSPHRASE) except EasyRSAError as exc: - self._error(stdscr, f"EasyRSA error:\n{exc}") + if is_renewal: + self._error( + stdscr, + f"EasyRSA error during build-client-full:\n{exc}\n\n" + f"WARNING: {final_cn} has been revoked but no new cert was built.\n" + f"Re-run renewal for this CN to issue a new certificate.", + ) + else: + self._error(stdscr, f"EasyRSA error:\n{exc}") return True if form.email: