VaKU/openvpncertupdate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: show explicit half-done warning when build-client-full fails after revoke

Browse Source 
Split revoke_issued and build_client_full into separate try/except blocks.
When renewal is in progress and build-client-full fails after a successful
revoke, display an explicit warning that the old certificate has been revoked
but no new one was built, and advise re-running the renewal.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Vlad Doloman
2026-06-24 00:33:23 +03:00
parent 896ad2d19b
commit 629095e0d8
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
openvpncertupdate.py
View File

@@ -799,13 +799,26 @@ class CursesApp:
final_cn = form.cn final_cn = form.cn
self._msg(stdscr, f"Generating certificate for {final_cn}…") self._msg(stdscr, f"Generating certificate for {final_cn}…")
try: if is_renewal:
if is_renewal: try:
revoke_issued(EASYRSA_DIR, EASYRSA_PKI_DIR, final_cn, CA_PASSPHRASE) revoke_issued(EASYRSA_DIR, EASYRSA_PKI_DIR, final_cn, CA_PASSPHRASE)
except EasyRSAError as exc:
self._error(stdscr, f"EasyRSA error during revoke:\n{exc}")
return True
try:
build_client_full(EASYRSA_DIR, EASYRSA_PKI_DIR, build_client_full(EASYRSA_DIR, EASYRSA_PKI_DIR,
final_cn, form.password, CA_PASSPHRASE) final_cn, form.password, CA_PASSPHRASE)
except EasyRSAError as exc: except EasyRSAError as exc:
self._error(stdscr, f"EasyRSA error:\n{exc}") if is_renewal:
self._error(
stdscr,
f"EasyRSA error during build-client-full:\n{exc}\n\n"
f"WARNING: {final_cn} has been revoked but no new cert was built.\n"
f"Re-run renewal for this CN to issue a new certificate.",
)
else:
self._error(stdscr, f"EasyRSA error:\n{exc}")
return True return True
if form.email: if form.email: