@TransactionAttribute(TransactionAttributeType.REQUIRES_NEW)
@Override
public boolean runNewTransactionConditioned(Admin admin, CA ca, long addtocrloverlaptime) throws CATokenOfflineException {
boolean ret = false;
Date currenttime = new Date();
CAInfo cainfo = ca.getCAInfo();
try {
if (cainfo.getStatus() == SecConst.CA_EXTERNAL) {
if (log.isDebugEnabled()) {
log.debug("Not trying to generate CRL for external CA "+cainfo.getName());
}
} else if (cainfo.getStatus() == SecConst.CA_WAITING_CERTIFICATE_RESPONSE) {
if (log.isDebugEnabled()) {
log.debug("Not trying to generate CRL for CA "+cainfo.getName() +" awaiting certificate response.");
}
} else {
if (cainfo instanceof X509CAInfo) {
Collection<Certificate> certs = cainfo.getCertificateChain();
final Certificate cacert;
if (!certs.isEmpty()) {
cacert = certs.iterator().next();
} else {
cacert = null;
}
// Don't create CRLs if the CA has expired
if ( (cacert != null) && (CertTools.getNotAfter(cacert).after(new Date())) ) {
if (cainfo.getStatus() == SecConst.CA_OFFLINE ) {
String msg = intres.getLocalizedMessage("createcrl.caoffline", cainfo.getName(), Integer.valueOf(cainfo.getCAId()));
log.info(msg);
logSession.log(admin, cainfo.getCAId(), LogConstants.MODULE_CA, new java.util.Date(),null, null, LogConstants.EVENT_INFO_CREATECRL, msg);
} else {
try {
if (log.isDebugEnabled()) {
log.debug("Checking to see if CA '"+cainfo.getName()+"' ("+cainfo.getCAId()+") needs CRL generation.");
}
final String certSubjectDN = CertTools.getSubjectDN(cacert);
CRLInfo crlinfo = crlSession.getLastCRLInfo(admin,certSubjectDN,false);
if (log.isDebugEnabled()) {
if (crlinfo == null) {
log.debug("Crlinfo was null");
} else {
log.debug("Read crlinfo for CA: "+cainfo.getName()+", lastNumber="+crlinfo.getLastCRLNumber()+", expireDate="+crlinfo.getExpireDate());
}
}
long crlissueinterval = cainfo.getCRLIssueInterval();
if (log.isDebugEnabled()) {
log.debug("crlissueinterval="+crlissueinterval);
log.debug("crloverlaptime="+cainfo.getCRLOverlapTime());
}
long overlap = cainfo.getCRLOverlapTime() + addtocrloverlaptime; // Overlaptime is in minutes, default if crlissueinterval == 0
long nextUpdate = 0; // if crlinfo == 0, we will issue a crl now
if (crlinfo != null) {
// CRL issueinterval in hours. If this is 0, we should only issue a CRL when
// the old one is about to expire, i.e. when currenttime + overlaptime > expiredate
// if isseuinterval is > 0 we will issue a new CRL when currenttime > createtime + issueinterval
nextUpdate = crlinfo.getExpireDate().getTime(); // Default if crlissueinterval == 0
if (crlissueinterval > 0) {
long u = crlinfo.getCreateDate().getTime() + crlissueinterval;
// If this period for some reason (we missed to issue some?) is larger than when the CRL expires,
// we need to issue one when the CRL expires
if ((u + overlap) < nextUpdate) {
nextUpdate = u;
// When we issue CRLs before the real expiration date we don't use overlap
overlap = 0;
}
}
if (log.isDebugEnabled()) {
log.debug("Calculated nextUpdate to "+nextUpdate);
}
} else {
String msg = intres.getLocalizedMessage("createcrl.crlinfonull", cainfo.getName());
log.info(msg);
}
if ((currenttime.getTime() + overlap) >= nextUpdate) {
if (log.isDebugEnabled()) {
log.debug("Creating CRL for CA, because:"+currenttime.getTime()+overlap+" >= "+nextUpdate);
}
run(admin, ca);
//this.runNewTransaction(admin, cainfo.getSubjectDN());
ret = true;
//createdcrls++;
}
} catch (CATokenOfflineException e) {
String msg = intres.getLocalizedMessage("createcrl.caoffline", cainfo.getName(), Integer.valueOf(cainfo.getCAId()));
log.error(msg);
logSession.log(admin, cainfo.getCAId(), LogConstants.MODULE_CA, new java.util.Date(),null, null, LogConstants.EVENT_ERROR_CREATECRL, msg);
}
}
} else if (cacert != null) {
if (log.isDebugEnabled()) {
log.debug("Not creating CRL for expired CA "+cainfo.getName()+". CA subjectDN='"+CertTools.getSubjectDN(cacert)+"', expired: "+CertTools.getNotAfter(cacert));
}
} else {
if (log.isDebugEnabled()) {
log.debug("Not creating CRL for CA without CA certificate: "+cainfo.getName());
}
}
}
}
} catch(Exception e) {
String msg = intres.getLocalizedMessage("createcrl.generalerror", Integer.valueOf(cainfo.getCAId()));
log.error(msg, e);
logSession.log(admin, cainfo.getCAId(), LogConstants.MODULE_CA, new java.util.Date(),null, null, LogConstants.EVENT_ERROR_CREATECRL,msg,e);
if (e instanceof EJBException) {
throw (EJBException)e;
}
throw new EJBException(e);
}