Updated files to account for pem storage in the Certificate Store

Signed-off-by: John McCrae <jmccrae@chf.io>

1 files changed, 19 insertions, 2 deletions

diff --git a/lib/chef/http/authenticator.rb b/lib/chef/http/authenticator.rb
index 98d331d4f0..d31aa6b53d 100644
--- a/lib/chef/http/authenticator.rb
+++ b/lib/chef/http/authenticator.rb
@@ -228,13 +228,18 @@ class Chef
             file_path = ps_blob["PSPath"].split("::")[1]
             pkcs = OpenSSL::PKCS12.new(File.binread(file_path), password)
 
-            # We test the pfx we just extracted the private key from
+            # We check the pfx we just extracted the private key from
             # if that cert is expiring in 7 days or less we generate a new pfx/p12 object
             # then we post the new public key from that to the client endpoint on
             # chef server.
-            # is_certificate_expiring(pkcs)
             File.delete(file_path)
+            key_expiring = is_certificate_expiring?(pkcs)
+            if key_expiring
+              powershell_exec!(delete_old_key_ps(client_name))
+              ::Chef::Client.update_key_and_register(Chef::Config[:client_name], pkcs)
+            end
 
+            File.delete(file_path)
             return pkcs.key.private_to_pem
           end
         end
@@ -242,6 +247,12 @@ class Chef
         false
       end
 
+      def self.is_certificate_expiring?(pkcs)
+        today = Date.parse(Time.now.utc.iso8601)
+        future = Date.parse(pkcs.certificate.not_after.iso8601)
+        future.mjd - today.mjd <= 7
+      end
+
       def self.get_the_key_ps(client_name, password)
         powershell_code = <<~CODE
             Try {
@@ -256,6 +267,12 @@ class Chef
         CODE
       end
 
+      def self.delete_old_key_ps(client_name)
+        powershell_code = <<~CODE
+          Get-ChildItem -path cert:\\LocalMachine\\My -Recurse | Where-Object { $_.Subject -match "chef-#{client_name}$" } | Remove-Item -ErrorAction Stop;
+        CODE
+      end
+
       def authentication_headers(method, url, json_body = nil, headers = nil)
         request_params = {
           http_method: method,