Check renewall all inline

Signed-off-by: Julien Huon <julien@huon.email>

1 files changed, 1 insertions, 2 deletions

diff --git a/lib/chef/resource/openssl_x509_certificate.rb b/lib/chef/resource/openssl_x509_certificate.rb
index 27677971a3..a501fbdaac 100644
--- a/lib/chef/resource/openssl_x509_certificate.rb
+++ b/lib/chef/resource/openssl_x509_certificate.rb
@@ -125,7 +125,7 @@ class Chef
           content cert.to_pem
         end
 
-        unless new_resource.renew_before_expiry.nil?
+        if !new_resource.renew_before_expiry.nil? && cert_need_renewall?(new_resource.path, new_resource.renew_before_expiry)
           file new_resource.path do
             action :create
             owner new_resource.owner unless new_resource.owner.nil?
@@ -133,7 +133,6 @@ class Chef
             mode new_resource.mode unless new_resource.mode.nil?
             sensitive true
             content cert.to_pem
-            only_if { cert_need_renewall?(new_resource.path, new_resource.renew_before_expiry) }
           end
         end