Add the capability to automatically renew a certificate with x509_certificate resource

Signed-off-by: Julien Huon <julien@huon.email>

1 files changed, 6 insertions, 2 deletions

diff --git a/lib/chef/resource/openssl_x509_certificate.rb b/lib/chef/resource/openssl_x509_certificate.rb
index 20cf998239..354c8c0dab 100644
--- a/lib/chef/resource/openssl_x509_certificate.rb
+++ b/lib/chef/resource/openssl_x509_certificate.rb
@@ -109,13 +109,17 @@ class Chef
       property :ca_key_pass, String,
         description: "The passphrase for CA private key's passphrase."
 
+      property :renew_before_expiry, Integer,
+        description: "The number of days before the expiry. The certificate will be automaticaly renewed when the value is reached.",
+        default: 5
+
       action :create do
         description "Generate a certificate"
 
-        unless ::File.exist? new_resource.path
+        if cert_need_renewall?(new_resource.path, new_resource.renew_before_expiry)
           converge_by("Create #{@new_resource}") do
             file new_resource.path do
-              action :create_if_missing
+              action :create
               owner new_resource.owner unless new_resource.owner.nil?
               group new_resource.group unless new_resource.group.nil?
               mode new_resource.mode unless new_resource.mode.nil?