self-signed cert is valid for just a month

[Andreas Hasenack]

The self-signed certificate generated by the haproxy charm, revision 11 from the charm store (latest as of now), is valid for only 30 days:

# openssl x509 -in /var/lib/haproxy/selfsigned_ca.crt -noout -dates
notBefore=Aug 10 19:34:23 2015 GMT
notAfter=Sep 9 19:34:23 2015 GMT

$ juju status --format=tabular
[Services]
NAME STATUS EXPOSED CHARM
haproxy unknown false cs:trusty/haproxy-11
(...)

[Andreas Hasenack (ahasenack)]

For some reason the openssl.cnf file shipped in data/openssl.cnf is not being honored:
def gen_selfsigned_cert(cert_file, key_file):
...
    subprocess.call(
        ['openssl', 'req', '-new', '-x509', '-nodes', '-config',
         os.path.join(os.environ['CHARM_DIR'], 'data', 'openssl.cnf'),
         '-keyout', key_file, '-out', cert_file],)

A quick dirty fix is to add '-days', '3650' to the command line.

[Andreas Hasenack (ahasenack)]

I think default_days is ignored in the [req] section. We should just add -days 3650 to the command line.

[Andreas Hasenack (ahasenack)]

The apache2 charm uses -days in the command line, and its openssl.cnf does not have default_days.