fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.

debian-package/src/usr/sbin/vpn-router-ca

@@ -1,13 +1,13 @@
 #!/usr/bin/python3
-"""Manage the router's PKI from the command line, with vpnrouter_pki.
+"""Manage the router's PKI, which the router's directory holds, from the command line, with vpnrouter_pki.
 
 status shows the root, the issuing CAs and the warnings; list the certificates the router issued. issue signs a CSR,
 or makes a key and writes a PFX file whose password is read from the first line of standard input. ca csr prints the
 CSR of an issuing CA that waits for the offline root, with the openssl extensions to sign it with, and ca import takes
 the signed certificate. root export-key writes the root key encrypted with the passphrase read from standard input,
-root remove-key removes it from the router, root import-key puts it back, root import-cert places an existing root's
-certificate before the root exists, and root import-crl takes a root CRL signed offline. maintain signs the stale CRLs
-again; vpn-router-pki.service runs it daily. A change that needs vpn-router-setup restarts it without waiting.
+root remove-key removes it from the router, root import-key puts it back, and root import-crl takes a root CRL signed
+offline. maintain signs the stale CRLs again; vpn-router-pki.service runs it daily. A change that needs
+vpn-router-setup restarts it without waiting.
 
 The answer is text for people on standard output, and a failure is a message on standard error. With --json the answer
 is JSON on standard output, and a failure is {"error": ...} there too. The exit status says what failed: 2 the request
@@ -22,7 +22,6 @@ commands and their options.
   vpn-router-ca [--json] maintain
   vpn-router-ca [--json] ca csr NAME
   vpn-router-ca [--json] ca import NAME FILE
-  vpn-router-ca [--json] root import-cert FILE
   vpn-router-ca [--json] root export-key --out FILE   (passphrase on stdin)
   vpn-router-ca [--json] root remove-key [--yes]
   vpn-router-ca [--json] root import-key FILE   (passphrase on stdin, an empty line for none)
@@ -39,6 +38,8 @@ import sys
 
 sys.path.insert(0, '/usr/lib/vpn-router')
 
+import ldap
+
 import vpnrouter
 import vpnrouter_pki
 from vpnrouter_pki import Failure
@@ -125,10 +126,6 @@ def run(options):
             document = vpnrouter_pki.import_ca(cfg, options.name, pathlib.Path(options.file).read_text(encoding='ascii'))
             restart_setup()
             return document, f'Issuing CA {options.name} has its certificate, which expires {document["expires"]}.'
-        if options.action == 'import-cert':
-            document = vpnrouter_pki.import_root_cert(pathlib.Path(options.file).read_bytes())
-            restart_setup()
-            return document, f'Root CA {document["subject"]} placed, without its key.'
         if options.action == 'export-key':
             data = vpnrouter_pki.export_root_key(secret())
             out = pathlib.Path(options.out)
@@ -177,7 +174,6 @@ def main(argv):
     importer.add_argument('file')
     root = commands.add_parser('root', help='the root CA')
     root_actions = root.add_subparsers(dest='action', required=True, parser_class=Parser)
-    root_actions.add_parser('import-cert', help="place an existing root's certificate").add_argument('file')
     exporter = root_actions.add_parser('export-key', help='write the root key encrypted with the passphrase from stdin')
     exporter.add_argument('--out', required=True, help='the file to write')
     remover = root_actions.add_parser('remove-key', help='remove the root key from the router')
@@ -193,6 +189,8 @@ def main(argv):
         code, message = failure.status, str(failure)
     except OSError as exc:
         code, message = 1, str(exc)
+    except ldap.LDAPError as exc:
+        code, message = 1, f'the directory, which holds the PKI, failed: {exc}'
     except SystemExit as exc:
         code, message = 1, str(exc.code)
     else: