fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.

debian-package/debian/changelog

@@ -1,3 +1,13 @@
+vpn-router (0.21.1-1) unstable; urgency=medium
+
+  fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.
+
+  * A CRL whose CA key is on the router is reported once past half of its
+    validity, when the timer should have signed it again; a root CRL
+    signed offline is still reported 30 days before it expires.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 30 Oct 2026 10:00:00 +0100
+
 vpn-router (0.21.0-1) unstable; urgency=medium
 
   feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.

debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py

@@ -938,11 +938,14 @@ def status(cfg):
     warnings = []
 
     def crl_of(name):
+        """The next update of the CA's CRL; a CRL the router signs warns once past half of its validity, which the timer
+        renews before, and one signed offline WARN_DAYS before it expires."""
         crl = read_crl(directory(name) / 'crl.pem')
         following = utc(crl, 'next_update') if crl is not None else None
+        signed_here = (directory(name) / 'key.pem').is_file()
         if crl is None:
             warnings.append(f'{name} has no CRL')
-        elif following is not None and following <= soon:
+        elif following is not None and (crl_stale(directory(name) / 'crl.pem') if signed_here else following <= soon):
             warnings.append(f'the CRL of {name} {"expired" if following <= moment else "expires"} on {iso(following)}')
         return iso(following) if following else None