fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.

README.md

@@ -144,6 +144,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `pki` | `s2s_name` | string | `VPN Router Site-to-Site CA` | Common name of the site-to-site issuing CA |
 | `pki` | `issuing_cas` | object | | The general-purpose issuing CAs, each a name and `{name, templates, acme}` (see Certificates) |
 | `pki` | `templates` | object | | Certificate templates, each a name and the options it changes or defines (see Certificates) |
+| `pki` | `root_key_warning` | boolean | `true` | `vpn-router-ca status` and `/ca` warn while the root key is on the router; `false` silences that warning |
 | `metrics` | `enabled` | boolean | `true` | The metrics service: collection, history and `/metrics` |
 | `metrics` | `listen` | string | `internal` | The interfaces `/metrics` is served on: `internal`, `external` or `both` |
 | `metrics` | `port` | integer | `9464` | TCP port of `/metrics` |
@@ -506,7 +507,8 @@ expired.
 
 ### Offline root
 
-Keeping the root key off the router is recommended, not required. Export it, encrypted with a
+Keeping the root key off the router is recommended, not required; while it is on the router,
+`vpn-router-ca status` says so, unless `pki.root_key_warning` is `false`. Export it, encrypted with a
 passphrase read from the first line of standard input, keep the file in a safe place, and remove
 the key from the router:
 

debian-package/debian/changelog

@@ -1,3 +1,22 @@
+vpn-router (0.21.2-1) unstable; urgency=medium
+
+  fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.
+
+  * pki.root_key_warning, true by default, set to false silences the
+    warning that the root key is on the router.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 31 Oct 2026 10:00:00 +0100
+
+vpn-router (0.21.1-1) unstable; urgency=medium
+
+  fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.
+
+  * A CRL whose CA key is on the router is reported once past half of its
+    validity, when the timer should have signed it again; a root CRL
+    signed offline is still reported 30 days before it expires.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 30 Oct 2026 10:00:00 +0100
+
 vpn-router (0.21.0-1) unstable; urgency=medium
 
   feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -55,7 +55,8 @@ SCHEMA = {
     'https':      {'enabled': True, 'email': '', 'web_port': 7444, 'manager_port': 7443, 'caddy_source': 'ubuntu'},
     'pki':        {'root_name': 'VPN Router Root CA', 'root_days': 7300, 'ca_days': 3650, 'key': 'rsa-4096',
                    'crl_days': 7, 'root_crl_days': 180, 'publish': ['http'], 'p2s_name': 'VPN Router P2S CA',
-                   's2s_name': 'VPN Router Site-to-Site CA', 'issuing_cas': {}, 'templates': {}},
+                   's2s_name': 'VPN Router Site-to-Site CA', 'issuing_cas': {}, 'templates': {},
+                   'root_key_warning': True},
     'metrics':    {'enabled': True, 'listen': 'internal', 'port': 9464, 'https_port': 9465, 'service_account': 'metrics',
                    'otlp_endpoint': '', 'otlp_username': '', 'otlp_password': '',
                    'keep_details': '24 hours', 'keep_hourly': '1 month', 'keep_daily': '3 months',

debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py

@@ -931,18 +931,22 @@ def acme_url(cfg, name):
 
 
 def status(cfg):
-    """The root, the issuing CAs, the retired CAs and the warnings, as /ca and vpn-router-ca status show them."""
+    """The root, the issuing CAs, the retired CAs and the warnings, as /ca and vpn-router-ca status show them; the root
+    key on the router is a warning while pki.root_key_warning is true."""
     moment = now()
     soon = moment + datetime.timedelta(days=WARN_DAYS)
     state = read_state()
     warnings = []
 
     def crl_of(name):
+        """The next update of the CA's CRL; a CRL the router signs warns once past half of its validity, which the timer
+        renews before, and one signed offline WARN_DAYS before it expires."""
         crl = read_crl(directory(name) / 'crl.pem')
         following = utc(crl, 'next_update') if crl is not None else None
+        signed_here = (directory(name) / 'key.pem').is_file()
         if crl is None:
             warnings.append(f'{name} has no CRL')
-        elif following is not None and following <= soon:
+        elif following is not None and (crl_stale(directory(name) / 'crl.pem') if signed_here else following <= soon):
             warnings.append(f'the CRL of {name} {"expired" if following <= moment else "expires"} on {iso(following)}')
         return iso(following) if following else None
 
@@ -953,7 +957,7 @@ def status(cfg):
         root = {'subject': common_name(root_cert), 'expires': iso(utc(root_cert, 'not_valid_after')), 'key': key,
                 'crl_next_update': crl_of('root') if key or (ROOT_DIR / 'crl.pem').is_file() else None,
                 'crl_source': state['root_crl']}
-        if key:
+        if key and cfg['pki']['root_key_warning']:
             warnings.append('the root key is on the router; export it with vpn-router-ca root export-key and remove it '
                             'with vpn-router-ca root remove-key to keep the root offline')
         elif not (ROOT_DIR / 'crl.pem').is_file():

debian-package/src/usr/share/doc/vpn-router/vpn-router.json.example

@@ -91,7 +91,8 @@
       "server": {
         "days": 397
       }
-    }
+    },
+    "root_key_warning": true
   },
   "metrics": {
     "enabled": true,