[Swan-dev] Generate test certificates iff missing

[Paul Wouters]

On Wed, 9 Dec 2015, Antony Antony wrote:

> this has more side effects.
> how do I disable expired certs check in Makefile.inc.local?
> If not I thinking disable this check in the master.
>
> the side effect  is
> when I use 'make check "UPDATEONLY=1"' and the rule think the cert 'expired' it abort UPDATEONLY.
> That is not desired behavior.
>
> make check "UPDATEONLY=1" is used while working one specific test case that has nothing to do with certs and want update the pluto on vm. Especially the uncommited working directory.

Can you not run: make kvm-clean-keys kvm-keys check UPDATEONLY=1

Keys really need to be up to date to get passing OCSP and CRL tests.

Note that nic needs to have the ocspd package installed too. I noticed
your blackswan does not have it and is failing various tests because of
it.

Paul