Applied last patch of Micah Anderson on IKE status.

diff --git a/src/certtool.c b/src/certtool.c
index 794a0d6b6d436165d88184d6e7459ca0295cba91..e9a92ccb6361eb78b9c1d2092a655e703adbd3c5 100644 (file)
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -2135,6 +2135,9 @@ generate_request (void)
       else
        usage |= GNUTLS_KEY_DIGITAL_SIGNATURE;
 
+      if (get_ipsec_ike_status && (get_sign_status (get_tls_server_status()) !=1))
+       usage |= GNUTLS_KEY_NON_REPUDIATION;
+
       if (ca_status)
        {
          ret = get_cert_sign_status ();
@@ -2171,15 +2174,6 @@ generate_request (void)
              if (ret < 0)
                error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
            }
-
-         ret = get_ipsec_ike_status ();
-         if (ret)
-           {
-             ret = gnutls_x509_crq_set_key_purpose_oid
-               (crq, GNUTLS_KP_IPSEC_IKE, 0);
-             if (ret < 0)
-               error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
-           }
        }
 
       ret = gnutls_x509_crq_set_key_usage (crq, usage);
@@ -2203,6 +2197,15 @@ generate_request (void)
          if (ret < 0)
            error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
        }
+
+      ret = get_ipsec_ike_status ();
+      if (ret)
+       {
+         ret = gnutls_x509_crq_set_key_purpose_oid
+           (crq, GNUTLS_KP_IPSEC_IKE, 0);
+         if (ret < 0)
+           error (EXIT_FAILURE, 0, "key_kp: %s", gnutls_strerror (ret));
+       }
     }
 
   ret = gnutls_x509_crq_set_key (crq, key);