From e76f3438f0e7f4dfc60ddd5486aefbfafa38662b Mon Sep 17 00:00:00 2001
From: Tim Bruijnzeels <tim@nlnetlabs.nl>
Date: Thu, 3 Oct 2019 11:05:02 +0200
Subject: [PATCH] Ignore key roll activation when there is no new key to
 activate. (interop #3)

---
 src/daemon/ca/keys.rs | 8 ++++++++
 src/daemon/ca/rc.rs   | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/daemon/ca/keys.rs b/src/daemon/ca/keys.rs
index 5c7cdb6b..ccf99c6b 100644
--- a/src/daemon/ca/keys.rs
+++ b/src/daemon/ca/keys.rs
@@ -481,4 +481,12 @@ impl KeyState {
             _ => Err(Error::ResourceClassNoNewKey),
         }
     }
+
+    /// Returns true if there is a new key
+    pub fn has_new_key(&self) -> bool {
+        match self {
+            KeyState::RollNew(_, _) => true,
+            _ => false,
+        }
+    }
 }
diff --git a/src/daemon/ca/rc.rs b/src/daemon/ca/rc.rs
index 771f7a5c..e82f734a 100644
--- a/src/daemon/ca/rc.rs
+++ b/src/daemon/ca/rc.rs
@@ -693,7 +693,7 @@ impl ResourceClass {
         staging: Duration,
         signer: &S,
     ) -> ca::Result<Vec<EvtDet>> {
-        if self.last_key_change + staging > Time::now() {
+        if !self.key_state.has_new_key() || self.last_key_change + staging > Time::now() {
             return Ok(vec![]);
         }