Attachment 294960 Details for Bug 432904 – Don't export the CA into a PKCS#12 on replicas

[patch] Don't export the CA into a PKCS#12 on replicas

freeipa-639-replica.patch (text/plain), 3.43 KB, created by Rob Crittenden on 2008-02-15 01:40:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Crittenden

Created: 2008-02-15 01:40:20 UTC

Size: 3.43 KB

patch

obsolete

># HG changeset patch
># User Rob Crittenden <rcritten@redhat.com>
># Date 1203039546 28800
># Node ID b5bfec4dd2b47486791fb543baae595850e9c4c0
># Parent  4e50563c7c89901fd5d10b2e55ad97fda8e7c117
>Don't create a backup of the PKCS#12 cert on replicas
>Name the file created by ipa-replica-prepare after the FQDN of the target
>
>Resolves 432904
>
>diff -r 4e50563c7c89 -r b5bfec4dd2b4 ipa-server/ipa-install/ipa-replica-prepare
>--- a/ipa-server/ipa-install/ipa-replica-prepare	Mon Feb 11 09:42:47 2008 -0500
>+++ b/ipa-server/ipa-install/ipa-replica-prepare	Thu Feb 14 17:39:06 2008 -0800
>@@ -150,8 +150,8 @@ def main():
>     print "Finalizing configuration"
>     save_config(dir, realm_name, host_name, ds_user)
> 
>-    print "Packaging the replica into %s" % "replica-info-" + realm_name
>-    ipautil.run(["/bin/tar", "cfz", "replica-info-" + realm_name, "-C", top_dir, "realm_info"])
>+    print "Packaging the replica into %s" % "replica-info-" + replica_fqdn
>+    ipautil.run(["/bin/tar", "cfz", "replica-info-" + replica_fqdn, "-C", top_dir, "realm_info"])
> 
>     shutil.rmtree(dir)
> 
>diff -r 4e50563c7c89 -r b5bfec4dd2b4 ipa-server/ipaserver/certs.py
>--- a/ipa-server/ipaserver/certs.py	Mon Feb 11 09:42:47 2008 -0500
>+++ b/ipa-server/ipaserver/certs.py	Thu Feb 14 17:39:06 2008 -0800
>@@ -150,20 +150,25 @@ class CertDB(object):
>                            "-z", self.noise_fname,
>                            "-f", self.passwd_fname])
> 
>-    def export_ca_cert(self):
>+    def export_ca_cert(self, create_pkcs12=False):
>+        """create_pkcs12 tells us whether we should create a PKCS#12 file
>+           of the CA or not. If we are running on a replica then we won't
>+           have the private key to make a PKCS#12 file so we don't need to
>+           do that step."""
>         # export the CA cert for use with other apps
>         ipautil.backup_file(self.cacert_fname)
>         self.run_certutil(["-L", "-n", "CA certificate",
>                            "-a",
>                            "-o", self.cacert_fname])
>         self.set_perms(self.cacert_fname)
>-        ipautil.backup_file(self.pk12_fname)
>-        ipautil.run(["/usr/bin/pk12util", "-d", self.secdir,
>-                     "-o", self.pk12_fname,
>-                     "-n", "CA certificate",
>-                     "-w", self.passwd_fname,
>-                     "-k", self.passwd_fname])
>-        self.set_perms(self.pk12_fname)
>+        if create_pkcs12:
>+            ipautil.backup_file(self.pk12_fname)
>+            ipautil.run(["/usr/bin/pk12util", "-d", self.secdir,
>+                         "-o", self.pk12_fname,
>+                         "-n", "CA certificate",
>+                         "-w", self.passwd_fname,
>+                         "-k", self.passwd_fname])
>+            self.set_perms(self.pk12_fname)
> 
>     def load_cacert(self, cacert_fname):
>         self.run_certutil(["-A", "-n", self.cacert_name,
>@@ -342,7 +347,7 @@ class CertDB(object):
>         self.create_passwd_file(passwd)
>         self.create_certdbs()
>         self.create_ca_cert()
>-        self.export_ca_cert()
>+        self.export_ca_cert(True)
>         self.create_pin_file()
> 
>     def create_from_cacert(self, cacert_fname, passwd=False):
>@@ -358,7 +363,7 @@ class CertDB(object):
>         self.import_pkcs12(pkcs12_fname, pkcs12_pwd_fname)
>         self.trust_root_cert(nickname)
>         self.create_pin_file()
>-        self.export_ca_cert()
>+        self.export_ca_cert(False)
> 
>     def backup_files(self):
>         sysrestore.backup_file(self.noise_fname)

Actions: View | Diff

Attachments on bug 432904: 294960