Bug 1131700

Summary:	In getcert, change order of writing certificates to disk and running post hook
Product:	Red Hat Enterprise Linux 7	Reporter:	Keenan Brock <kbrock>
Component:	certmonger	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED ERRATA	QA Contact:	Kaleem <ksiddiqu>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	7.1	CC:	dpal, jcholast, nsoman
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	certmonger-0.78.1-1.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-19 11:58:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Keenan Brock 2014-08-19 20:54:22 UTC

Description of problem:

Certmonger's getcert command provides a flag -C that runs a command after a certificate is downloaded.

This command is run after the certificate is written to disk, but before the root certificate is written to disk.

It makes more sense to write after both have been written.

Version-Release number of selected component (if applicable):

latest (and before)
certmonger-0.75.13-0.20140818T1524Zgit0ed42b6.el6.x86_64

How reproducible:

Always

Steps to Reproduce:

1. ipa-getcert -k service.key -f service.cert -F root.cert -C "chmod 644 `pwd`/service.cert `pwd`/root.cert"
2. ls -l root.cert

Actual results:
-rw-------. 1 root root 3185 Jul 21 20:23 root.cer

Expected results:

-rw-r--r--. 1 root root 3185 Jul 21 20:23 root.cer

Additional info:

Comment 2 Nalin Dahyabhai 2015-03-19 15:51:25 UTC

Fixed upstream in 0.76.3, so we can fix it here by rebasing.

Comment 4 Kaleem 2015-10-12 08:15:32 UTC

Verified.

certmonger version:
===================
[root@dhcp207-115 certtest]# rpm -q certmonger ipa-server
certmonger-0.78.4-1.el7.x86_64
ipa-server-4.2.0-13.el7.x86_64
[root@dhcp207-115 certtest]# 

console output:
===============
[root@dhcp207-115 ~]# ipa-getcert request -k /tmp/certtest/service.key -f /tmp/certtest/service.cert -F /tmp/certtest/root.cert -C "chmod 644 /tmp/certtest/service.cert /tmp/certtest/root.cert"
New signing request "20151012081159" added.
[root@dhcp207-115 ~]# cd /tmp/certtest/
[root@dhcp207-115 certtest]# ls
root.cert  service.cert  service.key
[root@dhcp207-115 certtest]# ls -la root.cert 
-rw-r--r--. 1 root root 1310 Oct 12 13:42 root.cert
[root@dhcp207-115 certtest]#

Comment 5 errata-xmlrpc 2015-11-19 11:58:54 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2365.html