It should be possible to use another pki implementation, instead of the existing fixed one which uses an internal CA and a few shell scripts. In particular, it should be possible to interface with an external CA. It should be possible to manage pki through the api (and web admin): * issue a certificate request to be kept in a queue * approve a request from the queue * receive a certificate Use cases: * Have an external CA sign the certs used for engine<->host communication * Allow easier signing of certs for remote websocket-proxy (bug #1080992) and reports (bug #1080998) hosts.
*** Bug 631936 has been marked as a duplicate of this bug. ***
It should also be transactional - should allow engine-setup to cleanly rollback to previous pki state on failure. See also bug 1224672.
Alon, please write up some set of requirements for the new pki. How it should look like, what needs to be fixed in it compared to current, etc. Thanks.
Target release should be placed once a package build is known to fix a issue. Since this bug is not modified, the target version has been reset. Please use target milestone to plan a fix for a oVirt release.
This bug didn't get any attention for a while, we didn't have the capacity to make any progress. If you deeply care about it or want to work on it please assign/target accordingly
ok, closing. Please reopen if still relevant/you want to work on it.