pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0101-custodia-include-known-CA-certs-in-the-PKCS-12-file-.patch

403b09
From 70ec9193404463ad62ee6fe14a033425906e6b13 Mon Sep 17 00:00:00 2001
403b09
From: Jan Cholasta <jcholast@redhat.com>
403b09
Date: Tue, 23 Aug 2016 10:39:08 +0200
403b09
Subject: [PATCH] custodia: include known CA certs in the PKCS#12 file for
403b09
 Dogtag
403b09
403b09
This fixes CA replica install in a topology upgraded from CA-less to
403b09
CA-full.
403b09
403b09
https://fedorahosted.org/freeipa/ticket/6207
403b09
403b09
Reviewed-By: Martin Basti <mbasti@redhat.com>
403b09
---
403b09
 ipaserver/install/custodiainstance.py | 6 ++++++
403b09
 1 file changed, 6 insertions(+)
403b09
403b09
diff --git a/ipaserver/install/custodiainstance.py b/ipaserver/install/custodiainstance.py
403b09
index 785f86fc159f2d73184ea5bb3c0303cecde153df..18bd51426cde09af6a34855a49db386a72cc6b9c 100644
403b09
--- a/ipaserver/install/custodiainstance.py
403b09
+++ b/ipaserver/install/custodiainstance.py
403b09
@@ -2,6 +2,7 @@
403b09
 
403b09
 from ipapython.secrets.kem import IPAKEMKeys
403b09
 from ipapython.secrets.client import CustodiaClient
403b09
+from ipaserver.install.certs import CertDB
403b09
 from ipaplatform.paths import paths
403b09
 from ipaplatform.constants import constants
403b09
 from ipaserver.install.service import SimpleServiceInstance
403b09
@@ -154,6 +155,11 @@ class CustodiaInstance(SimpleServiceInstance):
403b09
                              '-i', pk12file,
403b09
                              '-w', pk12pwfile])
403b09
 
403b09
+            # Add CA certificates
403b09
+            tmpdb = CertDB(self.realm, nssdir=tmpnssdir)
403b09
+            self.suffix = ipautil.realm_to_suffix(self.realm)
403b09
+            self.import_ca_certs(tmpdb, True)
403b09
+
403b09
             # Now that we gathered all certs, re-export
403b09
             ipautil.run([paths.PKCS12EXPORT,
403b09
                          '-d', tmpnssdir,
403b09
-- 
403b09
2.7.4
403b09