|
 |
ac7d03 |
From da3e6ab68f4f40b2851770fcc928b5bb93831c42 Mon Sep 17 00:00:00 2001
|
|
|
ac7d03 |
From: Jan Cholasta <jcholast@redhat.com>
|
|
|
ac7d03 |
Date: Mon, 24 Apr 2017 06:20:07 +0000
|
|
|
ac7d03 |
Subject: [PATCH] renew agent: always export CSR on IPA CA certificate renewal
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Make sure a CSR is exported for the IPA CA whenever certmonger detects that
|
|
|
ac7d03 |
the CA certificate is about to expire.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
This is a pre-requisite for using the `dogtag-ipa-ca-renew-agent-reuse` CA
|
|
|
ac7d03 |
instead of the `ipaCSRExport` virtual profile to export the CSR.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
https://pagure.io/freeipa/issue/5799
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Reviewed-By: David Kupka <dkupka@redhat.com>
|
|
|
ac7d03 |
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
ac7d03 |
---
|
|
|
ac7d03 |
install/certmonger/dogtag-ipa-ca-renew-agent-submit | 11 +++++++++++
|
|
|
ac7d03 |
1 file changed, 11 insertions(+)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
diff --git a/install/certmonger/dogtag-ipa-ca-renew-agent-submit b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
|
|
|
ac7d03 |
index 7b5489555d069856a6da7a21b5ab2b0f4dd4a41c..657a1bc638e1da680522c638e92914098fc6ab4b 100755
|
|
|
ac7d03 |
--- a/install/certmonger/dogtag-ipa-ca-renew-agent-submit
|
|
|
ac7d03 |
+++ b/install/certmonger/dogtag-ipa-ca-renew-agent-submit
|
|
|
ac7d03 |
@@ -451,6 +451,10 @@ def renew_ca_cert(reuse_existing, **kwargs):
|
|
|
ac7d03 |
"""
|
|
|
ac7d03 |
This is used for automatic CA certificate renewal.
|
|
|
ac7d03 |
"""
|
|
|
ac7d03 |
+ csr = os.environ.get('CERTMONGER_CSR')
|
|
|
ac7d03 |
+ if not csr:
|
|
|
ac7d03 |
+ return (UNCONFIGURED, "Certificate request not provided")
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
cert = os.environ.get('CERTMONGER_CERTIFICATE')
|
|
|
ac7d03 |
if not cert:
|
|
|
ac7d03 |
return (REJECTED, "New certificate requests not supported")
|
|
|
ac7d03 |
@@ -462,6 +466,13 @@ def renew_ca_cert(reuse_existing, **kwargs):
|
|
|
ac7d03 |
|
|
|
ac7d03 |
if is_self_signed and not reuse_existing and is_renewal_master():
|
|
|
ac7d03 |
state = 'request'
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ csr_file = paths.IPA_CA_CSR
|
|
|
ac7d03 |
+ try:
|
|
|
ac7d03 |
+ with open(csr_file, 'wb') as f:
|
|
|
ac7d03 |
+ f.write(csr)
|
|
|
ac7d03 |
+ except Exception as e:
|
|
|
ac7d03 |
+ return (UNREACHABLE, "Failed to write %s: %s" % (csr_file, e))
|
|
|
ac7d03 |
elif operation == 'POLL':
|
|
|
ac7d03 |
cookie = os.environ.get('CERTMONGER_CA_COOKIE')
|
|
|
ac7d03 |
if not cookie:
|
|
|
ac7d03 |
--
|
|
|
ac7d03 |
2.9.3
|
|
|
ac7d03 |
|