|
 |
ac7d03 |
From ceb0d5c2a4a8e8fae271e5a37ee32f58a2d36273 Mon Sep 17 00:00:00 2001
|
|
|
ac7d03 |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
ac7d03 |
Date: Tue, 16 May 2017 17:24:09 +0200
|
|
|
ac7d03 |
Subject: [PATCH] ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
|
|
|
ac7d03 |
|
|
|
ac7d03 |
ipa-ca-install currently overwrites /etc/ipa/ca.crt with the CA chain
|
|
|
ac7d03 |
retrieved from Dogtag. It should instead append the new certs, otherwise
|
|
|
ac7d03 |
the CA that signed dirsrv and httpd certificates is removed and ipa tools
|
|
|
ac7d03 |
fail.
|
|
|
ac7d03 |
A consequence is that ipa-kra-install fails.
|
|
|
ac7d03 |
This is a regression introduced by 5ab85b36.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
https://pagure.io/freeipa/issue/6925
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
ac7d03 |
---
|
|
|
ac7d03 |
ipaserver/install/cainstance.py | 8 ++++++++
|
|
|
ac7d03 |
1 file changed, 8 insertions(+)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
|
|
|
ac7d03 |
index b8c8cc4fc4532fc2c911ec174d363f8280ce863b..b0e9e8757ec3e3c0d03ed930743ef5a1253b864a 100644
|
|
|
ac7d03 |
--- a/ipaserver/install/cainstance.py
|
|
|
ac7d03 |
+++ b/ipaserver/install/cainstance.py
|
|
|
ac7d03 |
@@ -793,6 +793,14 @@ class CAInstance(DogtagInstance):
|
|
|
ac7d03 |
# Get list of PEM certificates
|
|
|
ac7d03 |
certlist = x509.pkcs7_to_pems(data, x509.DER)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
+ # We need to append the certs to the existing file, so start by
|
|
|
ac7d03 |
+ # reading the file
|
|
|
ac7d03 |
+ if ipautil.file_exists(paths.IPA_CA_CRT):
|
|
|
ac7d03 |
+ ca_certs = x509.load_certificate_list_from_file(paths.IPA_CA_CRT)
|
|
|
ac7d03 |
+ ca_certs = [cert.public_bytes(serialization.Encoding.PEM)
|
|
|
ac7d03 |
+ for cert in ca_certs]
|
|
|
ac7d03 |
+ certlist.extend(ca_certs)
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
# We have all the certificates in certlist, write them to a PEM file
|
|
|
ac7d03 |
for path in [paths.IPA_CA_CRT,
|
|
|
ac7d03 |
paths.KDC_CA_BUNDLE_PEM,
|
|
|
ac7d03 |
--
|
|
|
ac7d03 |
2.9.4
|
|
|
ac7d03 |
|