|
 |
86baa9 |
From 3c1ac4d5c9c36c2b99ac2b1d9d86e46b563b4361 Mon Sep 17 00:00:00 2001
|
|
|
86baa9 |
From: Fraser Tweedale <ftweedal@redhat.com>
|
|
|
86baa9 |
Date: Mon, 27 May 2019 10:00:28 +1000
|
|
|
86baa9 |
Subject: [PATCH] ipa-cert-fix: handle 'pki-server cert-fix' failure
|
|
|
86baa9 |
|
|
|
86baa9 |
When DS cert is expired, 'pki-server cert-fix' will fail at the
|
|
|
86baa9 |
final step (restart). When this case arises, ignore the
|
|
|
86baa9 |
CalledProcessError and continue.
|
|
|
86baa9 |
|
|
|
86baa9 |
We can't know for sure if the error was due to failure of final
|
|
|
86baa9 |
restart, or something going wrong earlier. But if it was a more
|
|
|
86baa9 |
serious failure, the next step (installing the renewed IPA-specific
|
|
|
86baa9 |
certificates) will fail.
|
|
|
86baa9 |
|
|
|
86baa9 |
Part of: https://pagure.io/freeipa/issue/7885
|
|
|
86baa9 |
|
|
|
86baa9 |
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
86baa9 |
---
|
|
|
86baa9 |
ipaserver/install/ipa_cert_fix.py | 12 +++++++++++-
|
|
|
86baa9 |
1 file changed, 11 insertions(+), 1 deletion(-)
|
|
|
86baa9 |
|
|
|
86baa9 |
diff --git a/ipaserver/install/ipa_cert_fix.py b/ipaserver/install/ipa_cert_fix.py
|
|
|
86baa9 |
index c8ee51faea9092350c8a182ba55387ddd7b196d8..5d5668b1d89115adcda167222ffc38a0caa690a2 100644
|
|
|
86baa9 |
--- a/ipaserver/install/ipa_cert_fix.py
|
|
|
86baa9 |
+++ b/ipaserver/install/ipa_cert_fix.py
|
|
|
86baa9 |
@@ -113,7 +113,17 @@ class IPACertFix(AdminTool):
|
|
|
86baa9 |
return 0
|
|
|
86baa9 |
print("Proceeding.")
|
|
|
86baa9 |
|
|
|
86baa9 |
- run_cert_fix(certs, extra_certs)
|
|
|
86baa9 |
+ try:
|
|
|
86baa9 |
+ run_cert_fix(certs, extra_certs)
|
|
|
86baa9 |
+ except ipautil.CalledProcessError:
|
|
|
86baa9 |
+ if any(x[0] is IPACertType.LDAPS for x in extra_certs):
|
|
|
86baa9 |
+ # The DS cert was expired. This will cause
|
|
|
86baa9 |
+ # 'pki-server cert-fix' to fail at the final
|
|
|
86baa9 |
+ # restart. Therefore ignore the CalledProcessError
|
|
|
86baa9 |
+ # and proceed to installing the IPA-specific certs.
|
|
|
86baa9 |
+ pass
|
|
|
86baa9 |
+ else:
|
|
|
86baa9 |
+ raise # otherwise re-raise
|
|
|
86baa9 |
|
|
|
86baa9 |
replicate_dogtag_certs(subject_base, ca_subject_dn, certs)
|
|
|
86baa9 |
install_ipa_certs(subject_base, ca_subject_dn, extra_certs)
|
|
|
86baa9 |
--
|
|
|
86baa9 |
2.20.1
|
|
|
86baa9 |
|