|
 |
fef02c |
From 08d3dcb1834fc227dcd9d2071fda58e6dc639394 Mon Sep 17 00:00:00 2001
|
|
|
fef02c |
From: Tomas Krizek <tkrizek@redhat.com>
|
|
|
fef02c |
Date: Tue, 13 Sep 2016 10:14:47 +0200
|
|
|
fef02c |
Subject: [PATCH] Keep NSS trust flags of existing certificates
|
|
|
fef02c |
|
|
|
fef02c |
Backup and restore trust flags of existing certificates during CA
|
|
|
fef02c |
installation. This prevents marking a previously trusted certificate
|
|
|
fef02c |
as untrusted, as was the case when CA-less was converted to CA-full
|
|
|
fef02c |
with external CA when using the same certificate.
|
|
|
fef02c |
|
|
|
fef02c |
https://fedorahosted.org/freeipa/ticket/5791
|
|
|
fef02c |
|
|
|
fef02c |
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
|
|
|
fef02c |
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
|
|
|
fef02c |
---
|
|
|
fef02c |
ipaserver/install/cainstance.py | 8 ++++++++
|
|
|
fef02c |
1 file changed, 8 insertions(+)
|
|
|
fef02c |
|
|
|
fef02c |
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
|
|
|
fef02c |
index 3551887cd8ff8baa5e17f8969c84fb92d7552ef3..6c57aadfcdc2864f8cdc84c16556dce7163737fc 100644
|
|
|
fef02c |
--- a/ipaserver/install/cainstance.py
|
|
|
fef02c |
+++ b/ipaserver/install/cainstance.py
|
|
|
fef02c |
@@ -832,6 +832,10 @@ class CAInstance(DogtagInstance):
|
|
|
fef02c |
raise RuntimeError("Unable to retrieve CA chain: %s" % str(e))
|
|
|
fef02c |
|
|
|
fef02c |
def __import_ca_chain(self):
|
|
|
fef02c |
+ # Backup NSS trust flags of all already existing certificates
|
|
|
fef02c |
+ certdb = certs.CertDB(self.realm)
|
|
|
fef02c |
+ cert_backup_list = certdb.list_certs()
|
|
|
fef02c |
+
|
|
|
fef02c |
chain = self.__get_ca_chain()
|
|
|
fef02c |
|
|
|
fef02c |
# If this chain contains multiple certs then certutil will only import
|
|
|
fef02c |
@@ -882,6 +886,10 @@ class CAInstance(DogtagInstance):
|
|
|
fef02c |
os.remove(chain_name)
|
|
|
fef02c |
subid += 1
|
|
|
fef02c |
|
|
|
fef02c |
+ # Restore NSS trust flags of all previously existing certificates
|
|
|
fef02c |
+ for nick, trust_flags in cert_backup_list:
|
|
|
fef02c |
+ certdb.trust_root_cert(nick, trust_flags)
|
|
|
fef02c |
+
|
|
|
fef02c |
def __request_ra_certificate(self):
|
|
|
fef02c |
# Create a noise file for generating our private key
|
|
|
fef02c |
noise = array.array('B', os.urandom(128))
|
|
|
fef02c |
--
|
|
|
fef02c |
2.10.2
|
|
|
fef02c |
|