ac7d03
From ceb0d5c2a4a8e8fae271e5a37ee32f58a2d36273 Mon Sep 17 00:00:00 2001
ac7d03
From: Florence Blanc-Renaud <flo@redhat.com>
ac7d03
Date: Tue, 16 May 2017 17:24:09 +0200
ac7d03
Subject: [PATCH] ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
ac7d03
ac7d03
ipa-ca-install currently overwrites /etc/ipa/ca.crt with the CA chain
ac7d03
retrieved from Dogtag. It should instead append the new certs, otherwise
ac7d03
the CA that signed dirsrv and httpd certificates is removed and ipa tools
ac7d03
fail.
ac7d03
A consequence is that ipa-kra-install fails.
ac7d03
This is a regression introduced by 5ab85b36.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/6925
ac7d03
ac7d03
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
ac7d03
---
ac7d03
 ipaserver/install/cainstance.py | 8 ++++++++
ac7d03
 1 file changed, 8 insertions(+)
ac7d03
ac7d03
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
ac7d03
index b8c8cc4fc4532fc2c911ec174d363f8280ce863b..b0e9e8757ec3e3c0d03ed930743ef5a1253b864a 100644
ac7d03
--- a/ipaserver/install/cainstance.py
ac7d03
+++ b/ipaserver/install/cainstance.py
ac7d03
@@ -793,6 +793,14 @@ class CAInstance(DogtagInstance):
ac7d03
         # Get list of PEM certificates
ac7d03
         certlist = x509.pkcs7_to_pems(data, x509.DER)
ac7d03
 
ac7d03
+        # We need to append the certs to the existing file, so start by
ac7d03
+        # reading the file
ac7d03
+        if ipautil.file_exists(paths.IPA_CA_CRT):
ac7d03
+            ca_certs = x509.load_certificate_list_from_file(paths.IPA_CA_CRT)
ac7d03
+            ca_certs = [cert.public_bytes(serialization.Encoding.PEM)
ac7d03
+                        for cert in ca_certs]
ac7d03
+            certlist.extend(ca_certs)
ac7d03
+
ac7d03
         # We have all the certificates in certlist, write them to a PEM file
ac7d03
         for path in [paths.IPA_CA_CRT,
ac7d03
                      paths.KDC_CA_BUNDLE_PEM,
ac7d03
-- 
ac7d03
2.9.4
ac7d03