|
 |
aa60fb |
From c0598b1af6885b1558ef592d6e2a5250f707e878 Mon Sep 17 00:00:00 2001
|
|
|
aa60fb |
From: Jan Cholasta <jcholast@redhat.com>
|
|
|
aa60fb |
Date: Thu, 10 Mar 2016 13:16:41 +0100
|
|
|
aa60fb |
Subject: [PATCH] certdb: never use the -r option of certutil
|
|
|
aa60fb |
|
|
|
aa60fb |
The -r option makes certutil output certificates in DER. If there are
|
|
|
aa60fb |
multiple certificates sharing the same nickname, certutil will output
|
|
|
aa60fb |
them concatenated into a single blob. The blob is not a valid DER
|
|
|
aa60fb |
anymore and causes failures further in the code.
|
|
|
aa60fb |
|
|
|
aa60fb |
Use the -a option instead to output the certificates in PEM and convert
|
|
|
aa60fb |
them to DER on demand.
|
|
|
aa60fb |
|
|
|
aa60fb |
https://fedorahosted.org/freeipa/ticket/5117
|
|
|
aa60fb |
https://fedorahosted.org/freeipa/ticket/5720
|
|
|
aa60fb |
|
|
|
aa60fb |
Reviewed-By: David Kupka <dkupka@redhat.com>
|
|
|
aa60fb |
---
|
|
|
aa60fb |
ipapython/certdb.py | 10 +++++-----
|
|
|
aa60fb |
1 file changed, 5 insertions(+), 5 deletions(-)
|
|
|
aa60fb |
|
|
|
aa60fb |
diff --git a/ipapython/certdb.py b/ipapython/certdb.py
|
|
|
aa60fb |
index 5a6e494fb8a5963ae9c68c697234e83575bc89ec..63dc4580b43ec11329d2074fc9a33e55dac9cb03 100644
|
|
|
aa60fb |
--- a/ipapython/certdb.py
|
|
|
aa60fb |
+++ b/ipapython/certdb.py
|
|
|
aa60fb |
@@ -395,15 +395,15 @@ class NSSDatabase(object):
|
|
|
aa60fb |
"Setting trust on %s failed" % root_nickname)
|
|
|
aa60fb |
|
|
|
aa60fb |
def get_cert(self, nickname, pem=False):
|
|
|
aa60fb |
- args = ['-L', '-n', nickname]
|
|
|
aa60fb |
- if pem:
|
|
|
aa60fb |
- args.append('-a')
|
|
|
aa60fb |
- else:
|
|
|
aa60fb |
- args.append('-r')
|
|
|
aa60fb |
+ args = ['-L', '-n', nickname, '-a']
|
|
|
aa60fb |
try:
|
|
|
aa60fb |
cert, err, returncode = self.run_certutil(args)
|
|
|
aa60fb |
except ipautil.CalledProcessError:
|
|
|
aa60fb |
raise RuntimeError("Failed to get %s" % nickname)
|
|
|
aa60fb |
+ if not pem:
|
|
|
aa60fb |
+ (cert, start) = find_cert_from_txt(cert, start=0)
|
|
|
aa60fb |
+ cert = x509.strip_header(cert)
|
|
|
aa60fb |
+ cert = base64.b64decode(cert)
|
|
|
aa60fb |
return cert
|
|
|
aa60fb |
|
|
|
aa60fb |
def has_nickname(self, nickname):
|
|
|
aa60fb |
--
|
|
|
aa60fb |
2.5.0
|
|
|
aa60fb |
|