Blob Blame History Raw
Addtional patches that need to be partly reverted that are touching csrgen
related files:

7b8a2af2197381058ca532d1ae206defb16fac88
ac6568dcf58ec8d06df5493d14a28aa41845d4ef
9c86d35a3f0af4a793fada7dfe726e9cc66782ea
9836511a2b6d7cf48b1a54cb3158e5eac674081a
b431e9b684df11c811892bd9d2a5711355f0076e

This is a collection of an existing patch to remove csrgen for 4.7.1 and
additional patches that have been added for 4.7.90 pre1.

Additional reverted csrgen patches:

852618fd6529fbdd7b03077fae37c6fbbe45b51b
0ac1d3ea62efd9751fcc59cea46bcdafe1f11c37
7633d62d858c14523a99143aa0ff36f76bb4ff68
53f87ee5cd9d19f6fb91a9a1eafc8ea798095954
395a68d20887d0ac010e480e68b225d6dfeff726
03786ad9f3bd5edc351040847b8a49c9cd9288b2
c9d710a446d10aad72795e15bf041b87102628c1
2b90c8a20e45ade9bfd27731cccc94a34cf3f61e
61dde27f70b9f8dd1b57ad1fbc3744f3c380613a
806784dbd9e69a89c7a705c89bf42ba1fd4265c9
79378c90512a1cdd5f3d5ec6482e434caea06e01
bd5a5012d24820b54cdca2955f5405b84de1178c
26ab51ddf47f421f3404709052db89f08c05adaa
a53e17830c3d4fd59a62248d4447491675c6a80e
e7588ab2dc73e7f66ebc6cdcfb99470540e37731
136c6c3e2a4f77a27f435efd4a1cd95c9e089314
5420e9cfbe7803808b6e26d2dae64f2a6a50149a

Original patch from 4.7.1:

From 468bcf90cb985e2b1eb394bd752dc39aa4b75582 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 19 Jul 2018 18:37:18 -0400
Subject: [PATCH] Remove csrgen

This reverts commits:
* 72de679eb445c975ec70cd265d37d4927823ce5b
* 177f07e163d6d591a1e609d35e0a6f6f5347551e
* 80be18162921268be9c8981495c9e8a4de0c85cd
* 83e2c2b65eeb5a3aa4a59c0535e9177aac5e4637
* ada91c20588046bb147fc701718d3da4d2c080ca
* 4350dcdea22fd2284836315d0ae7d38733a7620e
* 39a5d9c5aae77687f67d9be02457733bdfb99ead
* a26cf0d7910dd4c0a4da08682b4be8d3d94ba520
* afd7c05d11432304bfdf183832a21d419f363689
* f1a1c6eca1b294f24174d7b0e1f78de46d9d5b05
* fc58eff6a3d7fe805e612b8b002304d8b9cd4ba9
* 10ef5947860f5098182b1f95c08c1158e2da15f9

https://bugzilla.redhat.com/show_bug.cgi?id=1432630
---
 freeipa.spec.in                                    |  14 -
 ipaclient/csrgen.py                                | 488 ---------------------
 ipaclient/csrgen/profiles/caIPAserviceCert.json    |  15 -
 ipaclient/csrgen/profiles/userCert.json            |  15 -
 ipaclient/csrgen/rules/dataDNS.json                |   8 -
 ipaclient/csrgen/rules/dataEmail.json              |   8 -
 ipaclient/csrgen/rules/dataHostCN.json             |   8 -
 ipaclient/csrgen/rules/dataSubjectBase.json        |   8 -
 ipaclient/csrgen/rules/dataUsernameCN.json         |   8 -
 ipaclient/csrgen/rules/syntaxSAN.json              |   8 -
 ipaclient/csrgen/rules/syntaxSubject.json          |   9 -
 ipaclient/csrgen/templates/openssl_base.tmpl       |  17 -
 ipaclient/csrgen/templates/openssl_macros.tmpl     |  29 --
 ipaclient/csrgen_ffi.py                            | 331 --------------
 ipaclient/plugins/cert.py                          |  80 ----
 ipaclient/plugins/csrgen.py                        | 128 ------
 ipaclient/setup.py                                 |   8 -
 .../data/test_csrgen/configs/caIPAserviceCert.conf |  16 -
 .../data/test_csrgen/configs/userCert.conf         |  16 -
 .../data/test_csrgen/profiles/profile.json         |   8 -
 .../data/test_csrgen/rules/basic.json              |   5 -
 .../data/test_csrgen/rules/options.json            |   8 -
 .../data/test_csrgen/templates/identity_base.tmpl  |   1 -
 ipatests/test_ipaclient/test_csrgen.py             | 304 -------------
 24 files changed, 1540 deletions(-)
 delete mode 100644 ipaclient/csrgen.py
 delete mode 100644 ipaclient/csrgen/profiles/caIPAserviceCert.json
 delete mode 100644 ipaclient/csrgen/profiles/userCert.json
 delete mode 100644 ipaclient/csrgen/rules/dataDNS.json
 delete mode 100644 ipaclient/csrgen/rules/dataEmail.json
 delete mode 100644 ipaclient/csrgen/rules/dataHostCN.json
 delete mode 100644 ipaclient/csrgen/rules/dataSubjectBase.json
 delete mode 100644 ipaclient/csrgen/rules/dataUsernameCN.json
 delete mode 100644 ipaclient/csrgen/rules/syntaxSAN.json
 delete mode 100644 ipaclient/csrgen/rules/syntaxSubject.json
 delete mode 100644 ipaclient/csrgen/templates/openssl_base.tmpl
 delete mode 100644 ipaclient/csrgen/templates/openssl_macros.tmpl
 delete mode 100644 ipaclient/csrgen_ffi.py
 delete mode 100644 ipaclient/plugins/csrgen.py
 delete mode 100644 ipatests/test_ipaclient/data/test_csrgen/configs/caIPAserviceCert.conf
 delete mode 100644 ipatests/test_ipaclient/data/test_csrgen/configs/userCert.conf
 delete mode 100644 ipatests/test_ipaclient/data/test_csrgen/profiles/profile.json
 delete mode 100644 ipatests/test_ipaclient/data/test_csrgen/rules/basic.json
 delete mode 100644 ipatests/test_ipaclient/data/test_csrgen/rules/options.json
 delete mode 100644 ipatests/test_ipaclient/data/test_csrgen/templates/identity_base.tmpl
 delete mode 100644 ipatests/test_ipaclient/test_csrgen.py

#diff -urN freeipa-4.8.0/freeipa.spec.in freeipa-4.8.0.removed_csrgen/freeipa.spec.in
#--- freeipa-4.8.0/freeipa.spec.in	2019-06-29 10:01:30.458735813 +0200
#+++ freeipa-4.8.0.removed_csrgen/freeipa.spec.in	2019-07-03 13:24:38.471222723 +0200
#@@ -1247,13 +1247,6 @@
# %dir %{python3_sitelib}/ipaclient/remote_plugins/2_*
# %{python3_sitelib}/ipaclient/remote_plugins/2_*/*.py
# %{python3_sitelib}/ipaclient/remote_plugins/2_*/__pycache__/*.py*
#-%dir %{python3_sitelib}/ipaclient/csrgen
#-%dir %{python3_sitelib}/ipaclient/csrgen/profiles
#-%{python3_sitelib}/ipaclient/csrgen/profiles/*.json
#-%dir %{python3_sitelib}/ipaclient/csrgen/rules
#-%{python3_sitelib}/ipaclient/csrgen/rules/*.json
#-%dir %{python3_sitelib}/ipaclient/csrgen/templates
#-%{python3_sitelib}/ipaclient/csrgen/templates/*.tmpl
# %{python3_sitelib}/ipaclient-*.egg-info
# 
# 
diff -urN freeipa-4.8.0/ipaclient/csrgen/profiles/caIPAserviceCert.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/profiles/caIPAserviceCert.json
--- freeipa-4.8.0/ipaclient/csrgen/profiles/caIPAserviceCert.json	2019-07-03 08:42:41.844539797 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/profiles/caIPAserviceCert.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,15 +0,0 @@
-[
-    {
-        "syntax": "syntaxSubject",
-        "data": [
-            "dataHostCN",
-            "dataSubjectBase"
-        ]
-    },
-    {
-        "syntax": "syntaxSAN",
-        "data": [
-            "dataDNS"
-        ]
-    }
-]
diff -urN freeipa-4.8.0/ipaclient/csrgen/profiles/userCert.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/profiles/userCert.json
--- freeipa-4.8.0/ipaclient/csrgen/profiles/userCert.json	2019-07-03 08:42:41.848539737 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/profiles/userCert.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,15 +0,0 @@
-[
-    {
-        "syntax": "syntaxSubject",
-        "data": [
-            "dataUsernameCN",
-            "dataSubjectBase"
-        ]
-    },
-    {
-        "syntax": "syntaxSAN",
-        "data": [
-            "dataEmail"
-        ]
-    }
-]
diff -urN freeipa-4.8.0/ipaclient/csrgen/rules/dataDNS.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataDNS.json
--- freeipa-4.8.0/ipaclient/csrgen/rules/dataDNS.json	2019-07-03 08:42:41.853539663 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataDNS.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,8 +0,0 @@
-{
-  "rule": {
-    "template": "DNS = {{subject.krbprincipalname.0.partition('/')[2].partition('@')[0]}}"
-  },
-  "options": {
-    "data_source": "subject.krbprincipalname.0.partition('/')[2].partition('@')[0]"
-  }
-}
diff -urN freeipa-4.8.0/ipaclient/csrgen/rules/dataEmail.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataEmail.json
--- freeipa-4.8.0/ipaclient/csrgen/rules/dataEmail.json	2019-07-03 08:42:41.857539603 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataEmail.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,8 +0,0 @@
-{
-  "rule": {
-    "template": "email = {{subject.mail.0}}"
-  },
-  "options": {
-    "data_source": "subject.mail.0"
-  }
-}
diff -urN freeipa-4.8.0/ipaclient/csrgen/rules/dataHostCN.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataHostCN.json
--- freeipa-4.8.0/ipaclient/csrgen/rules/dataHostCN.json	2019-07-03 08:42:41.861539544 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataHostCN.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,8 +0,0 @@
-{
-  "rule": {
-    "template": "CN={{subject.krbprincipalname.0.partition('/')[2].partition('@')[0]}}"
-  },
-  "options": {
-    "data_source": "subject.krbprincipalname.0.partition('/')[2].partition('@')[0]"
-  }
-}
diff -urN freeipa-4.8.0/ipaclient/csrgen/rules/dataSubjectBase.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataSubjectBase.json
--- freeipa-4.8.0/ipaclient/csrgen/rules/dataSubjectBase.json	2019-07-03 08:42:41.865539484 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataSubjectBase.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,8 +0,0 @@
-{
-  "rule": {
-    "template": "{{config.ipacertificatesubjectbase.0}}"
-  },
-  "options": {
-    "data_source": "config.ipacertificatesubjectbase.0"
-  }
-}
diff -urN freeipa-4.8.0/ipaclient/csrgen/rules/dataUsernameCN.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataUsernameCN.json
--- freeipa-4.8.0/ipaclient/csrgen/rules/dataUsernameCN.json	2019-07-03 08:42:41.869539424 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/dataUsernameCN.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,8 +0,0 @@
-{
-  "rule": {
-    "template": "CN={{subject.uid.0}}"
-  },
-  "options": {
-    "data_source": "subject.uid.0"
-  }
-}
diff -urN freeipa-4.8.0/ipaclient/csrgen/rules/syntaxSAN.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/syntaxSAN.json
--- freeipa-4.8.0/ipaclient/csrgen/rules/syntaxSAN.json	2019-07-03 08:42:41.874539350 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/syntaxSAN.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,8 +0,0 @@
-{
-  "rule": {
-    "template": "subjectAltName = @{% call openssl.section() %}{{ datarules|join('\n') }}{% endcall %}"
-  },
-  "options": {
-    "extension": true
-  }
-}
diff -urN freeipa-4.8.0/ipaclient/csrgen/rules/syntaxSubject.json freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/syntaxSubject.json
--- freeipa-4.8.0/ipaclient/csrgen/rules/syntaxSubject.json	2019-07-03 08:42:41.878539290 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/rules/syntaxSubject.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,9 +0,0 @@
-{
-  "rule": {
-    "template": "distinguished_name = {% call openssl.section() %}{{ datarules|reverse|join('\n') }}{% endcall %}"
-  },
-  "options": {
-    "required": true,
-    "data_source_combinator": "and"
-  }
-}
diff -urN freeipa-4.8.0/ipaclient/csrgen/templates/openssl_base.tmpl freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/templates/openssl_base.tmpl
--- freeipa-4.8.0/ipaclient/csrgen/templates/openssl_base.tmpl	2019-07-03 08:42:41.882539231 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/templates/openssl_base.tmpl	1970-01-01 01:00:00.000000000 +0100
@@ -1,17 +0,0 @@
-{% raw -%}
-{% import "openssl_macros.tmpl" as openssl -%}
-{% endraw -%}
-[ req ]
-prompt = no
-encrypt_key = no
-
-{{ parameters|join('\n') }}
-{% raw %}{% set rendered_extensions -%}{% endraw %}
-{{ extensions|join('\n') }}
-{% raw -%}
-{%- endset -%}
-{% if rendered_extensions -%}
-req_extensions = {% call openssl.section() %}{{ rendered_extensions }}{% endcall %}
-{% endif %}
-{{ openssl.openssl_sections|join('\n\n') }}
-{%- endraw %}
diff -urN freeipa-4.8.0/ipaclient/csrgen/templates/openssl_macros.tmpl freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/templates/openssl_macros.tmpl
--- freeipa-4.8.0/ipaclient/csrgen/templates/openssl_macros.tmpl	2019-07-03 08:42:41.886539171 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen/templates/openssl_macros.tmpl	1970-01-01 01:00:00.000000000 +0100
@@ -1,29 +0,0 @@
-{# List containing rendered sections to be included at end #}
-{% set openssl_sections = [] %}
-
-{#
-List containing one entry for each section name allocated. Because of
-scoping rules, we need to use a list so that it can be a "per-render global"
-that gets updated in place. Real globals are shared by all templates with the
-same environment, and variables defined in the macro don't persist after the
-macro invocation ends.
-#}
-{% set openssl_section_num = [] %}
-
-{% macro section() -%}
-{% set name -%}
-sec{{ openssl_section_num|length -}}
-{% endset -%}
-{% do openssl_section_num.append('') -%}
-{% set contents %}{{ caller() }}{% endset -%}
-{% if contents -%}
-{% set sectiondata = formatsection(name, contents) -%}
-{% do openssl_sections.append(sectiondata) -%}
-{% endif -%}
-{{ name -}}
-{% endmacro %}
-
-{% macro formatsection(name, contents) -%}
-[ {{ name }} ]
-{{ contents -}}
-{% endmacro %}
diff -urN freeipa-4.8.0/ipaclient/csrgen_ffi.py freeipa-4.8.0.removed_csrgen/ipaclient/csrgen_ffi.py
--- freeipa-4.8.0/ipaclient/csrgen_ffi.py	2019-07-03 08:42:41.816540214 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen_ffi.py	1970-01-01 01:00:00.000000000 +0100
@@ -1,387 +0,0 @@
-from cffi import FFI
-import ctypes.util
-
-from ipalib import errors
-
-_ffi = FFI()
-
-_ffi.cdef('''
-/* libcrypto/crypto.h */
-unsigned long OpenSSL_version_num(void);
-unsigned long SSLeay(void);
-const char * OpenSSL_version(int t);
-const char * SSLeay_version(int t);
-
-#define OPENSSL_VERSION 0
-''')
-
-_libcrypto = _ffi.dlopen(ctypes.util.find_library('crypto'))
-
-# SSLeay_version has been renamed with OpenSSL_version in OpenSSL 1.1.0
-# LibreSSL has OpenSSL_version since 2.7.0
-try:
-    OpenSSL_version = _libcrypto.OpenSSL_version
-except AttributeError:
-    OpenSSL_version = _libcrypto.SSLeay_version
-
-_version = OpenSSL_version(_libcrypto.OPENSSL_VERSION)
-_version = _ffi.string(_version).decode('utf-8')
-LIBRESSL = _version.startswith('LibreSSL')
-if not _version.startswith("OpenSSL") and not LIBRESSL:
-    raise ImportError("Only LibreSSL and OpenSSL are supported")
-
-# SSLeay has been renamed with OpenSSL_version_num in OpenSSL 1.1.0
-# LibreSSL has OpenSSL_version_num since 2.7.0
-try:
-    OpenSSL_version_num = _libcrypto.OpenSSL_version_num
-except AttributeError:
-    OpenSSL_version_num = _libcrypto.SSLeay
-
-# OpenSSL_version_num()/SSLeay() returns the value of OPENSSL_VERSION_NUMBER
-#
-# OPENSSL_VERSION_NUMBER is a numeric release version identifier:
-# MNNFFPPS: major minor fix patch status
-# For example,
-# 0x000906000 == 0.9.6 dev
-# 0x000906023 == 0.9.6b beta 3
-# 0x00090605f == 0.9.6e release
-_openssl_version = OpenSSL_version_num()
-
-_ffi.cdef('''
-typedef ... CONF;
-typedef ... CONF_METHOD;
-typedef ... BIO;
-typedef ... ipa_STACK_OF_CONF_VALUE;
-
-/* openssl/conf.h */
-typedef struct {
-    char *section;
-    char *name;
-    char *value;
-} CONF_VALUE;
-
-CONF *NCONF_new(CONF_METHOD *meth);
-void NCONF_free(CONF *conf);
-int NCONF_load_bio(CONF *conf, BIO *bp, long *eline);
-ipa_STACK_OF_CONF_VALUE *NCONF_get_section(const CONF *conf,
-                                        const char *section);
-char *NCONF_get_string(const CONF *conf, const char *group, const char *name);
-
-/* openssl/safestack.h */
-// int sk_CONF_VALUE_num(ipa_STACK_OF_CONF_VALUE *);
-// CONF_VALUE *sk_CONF_VALUE_value(ipa_STACK_OF_CONF_VALUE *, int);
-
-/* openssl/stack.h */
-typedef ... _STACK;
-
-int OPENSSL_sk_num(const _STACK *);
-void *OPENSSL_sk_value(const _STACK *, int);
-
-int sk_num(const _STACK *);
-void *sk_value(const _STACK *, int);
-
-/* openssl/bio.h */
-BIO *BIO_new_mem_buf(const void *buf, int len);
-int BIO_free(BIO *a);
-
-/* openssl/asn1.h */
-typedef struct ASN1_ENCODING_st {
-    unsigned char *enc;         /* DER encoding */
-    long len;                   /* Length of encoding */
-    int modified;               /* set to 1 if 'enc' is invalid */
-} ASN1_ENCODING;
-
-/* openssl/evp.h */
-typedef ... EVP_PKEY;
-
-void EVP_PKEY_free(EVP_PKEY *pkey);
-
-/* openssl/x509.h */
-typedef ... ASN1_INTEGER;
-typedef ... ASN1_BIT_STRING;
-typedef ... ASN1_OBJECT;
-typedef ... X509;
-typedef ... X509_CRL;
-typedef ... X509_NAME;
-typedef ... X509_PUBKEY;
-typedef ... ipa_STACK_OF_X509_ATTRIBUTE;
-
-typedef struct X509_req_info_st {
-    ASN1_ENCODING enc;
-    ASN1_INTEGER *version;
-    X509_NAME *subject;
-    X509_PUBKEY *pubkey;
-    /*  d=2 hl=2 l=  0 cons: cont: 00 */
-    ipa_STACK_OF_X509_ATTRIBUTE *attributes; /* [ 0 ] */
-} X509_REQ_INFO;
-''')
-
-# since OpenSSL 1.1.0 req_info field is no longer pointer to X509_REQ_INFO
-if _openssl_version >= 0x10100000 and not LIBRESSL:
-    _ffi.cdef('''
-    typedef struct X509_req_st {
-        X509_REQ_INFO req_info;
-    } X509_REQ;
-    ''')
-else:
-    _ffi.cdef('''
-    typedef struct X509_req_st {
-        X509_REQ_INFO *req_info;
-    } X509_REQ;
-    ''')
-
-_ffi.cdef('''
-X509_REQ *X509_REQ_new(void);
-void X509_REQ_free(X509_REQ *);
-EVP_PKEY *d2i_PUBKEY_bio(BIO *bp, EVP_PKEY **a);
-int X509_REQ_set_pubkey(X509_REQ *x, EVP_PKEY *pkey);
-int X509_NAME_add_entry_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, int type,
-                               const unsigned char *bytes, int len, int loc,
-                               int set);
-int X509_NAME_entry_count(X509_NAME *name);
-int i2d_X509_REQ_INFO(X509_REQ_INFO *a, unsigned char **out);
-
-/* openssl/objects.h */
-ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name);
-
-/* openssl/x509v3.h */
-typedef ... X509V3_CONF_METHOD;
-
-typedef struct v3_ext_ctx {
-    int flags;
-    X509 *issuer_cert;
-    X509 *subject_cert;
-    X509_REQ *subject_req;
-    X509_CRL *crl;
-    X509V3_CONF_METHOD *db_meth;
-    void *db;
-} X509V3_CTX;
-
-void X509V3_set_ctx(X509V3_CTX *ctx, X509 *issuer, X509 *subject,
-                    X509_REQ *req, X509_CRL *crl, int flags);
-void X509V3_set_nconf(X509V3_CTX *ctx, CONF *conf);
-int X509V3_EXT_REQ_add_nconf(CONF *conf, X509V3_CTX *ctx, char *section,
-                             X509_REQ *req);
-
-/* openssl/x509v3.h */
-unsigned long ERR_get_error(void);
-char *ERR_error_string(unsigned long e, char *buf);
-''')  # noqa: E501
-
-NULL = _ffi.NULL
-# openssl/conf.h
-NCONF_new = _libcrypto.NCONF_new
-NCONF_free = _libcrypto.NCONF_free
-NCONF_load_bio = _libcrypto.NCONF_load_bio
-NCONF_get_section = _libcrypto.NCONF_get_section
-NCONF_get_string = _libcrypto.NCONF_get_string
-
-# openssl/stack.h
-try:
-    sk_num = _libcrypto.OPENSSL_sk_num
-    sk_value = _libcrypto.OPENSSL_sk_value
-except AttributeError:
-    sk_num = _libcrypto.sk_num
-    sk_value = _libcrypto.sk_value
-
-
-def sk_CONF_VALUE_num(sk):
-    return sk_num(_ffi.cast("_STACK *", sk))
-
-
-def sk_CONF_VALUE_value(sk, i):
-    return _ffi.cast("CONF_VALUE *", sk_value(_ffi.cast("_STACK *", sk), i))
-
-
-# openssl/bio.h
-BIO_new_mem_buf = _libcrypto.BIO_new_mem_buf
-BIO_free = _libcrypto.BIO_free
-
-# openssl/x509.h
-X509_REQ_new = _libcrypto.X509_REQ_new
-X509_REQ_free = _libcrypto.X509_REQ_free
-X509_REQ_set_pubkey = _libcrypto.X509_REQ_set_pubkey
-d2i_PUBKEY_bio = _libcrypto.d2i_PUBKEY_bio
-i2d_X509_REQ_INFO = _libcrypto.i2d_X509_REQ_INFO
-X509_NAME_add_entry_by_OBJ = _libcrypto.X509_NAME_add_entry_by_OBJ
-X509_NAME_entry_count = _libcrypto.X509_NAME_entry_count
-
-
-def X509_REQ_get_subject_name(req):
-    return req.req_info.subject
-
-
-# openssl/objects.h
-OBJ_txt2obj = _libcrypto.OBJ_txt2obj
-
-# openssl/evp.h
-EVP_PKEY_free = _libcrypto.EVP_PKEY_free
-
-# openssl/asn1.h
-MBSTRING_UTF8 = 0x1000
-
-# openssl/x509v3.h
-X509V3_set_ctx = _libcrypto.X509V3_set_ctx
-X509V3_set_nconf = _libcrypto.X509V3_set_nconf
-X509V3_EXT_REQ_add_nconf = _libcrypto.X509V3_EXT_REQ_add_nconf
-
-# openssl/err.h
-ERR_get_error = _libcrypto.ERR_get_error
-ERR_error_string = _libcrypto.ERR_error_string
-
-
-def _raise_openssl_errors():
-    msgs = []
-
-    code = ERR_get_error()
-    while code != 0:
-        msg = _ffi.string(ERR_error_string(code, NULL))
-        try:
-            strmsg = msg.decode('utf-8')
-        except UnicodeDecodeError:
-            strmsg = repr(msg)
-        msgs.append(strmsg)
-        code = ERR_get_error()
-
-    raise errors.CSRTemplateError(reason='\n'.join(msgs))
-
-
-def _parse_dn_section(subj, dn_sk):
-    for i in range(sk_CONF_VALUE_num(dn_sk)):
-        v = sk_CONF_VALUE_value(dn_sk, i)
-        rdn_type = _ffi.string(v.name)
-
-        # Skip past any leading X. X: X, etc to allow for multiple instances
-        for idx, c in enumerate(rdn_type):
-            if c in b':,.':
-                if idx+1 < len(rdn_type):
-                    rdn_type = rdn_type[idx+1:]
-                break
-        if rdn_type.startswith(b'+'):
-            rdn_type = rdn_type[1:]
-            mval = -1
-        else:
-            mval = 0
-
-        # convert rdn_type to an OID
-        #
-        # OpenSSL is fussy about the case of the string.  For example,
-        # lower-case 'o' (for "organization name") is not recognised.
-        # Therefore, try to convert the given string into an OID.  If
-        # that fails, convert it upper case and try again.
-        #
-        oid = OBJ_txt2obj(rdn_type, 0)
-        if oid == NULL:
-            oid = OBJ_txt2obj(rdn_type.upper(), 0)
-        if oid == NULL:
-            raise errors.CSRTemplateError(
-                reason='unrecognised attribute type: {}'
-                .format(rdn_type.decode('utf-8')))
-
-        if not X509_NAME_add_entry_by_OBJ(
-                subj, oid, MBSTRING_UTF8,
-                _ffi.cast("unsigned char *", v.value), -1, -1, mval):
-            _raise_openssl_errors()
-
-    if not X509_NAME_entry_count(subj):
-        raise errors.CSRTemplateError(
-            reason='error, subject in config file is empty')
-
-
-def build_requestinfo(config, public_key_info):
-    '''
-    Return a cffi buffer containing a DER-encoded CertificationRequestInfo.
-
-    The returned object implements the buffer protocol.
-
-    '''
-    reqdata = NULL
-    req = NULL
-    nconf_bio = NULL
-    pubkey_bio = NULL
-    pubkey = NULL
-
-    try:
-        reqdata = NCONF_new(NULL)
-        if reqdata == NULL:
-            _raise_openssl_errors()
-
-        nconf_bio = BIO_new_mem_buf(config, len(config))
-        errorline = _ffi.new('long[1]', [-1])
-        i = NCONF_load_bio(reqdata, nconf_bio, errorline)
-        if i < 0:
-            if errorline[0] < 0:
-                raise errors.CSRTemplateError(reason="Can't load config file")
-            else:
-                raise errors.CSRTemplateError(
-                    reason='Error on line %d of config file' % errorline[0])
-
-        dn_sect = NCONF_get_string(reqdata, b'req', b'distinguished_name')
-        if dn_sect == NULL:
-            raise errors.CSRTemplateError(
-                reason='Unable to find "distinguished_name" key in config')
-
-        dn_sk = NCONF_get_section(reqdata, dn_sect)
-        if dn_sk == NULL:
-            raise errors.CSRTemplateError(
-                reason='Unable to find "%s" section in config' %
-                _ffi.string(dn_sect))
-
-        pubkey_bio = BIO_new_mem_buf(public_key_info, len(public_key_info))
-        pubkey = d2i_PUBKEY_bio(pubkey_bio, NULL)
-        if pubkey == NULL:
-            _raise_openssl_errors()
-
-        req = X509_REQ_new()
-        if req == NULL:
-            _raise_openssl_errors()
-
-        subject = X509_REQ_get_subject_name(req)
-
-        _parse_dn_section(subject, dn_sk)
-
-        if not X509_REQ_set_pubkey(req, pubkey):
-            _raise_openssl_errors()
-
-        ext_ctx = _ffi.new("X509V3_CTX[1]")
-        X509V3_set_ctx(ext_ctx, NULL, NULL, req, NULL, 0)
-        X509V3_set_nconf(ext_ctx, reqdata)
-
-        extn_section = NCONF_get_string(reqdata, b"req", b"req_extensions")
-        if extn_section != NULL:
-            if not X509V3_EXT_REQ_add_nconf(
-                    reqdata, ext_ctx, extn_section, req):
-                _raise_openssl_errors()
-
-        if _openssl_version < 0x10100000 or LIBRESSL:
-            der_len = i2d_X509_REQ_INFO(req.req_info, NULL)
-        else:
-            req_info = _ffi.new("X509_REQ_INFO *", req.req_info)
-            der_len = i2d_X509_REQ_INFO(req_info, NULL)
-            req.req_info = req_info[0]
-        if der_len < 0:
-            _raise_openssl_errors()
-
-        der_buf = _ffi.new("unsigned char[%d]" % der_len)
-        der_out = _ffi.new("unsigned char **", der_buf)
-        if _openssl_version < 0x10100000 or LIBRESSL:
-            der_len = i2d_X509_REQ_INFO(req.req_info, der_out)
-        else:
-            der_len = i2d_X509_REQ_INFO(req_info, der_out)
-            req.req_info = req_info[0]
-        if der_len < 0:
-            _raise_openssl_errors()
-
-        return _ffi.buffer(der_buf, der_len)
-
-    finally:
-        if reqdata != NULL:
-            NCONF_free(reqdata)
-        if req != NULL:
-            X509_REQ_free(req)
-        if nconf_bio != NULL:
-            BIO_free(nconf_bio)
-        if pubkey_bio != NULL:
-            BIO_free(pubkey_bio)
-        if pubkey != NULL:
-            EVP_PKEY_free(pubkey)
diff -urN freeipa-4.8.0/ipaclient/csrgen.py freeipa-4.8.0.removed_csrgen/ipaclient/csrgen.py
--- freeipa-4.8.0/ipaclient/csrgen.py	2019-07-03 08:42:41.811540288 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/csrgen.py	1970-01-01 01:00:00.000000000 +0100
@@ -1,488 +0,0 @@
-#
-# Copyright (C) 2016  FreeIPA Contributors see COPYING for license
-#
-
-import base64
-import collections
-import errno
-import json
-import logging
-import os
-import os.path
-import pipes
-import subprocess
-import traceback
-import codecs
-
-import pkg_resources
-
-from cryptography.hazmat.backends import default_backend
-from cryptography.hazmat.primitives.asymmetric import padding
-from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.serialization import (
-    load_pem_private_key, Encoding, PublicFormat)
-from cryptography.x509 import load_pem_x509_certificate
-import jinja2
-import jinja2.ext
-import jinja2.sandbox
-from pyasn1.codec.der import decoder, encoder
-from pyasn1.type import univ
-from pyasn1_modules import rfc2314
-import six
-
-from ipalib import api
-from ipalib import errors
-from ipalib.text import _
-
-if six.PY3:
-    unicode = str
-
-__doc__ = _("""
-Routines for constructing certificate signing requests using IPA data and
-stored templates.
-""")
-
-logger = logging.getLogger(__name__)
-
-
-class IndexableUndefined(jinja2.Undefined):
-    def __getitem__(self, key):
-        return jinja2.Undefined(
-            hint=self._undefined_hint, obj=self._undefined_obj,
-            name=self._undefined_name, exc=self._undefined_exception)
-
-
-class IPAExtension(jinja2.ext.Extension):
-    """Jinja2 extension providing useful features for CSR generation rules."""
-
-    def __init__(self, environment):
-        super(IPAExtension, self).__init__(environment)
-
-        environment.filters.update(
-            quote=self.quote,
-            required=self.required,
-        )
-
-    def quote(self, data):
-        return pipes.quote(data)
-
-    def required(self, data, name):
-        if not data:
-            raise errors.CSRTemplateError(
-                reason=_(
-                    'Required CSR generation rule %(name)s is missing data') %
-                {'name': name})
-        return data
-
-
-class Formatter:
-    """
-    Class for processing a set of CSR generation rules into a template.
-
-    The template can be rendered with user and database data to produce a
-    config, which specifies how to build a CSR.
-
-    Subclasses of Formatter should set the value of base_template_name to the
-    filename of a base template with spaces for the processed rules.
-    Additionally, they should override the _get_template_params method to
-    produce the correct output for the base template.
-    """
-    base_template_name = None
-
-    def __init__(self, csr_data_dir=None):
-        # chain loaders:
-        # 1) csr_data_dir/templates
-        # 2) /etc/ipa/csrgen/templates
-        # 3) ipaclient/csrgen/templates
-        loaders = []
-        if csr_data_dir is not None:
-            loaders.append(jinja2.FileSystemLoader(
-                os.path.join(csr_data_dir, 'templates'))
-            )
-        loaders.append(jinja2.FileSystemLoader(
-            os.path.join(api.env.confdir, 'csrgen/templates'))
-        )
-        loaders.append(jinja2.PackageLoader('ipaclient', 'csrgen/templates'))
-
-        self.jinja2 = jinja2.sandbox.SandboxedEnvironment(
-            loader=jinja2.ChoiceLoader(loaders),
-            extensions=[jinja2.ext.ExprStmtExtension, IPAExtension],
-            keep_trailing_newline=True, undefined=IndexableUndefined)
-
-        self.passthrough_globals = {}
-
-    def _define_passthrough(self, call):
-        """Some macros are meant to be interpreted during the final render, not
-        when data rules are interpolated into syntax rules. This method allows
-        those macros to be registered so that calls to them are passed through
-        to the prepared rule rather than interpreted.
-        """
-
-        def passthrough(caller):
-            return u'{%% call %s() %%}%s{%% endcall %%}' % (call, caller())
-
-        parts = call.split('.')
-        current_level = self.passthrough_globals
-        for part in parts[:-1]:
-            if part not in current_level:
-                current_level[part] = {}
-            current_level = current_level[part]
-        current_level[parts[-1]] = passthrough
-
-    def build_template(self, rules):
-        """
-        Construct a template that can produce CSR generator strings.
-
-        :param rules: list of FieldMapping to use to populate the template.
-
-        :returns: jinja2.Template that can be rendered to produce the CSR data.
-        """
-        syntax_rules = []
-        for field_mapping in rules:
-            data_rules_prepared = [
-                self._prepare_data_rule(rule)
-                for rule in field_mapping.data_rules]
-
-            data_sources = []
-            for xrule in field_mapping.data_rules:
-                data_source = xrule.options.get('data_source')
-                if data_source:
-                    data_sources.append(data_source)
-
-            syntax_rules.append(self._prepare_syntax_rule(
-                field_mapping.syntax_rule, data_rules_prepared,
-                field_mapping.description, data_sources))
-
-        template_params = self._get_template_params(syntax_rules)
-        base_template = self.jinja2.get_template(
-            self.base_template_name, globals=self.passthrough_globals)
-
-        try:
-            combined_template_source = base_template.render(**template_params)
-        except jinja2.UndefinedError:
-            logger.debug(traceback.format_exc())
-            raise errors.CSRTemplateError(reason=_(
-                'Template error when formatting certificate data'))
-
-        logger.debug(
-            'Formatting with template: %s', combined_template_source)
-        combined_template = self.jinja2.from_string(combined_template_source)
-
-        return combined_template
-
-    def _wrap_conditional(self, rule, condition):
-        rule = '{%% if %s %%}%s{%% endif %%}' % (condition, rule)
-        return rule
-
-    def _wrap_required(self, rule, description):
-        template = '{%% filter required("%s") %%}%s{%% endfilter %%}' % (
-            description, rule)
-
-        return template
-
-    def _prepare_data_rule(self, data_rule):
-        template = data_rule.template
-
-        data_source = data_rule.options.get('data_source')
-        if data_source:
-            template = self._wrap_conditional(template, data_source)
-
-        return template
-
-    def _prepare_syntax_rule(
-            self, syntax_rule, data_rules, description, data_sources):
-        logger.debug('Syntax rule template: %s', syntax_rule.template)
-        template = self.jinja2.from_string(
-            syntax_rule.template, globals=self.passthrough_globals)
-        is_required = syntax_rule.options.get('required', False)
-        try:
-            prepared_template = template.render(datarules=data_rules)
-        except jinja2.UndefinedError:
-            logger.debug(traceback.format_exc())
-            raise errors.CSRTemplateError(reason=_(
-                'Template error when formatting certificate data'))
-
-        if data_sources:
-            combinator = ' %s ' % syntax_rule.options.get(
-                'data_source_combinator', 'or')
-            condition = combinator.join(data_sources)
-            prepared_template = self._wrap_conditional(
-                prepared_template, condition)
-
-        if is_required:
-            prepared_template = self._wrap_required(
-                prepared_template, description)
-
-        return prepared_template
-
-    def _get_template_params(self, syntax_rules):
-        """
-        Package the syntax rules into fields expected by the base template.
-
-        :param syntax_rules: list of prepared syntax rules to be included in
-            the template.
-
-        :returns: dict of values needed to render the base template.
-        """
-        raise NotImplementedError('Formatter class must be subclassed')
-
-
-class OpenSSLFormatter(Formatter):
-    """Formatter class generating the openssl config-file format."""
-
-    base_template_name = 'openssl_base.tmpl'
-
-    # Syntax rules are wrapped in this data structure, to keep track of whether
-    # each goes in the extension or the root section
-    SyntaxRule = collections.namedtuple(
-        'SyntaxRule', ['template', 'is_extension'])
-
-    def __init__(self, *args, **kwargs):
-        super(OpenSSLFormatter, self).__init__(*args, **kwargs)
-        self._define_passthrough('openssl.section')
-
-    def _get_template_params(self, syntax_rules):
-        parameters = [rule.template for rule in syntax_rules
-                      if not rule.is_extension]
-        extensions = [rule.template for rule in syntax_rules
-                      if rule.is_extension]
-
-        return {'parameters': parameters, 'extensions': extensions}
-
-    def _prepare_syntax_rule(
-            self, syntax_rule, data_rules, description, data_sources):
-        """Overrides method to pull out whether rule is an extension or not."""
-        prepared_template = super(OpenSSLFormatter, self)._prepare_syntax_rule(
-            syntax_rule, data_rules, description, data_sources)
-        is_extension = syntax_rule.options.get('extension', False)
-        return self.SyntaxRule(prepared_template, is_extension)
-
-
-class FieldMapping:
-    """Representation of the rules needed to construct a complete cert field.
-
-    Attributes:
-        description: str, a name or description of this field, to be used in
-            messages
-        syntax_rule: Rule, the rule defining the syntax of this field
-        data_rules: list of Rule, the rules that produce data to be stored in
-            this field
-    """
-    __slots__ = ['description', 'syntax_rule', 'data_rules']
-
-    def __init__(self, description, syntax_rule, data_rules):
-        self.description = description
-        self.syntax_rule = syntax_rule
-        self.data_rules = data_rules
-
-
-class Rule:
-    __slots__ = ['name', 'template', 'options']
-
-    def __init__(self, name, template, options):
-        self.name = name
-        self.template = template
-        self.options = options
-
-
-class RuleProvider:
-    def rules_for_profile(self, profile_id):
-        """
-        Return the rules needed to build a CSR using the given profile.
-
-        :param profile_id: str, name of the CSR generation profile to use
-
-        :returns: list of FieldMapping, filled out with the appropriate rules
-        """
-        raise NotImplementedError('RuleProvider class must be subclassed')
-
-
-class FileRuleProvider(RuleProvider):
-    def __init__(self, csr_data_dir=None):
-        self.rules = {}
-        self._csrgen_data_dirs = []
-        if csr_data_dir is not None:
-            self._csrgen_data_dirs.append(csr_data_dir)
-        self._csrgen_data_dirs.append(
-            os.path.join(api.env.confdir, 'csrgen')
-        )
-        self._csrgen_data_dirs.append(
-            pkg_resources.resource_filename('ipaclient', 'csrgen')
-        )
-
-    def _open(self, subdir, filename):
-        for data_dir in self._csrgen_data_dirs:
-            path = os.path.join(data_dir, subdir, filename)
-            try:
-                return open(path)
-            except IOError as e:
-                if e.errno != errno.ENOENT:
-                    raise
-        raise IOError(
-            errno.ENOENT,
-            "'{}' not found in {}".format(
-                os.path.join(subdir, filename),
-                ", ".join(self._csrgen_data_dirs)
-            )
-        )
-
-    def _rule(self, rule_name):
-        if rule_name not in self.rules:
-            try:
-                with self._open('rules', '%s.json' % rule_name) as f:
-                    ruleconf = json.load(f)
-            except IOError:
-                raise errors.NotFound(
-                    reason=_('No generation rule %(rulename)s found.') %
-                    {'rulename': rule_name})
-
-            try:
-                rule = ruleconf['rule']
-            except KeyError:
-                raise errors.EmptyResult(
-                    reason=_('Generation rule "%(rulename)s" is missing the'
-                             ' "rule" key') % {'rulename': rule_name})
-
-            options = ruleconf.get('options', {})
-
-            self.rules[rule_name] = Rule(
-                rule_name, rule['template'], options)
-
-        return self.rules[rule_name]
-
-    def rules_for_profile(self, profile_id):
-        try:
-            with self._open('profiles', '%s.json' % profile_id) as f:
-                profile = json.load(f)
-        except IOError:
-            raise errors.NotFound(
-                reason=_('No CSR generation rules are defined for profile'
-                         ' %(profile_id)s') % {'profile_id': profile_id})
-
-        field_mappings = []
-        for field in profile:
-            syntax_rule = self._rule(field['syntax'])
-            data_rules = [self._rule(name) for name in field['data']]
-            field_mappings.append(FieldMapping(
-                syntax_rule.name, syntax_rule, data_rules))
-        return field_mappings
-
-
-class CSRGenerator:
-    def __init__(self, rule_provider, formatter_class=OpenSSLFormatter):
-        self.rule_provider = rule_provider
-        self.formatter = formatter_class()
-
-    def csr_config(self, principal, config, profile_id):
-        render_data = {'subject': principal, 'config': config}
-
-        rules = self.rule_provider.rules_for_profile(profile_id)
-        template = self.formatter.build_template(rules)
-
-        try:
-            config = template.render(render_data)
-        except jinja2.UndefinedError:
-            logger.debug(traceback.format_exc())
-            raise errors.CSRTemplateError(reason=_(
-                'Template error when formatting certificate data'))
-
-        return config
-
-
-class CSRLibraryAdaptor:
-    def get_subject_public_key_info(self):
-        raise NotImplementedError('Use a subclass of CSRLibraryAdaptor')
-
-    def sign_csr(self, certification_request_info):
-        """Sign a CertificationRequestInfo.
-
-        :returns: bytes, a DER-encoded signed CSR.
-        """
-        raise NotImplementedError('Use a subclass of CSRLibraryAdaptor')
-
-
-class OpenSSLAdaptor:
-    def __init__(self, key=None, key_filename=None, password_filename=None):
-        """
-        Must provide either ``key_filename`` or ``key``.
-
-        """
-        if key_filename is not None:
-            with open(key_filename, 'rb') as key_file:
-                key_bytes = key_file.read()
-
-            password = None
-            if password_filename is not None:
-                with open(password_filename, 'rb') as password_file:
-                    password = password_file.read().strip()
-
-            self._key = load_pem_private_key(
-                key_bytes, password, default_backend())
-
-        elif key is not None:
-            self._key = key
-
-        else:
-            raise ValueError("Must provide 'key' or 'key_filename'")
-
-    def key(self):
-        return self._key
-
-    def get_subject_public_key_info(self):
-        pubkey_info = self.key().public_key().public_bytes(
-            Encoding.DER, PublicFormat.SubjectPublicKeyInfo)
-        return pubkey_info
-
-    def sign_csr(self, certification_request_info):
-        reqinfo = decoder.decode(
-            certification_request_info, rfc2314.CertificationRequestInfo())[0]
-        csr = rfc2314.CertificationRequest()
-        csr.setComponentByName('certificationRequestInfo', reqinfo)
-
-        algorithm = rfc2314.SignatureAlgorithmIdentifier()
-        algorithm.setComponentByName(
-            'algorithm', univ.ObjectIdentifier(
-                '1.2.840.113549.1.1.11'))  # sha256WithRSAEncryption
-        csr.setComponentByName('signatureAlgorithm', algorithm)
-
-        signature = self.key().sign(
-            certification_request_info,
-            padding.PKCS1v15(),
-            hashes.SHA256()
-        )
-        asn1sig = univ.BitString("'{sig}'H".format(
-                                    sig=codecs.encode(signature, 'hex')
-                                    .decode('ascii'))
-                                 )
-        csr.setComponentByName('signature', asn1sig)
-        return encoder.encode(csr)
-
-
-class NSSAdaptor:
-    def __init__(self, database, password_filename):
-        self.database = database
-        self.password_filename = password_filename
-        self.nickname = base64.b32encode(os.urandom(40))
-
-    def get_subject_public_key_info(self):
-        temp_cn = base64.b32encode(os.urandom(40)).decode('ascii')
-
-        password_args = []
-        if self.password_filename is not None:
-            password_args = ['-f', self.password_filename]
-
-        subprocess.check_call(
-            ['certutil', '-S', '-n', self.nickname, '-s', 'CN=%s' % temp_cn,
-             '-x', '-t', ',,', '-d', self.database] + password_args)
-        cert_pem = subprocess.check_output(
-            ['certutil', '-L', '-n', self.nickname, '-a',
-             '-d', self.database] + password_args)
-
-        cert = load_pem_x509_certificate(cert_pem, default_backend())
-        pubkey_info = cert.public_key().public_bytes(
-            Encoding.DER, PublicFormat.SubjectPublicKeyInfo)
-
-        return pubkey_info
-
-    def sign_csr(self, certification_request_info):
-        raise NotImplementedError('NSS is not yet supported')
diff -urN freeipa-4.8.0/ipaclient/plugins/cert.py freeipa-4.8.0.removed_csrgen/ipaclient/plugins/cert.py
--- freeipa-4.8.0/ipaclient/plugins/cert.py	2019-07-03 08:42:41.978537802 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/plugins/cert.py	2019-07-03 13:24:38.477222594 +0200
@@ -21,8 +21,6 @@
 
 import base64
 
-import six
-
 from ipaclient.frontend import MethodOverride
 from ipalib import errors
 from ipalib import x509
@@ -31,9 +29,6 @@
 from ipalib.plugable import Registry
 from ipalib.text import _
 
-if six.PY3:
-    unicode = str
-
 register = Registry()
 
 
@@ -73,87 +68,12 @@
 
 @register(override=True, no_fail=True)
 class cert_request(CertRetrieveOverride):
-    takes_options = CertRetrieveOverride.takes_options + (
-        Str(
-            'database?',
-            label=_('Path to NSS database'),
-            doc=_('Path to NSS database to use for private key'),
-        ),
-        Str(
-            'private_key?',
-            label=_('Path to private key file'),
-            doc=_('Path to PEM file containing a private key'),
-        ),
-        Str(
-            'password_file?',
-            label=_(
-                'File containing a password for the private key or database'),
-        ),
-        Str(
-            'csr_profile_id?',
-            label=_('Name of CSR generation profile (if not the same as'
-                    ' profile_id)'),
-        ),
-    )
-
     def get_args(self):
         for arg in super(cert_request, self).get_args():
             if arg.name == 'csr':
                 arg = arg.clone_retype(arg.name, File, required=False)
             yield arg
 
-    def forward(self, csr=None, **options):
-        database = options.pop('database', None)
-        private_key = options.pop('private_key', None)
-        csr_profile_id = options.pop('csr_profile_id', None)
-        password_file = options.pop('password_file', None)
-
-        if csr is None:
-            # Deferred import, ipaclient.csrgen is expensive to load.
-            # see https://pagure.io/freeipa/issue/7484
-            from ipaclient import csrgen
-
-            if database:
-                adaptor = csrgen.NSSAdaptor(database, password_file)
-            elif private_key:
-                adaptor = csrgen.OpenSSLAdaptor(
-                    key_filename=private_key, password_filename=password_file)
-            else:
-                raise errors.InvocationError(
-                    message=u"One of 'database' or 'private_key' is required")
-
-            pubkey_info = adaptor.get_subject_public_key_info()
-            pubkey_info_b64 = base64.b64encode(pubkey_info)
-
-            # If csr_profile_id is passed, that takes precedence.
-            # Otherwise, use profile_id. If neither are passed, the default
-            # in cert_get_requestdata will be used.
-            profile_id = csr_profile_id
-            if profile_id is None:
-                profile_id = options.get('profile_id')
-
-            response = self.api.Command.cert_get_requestdata(
-                profile_id=profile_id,
-                principal=options.get('principal'),
-                public_key_info=pubkey_info_b64)
-
-            req_info_b64 = response['result']['request_info']
-            req_info = base64.b64decode(req_info_b64)
-
-            csr = adaptor.sign_csr(req_info)
-
-            if not csr:
-                raise errors.CertificateOperationError(
-                    error=(_('Generated CSR was empty')))
-
-        else:
-            if database is not None or private_key is not None:
-                raise errors.MutuallyExclusiveError(reason=_(
-                    "Options 'database' and 'private_key' are not compatible"
-                    " with 'csr'"))
-
-        return super(cert_request, self).forward(csr, **options)
-
 
 @register(override=True, no_fail=True)
 class cert_show(CertRetrieveOverride):
diff -urN freeipa-4.8.0/ipaclient/plugins/cert.py.orig freeipa-4.8.0.removed_csrgen/ipaclient/plugins/cert.py.orig
--- freeipa-4.8.0/ipaclient/plugins/cert.py.orig	1970-01-01 01:00:00.000000000 +0100
+++ freeipa-4.8.0.removed_csrgen/ipaclient/plugins/cert.py.orig	2019-07-03 13:24:38.478222573 +0200
@@ -0,0 +1,215 @@
+# Authors:
+#   Andrew Wnuk <awnuk@redhat.com>
+#   Jason Gerard DeRose <jderose@redhat.com>
+#   John Dennis <jdennis@redhat.com>
+#
+# Copyright (C) 2009  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import base64
+
+import six
+
+from ipaclient.frontend import MethodOverride
+from ipalib import errors
+from ipalib import x509
+from ipalib import util
+from ipalib.parameters import BinaryFile, File, Flag, Str
+from ipalib.plugable import Registry
+from ipalib.text import _
+
+if six.PY3:
+    unicode = str
+
+register = Registry()
+
+
+class CertRetrieveOverride(MethodOverride):
+    takes_options = (
+        Str(
+            'certificate_out?',
+            doc=_('Write certificate (chain if --chain used) to file'),
+            include='cli',
+            cli_metavar='FILE',
+        ),
+    )
+
+    def forward(self, *args, **options):
+        if 'certificate_out' in options:
+            certificate_out = options.pop('certificate_out')
+            try:
+                util.check_writable_file(certificate_out)
+            except errors.FileError as e:
+                raise errors.ValidationError(name='certificate-out',
+                                             error=str(e))
+        else:
+            certificate_out = None
+
+        result = super(CertRetrieveOverride, self).forward(*args, **options)
+
+        if certificate_out is not None:
+            if options.get('chain', False):
+                certs = result['result']['certificate_chain']
+            else:
+                certs = [base64.b64decode(result['result']['certificate'])]
+            certs = (x509.load_der_x509_certificate(cert) for cert in certs)
+            x509.write_certificate_list(certs, certificate_out)
+
+        return result
+
+
+@register(override=True, no_fail=True)
+class cert_request(CertRetrieveOverride):
+    takes_options = CertRetrieveOverride.takes_options + (
+        Str(
+            'database?',
+            label=_('Path to NSS database'),
+            doc=_('Path to NSS database to use for private key'),
+        ),
+        Str(
+            'private_key?',
+            label=_('Path to private key file'),
+            doc=_('Path to PEM file containing a private key'),
+        ),
+        Str(
+            'password_file?',
+            label=_(
+                'File containing a password for the private key or database'),
+        ),
+        Str(
+            'csr_profile_id?',
+            label=_('Name of CSR generation profile (if not the same as'
+                    ' profile_id)'),
+        ),
+    )
+
+    def get_args(self):
+        for arg in super(cert_request, self).get_args():
+            if arg.name == 'csr':
+                arg = arg.clone_retype(arg.name, File, required=False)
+            yield arg
+
+    def forward(self, csr=None, **options):
+        database = options.pop('database', None)
+        private_key = options.pop('private_key', None)
+        csr_profile_id = options.pop('csr_profile_id', None)
+        password_file = options.pop('password_file', None)
+
+        if csr is None:
+            # Deferred import, ipaclient.csrgen is expensive to load.
+            # see https://pagure.io/freeipa/issue/7484
+            from ipaclient import csrgen
+
+            if database:
+                adaptor = csrgen.NSSAdaptor(database, password_file)
+            elif private_key:
+                adaptor = csrgen.OpenSSLAdaptor(
+                    key_filename=private_key, password_filename=password_file)
+            else:
+                raise errors.InvocationError(
+                    message=u"One of 'database' or 'private_key' is required")
+
+            pubkey_info = adaptor.get_subject_public_key_info()
+            pubkey_info_b64 = base64.b64encode(pubkey_info)
+
+            # If csr_profile_id is passed, that takes precedence.
+            # Otherwise, use profile_id. If neither are passed, the default
+            # in cert_get_requestdata will be used.
+            profile_id = csr_profile_id
+            if profile_id is None:
+                profile_id = options.get('profile_id')
+
+            response = self.api.Command.cert_get_requestdata(
+                profile_id=profile_id,
+                principal=options.get('principal'),
+                public_key_info=pubkey_info_b64)
+
+            req_info_b64 = response['result']['request_info']
+            req_info = base64.b64decode(req_info_b64)
+
+            csr = adaptor.sign_csr(req_info)
+
+            if not csr:
+                raise errors.CertificateOperationError(
+                    error=(_('Generated CSR was empty')))
+
+        else:
+            if database is not None or private_key is not None:
+                raise errors.MutuallyExclusiveError(reason=_(
+                    "Options 'database' and 'private_key' are not compatible"
+                    " with 'csr'"))
+
+        return super(cert_request, self).forward(csr, **options)
+
+
+@register(override=True, no_fail=True)
+class cert_show(CertRetrieveOverride):
+    def get_options(self):
+        for option in super(cert_show, self).get_options():
+            if option.name == 'out':
+                # skip server-defined --out
+                continue
+            if option.name == 'certificate_out':
+                # add --out as a deprecated alias of --certificate-out
+                option = option.clone_rename(
+                    'out',
+                    cli_name='certificate_out',
+                    deprecated_cli_aliases={'out'},
+                )
+            yield option
+
+    def forward(self, *args, **options):
+        try:
+            options['certificate_out'] = options.pop('out')
+        except KeyError:
+            pass
+
+        return super(cert_show, self).forward(*args, **options)
+
+
+@register(override=True, no_fail=True)
+class cert_remove_hold(MethodOverride):
+    has_output_params = (
+        Flag('unrevoked',
+            label=_('Unrevoked'),
+        ),
+        Str('error_string',
+            label=_('Error'),
+        ),
+    )
+
+
+@register(override=True, no_fail=True)
+class cert_find(MethodOverride):
+    takes_options = (
+        BinaryFile(
+            'file?',
+            label=_("Input filename"),
+            doc=_('File to load the certificate from.'),
+            include='cli',
+        ),
+    )
+
+    def forward(self, *args, **options):
+        if self.api.env.context == 'cli':
+            if 'certificate' in options and 'file' in options:
+                raise errors.MutuallyExclusiveError(
+                    reason=_("cannot specify both raw certificate and file"))
+            if 'certificate' not in options and 'file' in options:
+                options['certificate'] = x509.load_unknown_x509_certificate(
+                                            options.pop('file'))
+
+        return super(cert_find, self).forward(*args, **options)
diff -urN freeipa-4.8.0/ipaclient/plugins/csrgen.py freeipa-4.8.0.removed_csrgen/ipaclient/plugins/csrgen.py
--- freeipa-4.8.0/ipaclient/plugins/csrgen.py	2019-07-03 08:42:41.990537623 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/plugins/csrgen.py	1970-01-01 01:00:00.000000000 +0100
@@ -1,128 +0,0 @@
-#
-# Copyright (C) 2016  FreeIPA Contributors see COPYING for license
-#
-
-import base64
-
-import six
-
-from ipalib import api
-from ipalib import errors
-from ipalib import output
-from ipalib import util
-from ipalib.frontend import Local, Str
-from ipalib.parameters import Bytes, Principal
-from ipalib.plugable import Registry
-from ipalib.text import _
-from ipapython import dogtag
-
-
-if six.PY3:
-    unicode = str
-
-register = Registry()
-
-__doc__ = _("""
-Commands to build certificate requests automatically
-""")
-
-
-@register()
-class cert_get_requestdata(Local):
-    __doc__ = _('Gather data for a certificate signing request.')
-
-    NO_CLI = True
-
-    takes_options = (
-        Principal(
-            'principal',
-            label=_('Principal'),
-            doc=_('Principal for this certificate (e.g.'
-                  ' HTTP/test.example.com)'),
-        ),
-        Str(
-            'profile_id?',
-            label=_('Profile ID'),
-            doc=_('CSR Generation Profile to use'),
-        ),
-        Bytes(
-            'public_key_info',
-            label=_('Subject Public Key Info'),
-            doc=_('DER-encoded SubjectPublicKeyInfo structure'),
-        ),
-        Str(
-            'out?',
-            doc=_('Write CertificationRequestInfo to file'),
-        ),
-    )
-
-    has_output = (
-        output.Output(
-            'result',
-            type=dict,
-            doc=_('Dictionary mapping variable name to value'),
-        ),
-    )
-
-    has_output_params = (
-        Str(
-            'request_info',
-            label=_('CertificationRequestInfo structure'),
-        )
-    )
-
-    def execute(self, *args, **options):
-        # Deferred import, ipaclient.csrgen is expensive to load.
-        # see https://pagure.io/freeipa/issue/7484
-        from ipaclient import csrgen
-        from ipaclient import csrgen_ffi
-
-        if 'out' in options:
-            util.check_writable_file(options['out'])
-
-        principal = options.get('principal')
-        profile_id = options.get('profile_id')
-        if profile_id is None:
-            profile_id = dogtag.DEFAULT_PROFILE
-        public_key_info = options.get('public_key_info')
-        public_key_info = base64.b64decode(public_key_info)
-
-        if self.api.env.in_server:
-            backend = self.api.Backend.ldap2
-        else:
-            backend = self.api.Backend.rpcclient
-        if not backend.isconnected():
-            backend.connect()
-
-        try:
-            if principal.is_host:
-                principal_obj = api.Command.host_show(
-                    principal.hostname, all=True)
-            elif principal.is_service:
-                principal_obj = api.Command.service_show(
-                    unicode(principal), all=True)
-            elif principal.is_user:
-                principal_obj = api.Command.user_show(
-                    principal.username, all=True)
-        except errors.NotFound:
-            raise errors.NotFound(
-                reason=_("The principal for this request doesn't exist."))
-        principal_obj = principal_obj['result']
-        config = api.Command.config_show()['result']
-
-        generator = csrgen.CSRGenerator(csrgen.FileRuleProvider())
-
-        csr_config = generator.csr_config(principal_obj, config, profile_id)
-        request_info = base64.b64encode(csrgen_ffi.build_requestinfo(
-            csr_config.encode('utf8'), public_key_info))
-
-        result = {}
-        if 'out' in options:
-            with open(options['out'], 'wb') as f:
-                f.write(request_info)
-        else:
-            result = dict(request_info=request_info)
-
-        return dict(
-            result=result
-        )
diff -urN freeipa-4.8.0/ipaclient/setup.py freeipa-4.8.0.removed_csrgen/ipaclient/setup.py
--- freeipa-4.8.0/ipaclient/setup.py	2019-07-03 08:42:41.836539916 +0200
+++ freeipa-4.8.0.removed_csrgen/ipaclient/setup.py	2019-07-03 13:24:38.479222551 +0200
@@ -41,13 +41,6 @@
             "ipaclient.remote_plugins.2_156",
             "ipaclient.remote_plugins.2_164",
         ],
-        package_data={
-            'ipaclient': [
-                'csrgen/profiles/*.json',
-                'csrgen/rules/*.json',
-                'csrgen/templates/*.tmpl',
-            ],
-        },
         install_requires=[
             "cryptography",
             "ipalib",
@@ -63,7 +56,6 @@
         extras_require={
             "install": ["ipaplatform"],
             "otptoken_yubikey": ["python-yubico", "pyusb"],
-            "csrgen": ["cffi", "jinja2"],
             "ldap": ["python-ldap"],  # ipapython.ipaldap
         },
         zip_safe=False,
diff -urN freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/configs/caIPAserviceCert.conf freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/configs/caIPAserviceCert.conf
--- freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/configs/caIPAserviceCert.conf	2019-07-03 08:42:45.972478335 +0200
+++ freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/configs/caIPAserviceCert.conf	1970-01-01 01:00:00.000000000 +0100
@@ -1,16 +0,0 @@
-[ req ]
-prompt = no
-encrypt_key = no
-
-distinguished_name = sec0
-req_extensions = sec2
-
-[ sec0 ]
-O=DOMAIN.EXAMPLE.COM
-CN=machine.example.com
-
-[ sec1 ]
-DNS = machine.example.com
-
-[ sec2 ]
-subjectAltName = @sec1
diff -urN freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/configs/userCert.conf freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/configs/userCert.conf
--- freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/configs/userCert.conf	2019-07-03 08:42:45.976478276 +0200
+++ freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/configs/userCert.conf	1970-01-01 01:00:00.000000000 +0100
@@ -1,16 +0,0 @@
-[ req ]
-prompt = no
-encrypt_key = no
-
-distinguished_name = sec0
-req_extensions = sec2
-
-[ sec0 ]
-O=DOMAIN.EXAMPLE.COM
-CN=testuser
-
-[ sec1 ]
-email = testuser@example.com
-
-[ sec2 ]
-subjectAltName = @sec1
diff -urN freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/profiles/profile.json freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/profiles/profile.json
--- freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/profiles/profile.json	2019-07-03 08:42:45.980478216 +0200
+++ freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/profiles/profile.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,8 +0,0 @@
-[
-    {
-        "syntax": "basic",
-        "data": [
-            "options"
-        ]
-    }
-]
diff -urN freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/rules/basic.json freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/rules/basic.json
--- freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/rules/basic.json	2019-07-03 08:42:45.984478157 +0200
+++ freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/rules/basic.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,5 +0,0 @@
-{
-  "rule": {
-    "template": "openssl_rule"
-  }
-}
diff -urN freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/rules/options.json freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/rules/options.json
--- freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/rules/options.json	2019-07-03 08:42:45.988478097 +0200
+++ freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/rules/options.json	1970-01-01 01:00:00.000000000 +0100
@@ -1,8 +0,0 @@
-{
-  "rule": {
-    "template": "openssl_rule"
-  },
-  "options": {
-    "rule_option": true
-  }
-}
diff -urN freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/templates/identity_base.tmpl freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/templates/identity_base.tmpl
--- freeipa-4.8.0/ipatests/test_ipaclient/data/test_csrgen/templates/identity_base.tmpl	2019-07-03 08:42:45.993478023 +0200
+++ freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/data/test_csrgen/templates/identity_base.tmpl	1970-01-01 01:00:00.000000000 +0100
@@ -1 +0,0 @@
-{{ options|join(";") }}
diff -urN freeipa-4.8.0/ipatests/test_ipaclient/test_csrgen.py freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/test_csrgen.py
--- freeipa-4.8.0/ipatests/test_ipaclient/test_csrgen.py	2019-07-03 08:42:45.963478469 +0200
+++ freeipa-4.8.0.removed_csrgen/ipatests/test_ipaclient/test_csrgen.py	1970-01-01 01:00:00.000000000 +0100
@@ -1,304 +0,0 @@
-#
-# Copyright (C) 2016  FreeIPA Contributors see COPYING for license
-#
-
-import os
-import pytest
-
-from cryptography.hazmat.backends import default_backend
-from cryptography.hazmat.primitives.asymmetric import rsa
-from cryptography import x509
-
-from ipaclient import csrgen, csrgen_ffi
-from ipalib import errors
-
-BASE_DIR = os.path.dirname(__file__)
-CSR_DATA_DIR = os.path.join(BASE_DIR, 'data', 'test_csrgen')
-
-
-@pytest.fixture
-def formatter():
-    return csrgen.Formatter(csr_data_dir=CSR_DATA_DIR)
-
-
-@pytest.fixture
-def rule_provider():
-    return csrgen.FileRuleProvider(csr_data_dir=CSR_DATA_DIR)
-
-
-@pytest.fixture
-def generator():
-    return csrgen.CSRGenerator(csrgen.FileRuleProvider())
-
-
-class StubRuleProvider(csrgen.RuleProvider):
-    def __init__(self):
-        self.syntax_rule = csrgen.Rule(
-            'syntax', '{{datarules|join(",")}}', {})
-        self.data_rule = csrgen.Rule('data', 'data_template', {})
-        self.field_mapping = csrgen.FieldMapping(
-            'example', self.syntax_rule, [self.data_rule])
-        self.rules = [self.field_mapping]
-
-    def rules_for_profile(self, profile_id):
-        return self.rules
-
-
-class IdentityFormatter(csrgen.Formatter):
-    base_template_name = 'identity_base.tmpl'
-
-    def __init__(self):
-        super(IdentityFormatter, self).__init__(csr_data_dir=CSR_DATA_DIR)
-
-    def _get_template_params(self, syntax_rules):
-        return {'options': syntax_rules}
-
-
-class test_Formatter:
-    def test_prepare_data_rule_with_data_source(self, formatter):
-        data_rule = csrgen.Rule('uid', '{{subject.uid.0}}',
-                                {'data_source': 'subject.uid.0'})
-        prepared = formatter._prepare_data_rule(data_rule)
-        assert prepared == '{% if subject.uid.0 %}{{subject.uid.0}}{% endif %}'
-
-    def test_prepare_data_rule_no_data_source(self, formatter):
-        """Not a normal case, but we should handle it anyway"""
-        data_rule = csrgen.Rule('uid', 'static_text', {})
-        prepared = formatter._prepare_data_rule(data_rule)
-        assert prepared == 'static_text'
-
-    def test_prepare_syntax_rule_with_data_sources(self, formatter):
-        syntax_rule = csrgen.Rule(
-            'example', '{{datarules|join(",")}}', {})
-        data_rules = ['{{subject.field1}}', '{{subject.field2}}']
-        data_sources = ['subject.field1', 'subject.field2']
-        prepared = formatter._prepare_syntax_rule(
-            syntax_rule, data_rules, 'example', data_sources)
-
-        assert prepared == (
-            '{% if subject.field1 or subject.field2 %}{{subject.field1}},'
-            '{{subject.field2}}{% endif %}')
-
-    def test_prepare_syntax_rule_with_combinator(self, formatter):
-        syntax_rule = csrgen.Rule('example', '{{datarules|join(",")}}',
-                                  {'data_source_combinator': 'and'})
-        data_rules = ['{{subject.field1}}', '{{subject.field2}}']
-        data_sources = ['subject.field1', 'subject.field2']
-        prepared = formatter._prepare_syntax_rule(
-            syntax_rule, data_rules, 'example', data_sources)
-
-        assert prepared == (
-            '{% if subject.field1 and subject.field2 %}{{subject.field1}},'
-            '{{subject.field2}}{% endif %}')
-
-    def test_prepare_syntax_rule_required(self, formatter):
-        syntax_rule = csrgen.Rule('example', '{{datarules|join(",")}}',
-                                  {'required': True})
-        data_rules = ['{{subject.field1}}']
-        data_sources = ['subject.field1']
-        prepared = formatter._prepare_syntax_rule(
-            syntax_rule, data_rules, 'example', data_sources)
-
-        assert prepared == (
-            '{% filter required("example") %}{% if subject.field1 %}'
-            '{{subject.field1}}{% endif %}{% endfilter %}')
-
-    def test_prepare_syntax_rule_passthrough(self, formatter):
-        """
-        Calls to macros defined as passthrough are still call tags in the final
-        template.
-        """
-        formatter._define_passthrough('example.macro')
-
-        syntax_rule = csrgen.Rule(
-            'example',
-            '{% call example.macro() %}{{datarules|join(",")}}{% endcall %}',
-            {})
-        data_rules = ['{{subject.field1}}']
-        data_sources = ['subject.field1']
-        prepared = formatter._prepare_syntax_rule(
-            syntax_rule, data_rules, 'example', data_sources)
-
-        assert prepared == (
-            '{% if subject.field1 %}{% call example.macro() %}'
-            '{{subject.field1}}{% endcall %}{% endif %}')
-
-    def test_prepare_syntax_rule_no_data_sources(self, formatter):
-        """Not a normal case, but we should handle it anyway"""
-        syntax_rule = csrgen.Rule(
-            'example', '{{datarules|join(",")}}', {})
-        data_rules = ['rule1', 'rule2']
-        data_sources = []
-        prepared = formatter._prepare_syntax_rule(
-            syntax_rule, data_rules, 'example', data_sources)
-
-        assert prepared == 'rule1,rule2'
-
-
-class test_FileRuleProvider:
-    def test_rule_basic(self, rule_provider):
-        rule_name = 'basic'
-
-        rule = rule_provider._rule(rule_name)
-
-        assert rule.template == 'openssl_rule'
-
-    def test_rule_global_options(self, rule_provider):
-        rule_name = 'options'
-
-        rule = rule_provider._rule(rule_name)
-
-        assert rule.options['rule_option'] is True
-
-    def test_rule_nosuchrule(self, rule_provider):
-        with pytest.raises(errors.NotFound):
-            rule_provider._rule('nosuchrule')
-
-    def test_rules_for_profile_success(self, rule_provider):
-        rules = rule_provider.rules_for_profile('profile')
-
-        assert len(rules) == 1
-        field_mapping = rules[0]
-        assert field_mapping.syntax_rule.name == 'basic'
-        assert len(field_mapping.data_rules) == 1
-        assert field_mapping.data_rules[0].name == 'options'
-
-    def test_rules_for_profile_nosuchprofile(self, rule_provider):
-        with pytest.raises(errors.NotFound):
-            rule_provider.rules_for_profile('nosuchprofile')
-
-
-class test_CSRGenerator:
-    def test_userCert_OpenSSL(self, generator):
-        principal = {
-            'uid': ['testuser'],
-            'mail': ['testuser@example.com'],
-        }
-        config = {
-            'ipacertificatesubjectbase': [
-                'O=DOMAIN.EXAMPLE.COM'
-            ],
-        }
-
-        script = generator.csr_config(principal, config, 'userCert')
-        with open(os.path.join(
-                CSR_DATA_DIR, 'configs', 'userCert.conf')) as f:
-            expected_script = f.read()
-        assert script == expected_script
-
-    def test_caIPAserviceCert_OpenSSL(self, generator):
-        principal = {
-            'krbprincipalname': [
-                'HTTP/machine.example.com@DOMAIN.EXAMPLE.COM'
-            ],
-        }
-        config = {
-            'ipacertificatesubjectbase': [
-                'O=DOMAIN.EXAMPLE.COM'
-            ],
-        }
-
-        script = generator.csr_config(
-            principal, config, 'caIPAserviceCert')
-        with open(os.path.join(
-                CSR_DATA_DIR, 'configs', 'caIPAserviceCert.conf')) as f:
-            expected_script = f.read()
-        assert script == expected_script
-
-    def test_works_with_lowercase_attr_type_shortname(self, generator):
-        principal = {
-            'uid': ['testuser'],
-            'mail': ['testuser@example.com'],
-        }
-        template_env = {
-            'ipacertificatesubjectbase': [
-                'o=DOMAIN.EXAMPLE.COM'  # lower-case attr type shortname
-            ],
-        }
-        config = generator.csr_config(principal, template_env, 'userCert')
-
-        key = rsa.generate_private_key(
-            public_exponent=65537,
-            key_size=2048,
-            backend=default_backend(),
-        )
-        adaptor = csrgen.OpenSSLAdaptor(key=key)
-
-        reqinfo = bytes(csrgen_ffi.build_requestinfo(
-            config.encode('utf-8'), adaptor.get_subject_public_key_info()))
-        csr_der = adaptor.sign_csr(reqinfo)
-        csr = x509.load_der_x509_csr(csr_der, default_backend())
-        assert (
-            csr.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME)
-            == [x509.NameAttribute(x509.NameOID.COMMON_NAME, u'testuser')]
-        )
-        assert (
-            csr.subject.get_attributes_for_oid(x509.NameOID.ORGANIZATION_NAME)
-            == [x509.NameAttribute(
-                x509.NameOID.ORGANIZATION_NAME, u'DOMAIN.EXAMPLE.COM')]
-        )
-
-    def test_unrecognised_attr_type_raises(self, generator):
-        principal = {
-            'uid': ['testuser'],
-            'mail': ['testuser@example.com'],
-        }
-        template_env = {
-            'ipacertificatesubjectbase': [
-                'X=DOMAIN.EXAMPLE.COM'  # unrecognised attr type
-            ],
-        }
-        config = generator.csr_config(principal, template_env, 'userCert')
-
-        key = rsa.generate_private_key(
-            public_exponent=65537,
-            key_size=2048,
-            backend=default_backend(),
-        )
-        adaptor = csrgen.OpenSSLAdaptor(key=key)
-
-        with pytest.raises(
-                errors.CSRTemplateError,
-                match=r'^unrecognised attribute type: X$'):
-            csrgen_ffi.build_requestinfo(
-                config.encode('utf-8'), adaptor.get_subject_public_key_info())
-
-
-class test_rule_handling:
-    def test_optionalAttributeMissing(self, generator):
-        principal = {'uid': 'testuser'}
-        rule_provider = StubRuleProvider()
-        rule_provider.data_rule.template = '{{subject.mail}}'
-        rule_provider.data_rule.options = {'data_source': 'subject.mail'}
-        generator = csrgen.CSRGenerator(
-            rule_provider, formatter_class=IdentityFormatter)
-
-        script = generator.csr_config(
-            principal, {}, 'example')
-        assert script == '\n'
-
-    def test_twoDataRulesOneMissing(self, generator):
-        principal = {'uid': 'testuser'}
-        rule_provider = StubRuleProvider()
-        rule_provider.data_rule.template = '{{subject.mail}}'
-        rule_provider.data_rule.options = {'data_source': 'subject.mail'}
-        rule_provider.field_mapping.data_rules.append(csrgen.Rule(
-            'data2', '{{subject.uid}}', {'data_source': 'subject.uid'}))
-        generator = csrgen.CSRGenerator(
-            rule_provider, formatter_class=IdentityFormatter)
-
-        script = generator.csr_config(principal, {}, 'example')
-        assert script == ',testuser\n'
-
-    def test_requiredAttributeMissing(self):
-        principal = {'uid': 'testuser'}
-        rule_provider = StubRuleProvider()
-        rule_provider.data_rule.template = '{{subject.mail}}'
-        rule_provider.data_rule.options = {'data_source': 'subject.mail'}
-        rule_provider.syntax_rule.options = {'required': True}
-        generator = csrgen.CSRGenerator(
-            rule_provider, formatter_class=IdentityFormatter)
-
-        with pytest.raises(errors.CSRTemplateError):
-            _script = generator.csr_config(
-                principal, {}, 'example')