From 96afd05dda2ce502994b6c9ceae819d79d96a666 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Wed, 3 May 2017 06:18:05 +0000
Subject: [PATCH] server certinstall: support PKINIT
Allow replacing the KDC certificate.
https://pagure.io/freeipa/issue/6831
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
---
install/tools/man/ipa-server-certinstall.1 | 5 ++-
ipaserver/install/ipa_server_certinstall.py | 70 +++++++++++++++++++++++++++--
2 files changed, 70 insertions(+), 5 deletions(-)
diff --git a/install/tools/man/ipa-server-certinstall.1 b/install/tools/man/ipa-server-certinstall.1
index d23bbd490e2b0454b8fb908e22f33c7a611c8874..35cd8c6c711119d7c782c6a89ac78b4894cec073 100644
--- a/install/tools/man/ipa-server-certinstall.1
+++ b/install/tools/man/ipa-server-certinstall.1
@@ -22,7 +22,7 @@ ipa\-server\-certinstall \- Install new SSL server certificates
.SH "SYNOPSIS"
ipa\-server\-certinstall [\fIOPTION\fR]... FILE...
.SH "DESCRIPTION"
-Replace the current SSL Directory and/or Apache server certificate(s) with the certificate in the specified files. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats.
+Replace the current Directory server SSL certificate, Apache server SSL certificate and/or Kerberos KDC certificate with the certificate in the specified files. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats.
PKCS#12 is a file format used to safely transport SSL certificates and public/private keypairs.
@@ -37,6 +37,9 @@ Install the certificate on the Directory Server
\fB\-w\fR, \fB\-\-http\fR
Install the certificate in the Apache Web Server
.TP
+\fB\-k\fR, \fB\-\-kdc\fR
+Install the certificate in the Kerberos KDC
+.TP
\fB\-\-pin\fR=\fIPIN\fR
The password to unlock the private key
.TP
diff --git a/ipaserver/install/ipa_server_certinstall.py b/ipaserver/install/ipa_server_certinstall.py
index 9f2cd9573a156949ae979e7b69fbd23adaf2feb8..a14a84f188c62170c8ac11f823ebba60609e4cc7 100644
--- a/ipaserver/install/ipa_server_certinstall.py
+++ b/ipaserver/install/ipa_server_certinstall.py
@@ -21,12 +21,17 @@
import os
import os.path
import pwd
+import tempfile
import optparse # pylint: disable=deprecated-module
+from ipalib import x509
+from ipalib.install import certmonger
from ipaplatform.constants import constants
from ipaplatform.paths import paths
from ipapython import admintool
-from ipapython.certdb import get_ca_nickname, NSSDatabase
+from ipapython.certdb import (get_ca_nickname,
+ NSSDatabase,
+ verify_kdc_cert_validity)
from ipapython.dn import DN
from ipalib import api, errors
from ipaserver.install import certs, dsinstance, installutils
@@ -35,7 +40,7 @@ from ipaserver.install import certs, dsinstance, installutils
class ServerCertInstall(admintool.AdminTool):
command_name = 'ipa-server-certinstall'
- usage = "%prog <-d|-w> [options] <file> ..."
+ usage = "%prog <-d|-w|-k> [options] <file> ..."
description = "Install new SSL server certificates."
@@ -52,6 +57,10 @@ class ServerCertInstall(admintool.AdminTool):
dest="http", action="store_true", default=False,
help="install certificate for the http server")
parser.add_option(
+ "-k", "--kdc",
+ dest="kdc", action="store_true", default=False,
+ help="install PKINIT certificate for the KDC")
+ parser.add_option(
"--pin",
dest="pin", metavar="PIN", sensitive=True,
help="The password of the PKCS#12 file")
@@ -73,8 +82,9 @@ class ServerCertInstall(admintool.AdminTool):
installutils.check_server_configuration()
- if not self.options.dirsrv and not self.options.http:
- self.option_parser.error("you must specify dirsrv and/or http")
+ if not any((self.options.dirsrv, self.options.http, self.options.kdc)):
+ self.option_parser.error(
+ "you must specify dirsrv, http and/or kdc")
if not self.args:
self.option_parser.error("you must provide certificate filename")
@@ -108,6 +118,9 @@ class ServerCertInstall(admintool.AdminTool):
if self.options.http:
self.install_http_cert()
+ if self.options.kdc:
+ self.install_kdc_cert()
+
api.Backend.ldap2.disconnect()
def install_dirsrv_cert(self):
@@ -161,6 +174,55 @@ class ServerCertInstall(admintool.AdminTool):
os.chown(os.path.join(dirname, 'key3.db'), 0, pent.pw_gid)
os.chown(os.path.join(dirname, 'secmod.db'), 0, pent.pw_gid)
+ def install_kdc_cert(self):
+ ca_cert_file = paths.CA_BUNDLE_PEM
+ pkcs12_file, pin, ca_cert = installutils.load_pkcs12(
+ cert_files=self.args,
+ key_password=self.options.pin,
+ key_nickname=self.options.cert_name,
+ ca_cert_files=[ca_cert_file],
+ realm_name=api.env.realm)
+
+ cdb = certs.CertDB(api.env.realm, nssdir=paths.IPA_NSSDB_DIR)
+
+ # Check that the ca_cert is known and trusted
+ with tempfile.NamedTemporaryFile() as temp:
+ certs.install_pem_from_p12(pkcs12_file.name, pin, temp.name)
+
+ kdc_cert = x509.load_certificate_from_file(temp.name)
+ ca_certs = x509.load_certificate_list_from_file(ca_cert_file)
+
+ try:
+ verify_kdc_cert_validity(kdc_cert, ca_certs, api.env.realm)
+ except ValueError as e:
+ raise admintool.ScriptError(
+ "Peer's certificate issuer is not trusted (%s). "
+ "Please run ipa-cacert-manage install and ipa-certupdate "
+ "to install the CA certificate." % str(e))
+
+ try:
+ ca_enabled = api.Command.ca_is_enabled()['result']
+ if ca_enabled:
+ certmonger.stop_tracking(certfile=paths.KDC_CERT)
+
+ certs.install_pem_from_p12(pkcs12_file.name, pin, paths.KDC_CERT)
+ certs.install_key_from_p12(pkcs12_file.name, pin, paths.KDC_KEY)
+
+ if ca_enabled:
+ # Start tracking only if the cert was issued by IPA CA
+ # Retrieve IPA CA
+ ipa_ca_cert = cdb.get_cert_from_db(
+ get_ca_nickname(api.env.realm),
+ pem=False)
+ # And compare with the CA which signed this certificate
+ if ca_cert == ipa_ca_cert:
+ certmonger.start_tracking(
+ (paths.KDC_CERT, paths.KDC_KEY),
+ storage='FILE',
+ profile='KDCs_PKINIT_Certs')
+ except RuntimeError as e:
+ raise admintool.ScriptError(str(e))
+
def check_chain(self, pkcs12_filename, pkcs12_pin, nssdb):
# create a temp nssdb
with NSSDatabase() as tempnssdb:
--
2.9.4