From 908019639e5e0975d3cd73c3c851319224737dcd Mon Sep 17 00:00:00 2001
From: Martin Basti <mbasti@redhat.com>
Date: Thu, 10 Sep 2015 18:46:00 +0200
Subject: [PATCH] Server Upgrade: backup CS.cfg when dogtag is turned off

Is unable to made CS.cfg when dogtag is running.

https://fedorahosted.org/freeipa/ticket/5287

Reviewed-By: David Kupka <dkupka@redhat.com>
---
 ipaserver/install/server/upgrade.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
index a57682a4bbdaab2a15b4e415223e2f5faa67ba73..5288f8fcc5fb56b13773e3bb8ea6a5a6c8c0e8a9 100644
--- a/ipaserver/install/server/upgrade.py
+++ b/ipaserver/install/server/upgrade.py
@@ -1354,10 +1354,13 @@ def upgrade_configuration():
         sub_dict['SUBJECT_BASE'] = subject_base
 
     ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
-    ca.backup_config()
 
     with installutils.stopped_service(configured_constants.SERVICE_NAME,
             configured_constants.PKI_INSTANCE_NAME):
+
+        # Dogtag must be stopped to be able to backup CS.cfg config
+        ca.backup_config()
+
         # migrate CRL publish dir before the location in ipa.conf is updated
         ca_restart = migrate_crl_publish_dir(ca)
 
-- 
2.4.3