From 148e78d74206730c31dd7bc87eece5c5bd1440ac Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Wed, 9 Aug 2017 17:28:35 -0400 Subject: [PATCH] Include the CA basic constraint in CSRs when renewing a CA The CSR generated by `ipa-cacert-manage renew --external-ca` did not include the CA basic constraint: X509v3 Basic Constraints: critical CA:TRUE Add a flag to certmonger::resubmit_request to specify that a CA is being requested. Note that this also sets pathlen to -1 which means an unlimited pathlen. Leave it up to the issuing CA to set this. https://pagure.io/freeipa/issue/7088 Reviewed-By: Florence Blanc-Renaud Reviewed-By: Florence Blanc-Renaud --- ipalib/install/certmonger.py | 13 +++++++++++-- ipaserver/install/ipa_cacert_manage.py | 3 ++- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/ipalib/install/certmonger.py b/ipalib/install/certmonger.py index c286996ee2318e241b4af190d1a01f42e28aa9f3..d2b782ddb0c746a3dfd96d0222bb31c6a960fdff 100644 --- a/ipalib/install/certmonger.py +++ b/ipalib/install/certmonger.py @@ -519,16 +519,25 @@ def modify(request_id, ca=None, profile=None): request.obj_if.modify(update) -def resubmit_request(request_id, ca=None, profile=None): +def resubmit_request(request_id, ca=None, profile=None, is_ca=False): + """ + :param request_id: the certmonger numeric request ID + :param ca: the nickname for the certmonger CA, e.g. IPA or SelfSign + :param profile: the dogtag template profile to use, e.g. SubCA + :param is_ca: boolean that if True adds the CA basic constraint + """ request = _get_request({'nickname': request_id}) if request: - if ca or profile: + if ca or profile or is_ca: update = {} if ca is not None: cm = _certmonger() update['CA'] = cm.obj_if.find_ca_by_nickname(ca) if profile is not None: update['template-profile'] = profile + if is_ca: + update['template-is-ca'] = True + update['template-ca-path-length'] = -1 # no path length request.obj_if.modify(update) request.obj_if.resubmit() diff --git a/ipaserver/install/ipa_cacert_manage.py b/ipaserver/install/ipa_cacert_manage.py index fcbf09155a3abc9ce9481aa2519ed39aaa6aa9bb..9607620d6c3e63b70b9e586f94282bf478c8c53e 100644 --- a/ipaserver/install/ipa_cacert_manage.py +++ b/ipaserver/install/ipa_cacert_manage.py @@ -310,7 +310,8 @@ class CACertManage(admintool.AdminTool): timeout = api.env.startup_timeout + 60 self.log.debug("resubmitting certmonger request '%s'", self.request_id) - certmonger.resubmit_request(self.request_id, ca=ca, profile=profile) + certmonger.resubmit_request(self.request_id, ca=ca, profile=profile, + is_ca=True) try: state = certmonger.wait_for_request(self.request_id, timeout) except RuntimeError: -- 2.9.5