From 17c2e31fdc77183b49edc728cc775c4078bf782e Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Tue, 13 Aug 2019 06:37:21 +0200 Subject: [PATCH] Don't move keys when key backup is disabled The CA_BACKUP_KEYS_P12 file is not enabled when pki_backup_keys is set to False. It's the case when FreeIPA is configured with HSM support. Related: https://pagure.io/freeipa/issue/7677 Signed-off-by: Christian Heimes Reviewed-By: Fraser Tweedale --- ipaserver/install/cainstance.py | 8 ++++++-- ipaserver/install/dogtaginstance.py | 3 +-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index d650726f2..6da0c3b69 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -599,8 +599,12 @@ class CAInstance(DogtagInstance): print("%s --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate" % sys.argv[0]) sys.exit(0) else: - shutil.move(paths.CA_BACKUP_KEYS_P12, - paths.CACERT_P12) + if config.getboolean( + self.subsystem, 'pki_backup_keys', fallback=True + ): + shutil.move( + paths.CA_BACKUP_KEYS_P12, paths.CACERT_P12 + ) logger.debug("completed creating ca instance") diff --git a/ipaserver/install/dogtaginstance.py b/ipaserver/install/dogtaginstance.py index d53328305..136f95893 100644 --- a/ipaserver/install/dogtaginstance.py +++ b/ipaserver/install/dogtaginstance.py @@ -875,8 +875,7 @@ class PKIIniLoader: ) # key backup is not compatible with HSM support - if (cfgtpl.has_option(section_name, 'pki_hsm_enable') and - cfgtpl.getboolean(section_name, 'pki_hsm_enable')): + if cfgtpl.getboolean(section_name, 'pki_hsm_enable', fallback=False): cfgtpl.set(section_name, 'pki_backup_keys', 'False') cfgtpl.set(section_name, 'pki_backup_password', '')