From 7cfd44d395da0d499c0569b6db2cabd9fedb488d Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Wed, 3 Feb 2021 15:52:05 -0500 Subject: [PATCH] ipa-cert-fix: Don't hardcode the NSS certificate nickname The nickname of the 389-ds certificate was hardcoded as Server-Cert which failed if the user had installed a third-party certificate using ipa-server-certinstall. Instead pull the nickname from the DS configuration and retrieve it based on that. https://pagure.io/freeipa/issue/8600 Signed-off-by: Rob Crittenden Reviewed-By: Florence Blanc-Renaud --- ipaserver/install/ipa_cert_fix.py | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/ipaserver/install/ipa_cert_fix.py b/ipaserver/install/ipa_cert_fix.py index 2f2c15613..29af89cd5 100644 --- a/ipaserver/install/ipa_cert_fix.py +++ b/ipaserver/install/ipa_cert_fix.py @@ -203,9 +203,12 @@ def expired_ipa_certs(now): certs.append((IPACertType.HTTPS, cert)) # LDAPS - ds_dbdir = dsinstance.config_dirname(realm_to_serverid(api.env.realm)) + serverid = realm_to_serverid(api.env.realm) + ds = dsinstance.DsInstance(realm_name=api.env.realm) + ds_dbdir = dsinstance.config_dirname(serverid) + ds_nickname = ds.get_server_cert_nickname(serverid) db = NSSDatabase(nssdir=ds_dbdir) - cert = db.get_cert('Server-Cert') + cert = db.get_cert(ds_nickname) if cert.not_valid_after <= now: certs.append((IPACertType.LDAPS, cert)) @@ -344,11 +347,13 @@ def install_ipa_certs(subject_base, ca_subject_dn, certs): elif certtype is IPACertType.HTTPS: shutil.copyfile(cert_path, paths.HTTPD_CERT_FILE) elif certtype is IPACertType.LDAPS: - ds_dbdir = dsinstance.config_dirname( - realm_to_serverid(api.env.realm)) + serverid = realm_to_serverid(api.env.realm) + ds = dsinstance.DsInstance(realm_name=api.env.realm) + ds_dbdir = dsinstance.config_dirname(serverid) db = NSSDatabase(nssdir=ds_dbdir) - db.delete_cert('Server-Cert') - db.import_pem_cert('Server-Cert', EMPTY_TRUST_FLAGS, cert_path) + ds_nickname = ds.get_server_cert_nickname(serverid) + db.delete_cert(ds_nickname) + db.import_pem_cert(ds_nickname, EMPTY_TRUST_FLAGS, cert_path) elif certtype is IPACertType.KDC: shutil.copyfile(cert_path, paths.KDC_CERT)