From 97942a7c7aac61d657832709e2dcc45a4cb4e4df Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Tue, 31 Oct 2017 18:20:15 +1100 Subject: [PATCH] Run certupdate after promoting to CA-ful deployment After installing a CA in a CA-less installations (using ipa-ca-install), the new CA certificate is not installed in /etc/httpd/alias. This causes communication failure between IPA framework and Dogtag (it cannot verify the Dogtag server certificate). Perform a CertUpdate as the final step when promoting a CA-less deployment to CA-ful. Fixes: https://pagure.io/freeipa/issue/7230 Reviewed-By: Rob Crittenden --- install/tools/ipa-ca-install | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install index 9fdbb0643..9f9cfd56a 100755 --- a/install/tools/ipa-ca-install +++ b/install/tools/ipa-ca-install @@ -254,6 +254,10 @@ def install_master(safe_options, options): ca.install_check(True, None, options) ca.install(True, None, options) + # Run ipa-certupdate to add the new CA certificate to + # certificate databases on this server. + logger.info("Updating certificate databases.") + CertUpdate.run_with_args(api) def install(safe_options, options, filename): options.promote = False