From bee3c1eccd44f7671a1455d12235bcbb910494b3 Mon Sep 17 00:00:00 2001 From: Stanislav Laznicka Date: Mon, 22 May 2017 17:08:00 +0200 Subject: [PATCH] More verbose error message on kdc cert validation KDC cert validation was added but provides rather non-descriptive error should there be something wrong with a certificate. Pass the error message from the `openssl` tool in such cases. https://pagure.io/freeipa/issue/6945 Reviewed-By: Martin Babinsky --- ipapython/certdb.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/ipapython/certdb.py b/ipapython/certdb.py index be2af6019..aa9bdaae5 100644 --- a/ipapython/certdb.py +++ b/ipapython/certdb.py @@ -192,13 +192,17 @@ def verify_kdc_cert_validity(kdc_cert, ca_certs, realm): try: ipautil.run( - [OPENSSL, 'verify', '-CAfile', ca_file.name, kdc_file.name]) + [OPENSSL, 'verify', '-CAfile', ca_file.name, kdc_file.name], + capture_output=True) + except ipautil.CalledProcessError as e: + raise ValueError(e.output) + + try: eku = kdc_cert.extensions.get_extension_for_class( cryptography.x509.ExtendedKeyUsage) list(eku.value).index( cryptography.x509.ObjectIdentifier(x509.EKU_PKINIT_KDC)) - except (ipautil.CalledProcessError, - cryptography.x509.ExtensionNotFound, + except (cryptography.x509.ExtensionNotFound, ValueError): raise ValueError("invalid for a KDC")