Fraser Tweedale 769180c2c6 Do not renew externally-signed CA as self-signed ...

Commit 49cf5ec64b fixed a bug that
prevented migration from externally-signed to self-signed IPA CA.
But it introduced a subtle new issue: certmonger-initiated renewal
renews an externally-signed IPA CA as a self-signed CA.

To resolve this issue, introduce the `--force-self-signed' flag for
the dogtag-ipa-ca-renew-agent script.  Add another certmonger CA
definition that calls this script with the `--force-self-signed'
flag.  Update dogtag-ipa-ca-renew-agent to only issue a self-signed
CA certificate if the existing certificate is self-signed or if
`--force-self-signed' was given.  Update `ipa-cacert-manage renew'
to supply `--force-self-signed' when appropriate.

As a result of these changes, certmonger-initiated renewal of an
externally-signed IPA CA certificate will not issue a self-signed
certificate.

Fixes: https://pagure.io/freeipa/issue/8176
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>

2020-01-29 21:47:14 +11:00

..

plugins

trust upgrade: ensure that host is member of adtrust agents

2019-12-04 09:06:56 +01:00

server

Do not renew externally-signed CA as self-signed

2020-01-29 21:47:14 +11:00

__init__.py

Remove __all__ specifications in ipaclient and ipaserver.install

2013-09-06 15:42:33 +02:00

adtrust.py

adtrust.py: mention restarting sssd when adding trust agents

2019-12-11 16:57:03 -05:00

adtrustinstance.py

Removes several pylint warnings.

2019-09-27 09:38:32 +02:00

bindinstance.py

DNS install check: allow overlapping zone to be from the master itself

2019-12-12 18:24:44 +01:00

ca.py

move MSCSTemplate classes to ipalib

2019-07-17 17:58:58 +03:00

cainstance.py

Do not renew externally-signed CA as self-signed

2020-01-29 21:47:14 +11:00

certs.py

removed unused function export_pem_p12

2019-12-17 09:18:37 +01:00

conncheck.py

install: introduce installer class hierarchy

2016-11-11 12:17:25 +01:00

custodiainstance.py

ipaserver.install.installutils: move commonly used utils to ipapython.ipautil

2019-06-29 11:00:28 +03:00

dns.py

DNS install check: Fix overlapping DNS zone from the master itself

2019-12-16 18:02:22 +01:00

dnskeysyncinstance.py

ipaserver.install.installutils: move commonly used utils to ipapython.ipautil

2019-06-29 11:00:28 +03:00

dogtag.py

Verify pki ini override early

2019-04-10 13:43:23 +02:00

dogtaginstance.py

Do not renew externally-signed CA as self-signed

2020-01-29 21:47:14 +11:00

dsinstance.py

Removes several pylint warnings.

2019-09-27 09:38:32 +02:00

httpinstance.py

Replace replication_wait_timeout with certmonger_wait_timeout

2019-09-04 14:52:14 +02:00

installutils.py

ipaserver.install.installutils: move commonly used utils to ipapython.ipautil

2019-06-29 11:00:28 +03:00

ipa_backup.py

Prevents DNS Amplification Attack and allow to customize named

2019-11-12 10:49:49 +02:00

ipa_cacert_manage.py

Do not renew externally-signed CA as self-signed

2020-01-29 21:47:14 +11:00

ipa_cert_fix.py

avoid realm_to_serverid deprecation warning

2019-05-29 12:49:27 +10:00

ipa_crlgen_manage.py

CRL generation master: new utility to enable|disable

2019-03-14 09:39:55 +01:00

ipa_kra_install.py

Add pki.ini override option

2019-04-10 13:43:23 +02:00

ipa_ldap_updater.py

Add absolute_import future imports

2018-04-20 09:43:37 +02:00

ipa_otptoken_import.py

Py3: Remove subclassing from object

2018-09-27 11:49:04 +02:00

ipa_pkinit_manage.py

PKINIT: fix ipa-pkinit-manage enable|disable

2018-12-05 11:06:21 +01:00

ipa_replica_install.py

Enable replica install info logging to match ipa-server-install

2018-11-01 13:08:58 +01:00

ipa_restore.py

ipa-restore: Restore ownership and perms on 389-ds log directory

2019-09-23 09:27:28 -04:00

ipa_server_certinstall.py

Move realm_to_serverid/ldap_uri to ipaldap

2019-02-05 08:39:13 -05:00

ipa_server_install.py

Improve console logging for ipa-server-install

2018-06-20 08:38:03 +02:00

ipa_server_upgrade.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipa_winsync_migrate.py

ipa commands: print 'IPA is not configured' when ipa is not setup

2018-08-23 12:08:45 +02:00

ipactl.py

ipa_client_automount.py and ipactl.py: fix codestyle

2019-06-28 10:53:07 +02:00

kra.py

krainstance: set correct issuer DN in uid=ipakra entry

2019-10-17 08:17:46 +02:00

krainstance.py

Do not renew externally-signed CA as self-signed

2020-01-29 21:47:14 +11:00

krbinstance.py

Move certauth configuration into a server krb5.conf template

2019-09-10 12:33:21 +03:00

ldapupdate.py

Skip commented lines after substitution

2019-11-05 11:48:28 -05:00

odsexporterinstance.py

ipaserver.install.installutils: move commonly used utils to ipapython.ipautil

2019-06-29 11:00:28 +03:00

opendnssecinstance.py

Add ODS manager abstraction to ipaplatform

2019-04-24 14:08:20 +02:00

otpdinstance.py

Enable pylint missing-final-newline check

2015-12-23 07:59:22 +01:00

replication.py

Add missing timeout option to logging statement

2019-09-05 09:15:23 +02:00

schemaupdate.py

logging: do not use ipa_log_manager to create module-level loggers

2017-07-14 15:55:59 +02:00

service.py

Fix service ldap_disable()

2019-12-10 16:22:48 +01:00

sysupgrade.py

Add absolute_import future imports

2018-04-20 09:43:37 +02:00

upgradeinstance.py

Move realm_to_serverid/ldap_uri to ipaldap

2019-02-05 08:39:13 -05:00