Stanislav Laznicka
5ab85b365a
The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
62 lines
1.9 KiB
Python
62 lines
1.9 KiB
Python
#
|
|
# Copyright (C) 2016 FreeIPA Contributors see COPYING for license
|
|
#
|
|
|
|
import os
|
|
import tempfile
|
|
|
|
from ipalib import Registry
|
|
from ipalib import Updater
|
|
from ipalib.install import certmonger
|
|
from ipaplatform.paths import paths
|
|
from ipapython.certdb import NSSDatabase
|
|
from ipaserver.install import cainstance
|
|
|
|
register = Registry()
|
|
|
|
|
|
@register()
|
|
class update_ra_cert_store(Updater):
|
|
"""
|
|
Moves the ipaCert store from /etc/httpd/alias RA_AGENT_PEM, RA_AGENT_KEY
|
|
files
|
|
"""
|
|
|
|
def execute(self, **options):
|
|
ra_nick = 'ipaCert'
|
|
ca_enabled = self.api.Command.ca_is_enabled()['result']
|
|
if not ca_enabled:
|
|
return False, []
|
|
|
|
certdb = NSSDatabase(nssdir=paths.HTTPD_ALIAS_DIR)
|
|
if not certdb.has_nickname(ra_nick):
|
|
# Nothign to do
|
|
return False, []
|
|
elif os.path.exists(paths.RA_AGENT_PEM):
|
|
# even though the certificate file exists, we will overwrite it
|
|
# as it's probabably something wrong anyway
|
|
self.log.warning(
|
|
"A certificate with the nickname 'ipaCert' exists in "
|
|
"the old '{}' NSS database as well as in the new "
|
|
"PEM file '{}'"
|
|
.format(paths.HTTPD_ALIAS_DIR, paths.RA_AGENT_PEM))
|
|
|
|
_fd, p12file = tempfile.mkstemp(dir=certdb.secdir)
|
|
# no password is necessary as we will be saving it in clear anyway
|
|
certdb.export_pkcs12(ra_nick, p12file, pkcs12_passwd='')
|
|
|
|
# stop tracking the old cert and remove it
|
|
certmonger.stop_tracking(paths.HTTPD_ALIAS_DIR, nickname=ra_nick)
|
|
certdb.delete_cert(ra_nick)
|
|
if os.path.exists(paths.OLD_KRA_AGENT_PEM):
|
|
os.remove(paths.OLD_KRA_AGENT_PEM)
|
|
|
|
# get the private key and certificate from the file and start
|
|
# tracking it in certmonger
|
|
ca = cainstance.CAInstance()
|
|
ca.import_ra_cert(p12file)
|
|
|
|
os.remove(p12file)
|
|
|
|
return False, []
|