rhtyd commented on a change in pull request #3075: KVM: Prevent regenerating
keystore on provisionCertificate API
URL: https://github.com/apache/cloudstack/pull/3075#discussion_r290627597
##########
File path: scripts/util/keystore-setup
##########
@@ -35,18 +35,19 @@ if [ -f "$PROPS_FILE" ]; then
fi
fi
-# Generate keystore
-rm -f "$KS_FILE"
-CN=$(hostname --fqdn)
-keytool -genkey -storepass "$KS_PASS" -keypass "$KS_PASS" -alias "$ALIAS"
-keyalg RSA -validity "$KS_VALIDITY" -dname
cn="$CN",ou="cloudstack",o="cloudstack",c="cloudstack" -keystore "$KS_FILE" >
/dev/null 2>&1
+# Generate keystore if it does not exist
+if [ ! -f "$KS_FILE" ]; then
+ CN=$(hostname --fqdn)
+ keytool -genkey -storepass "$KS_PASS" -keypass "$KS_PASS" -alias "$ALIAS"
-keyalg RSA -validity "$KS_VALIDITY" -dname
cn="$CN",ou="cloudstack",o="cloudstack",c="cloudstack" -keystore "$KS_FILE" >
/dev/null 2>&1
-# Generate CSR
-rm -f "$CSR_FILE"
-addresses=$(ip address | grep inet | awk '{print $2}' | sed 's/\/.*//g' | grep
-v '^169.254.' | grep -v '^127.0.0.1' | grep -v '^::1' | sed 's/^/ip:/g' | tr
'\r\n' ',')
-keytool -certreq -storepass "$KS_PASS" -alias "$ALIAS" -file $CSR_FILE
-keystore "$KS_FILE" -ext san="$addresses" > /dev/null 2>&1
-cat "$CSR_FILE"
+ # Generate CSR
+ rm -f "$CSR_FILE"
+ addresses=$(ip address | grep inet | awk '{print $2}' | sed 's/\/.*//g' |
grep -v '^169.254.' | grep -v '^127.0.0.1' | grep -v '^::1' | sed 's/^/ip:/g' |
tr '\r\n' ',')
+ keytool -certreq -storepass "$KS_PASS" -alias "$ALIAS" -file $CSR_FILE
-keystore "$KS_FILE" -ext san="$addresses" > /dev/null 2>&1
+ cat "$CSR_FILE"
Review comment:
This does not generate a CSR file, we'll need to add an else block to handle
if keystore already exists; per the renewal CSR must be regenerated.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
