URL: https://github.com/freeipa/freeipa/pull/285
Author: flo-renaud
 Title: #285: Check the result of cert request in replica installer
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/285/head:pr285
git checkout pr285
From 8bbca8a93bc713d64d43692689ab827106527019 Mon Sep 17 00:00:00 2001
From: Florence Blanc-Renaud <f...@redhat.com>
Date: Tue, 29 Nov 2016 21:15:29 +0100
Subject: [PATCH] Check the result of cert request in replica installer

When running ipa-replica-install in domain-level 1, the installer
requests the LDAP and HTTP certificates using certmonger but does
not check the return code. The installer goes on and fails when
restarting dirsrv.

Fix: when certmonger was not able to request the certificate, raise an
exception and exit from the installer:

  [28/45]: retrieving DS Certificate
  [error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE)
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR    Certificate issuance failed (CA_UNREACHABLE)
ipa.ipapython.install.cli.install_tool(CompatServerReplicaInstall): ERROR    The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

 ipalib/install/certmonger.py |  3 ++-
 ipaserver/install/certs.py   | 12 +++++-------
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/ipalib/install/certmonger.py b/ipalib/install/certmonger.py
index 6f0948a..3ea900b 100644
--- a/ipalib/install/certmonger.py
+++ b/ipalib/install/certmonger.py
@@ -312,9 +312,10 @@ def request_and_wait_for_cert(
     state = wait_for_request(reqId, timeout=60)
     ca_error = get_request_value(reqId, 'ca-error')
     if state != 'MONITORING' or ca_error:
-        raise RuntimeError("Certificate issuance failed")
+        raise RuntimeError("Certificate issuance failed ({})".format(state))
     return reqId
 def request_cert(
         nssdb, nickname, subject, principal, passwd_fname=None,
         dns=None, ca='IPA', profile=None, pre_command=None, post_command=None):
diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
index ab2379b..45602ba 100644
--- a/ipaserver/install/certs.py
+++ b/ipaserver/install/certs.py
@@ -647,13 +647,11 @@ def export_pem_cert(self, nickname, location):
     def request_service_cert(self, nickname, principal, host, pwdconf=False):
         if pwdconf:
-        reqid = certmonger.request_cert(nssdb=self.secdir,
-                                        nickname=nickname,
-                                        principal=principal,
-                                        subject=host,
-                                        passwd_fname=self.passwd_fname)
-        # Now wait for the cert to appear. Check three times then abort
-        certmonger.wait_for_request(reqid, timeout=60)
+        certmonger.request_and_wait_for_cert(nssdb=self.secdir,
+                                             nickname=nickname,
+                                             principal=principal,
+                                             subject=host,
+                                             passwd_fname=self.passwd_fname)
 class _CrossProcessLock(object):
Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to