URL: https://github.com/freeipa/freeipa/pull/650
Author: stlaz
 Title: #650: CA-less installation fix
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/650/head:pr650
git checkout pr650
From 1ab199a222e19dc5ac814ed639e1b6fb383ff3a7 Mon Sep 17 00:00:00 2001
From: Stanislav Laznicka <slazn...@redhat.com>
Date: Fri, 24 Mar 2017 09:52:18 +0100
Subject: [PATCH] Get correct CA cert nickname in CA-less

During CA-less installation, we initialize the HTTPD alias
database from a pkcs12 file. This means there's going to
be different nicknames to the added certificates. Store
the CA certificate nickname in HTTPInstance__setup_ssl()
to be able to correctly export it later.

 ipaserver/install/httpinstance.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py
index f6f0b0c..a039b85 100644
--- a/ipaserver/install/httpinstance.py
+++ b/ipaserver/install/httpinstance.py
@@ -118,6 +118,7 @@ class WebGuiInstance(service.SimpleServiceInstance):
     def __init__(self):
         service.SimpleServiceInstance.__init__(self, "ipa_webgui")
 class HTTPInstance(service.Service):
     def __init__(self, fstore=None, cert_nickname='Server-Cert',
@@ -130,6 +131,7 @@ def __init__(self, fstore=None, cert_nickname='Server-Cert',
+        self.cacert_nickname = None
         self.cert_nickname = cert_nickname
         self.ca_is_configured = True
         self.keytab_user = constants.GSSPROXY_USER
@@ -433,6 +435,9 @@ def __setup_ssl(self):
             if not server_certs:
                 raise RuntimeError("Could not find a suitable server cert.")
+        # store the CA cert nickname so that we can publish it later on
+        self.cacert_nickname = db.cacert_name
     def __import_ca_certs(self):
         db = certs.CertDB(self.realm, nssdir=paths.HTTPD_ALIAS_DIR,
@@ -441,7 +446,10 @@ def __import_ca_certs(self):
     def __publish_ca_cert(self):
         ca_db = certs.CertDB(self.realm, nssdir=paths.HTTPD_ALIAS_DIR,
-        ca_db.publish_ca_cert(paths.CA_CRT)
+        # One would expect CertDB.publish_ca_cert() should be used instead.
+        # One would be wrong because in CA-less the CA cert nickname is not
+        # easily received for the purposes of that method.
+        ca_db.export_pem_cert(self.cacert_nickname, paths.CA_CRT)
     def is_kdcproxy_configured(self):
         """Check if KDC proxy has already been configured in the past"""
Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to