tomaskrizek's pull request #76: "Keep NSS trust flags of existing certificates" was opened
PR body: """ Backup and restore trust flags of existing certificates during CA installation. This prevents marking a previously trusted certificate as untrusted, as was the case when CA-less was converted to CA-full with external CA when using the same certificate. https://fedorahosted.org/freeipa/ticket/5791 """ See the full pull-request at https://github.com/freeipa/freeipa/pull/76 ... or pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/76/head:pr76 git checkout pr76
From ff8949662e08c7f29e01a1629150de405914fce4 Mon Sep 17 00:00:00 2001 From: Tomas Krizek <tkri...@redhat.com> Date: Tue, 13 Sep 2016 10:14:47 +0200 Subject: [PATCH] Keep NSS trust flags of existing certificates Backup and restore trust flags of existing certificates during CA installation. This prevents marking a previously trusted certificate as untrusted, as was the case when CA-less was converted to CA-full with external CA when using the same certificate. https://fedorahosted.org/freeipa/ticket/5791 --- ipaserver/install/cainstance.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index ab006be..c81b8f5 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -833,6 +833,10 @@ def __get_ca_chain(self): raise RuntimeError("Unable to retrieve CA chain: %s" % str(e)) def __import_ca_chain(self): + # Backup NSS trust flags of all already existing certificates + certdb = certs.CertDB(self.realm) + cert_backup_list = certdb.list_certs() + chain = self.__get_ca_chain() # If this chain contains multiple certs then certutil will only import @@ -883,6 +887,10 @@ def __import_ca_chain(self): os.remove(chain_name) subid += 1 + # Restore NSS trust flags of all previously existing certificates + for nick, trust_flags in cert_backup_list: + certdb.trust_root_cert(nick, trust_flags) + def __request_ra_certificate(self): # Create a noise file for generating our private key noise = array.array('B', os.urandom(128))
-- Manage your subscription for the Freeipa-devel mailing list: https://www.redhat.com/mailman/listinfo/freeipa-devel Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code
