Re: [Freeipa-users] Dogtag certs did not auto-renew, very stuck!

2017-02-23 Thread Martin Basti
On 23.02.2017 12:40, Peter Fern wrote: On 23/02/17 20:27, Martin Basti wrote: On 23.02.2017 10:21, Timo Aaltonen wrote: And as you noticed, packaging nss-pem is not a trivial task because of the way it uses private NSS api's that the libnss maintainer refuses to make public.. OpenSSL,

Re: [Freeipa-users] Dogtag certs did not auto-renew, very stuck!

2017-02-23 Thread Peter Fern
On 23/02/17 20:27, Martin Basti wrote: > On 23.02.2017 10:21, Timo Aaltonen wrote: >> And as you noticed, packaging nss-pem is not a trivial task because of >> the way it uses private NSS api's that the libnss maintainer refuses to >> make public.. OpenSSL, anyone? :P >> > We are working on it :)

Re: [Freeipa-users] Dogtag certs did not auto-renew, very stuck!

2017-02-23 Thread Martin Basti
On 23.02.2017 10:21, Timo Aaltonen wrote: On 23.02.2017 02:04, Peter Fern wrote: On 23/02/17 05:26, Rob Crittenden wrote: It's been many moons since I worked on nss-pem but from what I can tell it should be buildable outside of NSS so can ship as a separate package. You might try building it

Re: [Freeipa-users] Dogtag certs did not auto-renew, very stuck!

2017-02-23 Thread Timo Aaltonen
On 23.02.2017 02:04, Peter Fern wrote: > On 23/02/17 05:26, Rob Crittenden wrote: >> It's been many moons since I worked on nss-pem but from what I can tell >> it should be buildable outside of NSS so can ship as a separate package. >> You might try building it locally to see if it resolves the

Re: [Freeipa-users] Dogtag certs did not auto-renew, very stuck!

2017-02-22 Thread Peter Fern
On 23/02/17 05:26, Rob Crittenden wrote: > It's been many moons since I worked on nss-pem but from what I can tell > it should be buildable outside of NSS so can ship as a separate package. > You might try building it locally to see if it resolves the issues for > you. It resides at

Re: [Freeipa-users] Dogtag certs did not auto-renew, very stuck!

2017-02-22 Thread Rob Crittenden
Peter Fern wrote: > Okay, with much debugging and hoop-jumping, I can say that certmonger on > Debian/Ubuntu is currently in a rather broken state, at least in a > server role. > > It links against libcurl3-nss, however on Debian/-derivs there is no > build of nss-pem, so anything built against

Re: [Freeipa-users] Dogtag certs did not auto-renew, very stuck!

2017-02-21 Thread Peter Fern
Okay, with much debugging and hoop-jumping, I can say that certmonger on Debian/Ubuntu is currently in a rather broken state, at least in a server role. It links against libcurl3-nss, however on Debian/-derivs there is no build of nss-pem, so anything built against libcurl3-nss cannot parse PEM