freeipa.git/install/tools/ipa-ca-install, branch testotp

Use /usr/bin/python2

2014-01-03T08:46:05+00:00

Part of the effort to port FreeIPA to Arch Linux,
where Python 3 is the default.

FreeIPA hasn't been ported to Python 3, so the code must be modified to
run /usr/bin/python2

https://fedorahosted.org/freeipa/ticket/3438

Updated by pviktori@redhat.com

Make CS.cfg edits with CA instance stopped

2013-08-26T14:21:36+00:00

This patch makes sure that all edits to CS.cfg configuration file
are performed while pki-tomcatd service is stopped.

Introduces a new contextmanager stopped_service for handling
a general problem of performing a task that needs certain service
being stopped.

https://fedorahosted.org/freeipa/ticket/3804

Print newline after receiving EOF in installutils.read_password.

2013-07-24T08:00:03+00:00

Fix CA-less check in ipa-replica-install and ipa-ca-install.

2013-06-26T09:00:20+00:00

https://fedorahosted.org/freeipa/ticket/3750

Do not allow installing CA replicas in CA-less setup.

2013-06-12T10:59:54+00:00

https://fedorahosted.org/freeipa/ticket/3673
https://fedorahosted.org/freeipa/ticket/3674

Use private ccache in ipa install tools

2013-06-05T10:27:45+00:00

All installers that handle Kerberos auth, have been altered to use
private ccache, that is ipa-server-install, ipa-dns-install,
ipa-replica-install, ipa-ca-install.

https://fedorahosted.org/freeipa/ticket/3666

Remove code to install Dogtag 9

2013-05-31T08:26:07+00:00

Since we depend on Dogtag 10 now, there is no need to keep code
that installs a Dogtag 9 CA.

Support for upgraded Dogtag-9-style instances is left in.

https://fedorahosted.org/freeipa/ticket/3529

Drop --selfsign server functionality

2013-04-15T20:56:12+00:00

Design: http://freeipa.org/page/V3/Drop_selfsign_functionality
Ticket: https://fedorahosted.org/freeipa/ticket/3494

Use A/AAAA records instead of CNAME records in ipa-ca.

2013-04-15T19:12:36+00:00

https://fedorahosted.org/freeipa/ticket/3547

Add OCSP and CRL URIs to certificates

2012-12-07T16:00:17+00:00

Modify the default IPA CA certificate profile to include CRL and
OCSP extensions which will add URIs to IPA CRL&OCSP to published
certificates.

Both CRL and OCSP extensions have 2 URIs, one pointing directly to
the IPA CA which published the certificate and one to a new CNAME
ipa-ca.$DOMAIN which was introduced as a general CNAME pointing
to all IPA replicas which have CA configured.

The new CNAME is added either during new IPA server/replica/CA
installation or during upgrade.

https://fedorahosted.org/freeipa/ticket/3074
https://fedorahosted.org/freeipa/ticket/1431