Add OCSP and CRL URIs to certificates

Modify the default IPA CA certificate profile to include CRL and
OCSP extensions which will add URIs to IPA CRL&OCSP to published
certificates.

Both CRL and OCSP extensions have 2 URIs, one pointing directly to
the IPA CA which published the certificate and one to a new CNAME
ipa-ca.$DOMAIN which was introduced as a general CNAME pointing
to all IPA replicas which have CA configured.

The new CNAME is added either during new IPA server/replica/CA
installation or during upgrade.

https://fedorahosted.org/freeipa/ticket/3074
https://fedorahosted.org/freeipa/ticket/1431

1 files changed, 4 insertions, 2 deletions

diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install
index f041c58a8..7d7115cfd 100755
--- a/install/tools/ipa-replica-install
+++ b/install/tools/ipa-replica-install
@@ -247,7 +247,8 @@ def install_bind(config, options):
         print "Using reverse zone %s" % reverse_zone
 
     bind.setup(config.host_name, config.ip_address, config.realm_name,
-               config.domain_name, forwarders, options.conf_ntp, reverse_zone)
+               config.domain_name, forwarders, options.conf_ntp, reverse_zone,
+               ca_configured=options.setup_ca)
     bind.create_instance()
 
     print ""
@@ -296,7 +297,8 @@ def install_dns_records(config, options):
 
         bind.add_master_dns_records(config.host_name, config.ip_address,
                                     config.realm_name, config.domain_name,
-                                    reverse_zone, options.conf_ntp)
+                                    reverse_zone, options.conf_ntp,
+                                    options.setup_ca)
 
 def check_dirsrv():
     (ds_unsecure, ds_secure) = dsinstance.check_ports()