diff options
author | Rob Crittenden <rcrit@ipa.greyoak.com> | 2008-07-11 11:34:29 -0400 |
---|---|---|
committer | Rob Crittenden <rcrit@ipa.greyoak.com> | 2008-07-14 09:06:52 -0400 |
commit | 6980b073035cdd43b30b58aba3ce7f84f16a14ad (patch) | |
tree | 2e291b420d42ad02df9221fb4036bb22698463df /ipa-server/ipaserver/dsinstance.py | |
parent | b95c05f5c6a9977e6bb02d091a601efb3bcf360e (diff) | |
download | freeipa-6980b073035cdd43b30b58aba3ce7f84f16a14ad.tar.gz freeipa-6980b073035cdd43b30b58aba3ce7f84f16a14ad.tar.xz freeipa-6980b073035cdd43b30b58aba3ce7f84f16a14ad.zip |
Rework the way SSL certificates are imported from PKCS#12 files.
Add the ability to provide PKCS#12 files during initial installation
Add the ability to provide PKCS#12 files when preparing a replica
Correct some issues with ipa-server-certinstall
452402
Diffstat (limited to 'ipa-server/ipaserver/dsinstance.py')
-rw-r--r-- | ipa-server/ipaserver/dsinstance.py | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/ipa-server/ipaserver/dsinstance.py b/ipa-server/ipaserver/dsinstance.py index 540ff686f..d313b4ed2 100644 --- a/ipa-server/ipaserver/dsinstance.py +++ b/ipa-server/ipaserver/dsinstance.py @@ -324,9 +324,16 @@ class DsInstance(service.Service): ca = certs.CertDB(dirname) if self.pkcs12_info: ca.create_from_pkcs12(self.pkcs12_info[0], self.pkcs12_info[1]) + server_certs = ca.find_server_certs() + if len(server_certs) == 0: + raise RuntimeError("Could not find a suitable server cert in import in %s" % pkcs12_info[0]) + + # We only handle one server cert + nickname = server_certs[0][0] else: ca.create_self_signed() ca.create_server_cert("Server-Cert", "cn=%s,ou=Fedora Directory Server" % self.host_name) + nickname = "Server-Cert" conn = ipaldap.IPAdmin("127.0.0.1") conn.simple_bind_s("cn=directory manager", self.dm_password) @@ -347,7 +354,7 @@ class DsInstance(service.Service): entry.setValues("objectclass", "top", "nsEncryptionModule") entry.setValues("cn", "RSA") - entry.setValues("nsSSLPersonalitySSL", "Server-Cert") + entry.setValues("nsSSLPersonalitySSL", nickname) entry.setValues("nsSSLToken", "internal (software)") entry.setValues("nsSSLActivation", "on") |