Fix Install using dogtag.

The CA is installed before DS so we need to wait until DS is actually installed
to be able to ldap_enable the CA instance.

Fixes: https://fedorahosted.org/freeipa/ticket/612

1 files changed, 10 insertions, 2 deletions

diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index e03adfb9b..7cc8d50a3 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -478,8 +478,8 @@ class CAInstance(service.Service):
         # We do not let the system start IPA components on its own,
         # Instead we reply on the IPA init script to start only enabled
         # components as found in our LDAP configuration tree
-        suffix = util.realm_to_suffix(self.realm)
-        self.ldap_enable('CA', self.fqdn, self.dm_password, suffix)
+        # We need to install DS before we can actually ldap_enable a service.
+        # so actual enablement is delayed.
 
     def __create_ca_user(self):
         user_exists = True
@@ -996,6 +996,14 @@ class CAInstance(service.Service):
             except ipautil.CalledProcessError, e:
                 logging.critical("failed to delete user %s" % e)
 
+    def publish_ca_cert(self, location):
+        args = ["-L", "-n", self.canickname, "-a"]
+        (cert, err, returncode) = self.__run_certutil(args)
+        fd = open(location, "w+")
+        fd.write(cert)
+        fd.close()
+        os.chmod(location, 0444)
+
 if __name__ == "__main__":
     installutils.standard_logging_setup("install.log", False)
     cs = CADSInstance()