diff options
| author | Jan Cholasta <jcholast@redhat.com> | 2014-06-12 18:06:43 +0200 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-07-30 16:04:21 +0200 |
| commit | 9d4eeeda55b397237af17392f3acb9542e126145 (patch) | |
| tree | 6784e196dec3152eb5a591626b26e9a63d22ed88 /ipaserver | |
| parent | a8a44c1c714714d89ee5ac9b54611278de982d52 (diff) | |
| download | freeipa-9d4eeeda55b397237af17392f3acb9542e126145.tar.gz freeipa-9d4eeeda55b397237af17392f3acb9542e126145.tar.xz freeipa-9d4eeeda55b397237af17392f3acb9542e126145.zip | |
Allow specifying trust flags in NSSDatabase and CertDB method trust_root_cert.
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Diffstat (limited to 'ipaserver')
| -rw-r--r-- | ipaserver/install/certs.py | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py index e201c2529..c9f038f56 100644 --- a/ipaserver/install/certs.py +++ b/ipaserver/install/certs.py @@ -196,15 +196,17 @@ class NSSDatabase(object): raise RuntimeError("unknown error import pkcs#12 file %s" % pkcs12_filename) - def trust_root_cert(self, root_nickname): + def trust_root_cert(self, root_nickname, trust_flags=None): if root_nickname[:7] == "Builtin": root_logger.debug( "No need to add trust for built-in root CAs, skipping %s" % root_nickname) else: + if trust_flags is None: + trust_flags = 'CT,CT,' try: self.run_certutil(["-M", "-n", root_nickname, - "-t", "CT,CT,"]) + "-t", trust_flags]) except ipautil.CalledProcessError, e: raise RuntimeError( "Setting trust on %s failed" % root_nickname) @@ -782,13 +784,13 @@ class CertDB(object): return root_nicknames - def trust_root_cert(self, root_nickname): + def trust_root_cert(self, root_nickname, trust_flags=None): if root_nickname is None: root_logger.debug("Unable to identify root certificate to trust. Continuing but things are likely to fail.") return try: - self.nssdb.trust_root_cert(root_nickname) + self.nssdb.trust_root_cert(root_nickname, trust_flags) except RuntimeError: pass |