From 867f7691e9e8d4dc101d227ca56a94f9b947897f Mon Sep 17 00:00:00 2001 From: Martin Kosek Date: Mon, 19 Nov 2012 10:32:28 -0500 Subject: Add OCSP and CRL URIs to certificates Modify the default IPA CA certificate profile to include CRL and OCSP extensions which will add URIs to IPA CRL&OCSP to published certificates. Both CRL and OCSP extensions have 2 URIs, one pointing directly to the IPA CA which published the certificate and one to a new CNAME ipa-ca.$DOMAIN which was introduced as a general CNAME pointing to all IPA replicas which have CA configured. The new CNAME is added either during new IPA server/replica/CA installation or during upgrade. https://fedorahosted.org/freeipa/ticket/3074 https://fedorahosted.org/freeipa/ticket/1431 --- install/tools/ipa-server-install | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'install/tools/ipa-server-install') diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install index 92e9dcf2f..306d1e07b 100755 --- a/install/tools/ipa-server-install +++ b/install/tools/ipa-server-install @@ -965,8 +965,8 @@ def main(): ca = cainstance.CAInstance(realm_name, certs.NSS_DIR, dogtag_constants=dogtag.install_constants) if external == 0: - ca.configure_instance(host_name, dm_password, dm_password, - subject_base=options.subject) + ca.configure_instance(host_name, domain_name, dm_password, + dm_password, subject_base=options.subject) elif external == 1: # stage 1 of external CA installation options.realm_name = realm_name @@ -979,12 +979,13 @@ def main(): options.forwarders = dns_forwarders options.reverse_zone = reverse_zone write_cache(vars(options)) - ca.configure_instance(host_name, dm_password, dm_password, - csr_file="/root/ipa.csr", + ca.configure_instance(host_name, domain_name, dm_password, + dm_password, csr_file="/root/ipa.csr", subject_base=options.subject) else: # stage 2 of external CA installation - ca.configure_instance(host_name, dm_password, dm_password, + ca.configure_instance(host_name, domain_name, dm_password, + dm_password, cert_file=options.external_cert_file, cert_chain_file=options.external_ca_file, subject_base=options.subject) @@ -1079,7 +1080,8 @@ def main(): options.conf_ntp, reverse_zone, zonemgr=options.zonemgr, zone_refresh=options.zone_refresh, persistent_search=options.persistent_search, - serial_autoincrement=options.serial_autoincrement) + serial_autoincrement=options.serial_autoincrement, + ca_configured=not options.selfsign) if options.setup_dns: api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')), bind_pw=dm_password) -- cgit