From d32b44be6a1dd73e514a6063cad2c8c84aaed360 Mon Sep 17 00:00:00 2001 From: Adam Young Date: Wed, 17 Aug 2011 15:36:18 -0400 Subject: enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce --- ipalib/constants.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'ipalib') diff --git a/ipalib/constants.py b/ipalib/constants.py index 026e07354..51cf566e1 100644 --- a/ipalib/constants.py +++ b/ipalib/constants.py @@ -136,9 +136,13 @@ DEFAULT_CONFIG = ( # CA plugin: ('ca_host', FQDN), # Set in Env._finalize_core() - ('ca_port', 9180), - ('ca_agent_port', 9443), - ('ca_ee_port', 9444), + ('ca_port', 80), + ('ca_agent_port', 443), + ('ca_ee_port', 443), + ('ca_install_port', 9180), + ('ca_agent_install_port', 9443), + ('ca_ee_install_port', 9444), + # Special CLI: ('prompt_all', False), -- cgit