From c8f7cb0163c766aa46a3435dfc9984bf8761f27d Mon Sep 17 00:00:00 2001 From: David Kupka Date: Tue, 14 Oct 2014 03:40:43 -0400 Subject: Set IPA CA for freeipa certificates. In previous versions (before moving certmonger.py to DBus) it was set and some tools and modules depends on it. For example: ipa-getcert uses this to filter freeipa certificates. https://fedorahosted.org/freeipa/ticket/4618 Reviewed-By: Jan Cholasta --- ipapython/certmonger.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'ipapython/certmonger.py') diff --git a/ipapython/certmonger.py b/ipapython/certmonger.py index bcfafdaf4..ca8b37392 100644 --- a/ipapython/certmonger.py +++ b/ipapython/certmonger.py @@ -278,7 +278,7 @@ def start_tracking(nickname, secdir, password_file=None, command=None): certmonger to run when it renews a certificate. This command must reside in /usr/lib/ipa/certmonger to work with SELinux. - Returns True or False + Returns certificate nickname. """ cm = _connect_to_certmonger() params = {'TRACK': True} @@ -288,6 +288,10 @@ def start_tracking(nickname, secdir, password_file=None, command=None): params['key-nickname'] = nickname params['key-database'] = os.path.abspath(secdir) params['key-storage'] = 'NSSDB' + ca_path = cm.obj_if.find_ca_by_nickname('IPA') + if not ca_path: + raise RuntimeError('IPA CA not found') + params['ca'] = ca_path if command: params['cert-postsave-command'] = command if password_file: -- cgit