Lightweight CAs: add method to renew certificate

Add the CertificateAuthority.renewAuthority() method that creates
and processes a renewal request for the lightweight CA's signing
cert.  The new certificate replaces the old certificate in the NSSDB
and the serial number is stored in the 'authoritySerial' attribute.

Clones observe when the 'authoritySerial' attribute has changed and
update the certificate in their NSSDB, too.

The renewal behaviour is available in the REST API as a POST to
/ca/rest/authorities/<id>/renew.

Fixes: https://fedorahosted.org/pki/ticket/2327

1 files changed, 31 insertions, 0 deletions

diff --git a/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java b/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java
index 199ebef1a..0993b5c0d 100644
--- a/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java
+++ b/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java
@@ -282,6 +282,37 @@ public class AuthorityService extends PKIService implements AuthorityResource {
     }
 
     @Override
+    public Response renewCA(String aidString) {
+        AuthorityID aid = null;
+        try {
+            aid = new AuthorityID(aidString);
+        } catch (IllegalArgumentException e) {
+            throw new BadRequestException("Bad AuthorityID: " + aidString);
+        }
+
+        ICertificateAuthority ca = hostCA.getCA(aid);
+        if (ca == null)
+            throw new ResourceNotFoundException("CA \"" + aidString + "\" not found");
+
+        Map<String, String> auditParams = new LinkedHashMap<>();
+
+        try {
+            ca.renewAuthority(servletRequest);
+            audit(ILogger.SUCCESS, OpDef.OP_MODIFY, aidString, null);
+            return createNoContentResponse();
+        } catch (CADisabledException e) {
+            auditParams.put("exception", e.toString());
+            audit(ILogger.FAILURE, OpDef.OP_MODIFY, aidString, auditParams);
+            throw new ConflictingOperationException(e.toString());
+        } catch (EBaseException e) {
+            CMS.debug(e);
+            auditParams.put("exception", e.toString());
+            audit(ILogger.FAILURE, OpDef.OP_MODIFY, aidString, auditParams);
+            throw new PKIException("Error renewing authority: " + e.toString());
+        }
+    }
+
+    @Override
     public Response deleteCA(String aidString) {
         AuthorityID aid = null;
         try {