diff options
| author | Fraser Tweedale <ftweedal@redhat.com> | 2015-10-08 01:09:22 -0400 |
|---|---|---|
| committer | Fraser Tweedale <ftweedal@redhat.com> | 2016-02-22 16:48:34 -0500 |
| commit | da4ca36ef5e378f55259438b4f72491d0966e5e7 (patch) | |
| tree | 598d0ae41123b7d31f8f4eb9356a0c75125b5424 /base/ca/src/org | |
| parent | 754b15db85c22903b3f9b18742ab2649fc556ad3 (diff) | |
| download | pki-da4ca36ef5e378f55259438b4f72491d0966e5e7.tar.gz pki-da4ca36ef5e378f55259438b4f72491d0966e5e7.tar.xz pki-da4ca36ef5e378f55259438b4f72491d0966e5e7.zip | |
Lightweight CAs: enrol cert via profile subsystem
Enrol new CA certs via the profile subsystem to ensure that the
usual audit events are logged and to avoid the nasty ConfigStore
hack used to generate the cert via CertUtil.
This commit also fixes an issue where the new CA certificate does
not have the correct Authority Key Identifier extension.
Fixes: https://fedorahosted.org/pki/ticket/1624
Fixes: https://fedorahosted.org/pki/ticket/1632
Diffstat (limited to 'base/ca/src/org')
| -rw-r--r-- | base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java b/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java index b77788378..85203cb03 100644 --- a/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java +++ b/base/ca/src/org/dogtagpki/server/ca/rest/AuthorityService.java @@ -49,6 +49,7 @@ import com.netscape.certsrv.ca.CANotLeafException; import com.netscape.certsrv.ca.CATypeException; import com.netscape.certsrv.ca.ICertificateAuthority; import com.netscape.certsrv.ca.IssuerUnavailableException; +import com.netscape.cms.realm.PKIPrincipal; import com.netscape.cms.servlet.base.PKIService; import com.netscape.cmsutil.util.Utils; @@ -179,8 +180,12 @@ public class AuthorityService extends PKIService implements AuthorityResource { throw new BadRequestException("Bad Authority ID: " + parentAIDString); } + PKIPrincipal principal = + (PKIPrincipal) servletRequest.getUserPrincipal(); + try { ICertificateAuthority subCA = hostCA.createCA( + principal.getAuthToken(), data.getDN(), parentAID, data.getDescription()); return createOKResponse(readAuthorityData(subCA)); } catch (IllegalArgumentException e) { |