diff options
author | Endi S. Dewata <edewata@redhat.com> | 2016-08-01 22:35:32 +0200 |
---|---|---|
committer | Endi S. Dewata <edewata@redhat.com> | 2016-08-05 22:23:20 +0200 |
commit | da66600e8ae07fa4169d24909c7d04ed69d2906c (patch) | |
tree | 00f75b05951788df27c91c3559daf231d67a1b32 /base/common/python | |
parent | f726f9a668b523c4e5a9438d8ea301f4b556efd4 (diff) | |
download | pki-da66600e8ae07fa4169d24909c7d04ed69d2906c.tar.gz pki-da66600e8ae07fa4169d24909c7d04ed69d2906c.tar.xz pki-da66600e8ae07fa4169d24909c7d04ed69d2906c.zip |
Added log messages for certificate import during cloning.
To help troubleshooting cloning issues the security_databases.py
has been modified to log the content of the PKCS #12 file before
import and the NSS database after import.
https://fedorahosted.org/pki/ticket/2424
Diffstat (limited to 'base/common/python')
-rw-r--r-- | base/common/python/pki/nssdb.py | 10 | ||||
-rw-r--r-- | base/common/python/pki/pkcs12.py | 73 |
2 files changed, 83 insertions, 0 deletions
diff --git a/base/common/python/pki/nssdb.py b/base/common/python/pki/nssdb.py index a0b030214..ed456540b 100644 --- a/base/common/python/pki/nssdb.py +++ b/base/common/python/pki/nssdb.py @@ -398,6 +398,16 @@ class NSSDatabase(object): if rc: raise Exception('Failed to generate self-signed CA certificate. RC: %d' % rc) + def show_certs(self): + + cmd = [ + 'certutil', + '-L', + '-d', self.directory + ] + + subprocess.check_call(cmd) + def get_cert(self, nickname, output_format='pem'): if output_format == 'pem': diff --git a/base/common/python/pki/pkcs12.py b/base/common/python/pki/pkcs12.py new file mode 100644 index 000000000..a62ca0913 --- /dev/null +++ b/base/common/python/pki/pkcs12.py @@ -0,0 +1,73 @@ +# Authors: +# Endi S. Dewata <edewata@redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the Lesser GNU General Public License as published by +# the Free Software Foundation; either version 3 of the License or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Lesser General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this program; if not, write to the Free Software Foundation, +# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +# +# Copyright (C) 2016 Red Hat, Inc. +# All rights reserved. +# + +from __future__ import absolute_import +import os +import shutil +import subprocess +import tempfile + + +class PKCS12(object): + + def __init__(self, path, password=None, password_file=None, nssdb=None): + + # The pki CLI needs an NSS database to run PKCS #12 operations + # as required by JSS. If the nssdb parameter is provided, the CLI + # will use the specified NSS database object. Otherwise, it will use + # the default NSS database in ~/.dogtag/nssdb. + + self.path = path + self.nssdb = nssdb + + self.tmpdir = tempfile.mkdtemp() + + if password: + self.password_file = os.path.join(self.tmpdir, 'password.txt') + with open(self.password_file, 'w') as f: + f.write(password) + + elif password_file: + self.password_file = password_file + + else: + raise Exception('Missing PKCS #12 password') + + def close(self): + shutil.rmtree(self.tmpdir) + + def show_certs(self): + + cmd = ['pki'] + + if self.nssdb: + cmd.extend([ + '-d', self.nssdb.directory, + '-C', self.nssdb.password_file + ]) + + cmd.extend([ + 'pkcs12-cert-find', + '--pkcs12-file', self.path, + '--pkcs12-password-file', self.password_file + ]) + + subprocess.check_call(cmd) |