Lightweight CAs: indicate when CA does not yet have keys

When a lightweight CA is created, clones will initialise a local
object when the LDAP replication takes place, however, the signing
keys will not yet have been replicated.  Therefore, indicate CA
readiness in authority data and respond appropriately (HTTP 503)
when signing operations are attempted.

Part of: https://fedorahosted.org/pki/ticket/1625

1 files changed, 1 insertions, 4 deletions

diff --git a/base/server/cms/src/com/netscape/cms/servlet/cert/RequestProcessor.java b/base/server/cms/src/com/netscape/cms/servlet/cert/RequestProcessor.java
index 8558ec23f..b92ffb1d7 100644
--- a/base/server/cms/src/com/netscape/cms/servlet/cert/RequestProcessor.java
+++ b/base/server/cms/src/com/netscape/cms/servlet/cert/RequestProcessor.java
@@ -37,7 +37,6 @@ import com.netscape.certsrv.base.EBaseException;
 import com.netscape.certsrv.base.EPropertyNotFound;
 import com.netscape.certsrv.base.IConfigStore;
 import com.netscape.certsrv.ca.AuthorityID;
-import com.netscape.certsrv.ca.CADisabledException;
 import com.netscape.certsrv.ca.CANotFoundException;
 import com.netscape.certsrv.ca.ICertificateAuthority;
 import com.netscape.certsrv.cert.CertReviewResponse;
@@ -350,9 +349,7 @@ public class RequestProcessor extends CertProcessor {
         if (ca == null)
             // this shouldn't happen because request was already accepted
             throw new CANotFoundException("Unknown CA: " + aidString);
-        if (!ca.getAuthorityEnabled())
-            // authority was disabled after request was accepted
-            throw new CADisabledException("CA '" + aidString + "' is disabled");
+        ca.ensureReady();
     }
 
     /**