Additional clean-ups for PKCS #12 utilities.

The pki_server_external_cert_path has been renamed to
pki_server_external_certs_path to match the file name.

A default pki_server_external_certs_path has been added to
default.cfg.

The pki pkcs12-export has been modified to export into existing
PKCS #12 file by default.

The pki-server instance-cert-export has been modified to accept a
list of nicknames to export.

https://fedorahosted.org/pki/ticket/1742

3 files changed, 17 insertions, 17 deletions

diff --git a/base/server/python/pki/server/cli/instance.py b/base/server/python/pki/server/cli/instance.py
index 5d1615329..a779f3c16 100644
--- a/base/server/python/pki/server/cli/instance.py
+++ b/base/server/python/pki/server/cli/instance.py
@@ -67,10 +67,10 @@ class InstanceCertExportCLI(pki.cli.CLI):
 
     def __init__(self):
         super(InstanceCertExportCLI, self).__init__(
-            'export', 'Export subsystem certificate')
+            'export', 'Export system certificates')
 
     def print_help(self):  # flake8: noqa
-        print('Usage: pki-server instance-cert-export [OPTIONS]')
+        print('Usage: pki-server instance-cert-export [OPTIONS] [nicknames...]')
         print()
         print('  -i, --instance <instance ID>       Instance ID (default: pki-tomcat).')
         print('      --pkcs12-file <path>           Output file to store the exported certificate and key in PKCS #12 format.')
@@ -83,7 +83,7 @@ class InstanceCertExportCLI(pki.cli.CLI):
     def execute(self, argv):
 
         try:
-            opts, _ = getopt.gnu_getopt(argv, 'i:v', [
+            opts, args = getopt.gnu_getopt(argv, 'i:v', [
                 'instance=',
                 'pkcs12-file=', 'pkcs12-password=', 'pkcs12-password-file=',
                 'verbose', 'help'])
@@ -93,6 +93,8 @@ class InstanceCertExportCLI(pki.cli.CLI):
             self.print_help()
             sys.exit(1)
 
+        nicknames = args
+
         instance_name = 'pki-tomcat'
         pkcs12_file = None
         pkcs12_password = None
@@ -139,7 +141,8 @@ class InstanceCertExportCLI(pki.cli.CLI):
             nssdb.export_pkcs12(
                 pkcs12_file=pkcs12_file,
                 pkcs12_password=pkcs12_password,
-                pkcs12_password_file=pkcs12_password_file)
+                pkcs12_password_file=pkcs12_password_file,
+                nicknames=nicknames)
         finally:
             nssdb.close()
 
diff --git a/base/server/python/pki/server/cli/subsystem.py b/base/server/python/pki/server/cli/subsystem.py
index 8450f7b61..5ab232cc1 100644
--- a/base/server/python/pki/server/cli/subsystem.py
+++ b/base/server/python/pki/server/cli/subsystem.py
@@ -577,9 +577,9 @@ class SubsystemCertExportCLI(pki.cli.CLI):
             try:
                 nssdb.export_pkcs12(
                     pkcs12_file=pkcs12_file,
-                    nicknames=nicknames,
                     pkcs12_password=pkcs12_password,
-                    pkcs12_password_file=pkcs12_password_file)
+                    pkcs12_password_file=pkcs12_password_file,
+                    nicknames=nicknames)
 
             finally:
                 nssdb.close()
diff --git a/base/server/python/pki/server/deployment/scriptlets/security_databases.py b/base/server/python/pki/server/deployment/scriptlets/security_databases.py
index 027c4c4cf..3947ad64c 100644
--- a/base/server/python/pki/server/deployment/scriptlets/security_databases.py
+++ b/base/server/python/pki/server/deployment/scriptlets/security_databases.py
@@ -85,12 +85,11 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
             deployer.mdict['pki_secmod_database'],
             perms=config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
 
-        pki_server_pkcs12_path = deployer.mdict['pki_server_pkcs12_path']
+        # import system certificates before starting the server
 
+        pki_server_pkcs12_path = deployer.mdict['pki_server_pkcs12_path']
         if pki_server_pkcs12_path:
 
-            # importing system certificates
-
             pki_server_pkcs12_password = deployer.mdict[
                 'pki_server_pkcs12_password']
             if not pki_server_pkcs12_password:
@@ -105,9 +104,9 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 pkcs12_password=pki_server_pkcs12_password)
 
             # update external CA file (if needed)
-            external_cert_path = deployer.mdict['pki_server_external_cert_path']
-            if external_cert_path is not None:
-                self.update_external_cert_conf(external_cert_path, deployer)
+            external_certs_path = deployer.mdict['pki_server_external_certs_path']
+            if external_certs_path is not None:
+                self.update_external_certs_conf(external_certs_path, deployer)
 
         if len(deployer.instance.tomcat_instance_subsystems()) < 2:
             # only create a self signed cert for a new instance
@@ -183,20 +182,18 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
         deployer.file.delete(deployer.mdict['pki_shared_pfile'])
         return self.rv
 
-    def update_external_cert_conf(self, external_path, deployer):
+    def update_external_certs_conf(self, external_path, deployer):
         external_certs = pki.server.PKIInstance.read_external_certs(
             external_path)
 
         if len(external_certs) > 0:
-            instance = pki.server.PKIInstance(
-                deployer.mdict['pki_instance_name'])
-            instance.load_external_certs(
+            deployer.instance.load_external_certs(
                 os.path.join(deployer.mdict['pki_instance_configuration_path'],
                              'external_certs.conf')
             )
 
             for cert in external_certs:
-                instance.add_external_cert(cert.nickname, cert.token)
+                deployer.instance.add_external_cert(cert.nickname, cert.token)
 
     def destroy(self, deployer):