Prevent deletion of host CA cert and key from NSSDB

If authorityMonitor observes the deletion of the host CA's authority
entry, it will treat it the same as any other lightweight CA and
delete the signing cert AND KEY from the NSSDB. Because the database
is replicated, the change would be observed and deletion immediately
effected on all running clones.  Unless the main CA private key is
backed up somewhere there is no way to recover from this.

Although this scenario does not arise in normal operation, the
impact is severe so add a check that prevents cert and key deletion
for host authority.

Fixes: https://fedorahosted.org/pki/ticket/2443

0 files changed, 0 insertions, 0 deletions