summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Fixed KRA install problem.branch-10.2.7-dev1Endi S. Dewata2016-04-022-28/+44
| | | | | | | | | | | | | Currently when installing an additional subsystem to an existing instance the install tool always generates a new random password in the pki_pin property which would not work with the existing NSS database. The code has been modified to load the existing NSS database password from the instance if the instance already exists. The PKIInstance class has been modified to allow loading partially created instance to help the installation. https://fedorahosted.org/pki/ticket/2247
* Install tools clean-up.Endi S. Dewata2016-04-025-16/+13
| | | | | | | | | | | | Some variables in pkispawn and pkidestroy have been renamed for clarity. The unused PKI_CERT_DB_PASSWORD_SLOT variable has been removed. The constant pki_self_signed_token property has been moved into default.cfg. https://fedorahosted.org/pki/ticket/2247
* Fix escaping of password fields to prevent interpolationChristian Heimes2016-04-021-0/+3
| | | | | | | | | | Some password and pin fields are missing from the no_interpolation list. One entry is misspelled. A '%' in password field such as pki_clone_pkcs12_password causes an installation error. https://fedorahosted.org/pki/ticket/1703 Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Fixed certificate chain import problem.Endi S. Dewata2016-04-021-10/+13
| | | | | | | | | | | | In the external CA case if the externally-signed CA certificate is included in the certificate chain the CA certificate may get imported with an incorrect nickname. The code has been modified such that the certificate chain is imported after the CA certificate is imported with the proper nickname. https://fedorahosted.org/pki/ticket/2022
* Added support for cloning 3rd-party CA certificates.Endi S. Dewata2016-04-029-132/+271
| | | | | | | | | | | | | | | | | | | | | | | The installation code has been modified such that it imports all CA certificates from the PKCS #12 file for cloning before the server is started using certutil. The user certificates will continue to be imported using the existing JSS code after the server is started. This is necessary since JSS is unable to preserve the CA certificate nicknames. The PKCS12Util has been modified to support multiple certificates with the same nicknames. The pki pkcs12-cert-find has been modified to show certificate ID and another field indicating whether the certificate has a key. The pki pkcs12-cert-export has been modified to accept either certificate nickname or ID. The pki pkcs12-import has been modified to provide options for importing only user certificates or CA certificates. https://fedorahosted.org/pki/ticket/1742
* Additional clean-ups for PKCS #12 utilities.Endi S. Dewata2016-04-027-24/+38
| | | | | | | | | | | | | | | | The pki_server_external_cert_path has been renamed to pki_server_external_certs_path to match the file name. A default pki_server_external_certs_path has been added to default.cfg. The pki pkcs12-export has been modified to export into existing PKCS #12 file by default. The pki-server instance-cert-export has been modified to accept a list of nicknames to export. https://fedorahosted.org/pki/ticket/1742
* Renamed PKCS #12 options for consistency.Endi S. Dewata2016-04-0216-72/+72
| | | | | | | The pki CLI's --pkcs12 options has been renamed to --pkcs12-file for consistency with pki-server CLI options. https://fedorahosted.org/pki/ticket/1742
* Fix pkcs12 exportAde Lee2016-04-022-7/+11
| | | | | | | | | | | | | | | | | | | | The utility for exporting certs and keys to a PKCS12 file did not handle the signing certificate correctly. This is because the signing certificate was imported multiple times during the export process - either with its key (and key id set) or as part of the cert chain for the other system certs (with no key set). Each import would override the previous import - so whether or not the key_id was set would depend on the order in which the certificates were imported. This becomes an issue for import into a clone certdb, because in the new mechanism, we rely on the cert attributes (ie. key_id) to determine if a key is to be imported or not. We fix this by specifying whether the entry in the export should be overwritten or not.
* Handle import and export of external certsAde Lee2016-04-0210-25/+363
| | | | | | | | | | | | | | | | | | | | | | Ticket 1742 has a case where a third party CA certificate has been added by IPA to the dogtag certdb for the proxy cert. There is no way to ensure that this certificate is imported when the system is cloned. This patch will allow the user to import third party certificates into a dogtag instance through CLI commands (pki-server). The certs are tracked by a new instance level configuration file external_certs.conf. Then, when cloning: 1. When the pk12 file is created by the pki-server ca-clone-prepare command, the external certs are automatically included. 2. When creating the clone, the new pki_server_pk12_path and password must be provided. Also, a copy of the external_certs.conf file must be provided. 3. This copy will be read and merged with the existing external_certs.conf if one exists.
* Implement total ordering for PKISubsystem and PKIInstanceChristian Heimes2016-04-022-0/+106
| | | | | | | | In Python 3 subclasses no longer implement automatic ordering. To provide ordering for sort() and custom comparison, __eq__ and __lt__ are required. https://fedorahosted.org/pki/ticket/2216
* Added workaround for JSS limitation in pki pkcs12-import.Endi S. Dewata2016-04-026-58/+402
| | | | | | | | | | | | | | | | Currently JSS is unable to import CA certificates while preserving their nicknames. As a workaround, the pki pkcs12-import has been modified such that it exports individual CA certificates from PKCS The remaining user certificates will continue to be imported using JSS. A new pki pkcs12-cert-export command has been added to export individual certificates from PKCS #12 file into PEM files. The pki pkcs12-import has been modified to take a list of nicknames of the certificates to be imported into NSS database. https://fedorahosted.org/pki/ticket/1742
* Py3 modernization: libmodernize.fixes.fix_importChristian Heimes2016-04-0271-3/+78
| | | | | | | | | | | | | | Enforce absolute imports or explicit relative imports. Python 3 no longer supports implicit relative imports, that is unqualified imports from a module's directory. In order to load a module from the same directory inside a package, use from . import module The future feature 'from __future__ import absolute_import' ensures that pki uses absolute imports on Python 2, too. See https://www.python.org/dev/peps/pep-0328/
* Move pylint-build-scan.py to scripts directoryChristian Heimes2016-04-024-13/+14
| | | | | | Move internal helper and its configuration out of the project's root directory into scripts/. Also use re instead of fnmatch to find the upgrade scriptlets.
* Added Python wrapper for pki pkcs12-import.Endi S. Dewata2016-04-027-97/+501
| | | | | | | | | | | | | | | | | | A Python wrapper module has been added for the pki pkcs12-import command to provide a mechanism to implement a workaround for JSS import limitation. Additional fixes by cheimes have been merged into this patch: setup.py: We must track all sub-packages manually. pylint-build-scan.py: pylint confuses the 'pki' package with the 'pki' command. The workaround symlinks the command and analysis the command under its alternative name. https://fedorahosted.org/pki/ticket/1742
* Added mechanism to import system certs via PKCS #12 file.Endi S. Dewata2016-04-028-88/+163
| | | | | | | | | | | | | | | | | | | | | | The installation tool has been modified to provide an optional pki_server_pkcs12_path property to specify a PKCS #12 file containing certificate chain, system certificates, and third-party certificates needed by the subsystem being installed. If the pki_server_pkcs12_path is specified the installation tool will no longer download the certificate chain from the security domain directly, and it will no longer import the PKCS #12 containing the entire master NSS database specified in pki_clone_pkcs12_path. For backward compatibility, if the pki_server_pkcs12_path is not specified the installation tool will use the old mechanism to import the system certificates. The ConfigurationUtils.verifySystemCertificates() has been modified not to catch the exception to help troubleshooting. https://fedorahosted.org/pki/ticket/1742
* Added pki-server commands to export system certificates.Endi S. Dewata2016-04-0210-39/+1037
| | | | | | | | | | | | | | | | Some pki-server commands have been added to simplify exporting the required certificates for subsystem installations. These commands will invoke the pki pkcs12 utility to export the certificates from the instance NSS database. The pki-server ca-cert-chain-export command will export the the certificate chain needed for installing additional subsystems running on a separate instance. The pki-server <subsystem>-clone-prepare commands will export the certificates required for cloning a subsystem. https://fedorahosted.org/pki/ticket/1742
* Updated PKCS12Util.Endi S. Dewata2016-04-024-46/+59
| | | | | | | | | | | | | | | | | | | | | | | The PKCSUtil has been updated to match the functionality provided by JSS. In order to import a certificate properly, the certificate needs to be exported with its private key and certificate chain, so the option to export without key or without the certificate chain has been removed. The option to export only the certificate chain has also been removed since it can be done by exporting the complete certificate chain, then remove the leaf certificate while keeping the chain. The pki pkcs12-cert-add has been modified to provide an option to create a new PKCS #12 file to store the certificate. The pki pkcs12-export has been modified to always overwrite existing file to match the behavior of PKCS12Export. It also has been modified to accept a list of nicknames of certificates to export. https://fedorahosted.org/pki/ticket/1742
* Added CLI to manage keys in PKCS #12 file.Endi S. Dewata2016-04-022-0/+151
| | | | | | | A new CLI has been added to remove a key from a PKCS #12 file based on the key ID. https://fedorahosted.org/pki/ticket/1742
* Added CLI to manage certs in PKCS #12 file.Endi S. Dewata2016-04-026-10/+368
| | | | | | | New CLIs have been added to add a certificate from NSS database and to remove a certificate from the PKCS #12 file. https://fedorahosted.org/pki/ticket/1742
* Refactored PKCS12Util to use PKCS12 object.Endi S. Dewata2016-04-0211-214/+308
| | | | | | | | | | | | The PKCS12Util has been modified such that it stores the certs and keys in PKCS12 object instead of PFX object. The PKCS12 object can be loaded either from NSS database or PKCS #12 file. The PKCS12 object can later be stored into NSS database or PKCS #12 file. The pki pkcs12-cert-find and pkcs12-key-find commands were modified to require PKCS #12 password. https://fedorahosted.org/pki/ticket/1742
* Refactored PKCS12CertInfo and PKCS12KeyInfo classes.Endi S. Dewata2016-04-027-35/+133
| | | | | | | | | | The PKCS12CertInfo and PKCS12KeyInfo classes have been moved out of PKCS12Util into separate classes. The createLocalKeyID() has been modified to return BigInteger instead of byte array. https://fedorahosted.org/pki/ticket/1742
* Added PKCS #12 attribute to store certificate trust flags.Endi S. Dewata2016-04-026-52/+291
| | | | | | | | | A new PKCS #12 attribute has been defined to store NSS certificate trust flags in PKCS #12 file. The PKCS12Util has been modified to store the trust flags during export and reset the trust flags in NSS database during import. https://fedorahosted.org/pki/ticket/1742
* Added CLIs to import and export PKCS #12.Endi S. Dewata2016-04-025-0/+422
| | | | | | | | The pki pkcs12-import and pki pkcs12-export commands have been added to import and export PKCS #12 file into and from NSS database. https://fedorahosted.org/pki/ticket/1742
* Added CLIs to inspect PKCS #12 file.Endi S. Dewata2016-04-028-1/+599
| | | | | | | The pki pkcs12-cert-find and pki pkcs12-key-find commands have been added to list the certificates and keys in a PKCS #12 file. https://fedorahosted.org/pki/ticket/1742
* Refactored PKCS12Export.Endi S. Dewata2016-04-026-195/+273
| | | | | | | | | | | | | The code to export NSS database into PKCS #12 file in PKCS12Export tool has been refactored into PKCS12Util class to simplify further enhancements. The PKCS12Export tool has also been modified to use Java Logging API. A default logging configuration file has been added. The command-line wrapper has been modified to get the path to the logging configuration file from pki.conf. https://fedorahosted.org/pki/ticket/1742
* Python packaging of PKI client libraryChristian Heimes2016-04-023-0/+110
| | | | | | | | | | | | | | | | | | | | | | A new setup.py in base/common/python makes it possible to bundle the pki client library and upload it on PyPI. The setup.py in the root directory is only used for tox and testing. It's a cleaner and less fragile approach than to support two different build flavors with one setup.py The 'release' alias from setup.cfg creates and uploads a source distribution and an universal wheel: $ sudo yum install python-wheel python-setuptools $ cd base/common/python $ python setup.py release The 'packages' alias just creates the source distribution and wheel: $ python setup.py packages The version number is taken from the Version and Release fields of pki-core.spec.
* Synced some more pki-core spec file changes from DOGTAG_10_2_6_BRANCH.Matthew Harmsen2016-03-291-2/+6
|
* Build using tomcat 7.0.68 on F22Matthew Harmsen2016-03-291-0/+5
| | | | (cherry picked from commit 7638c5af03e50c4a59a2f7a2c96483bfae27045c)
* Inserted Fedora 22 specific dependencies into 'pki-core.spec' (Dogtag 10.2.7)Matthew Harmsen2016-03-291-1/+18
| | | | to be in sync with Fedora 22 in Koji.
* Changed 'pki-core.spec' (Dogtag 10.2.7) to be in sync with Fedora 23 in KojiMatthew Harmsen2016-03-291-7/+6
|
* pki-tomcat8 needs tomcat-api.jar to compileChristian Heimes2016-03-291-1/+9
| | | | | | | | | | Tomcat 8.0.32 has moved org.apache.tomcat.ContextBind into tomcat-api.jar. Add tomcat-api.jar to javac classpath to compile pki with latest Tomcat. https://fedorahosted.org/pki/attachment/ticket/2222 (cherry picked from commit 263dc2152640a95c8ca9b2829e74cce3a877f077) (cherry picked from commit a7055d92466463d444da83db94c7b775a33e6aa0)
* Modify dnsdomainname test in pkispawnAde Lee2016-03-293-3/+3
| | | | | | | | We do a check for the dnsdomainname, which fails in Openstack CI because this is not set. Instead of exiting, default to the hostname. (cherry picked from commit 795465f8620a0a10092435dce46e4cff93dbc20a)
* Fixed KRA installation.Endi S. Dewata2016-02-223-3/+3
| | | | | | | | | | Due to a recent change the KRA installation failed because the installer was trying to read the pki_external_csr_path parameter which is not available for KRA installation. The installer has been fixed to read the parameter in external CA case only. https://fedorahosted.org/pki/ticket/456 (cherry picked from commit d42f39334ce4b4f5fa89707bfb6145039ff04579)
* Renamed pki.nss into pki.nssdb.Endi S. Dewata2016-02-224-8/+8
| | | | | | | | The pki.nss module has been renamed into pki.nssdb to prevent conflicts with the nss module. https://fedorahosted.org/pki/ticket/456 (cherry picked from commit 9609f4e6035d3cdff19a0f78caee2d08b095c8ba)
* Fixed installation summary for existing CA.Endi S. Dewata2016-02-223-10/+26
| | | | | | | | The pkispawn has been modified to display the proper summary for external CA and existing CA cases. https://fedorahosted.org/pki/ticket/456 (cherry picked from commit 66a4b7e635a4456a102221049c58c461d3429093)
* Fixed mismatching certificate validity calculation.Endi S. Dewata2016-02-222-14/+67
| | | | | | | | | The CAValidityDefault has been modified to use Calendar API to calculate the certificate validity range to be consistent with the ValidityConstraint and ValidityDefault. https://fedorahosted.org/pki/ticket/1682 (cherry picked from commit 9193fe5191d1bd857b7e1f5a398c6a279b42ec84)
* Fixed external CA case for IPA compatibility.Endi S. Dewata2016-02-224-8/+40
| | | | | | | | | | | | | | The installation code for external CA case has been fixed such that IPA can detect step 1 completion properly. The code that handles certificate data conversion has been fixed to reformat base-64 data for PEM output properly. The installation summary for step 1 has been updated to provide more accurate information. https://fedorahosted.org/pki/ticket/456 (cherry picked from commit 449e4357e733a70e8f27f65f69ca8f0f7c8b5b21)
* Updated pki-cert and pki-server-subsystem man pages.Endi S. Dewata2016-02-222-8/+41
| | | | | | | | The pki-cert and pki-server-subsystem man pages have been updated to include recent changes. https://fedorahosted.org/pki/ticket/456 (cherry picked from commit 3294f5087997427d060bce85d033652f7a8431da)
* Added mechanism to import existing CA certificate.Endi S. Dewata2016-02-229-66/+557
| | | | | | | | | | | | The deployment procedure for external CA has been modified such that it generates the CA CSR before starting the server. This allows the same procedure to be used to import CA certificate from an existing server. It also removes the requirement to keep the server running while waiting to get the CSR signed by an external CA. https://fedorahosted.org/pki/ticket/456 (cherry picked from commit 20c985ae773b26f653cac6d22bd9d93923e18c8e)
* Added CLI options to simplify submitting CSR.Endi S. Dewata2016-02-221-9/+144
| | | | | | | | | | | The pki ca-cert-request-submit command has been modified to provide options to specify the profile name and the CSR which will be used to create and populate the request object. This way it's no longer necessary to download the request template and insert the CSR manually. https://fedorahosted.org/pki/ticket/456 (cherry picked from commit ec9c68d68eabff3784fcf6dabf2c6745734b3c9c)
* Added pki-server subsystem-cert-export command.Endi S. Dewata2016-02-223-0/+468
| | | | | | | | | A new command has been added to export a system certificate, the CSR, and the key. This command can be used to migrate a system certificate into another instance. https://fedorahosted.org/pki/ticket/456 (cherry picked from commit 9dce4a497f7c977a3c453972706eeb325bd33275)
* Fix to determine supported javadoc optionsMatthew Harmsen2016-02-191-2/+59
| | | | | | - PKI TRAC Ticket #2040 - Determine supported javadoc options (cherry picked from commit c32dd90ef638e9653136eeb901426c56b511fda4)
* Resolves: PKI TRAC Ticket #1714Matthew Harmsen2016-02-041-3/+5
| | | | | - PKI TRAC Ticket #1714 - mod_revocator and mod_nss dependency for tps should be removed
* Block startup until initial profile load completedFraser Tweedale2016-01-211-2/+35
| | | | | | | | | It is possible for the CMS getStatus resource to indicate that CMS is ready when the initial loading of profiles (which is performed by another thread) is not complete. During startup, wait for the initial loading of profiles to complete before continuing. Fixes: https://fedorahosted.org/pki/ticket/1702
* Ensure config store commits refresh file-based profile dataFraser Tweedale2016-01-211-1/+38
| | | | | | | | The file-based LDAP profile subsystem does not update profiles correctly. Ensure that each commit of the underlying config store refreshes the profile inputs, outputs and policy objects. Part of: https://fedorahosted.org/pki/ticket/1700
* Handle LDAPProfileSubsystem delete-then-recreate racesFraser Tweedale2016-01-211-20/+92
| | | | | | | | | | | | Deleting and then immediately recreating a profile can result in the new profile temporarily going missing, if the DELETE EntryChangeControl is processed after profile readdition. Handle this case by tracking the nsUniqueId of entries that are deleted by an LDAPProfileSubsystem and NOT (re-)forgetting the profile when the subsequent EntryChangeControl gets processed. Fixes: https://fedorahosted.org/pki/ticket/1700
* Avoid profile race conditions by tracking entryUSNFraser Tweedale2016-01-216-30/+118
| | | | | | | | | | | | | Avoid race conditions in the LDAPProfileSubsystem by tracking the most recently known entryUSN of profiles' LDAP entries. As part of this change, add the commitProfile method to the IProfileSubsystem interface, remove commit behaviour from the enableProfile and disableProfile methods and update ProfileService and ProfileApproveServlet to commit the profile (using the commitProfile method) where needed. Part of: https://fedorahosted.org/pki/ticket/1700
* Add LDAPPostReadControl classFraser Tweedale2016-01-211-0/+106
| | | | | | | | The LDAPPostReadControl can be used to read an entry after perfoming an add, modify or modrdn, giving atomic access to operational attributes. Part of: https://fedorahosted.org/pki/ticket/1700
* Extract LDAPControl search function to LDAPUtilFraser Tweedale2016-01-212-11/+22
|
* sslget must set Host HTTP headerChristian Heimes2015-12-151-13/+10
| | | | | | | | | | | | | | | | The sslget tool sends a TLS SNI header. Apache doesn't like server name indication without a matching HTTP header. Requests without a Host header are refused with HTTP/1.1 400 Bad Request Hostname example.org provided via SNI, but no hostname provided in HTTP request sslget now sets a Host HTTP header for all requests. https://fedorahosted.org/pki/ticket/1704 Signed-off-by: Christian Heimes <cheimes@redhat.com> (cherry picked from commit 73f5e33c945d865a88b47491b73553ba8ecf2f53)
generated by cgit (git 2.34.1) at 2024-04-26 01:15:56 +0000