summaryrefslogtreecommitdiffstats
path: root/base/server/etc/default.cfg
Commit message (Collapse)AuthorAgeFilesLines
* Added PKCS #12 deployment properties.Endi S. Dewata2016-04-151-2/+5
| | | | | | | | | | New PKCS #12 deployment properties have been added as aliases for some external CA properties to allow them to be used in more general cases: - pki_pkcs12_path -> pki_external_pkcs12_path - pki_pkcs12_password -> pki_external_pkcs12_password https://fedorahosted.org/pki/ticket/1736
* Install tools clean-up.Endi S. Dewata2016-03-301-0/+1
| | | | | | | | | | | | Some variables in pkispawn and pkidestroy have been renamed for clarity. The unused PKI_CERT_DB_PASSWORD_SLOT variable has been removed. The constant pki_self_signed_token property has been moved into default.cfg. https://fedorahosted.org/pki/ticket/2247
* Additional clean-ups for PKCS #12 utilities.Endi S. Dewata2016-03-181-2/+3
| | | | | | | | | | | | | | | | The pki_server_external_cert_path has been renamed to pki_server_external_certs_path to match the file name. A default pki_server_external_certs_path has been added to default.cfg. The pki pkcs12-export has been modified to export into existing PKCS #12 file by default. The pki-server instance-cert-export has been modified to accept a list of nicknames to export. https://fedorahosted.org/pki/ticket/1742
* Added mechanism to import system certs via PKCS #12 file.Endi S. Dewata2016-02-261-0/+3
| | | | | | | | | | | | | | | | | | | | | | The installation tool has been modified to provide an optional pki_server_pkcs12_path property to specify a PKCS #12 file containing certificate chain, system certificates, and third-party certificates needed by the subsystem being installed. If the pki_server_pkcs12_path is specified the installation tool will no longer download the certificate chain from the security domain directly, and it will no longer import the PKCS #12 containing the entire master NSS database specified in pki_clone_pkcs12_path. For backward compatibility, if the pki_server_pkcs12_path is not specified the installation tool will use the old mechanism to import the system certificates. The ConfigurationUtils.verifySystemCertificates() has been modified not to catch the exception to help troubleshooting. https://fedorahosted.org/pki/ticket/1742
* Add precheck option for pkispawn.Ade Lee2016-02-261-0/+2
| | | | | | | | | --precheck can be used to run specific tests prior to ensure that the installation parameters are sane, without actually doing the installation. There are also optional parameters to disable specific tests. Trac Ticket #2042
* Added mechanism to import existing CA certificate.Endi S. Dewata2015-11-251-3/+7
| | | | | | | | | | | The deployment procedure for external CA has been modified such that it generates the CA CSR before starting the server. This allows the same procedure to be used to import CA certificate from an existing server. It also removes the requirement to keep the server running while waiting to get the CSR signed by an external CA. https://fedorahosted.org/pki/ticket/456
* Add code to reindex data during cloning without replicationAde Lee2015-07-311-0/+1
| | | | | | | | | | | | | When setting up a clone, indexes are added before the replication agreements are set up and the consumer is initialized. Thus, as data is replicated and added to the clone db, the data is indexed. When cloning is done with the replication agreements already set up and the data replicated, the existing data is not indexed and cannot be accessed in searches. The data needs to be reindexed. Related to ticket 1414
* Add certutil options for ECCMatthew Harmsen2015-07-281-0/+1
| | | | | - PKI TRAC Ticket #1524 - pkispawn: certutil options incorrect for creating ecc admin certificate
* ticket 867 symkey library path link fixChristina Fu2015-06-181-0/+2
|
* Ticket 867 Need to support TPS as a separate tomcat instance.Christina Fu2015-06-011-2/+0
| | | | | This patch addressed the issue that TPS on independent Tomcat is missing symlink to symkey.jar and causes all symkey method reference to fail
* Fixed overwritten deployment property.Endi S. Dewata2015-05-291-1/+0
| | | | | | | The pki_pin has been removed from the default.cfg to avoid overwriting the randomly generated default value. https://fedorahosted.org/pki/ticket/1393
* Added deployment parameters to construct pki_clone_uri.Endi S. Dewata2015-05-221-1/+3
| | | | | | | | New parameters have been added into the default.cfg to specify the master hostname and port for pki_clone_uri. By default they point to the security domain. The man page has been updated as well. https://fedorahosted.org/pki/ticket/1385
* Added options for internal token and replication passwords.Endi S. Dewata2015-05-111-0/+3
| | | | | | | | The installation code has been modified such that the admin can optionally specify passwords for internal token and replication. Otherwise the code will generate random passwords like before. https://fedorahosted.org/pki/ticket/1354
* Add nuxwdog functionality to DogtagAde Lee2015-04-221-0/+3
| | | | | | | | | | | | This is the first of several commits. This adds a LifecycleListener to call init() on the nuxwdog client before any connectors or webapps start up, and call sendEndInit() once initialization completes. Code is also added to prompt for and test required passwords on startup. All that is required to use nuxwdog is to start the server using nuxwdog. An environment variable will be set that will trigger creation of the NuxwdogPasswordStore. We expect tags for the required passwords to be in cms.passwordList
* Ticket 1316 Allow adding SAN to server cert during the install processChristina Fu2015-04-211-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Usage: * under /usr/share/pki/ca/conf, you will find a new file called serverCert.profile.exampleWithSANpattern * copy existing serverCert.profile away and replace with serverCert.profile.exampleWithSANpattern * edit serverCert.profile.exampleWithSANpattern - follow the instruction right above 8.default. - save and quit * cd /usr/share/pki/ca/profiles/ca , edit caInternalAuthServerCert.cfg - follow the instruction right above policyset.serverCertSet.9 - save and quit * save away and edit the ca config file for pkispawn: (note: you can add multiple SAN's delimited by ',' for pki_san_server_cert - add the following lines, e.g. pki_san_inject=True pki_san_server_cert=host1.Example.com - do the same pkispawn cfg changes for kra or any other instances that you plan on creating * create your instance(s) check the sl sever cert, it should contain something like the following: Identifier: Subject Alternative Name - 2.5.29.17 Critical: no Value: DNSName: host1.Example.com
* Add HSM options to pkispawnMatthew Harmsen2015-04-141-0/+3
| | | | - PKI TRAC Ticket #1346 - pkispawn should have an HSM library option
* pki-tomcatd fails to start on system bootMatthew Harmsen2015-04-131-0/+1
| | | | | - PKI TRAC Ticket #1315 - pki-tomcatd fails to start on system boot - PKI TRAC Ticket #1340 - pkidestroy should not remove /var/lib/pki
* Add pkispawn config option for ldap profilesFraser Tweedale2015-04-131-0/+1
| | | | | | Add the `pki_profiles_in_ldap' pkispawn config to control whether profiles are stored on the filesystem (old behaviour) or LDAP (new behaviour). The default is file-based profiles.
* Allow use of secure LDAPS connectionMatthew Harmsen2015-03-131-0/+2
| | | | - PKI TRAC Ticket #1144 - pkispawn needs option to specify ca cert for ldap
* Updated Resteasy and Jackson dependenciesEndi S. Dewata2015-02-031-6/+0
| | | | | | | | | | In Fedora 22 the Resteasy package has been split into several subpackages. The pki-core.spec has been modified to depend on more specific Resteasy packages which depend only on Jackson 1.x. The classpaths and various scripts have been modified to remove unused references to Jackson 2.x. https://fedorahosted.org/pki/ticket/1254
* Moved web application deployment locations.Endi S. Dewata2015-01-281-2/+3
| | | | | | | | | | | | | Currently web applications are deployed into Host's appBase (i.e. <instance>/webapps). To allow better control of individual subsystem deployments, the web applications have to be moved out of the appBase so that the autoDeploy can work properly later. This patch moves the common web applications to <instance>/ common/webapps and subsystem web applications to <instance>/ <subsystem>/webapps. An upgrade script has been added to update existing deployments. https://fedorahosted.org/pki/ticket/1183
* Fix sub-CA installation with own security domainAde Lee2014-10-011-0/+2
| | | | | | | | | Installation code failed to anticipate installation of a subordinate CA that would host its own security domain. This patch includes changes to python installation code, java configuration servlet and changes to man pages. Ticket 1132
* ticket #1110 pkispawn (configuration) does not provide CA extensions in ↵Christina Fu2014-09-251-0/+5
| | | | subordinate certificate signing requests (CSR)
* Remove Apache info from pkispawn and pkidestroyMatthew Harmsen2014-09-021-32/+1
| | | | - PKI TRAC Ticket #1077 - Consider removing [Apache] section from 'default.cfg'
* Add ability to create database as subtree of existing treeAde Lee2014-07-171-0/+2
| | | | | | | | | | | | | | | | This patch adds the ability to create a subsystem that uses an existing subtree to create the internal basedn. This is useful for instance, for IPA which will use the original o=ipaca as the top level DN for a KRA, which will be situated at o=ipadrm, o=ipaca. The patch also allows such a system to be cloned, but not to setup the replication agreements, on the assumption that the data is already being replicated at the top-level DN or some higher level. The patch also contains some minor cleanups - removing unused imports and removal of an invalid reference in the python code. Ticket 1051
* TPS Token Profile Resolver Framework - part2Christina Fu2014-06-041-0/+1
|
* PhoneHome feature:Jack Magne2014-04-151-0/+1
| | | | | | 1. Provides an xml file served by TPS to allow the client(esc) to configure itself to contact TPS. 2. Edewata review fixes. Return application/xml instead of text/xml, and fix how the phone home file path is calculated.
* Share subsystem cert in shared tomcat instancesAde Lee2014-03-311-10/+13
| | | | | | | | | | In shared tomcat instances, we need to share the subsystem cert and not create a new one for each additional subsystem added to the instance. In addition, if the instances share the same database, then only one pkidbuser should be created with the relevant subsystem cert and seeAlso attribute. Ticket 893
* Upgraded RESTEasy client library.Endi S. Dewata2014-02-271-0/+1
| | | | | | | | | | The Dogtag client library has been modified to use RESTEasy 3.0 client library. A new upgrade script has been added to update existing servers. The JAXB annotation in ResourceMessage has been modified to require explicit property mapping. Ticket #554
* Replaced Jettison with Jackson.Endi S. Dewata2014-02-061-12/+20
| | | | | | | | | The Jettison library has been replaced with Jackson library as JSON provider for RESTEasy. All class paths and the deployment tools have been updated accordingly. The Python library and the TPS UI have been updated as well to use the new JSON format. Ticket #817
* Moved web application context file.Endi S. Dewata2013-12-161-3/+0
| | | | | | | | | | | | | | The location of web application context file has been changed from <instance>/webapps/<name>/META-INF/context.xml into <instance>/conf/Catalina/localhost/<name>.xml. This will eventually allow deploying the web application directly from the shared folder. A new upgrade script has been added to move the context files in the existing instances. Ticket #499
* Revert to allowing security managerAde Lee2013-11-071-1/+1
| | | | | | | Bug in tomcat for security manager has been resolved. Updated tomcat requirement accordingly. Ticket 774
* Stand-alone DRMMatthew Harmsen2013-10-251-0/+1
| | | | * TRAC Ticket #762 - Stand-alone DRM (cleanup tasks)
* Stand-alone DRMMatthew Harmsen2013-10-151-6/+50
| | | | * TRAC Ticket #667 - provide option for ca-less drm install
* Add service to generate and retrieve a shared secretAde Lee2013-09-301-0/+1
| | | | | | | | | | | | | | | | A new REST service has been added to the TKS to manage shared secrets. The shared secret is tied to the TKS-TPS connector, and is created at the end of the TPS configuration. At this point, the TPS contacts the TKS and requests that the shared secret be generated. The secret is returned to the TPS, wrapped using the subsystem certificate of the TPS. The TPS should then decrypt the shared secret and store it in its certificate database. This operations requires JSS changes, though, and so will be deferred to a later patch. For now, though, if the TPS and TKS share the same certdb, then it is sufficient to generate the shared secret. Clients and CLI are also provided. The CLI in particular is used to remove the TPSConnector entries and the shared secret when the TPS is pkidestroyed.
* Added new link for resteasy dependencyAde Lee2013-09-171-0/+2
| | | | | Resteasy 3.0.1 uses apache-commons-io. Also fixed PKIErrorInterceptor with correct method call and reformatted the interceptors.
* fixing for new tomcat systemd filesAde Lee2013-09-171-2/+2
| | | | | | | | tomcat now uses systemd unit files. We will reuse and customize those files accordingly. As a result, startup is simplified considerably - and pkidaemon has been gutted accordingly. We'll need to add migration scripts for older instances in a subsequent patch.
* Initial code to configure a TPS in tomcatAde Lee2013-08-131-0/+8
| | | | | This code allows pkispawn to configure a tps in tomcat. It does not include any config using the web UI panels.
* Added Tomcat-based TPS instance.Endi S. Dewata2013-06-101-3/+19
| | | | | | | | | The build and deployment tools have been modified to support creating a basic Tomcat instance to run TPS. New configuration and template files for TPS have been copied from another Tomcat subsystem. The TPS functionality itself will be added in future patches. Ticket #526
* Renamed CA_PORT into PKI_CA_PORT.Endi Sukma Dewata2013-06-031-0/+1
| | | | | The CA_PORT variable has been renamed into PKI_CA_PORT for consistency.
* Renamed CA_HOST into PKI_CA_HOSTNAME.Endi Sukma Dewata2013-06-031-0/+1
| | | | | The CA_HOST variable has been renamed into PKI_CA_HOSTNAME for consistency.
* Replaced ~/.pki with ~/.dogtag.Endi Sukma Dewata2013-04-271-1/+1
| | | | | The default folder for to store user files in the home directory has been changed from .pki to .dogtag.
* random certificate serial numbersAndrew Wnuk2013-04-191-0/+1
| | | | | | This patch adds support for random certificate serial numbers. Bug 912554.
* Renamed base/deploy to base/server.Endi Sukma Dewata2013-04-091-0/+531
The base/deploy folder has been renamed to base/server to match the package name. The pki.conf has been moved into pki-base package. Ticket #553, #564
generated by cgit (git 2.34.1) at 2024-06-02 11:39:19 +0000