From 5a1e826c42b79906e0eb2c221efa06d7cb94cc80 Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata@redhat.com>
Date: Fri, 19 Feb 2016 08:42:30 +0100
Subject: Added mechanism to import system certs via PKCS #12 file.

The installation tool has been modified to provide an optional
pki_server_pkcs12_path property to specify a PKCS #12 file
containing certificate chain, system certificates, and third-party
certificates needed by the subsystem being installed.

If the pki_server_pkcs12_path is specified the installation tool
will no longer download the certificate chain from the security
domain directly, and it will no longer import the PKCS #12
containing the entire master NSS database specified in
pki_clone_pkcs12_path.

For backward compatibility, if the pki_server_pkcs12_path is not
specified the installation tool will use the old mechanism to
import the system certificates.

The ConfigurationUtils.verifySystemCertificates() has been modified
not to catch the exception to help troubleshooting.

https://fedorahosted.org/pki/ticket/1742
---
 base/common/python/pki/nssdb.py                       | 16 +++++++++++-----
 base/server/python/pki/server/deployment/pkiparser.py |  5 +++--
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/base/common/python/pki/nssdb.py b/base/common/python/pki/nssdb.py
index 219d824fd..3b34805b1 100644
--- a/base/common/python/pki/nssdb.py
+++ b/base/common/python/pki/nssdb.py
@@ -489,14 +489,20 @@ class NSSDatabase(object):
                 raise Exception('Missing PKCS #12 password')
 
             cmd = [
-                'pk12util',
+                'pki',
                 '-d', self.directory,
-                '-h', self.token,
-                '-k', self.password_file,
-                '-i', pkcs12_file,
-                '-w', password_file
+                '-C', self.password_file
             ]
 
+            if self.token and self.token != 'internal':
+                cmd.extend(['--token', self.token])
+
+            cmd.extend([
+                'pkcs12-import',
+                '--pkcs12', pkcs12_file,
+                '--pkcs12-password-file', password_file
+            ])
+
             subprocess.check_call(cmd)
 
         finally:
diff --git a/base/server/python/pki/server/deployment/pkiparser.py b/base/server/python/pki/server/deployment/pkiparser.py
index e5e02a09e..02af1352d 100644
--- a/base/server/python/pki/server/deployment/pkiparser.py
+++ b/base/server/python/pki/server/deployment/pkiparser.py
@@ -333,8 +333,9 @@ class PKIConfigParser:
                     'pki_client_pkcs12_password',
                     'pki_ds_password',
                     'pki_pin',
-                    'pki_replicationdb_password',
-                    'pki_security_domain_password')
+                    'pki_replication_password',
+                    'pki_security_domain_password',
+                    'pki_token_password')
 
                 print 'Loading deployment configuration from ' + \
                       config.user_deployment_cfg + '.'
-- 
cgit