From 1d58b883ff9d0056d89d74d30f1375ab12d01f03 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Fri, 19 Feb 2016 08:42:30 +0100 Subject: Added mechanism to import system certs via PKCS #12 file. The installation tool has been modified to provide an optional pki_server_pkcs12_path property to specify a PKCS #12 file containing certificate chain, system certificates, and third-party certificates needed by the subsystem being installed. If the pki_server_pkcs12_path is specified the installation tool will no longer download the certificate chain from the security domain directly, and it will no longer import the PKCS #12 containing the entire master NSS database specified in pki_clone_pkcs12_path. For backward compatibility, if the pki_server_pkcs12_path is not specified the installation tool will use the old mechanism to import the system certificates. The ConfigurationUtils.verifySystemCertificates() has been modified not to catch the exception to help troubleshooting. https://fedorahosted.org/pki/ticket/1742 --- base/common/python/pki/nssdb.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) (limited to 'base/common/python') diff --git a/base/common/python/pki/nssdb.py b/base/common/python/pki/nssdb.py index a418cdc00..e290727ba 100644 --- a/base/common/python/pki/nssdb.py +++ b/base/common/python/pki/nssdb.py @@ -471,14 +471,20 @@ class NSSDatabase(object): raise Exception('Missing PKCS #12 password') cmd = [ - 'pk12util', + 'pki', '-d', self.directory, - '-h', self.token, - '-k', self.password_file, - '-i', pkcs12_file, - '-w', password_file + '-C', self.password_file ] + if self.token and self.token != 'internal': + cmd.extend(['--token', self.token]) + + cmd.extend([ + 'pkcs12-import', + '--pkcs12', pkcs12_file, + '--pkcs12-password-file', password_file + ]) + subprocess.check_call(cmd) finally: -- cgit