From cb9eb967b5e24f5fde8bbf8ae87aa615b7033db7 Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Fri, 13 May 2016 09:00:44 +1000 Subject: Lightweight CAs: add method to renew certificate Add the CertificateAuthority.renewAuthority() method that creates and processes a renewal request for the lightweight CA's signing cert. The new certificate replaces the old certificate in the NSSDB and the serial number is stored in the 'authoritySerial' attribute. Clones observe when the 'authoritySerial' attribute has changed and update the certificate in their NSSDB, too. The renewal behaviour is available in the REST API as a POST to /ca/rest/authorities//renew. Fixes: https://fedorahosted.org/pki/ticket/2327 --- .../src/com/netscape/certsrv/authority/AuthorityResource.java | 7 +++++++ base/common/src/com/netscape/certsrv/ca/ICertificateAuthority.java | 6 ++++++ 2 files changed, 13 insertions(+) (limited to 'base/common/src/com') diff --git a/base/common/src/com/netscape/certsrv/authority/AuthorityResource.java b/base/common/src/com/netscape/certsrv/authority/AuthorityResource.java index c6dc69624..0f8b70ade 100644 --- a/base/common/src/com/netscape/certsrv/authority/AuthorityResource.java +++ b/base/common/src/com/netscape/certsrv/authority/AuthorityResource.java @@ -94,6 +94,13 @@ public interface AuthorityResource { @ACLMapping("authorities.modify") public Response disableCA(@PathParam("id") String caIDString); + @POST + @Path("{id}/renew") + @ClientResponseType(entityType=AuthorityData.class) + @AuthMethodMapping("authorities") + @ACLMapping("authorities.modify") + public Response renewCA(@PathParam("id") String caIDString); + @DELETE @Path("{id}") @ClientResponseType(entityType=Void.class) diff --git a/base/common/src/com/netscape/certsrv/ca/ICertificateAuthority.java b/base/common/src/com/netscape/certsrv/ca/ICertificateAuthority.java index dd0d1b085..308bfba12 100644 --- a/base/common/src/com/netscape/certsrv/ca/ICertificateAuthority.java +++ b/base/common/src/com/netscape/certsrv/ca/ICertificateAuthority.java @@ -597,6 +597,12 @@ public interface ICertificateAuthority extends ISubsystem { public void modifyAuthority(Boolean enabled, String desc) throws EBaseException; + /** + * Renew certificate of CA. + */ + public void renewAuthority(HttpServletRequest httpReq) + throws EBaseException; + /** * Delete this lightweight CA. */ -- cgit