1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
// --- BEGIN COPYRIGHT BLOCK ---
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation; version 2 of the License.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License along
// with this program; if not, write to the Free Software Foundation, Inc.,
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
//
// (C) 2014 Red Hat, Inc.
// All rights reserved.
// --- END COPYRIGHT BLOCK ---
package org.dogtagpki.server.ocsp.rest;
import org.dogtagpki.server.rest.SystemConfigService;
import com.netscape.certsrv.apps.CMS;
import com.netscape.certsrv.base.EBaseException;
import com.netscape.certsrv.base.PKIException;
import com.netscape.certsrv.ocsp.IOCSPAuthority;
import com.netscape.certsrv.system.ConfigurationRequest;
import com.netscape.certsrv.system.ConfigurationResponse;
import com.netscape.cms.servlet.csadmin.ConfigurationUtils;
/**
* @author alee
*
*/
public class OCSPInstallerService extends SystemConfigService {
private static final int DEF_REFRESH_IN_SECS_FOR_CLONE = 14400; // CRL Publishing schedule
public OCSPInstallerService() throws EBaseException {
}
@Override
public void finalizeConfiguration(ConfigurationRequest request, ConfigurationResponse response) {
try {
String ca_host = cs.getString("preop.ca.hostname", "");
// import the CA certificate into the OCSP
// configure the CRL Publishing to OCSP in CA
if (!ca_host.equals("")) {
CMS.reinit(IOCSPAuthority.ID);
if (!request.isClone())
ConfigurationUtils.importCACertToOCSP();
else
CMS.debug("OCSPInstallerService: Skipping importCACertToOCSP for clone.");
if (!request.getStandAlone()) {
// For now don't register publishing with the CA for a clone.
// Preserves existing functionality
// Next we need to treat the publishing of clones as a group ,
// and fail over amongst them.
if (!request.isClone())
ConfigurationUtils.updateOCSPConfig();
ConfigurationUtils.setupClientAuthUser();
}
}
if (request.isClone()) {
configureCloneRefresh(request);
}
} catch (Exception e) {
CMS.debug(e);
throw new PKIException("Errors in configuring CA publishing to OCSP: " + e);
}
super.finalizeConfiguration(request, response);
}
private void configureCloneRefresh(ConfigurationRequest request) {
if (request == null || !request.isClone())
return;
//Set well know default value for OCSP clone
cs.putInteger("ocsp.store.defStore.refreshInSec", DEF_REFRESH_IN_SECS_FOR_CLONE);
}
}
|
