diff options
| author | David Kupka <dkupka@redhat.com> | 2014-10-14 03:40:43 -0400 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-10-14 10:55:29 +0200 |
| commit | 2e7f8da23810babf9d0e7312c495e86535593a83 (patch) | |
| tree | 71290facc14270fd6588620ee40e9406ea82c3d6 | |
| parent | b89c184ad5522d26282801495cffd50a1dcbc2c0 (diff) | |
| download | freeipa-2e7f8da23810babf9d0e7312c495e86535593a83.tar.gz freeipa-2e7f8da23810babf9d0e7312c495e86535593a83.tar.xz freeipa-2e7f8da23810babf9d0e7312c495e86535593a83.zip | |
Set IPA CA for freeipa certificates.
In previous versions (before moving certmonger.py to DBus) it was set and some
tools and modules depends on it. For example: ipa-getcert uses this to filter
freeipa certificates.
https://fedorahosted.org/freeipa/ticket/4618
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
| -rw-r--r-- | ipapython/certmonger.py | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ipapython/certmonger.py b/ipapython/certmonger.py index b46d65b2f..84f04a62e 100644 --- a/ipapython/certmonger.py +++ b/ipapython/certmonger.py @@ -279,7 +279,7 @@ def start_tracking(nickname, secdir, password_file=None, command=None): certmonger to run when it renews a certificate. This command must reside in /usr/lib/ipa/certmonger to work with SELinux. - Returns True or False + Returns certificate nickname. """ cm = _connect_to_certmonger() params = {'TRACK': True} @@ -289,6 +289,10 @@ def start_tracking(nickname, secdir, password_file=None, command=None): params['key-nickname'] = nickname params['key-database'] = os.path.abspath(secdir) params['key-storage'] = 'NSSDB' + ca_path = cm.obj_if.find_ca_by_nickname('IPA') + if not ca_path: + raise RuntimeError('IPA CA not found') + params['ca'] = ca_path if command: params['cert-postsave-command'] = command if password_file: |