diff options
| author | Jan Cholasta <jcholast@redhat.com> | 2013-10-16 08:40:31 +0000 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-03-25 16:54:55 +0100 |
| commit | 6a19738a4560ffbfe5a70699d787c4a44a9518c5 (patch) | |
| tree | 0dedb215bd13f7f17a63a6166f18e31a60334e0c /ipaserver | |
| parent | a356c3806b4e98207fa7d729ad921aded0a34c62 (diff) | |
| download | freeipa-6a19738a4560ffbfe5a70699d787c4a44a9518c5.tar.gz freeipa-6a19738a4560ffbfe5a70699d787c4a44a9518c5.tar.xz freeipa-6a19738a4560ffbfe5a70699d787c4a44a9518c5.zip | |
Use dogtag-ipa-ca-renew-agent to track certificates on master CA.
Before, dogtag-ipa-renew-agent was used to track the certificates and the
certificates were stored to LDAP in renew_ca_cert and renew_ra_cert. Since
dogtag-ipa-ca-renew-agent can store the certificates itself, the storage code
was removed from renew_ca_cert and renew_ra_cert.
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Diffstat (limited to 'ipaserver')
| -rw-r--r-- | ipaserver/install/cainstance.py | 37 |
1 files changed, 23 insertions, 14 deletions
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index 3458b312d..227cea00e 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -470,9 +470,10 @@ class CAInstance(service.Service): self.step("requesting RA certificate from CA", self.__request_ra_certificate) self.step("issuing RA agent certificate", self.__issue_ra_cert) self.step("adding RA agent as a trusted user", self.__configure_ra) + self.step("configure certmonger for renewals", self.configure_certmonger_renewal) + if not self.clone: self.step("configure certificate renewals", self.configure_renewal) else: - self.step("configure certmonger for renewals", self.configure_certmonger_renewal) self.step("configure clone certificate renewals", self.configure_clone_renewal) self.step("configure Server-Cert certificate renewal", self.track_servercert) self.step("Configure HTTP to proxy connections", self.__http_proxy) @@ -1428,11 +1429,6 @@ class CAInstance(service.Service): "certmonger failed to start tracking certificate: %s" % str(e)) def configure_renewal(self): - cmonger = ipaservices.knownservices.certmonger - cmonger.enable() - ipaservices.knownservices.messagebus.start() - cmonger.start() - pin = self.__get_ca_pin() # Server-Cert cert-pki-ca is renewed per-server @@ -1441,28 +1437,41 @@ class CAInstance(service.Service): 'subsystemCert cert-pki-ca']: try: certmonger.dogtag_start_tracking( - 'dogtag-ipa-renew-agent', nickname, pin, None, - self.dogtag_constants.ALIAS_DIR, 'stop_pkicad', 'renew_ca_cert "%s"' % nickname) + ca='dogtag-ipa-ca-renew-agent', + nickname=nickname, + pin=pin, + pinfile=None, + secdir=self.dogtag_constants.ALIAS_DIR, + pre_command='stop_pkicad', + post_command='renew_ca_cert "%s"' % nickname) except (ipautil.CalledProcessError, RuntimeError), e: root_logger.error( - "certmonger failed to start tracking certificate: %s" % str(e)) + "certmonger failed to start tracking certificate: " + "%s" % e) # Set up the agent cert for renewal try: - certmonger.dogtag_start_tracking('dogtag-ipa-renew-agent', 'ipaCert', None, '/etc/httpd/alias/pwdfile.txt', '/etc/httpd/alias', None, 'renew_ra_cert') + certmonger.dogtag_start_tracking( + ca='dogtag-ipa-ca-renew-agent', + nickname='ipaCert', + pin=None, + pinfile='/etc/httpd/alias/pwdfile.txt', + secdir='/etc/httpd/alias', + pre_command=None, + post_command='renew_ra_cert') except (ipautil.CalledProcessError, RuntimeError), e: - root_logger.error( - "certmonger failed to start tracking certificate: %s" % str(e)) + root_logger.error( + "certmonger failed to start tracking certificate: %s" % e) def configure_certmonger_renewal(self): """ Create a new CA type for certmonger that will retrieve updated certificates from the dogtag master server. """ + ipaservices.knownservices.messagebus.start() cmonger = ipaservices.knownservices.certmonger cmonger.enable() - ipaservices.knownservices.messagebus.start() - cmonger.restart() + cmonger.start() bus = dbus.SystemBus() obj = bus.get_object('org.fedorahosted.certmonger', |