summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins/cert.py
Commit message (Collapse)AuthorAgeFilesLines
* Add flag to allow a cert to be re-issuedRob Crittenden2010-02-031-3/+7
| | | | | I don't want a user to accidentally re-issue a certificate so I've added a new flag, --revoke, to revoke the old cert and load the new one.
* Fix plugin to work with new output validation, add new helpersRob Crittenden2010-01-201-34/+57
| | | | | | | | Add a new get_subject() helper and return the subject when retrieving certificates. Add a normalizer so that everything before and after the BEGIN/END block is removed.
* pass DER flag to x509.get_serial_number()John Dennis2010-01-191-1/+1
|
* Use the caIPAserviceCert profile for issuing service certs.Rob Crittenden2010-01-081-2/+2
| | | | | | | | | | | This profile enables subject validation and ensures that the subject that the CA issues is uniform. The client can only request a specific CN, the rest of the subject is fixed. This is the first step of allowing the subject to be set at installation time. Also fix 2 more issues related to the return results migration.
* Handle base64-encoded certificates better, import missing functionRob Crittenden2009-12-181-0/+5
|
* Make hosts more like real services so we can issue certs for host principalsRob Crittenden2009-12-161-9/+34
| | | | | This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
* rebase dogtag clean-up patchJohn Dennis2009-12-091-15/+21
|
* Use pyasn1-based PKCS#10 and X509v3 parsers instead of pyOpenSSL.Rob Crittenden2009-11-301-21/+69
| | | | | | | | | The pyOpenSSL PKCS#10 parser doesn't support attributes so we can't identify requests with subject alt names. Subject alt names are only allowed if: - the host for the alt name exists in IPA - if binding as host principal, the host is in the services managedBy attr
* Use File parameter for CSR in cert_request command plugin.Pavel Zuna2009-11-061-29/+12
|
* Use a new mechanism for delegating certificate issuance.Rob Crittenden2009-11-031-40/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | Using the client IP address was a rather poor mechanism for controlling who could request certificates for whom. Instead the client machine will bind using the host service principal and request the certificate. In order to do this: * the service will need to exist * the machine needs to be in the certadmin rolegroup * the host needs to be in the managedBy attribute of the service It might look something like: admin ipa host-add client.example.com --password=secret123 ipa service-add HTTP/client.example.com ipa service-add-host --hosts=client.example.com HTTP/client.example.com ipa rolegroup-add-member --hosts=client.example.com certadmin client ipa-client-install ipa-join -w secret123 kinit -kt /etc/krb5.keytab host/client.example.com ipa -d cert-request file://web.csr --principal=HTTP/client.example.com
* The name coming out of DNS will have a trailing dot (.). Remove it.Rob Crittenden2009-10-211-1/+1
|
* First pass at enforcing certificates be requested from same hostRob Crittenden2009-10-211-7/+71
| | | | | | | | | | | | We want to only allow a machine to request a certificate for itself, not for other machines. I've added a new taksgroup which will allow this. The requesting IP is resolved and compared to the subject of the CSR to determine if they are the same host. The same is done with the service principal. Subject alt names are not queried yet. This does not yet grant machines actual permission to request certificates yet, that is still limited to the taskgroup request_certs.
* Add external CA signing and abstract out the RA backendRob Crittenden2009-09-151-4/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | External CA signing is a 2-step process. You first have to run the IPA installer which will generate a CSR. You pass this CSR to your external CA and get back a cert. You then pass this cert and the CA cert and re-run the installer. The CSR is always written to /root/ipa.csr. A run would look like: # ipa-server-install --ca --external-ca -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com -U [ sign cert request ] # ipa-server-install --ca --external-ca -p password -a password --external_cert_file=/tmp/rob.crt --external_ca_file=/tmp/cacert.crt -U -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com This also abstracts out the RA backend plugin so the self-signed CA we create can be used in a running server. This means that the cert plugin can request certs (and nothing else). This should let us do online replica creation. To handle the self-signed CA the simple ca_serialno file now contains additional data so we don't have overlapping serial numbers in replicas. This isn't used yet. Currently the cert plugin will not work on self-signed replicas. One very important change for self-signed CAs is that the CA is no longer held in the DS database. It is now in the Apache database. Lots of general fixes were also made in ipaserver.install.certs including: - better handling when multiple CA certificates are in a single file - A temporary directory for request certs is not always created when the class is instantiated (you have to call setup_cert_request())
* Implement support for non-LDAP-based actions that use the LDAP ACI subsystem.Rob Crittenden2009-07-101-5/+16
| | | | | | | | | | | | There are some operations, like those for the certificate system, that don't need to write to the directory server. So instead we have an entry that we test against to determine whether the operation is allowed or not. This is done by attempting a write on the entry. If it would succeed then permission is granted. If not then denied. The write we attempt is actually invalid so the write itself will fail but the attempt will fail first if access is not permitted, so we can distinguish between the two without polluting the entry.
* Fix a few issues introduced by the new Param.use_in_context() patchRob Crittenden2009-05-211-4/+4
|
* Improve revocation_reason argumentRob Crittenden2009-05-131-1/+8
|
* Store the new certificate in a service record. Clean up some argument names ↵Rob Crittenden2009-05-071-15/+67
| | | | to match the current standard.
* Removed 'Assert False' that was mistakingly left in cert.py; small cleanup ↵Jason Gerard DeRose2009-02-171-4/+2
| | | | in cert.py and ra.py imports
* Implemented more elegant way for entire plugin module to be conditionally ↵Jason Gerard DeRose2009-02-171-73/+77
| | | | skipped; updated cert.py and ra.py modules to use this
* Added env.enable_ra variable and change cert.py and ra.py plugin modules to ↵Jason Gerard DeRose2009-02-171-71/+73
| | | | register plugins conditionally
* Continued cleanup cert/ra pluginsJason Gerard DeRose2009-02-171-1/+1
|
* Some cleanup in cert plugins module, changed to shorter command names all ↵Jason Gerard DeRose2009-02-171-27/+39
| | | | starting with cert_*
* Renamed f_ra.py plugin to cert.pyJason Gerard DeRose2009-02-171-0/+117
generated by cgit (git 2.34.1) at 2025-08-31 10:28:01 +0000