summaryrefslogtreecommitdiffstats
path: root/ipaserver/plugins/ra.py
Commit message (Collapse)AuthorAgeFilesLines
* Add external CA signing and abstract out the RA backendRob Crittenden2009-09-151-343/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | External CA signing is a 2-step process. You first have to run the IPA installer which will generate a CSR. You pass this CSR to your external CA and get back a cert. You then pass this cert and the CA cert and re-run the installer. The CSR is always written to /root/ipa.csr. A run would look like: # ipa-server-install --ca --external-ca -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com -U [ sign cert request ] # ipa-server-install --ca --external-ca -p password -a password --external_cert_file=/tmp/rob.crt --external_ca_file=/tmp/cacert.crt -U -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com This also abstracts out the RA backend plugin so the self-signed CA we create can be used in a running server. This means that the cert plugin can request certs (and nothing else). This should let us do online replica creation. To handle the self-signed CA the simple ca_serialno file now contains additional data so we don't have overlapping serial numbers in replicas. This isn't used yet. Currently the cert plugin will not work on self-signed replicas. One very important change for self-signed CAs is that the CA is no longer held in the DS database. It is now in the Apache database. Lots of general fixes were also made in ipaserver.install.certs including: - better handling when multiple CA certificates are in a single file - A temporary directory for request certs is not always created when the class is instantiated (you have to call setup_cert_request())
* Use XML rather than string routines to handle response from dogtag Remove ↵Rob Crittenden2009-04-281-6/+17
| | | | trailing CR/LF from the password file
* Rename errors2.py to errors.py. Modify all affected files.Pavel Zuna2009-04-231-1/+1
|
* Convert the RA plugin to use nsslib and remove the configure methodsRob Crittenden2009-04-201-134/+39
|
* Implement an installer for the Dogtag certificate system.Rob Crittenden2009-04-031-1/+4
| | | | | | | | | | | | | | | The CA is currently not automatically installed. You have to pass in the --ca flag to install it. What works: - installation - unistallation - cert/ra plugins can issue and retrieve server certs What doesn't work: - self-signed CA is still created and issues Apache and DS certs - dogtag and python-nss not in rpm requires - requires that CS be in the "pre" install state from pkicreate
* Removed 'Assert False' that was mistakingly left in cert.py; small cleanup ↵Jason Gerard DeRose2009-02-171-4/+2
| | | | in cert.py and ra.py imports
* Implemented more elegant way for entire plugin module to be conditionally ↵Jason Gerard DeRose2009-02-171-3/+7
| | | | skipped; updated cert.py and ra.py modules to use this
* Added env.enable_ra variable and change cert.py and ra.py plugin modules to ↵Jason Gerard DeRose2009-02-171-1/+2
| | | | register plugins conditionally
* Cleaned up ra.revoke_certificate() and ra.take_certificate_off_hold(); added ↵Jason Gerard DeRose2009-02-171-142/+121
| | | | more tests in integration.py
* Some cleanup in ra.request_certificate()Jason Gerard DeRose2009-02-171-44/+41
|
* More work on ra.check_request_status() and ra.get_certificate()Jason Gerard DeRose2009-02-171-55/+83
|
* Continued cleanup cert/ra pluginsJason Gerard DeRose2009-02-171-20/+57
|
* Fixed a few problems in ra.py backend pluginJason Gerard DeRose2009-02-171-4/+2
|
* Started cleanup work on ra plugin; fixed problem in api.bootstrap() when ↵Jason Gerard DeRose2009-02-171-102/+76
| | | | process does not have permision to open log file
* Renamed b_ra.py plugin module to ra.pyJason Gerard DeRose2009-02-171-0/+408
generated by cgit (git 2.34.1) at 2025-09-03 01:03:57 +0000