Make certificate renewal process synchronized

Synchronization is achieved using a global renewal lock.

https://fedorahosted.org/freeipa/ticket/4803

Reviewed-By: David Kupka <dkupka@redhat.com>

5 files changed, 40 insertions, 5 deletions

diff --git a/install/restart_scripts/renew_ca_cert b/install/restart_scripts/renew_ca_cert
index a205b0e36..c7bd5d74c 100644
--- a/install/restart_scripts/renew_ca_cert
+++ b/install/restart_scripts/renew_ca_cert
@@ -35,7 +35,7 @@ from ipaplatform import services
 from ipaplatform.paths import paths
 
 
-def main():
+def _main():
     nickname = sys.argv[1]
 
     api.bootstrap(context='restart')
@@ -210,6 +210,14 @@ def main():
         syslog.syslog(
             syslog.LOG_NOTICE, "Started %s" % dogtag_service.service_name)
 
+
+def main():
+    try:
+        _main()
+    finally:
+        certs.renewal_lock.release('renew_ca_cert')
+
+
 try:
     main()
 except Exception:
diff --git a/install/restart_scripts/renew_ra_cert b/install/restart_scripts/renew_ra_cert
index 6d4b81a53..7dae35623 100644
--- a/install/restart_scripts/renew_ra_cert
+++ b/install/restart_scripts/renew_ra_cert
@@ -32,9 +32,10 @@ from ipaserver.install import certs, cainstance
 from ipaplatform import services
 from ipaplatform.paths import paths
 
-nickname = 'ipaCert'
 
-def main():
+def _main():
+    nickname = 'ipaCert'
+
     api.bootstrap(context='restart')
     api.finalize()
 
@@ -68,6 +69,12 @@ def main():
     else:
         syslog.syslog(syslog.LOG_NOTICE, "Restarted httpd")
 
+
+def main():
+    with certs.renewal_lock:
+        _main()
+
+
 try:
     main()
 except Exception:
diff --git a/install/restart_scripts/restart_dirsrv b/install/restart_scripts/restart_dirsrv
index 837378191..723644215 100644
--- a/install/restart_scripts/restart_dirsrv
+++ b/install/restart_scripts/restart_dirsrv
@@ -24,8 +24,10 @@ import syslog
 import traceback
 from ipalib import api
 from ipaplatform import services
+from ipaserver.install import certs
 
-def main():
+
+def _main():
     try:
         instance = sys.argv[1]
     except IndexError:
@@ -41,6 +43,12 @@ def main():
     except Exception, e:
         syslog.syslog(syslog.LOG_ERR, "Cannot restart dirsrv (instance: '%s'): %s" % (instance, str(e)))
 
+
+def main():
+    with certs.renewal_lock:
+        _main()
+
+
 try:
     main()
 except Exception:
diff --git a/install/restart_scripts/restart_httpd b/install/restart_scripts/restart_httpd
index e3ef73c4f..f060a3091 100644
--- a/install/restart_scripts/restart_httpd
+++ b/install/restart_scripts/restart_httpd
@@ -22,8 +22,10 @@
 import syslog
 import traceback
 from ipaplatform import services
+from ipaserver.install import certs
 
-def main():
+
+def _main():
     syslog.syslog(syslog.LOG_NOTICE, 'certmonger restarted httpd')
 
     try:
@@ -31,6 +33,12 @@ def main():
     except Exception, e:
         syslog.syslog(syslog.LOG_ERR, "Cannot restart httpd: %s" % str(e))
 
+
+def main():
+    with certs.renewal_lock:
+        _main()
+
+
 try:
     main()
 except Exception:
diff --git a/install/restart_scripts/stop_pkicad b/install/restart_scripts/stop_pkicad
index b8866f16e..871e5e761 100644
--- a/install/restart_scripts/stop_pkicad
+++ b/install/restart_scripts/stop_pkicad
@@ -25,6 +25,8 @@ import traceback
 from ipapython import dogtag
 from ipalib import api
 from ipaplatform import services
+from ipaserver.install import certs
+
 
 def main():
     api.bootstrap(context='restart')
@@ -34,6 +36,8 @@ def main():
     dogtag_service = services.knownservices[configured_constants.SERVICE_NAME]
     dogtag_instance = configured_constants.PKI_INSTANCE_NAME
 
+    certs.renewal_lock.acquire('renew_ca_cert')
+
     syslog.syslog(syslog.LOG_NOTICE, "Stopping %s" % dogtag_service.service_name)
     try:
         dogtag_service.stop(dogtag_instance)