Make the IPA server host and its services "real" IPA entries

We use kadmin.local to bootstrap the creation of the kerberos principals
for the IPA server machine: host, HTTP and ldap. This works fine and has
the side-effect of protecting the services from modification by an
admin (which would likely break the server).

Unfortunately this also means that the services can't be managed by useful
utilities such as certmonger. So we have to create them as "real" services
instead.

1 files changed, 12 insertions, 0 deletions

diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py
index c4923a751..a1dffff24 100644
--- a/ipaserver/install/certs.py
+++ b/ipaserver/install/certs.py
@@ -26,6 +26,7 @@ import urllib
 import xml.dom.minidom
 import pwd
 import fcntl
+import base64
 
 from ipapython import nsslib
 from ipapython import sysrestore
@@ -459,9 +460,20 @@ class CertDB(object):
         (out, err) = self.request_cert(subject)
         cdb.issue_server_cert(self.certreq_fname, self.certder_fname)
         self.add_cert(self.certder_fname, nickname)
+        fd = open(self.certder_fname, "r")
+        dercert = fd.read()
+        fd.close()
+
         os.unlink(self.certreq_fname)
         os.unlink(self.certder_fname)
 
+        # On the off-chance the certificate is base64-encoded
+        try:
+            dercert = base64.b64decode(dercert)
+        except:
+            pass
+        return dercert
+
     def create_signing_cert(self, nickname, hostname, other_certdb=None, subject=None):
         cdb = other_certdb
         if not cdb: