freeipa.git/install/certmonger, branch AD-binds

Adopted kinit_keytab and kinit_password for kerberos auth

2015-04-20T08:27:35+00:00

Calls to ipautil.run using kinit were replaced with calls
kinit_keytab/kinit_password functions implemented in the PATCH 0015.

Reviewed-By: Jan Cholasta 
Reviewed-By: Simo Sorce 
Reviewed-By: Petr Spacek

Make certificate renewal process synchronized

2015-01-13T18:34:59+00:00

Synchronization is achieved using a global renewal lock.

https://fedorahosted.org/freeipa/ticket/4803

Reviewed-By: David Kupka

Fix CA certificate renewal syslog alert

2015-01-13T17:48:26+00:00

https://fedorahosted.org/freeipa/ticket/4820

Reviewed-By: David Kupka

Do not renew the IPA CA cert by serial number in dogtag-ipa-ca-renew-agent

2014-12-09T12:16:49+00:00

Always use the full CSR when renewing the IPA CA certificate with Dogtag. The
IPA CA certificate may be issued by an external CA, in which case renewal by
serial number does not make sense and will fail if the IPA CA was initially
installed as a subordinate of an external CA.

https://fedorahosted.org/freeipa/ticket/4784

Reviewed-By: David Kupka

Fix automatic CA cert renewal endless loop in dogtag-ipa-ca-renew-agent

2014-12-09T12:06:47+00:00

Reset profile name after requesting the CA cert from Dogtag to prevent the
automatic renewal request from being restarted in subsequent calls.

https://fedorahosted.org/freeipa/ticket/4765

Reviewed-By: David Kupka

Fix wrong expiration date on renewed IPA CA certificates

2014-11-19T14:25:26+00:00

The expiration date was always set to the expiration date of the original
certificate.

https://fedorahosted.org/freeipa/ticket/4717

Reviewed-By: David Kupka

Fail if certmonger can't see new CA certificate in LDAP in ipa-cacert-manage

2014-11-05T14:26:42+00:00

This should not normally happen, but if it does, report an error instead of
waiting idefinitely for the certificate to appear.

https://fedorahosted.org/freeipa/ticket/4629

Reviewed-By: David Kupka

Do not wait for new CA certificate to appear in LDAP in ipa-certupdate

2014-10-30T09:51:36+00:00

If new certificate is not available, reuse the old one, instead of waiting
indefinitely for the new certificate to appear.

https://fedorahosted.org/freeipa/ticket/4628

Reviewed-By: David Kupka

Handle profile changes in dogtag-ipa-ca-renew-agent

2014-10-29T14:06:05+00:00

To update the CA certificate in the Dogtag NSS database, the
"ipa-cacert-manage renew" and "ipa-certupdate" commands temporarily change
the profile of the CA certificate certmonger request, resubmit it and
change the profile back to the original one.

When something goes wrong while resubmitting the request, it needs to be
modified and resubmitted again manually. This might fail with invalid
cookie error, because changing the profile does not change the internal
state of the request.

Detect this in dogtag-ipa-ca-renew-agent and reset the internal state when
profile is changed.

https://fedorahosted.org/freeipa/ticket/4627

Reviewed-By: David Kupka

Check that renewed certificates coming from LDAP are actually renewed.

2014-07-30T14:04:21+00:00

Reviewed-By: Rob Crittenden