freeipa.git/install/restart_scripts/stop_pkicad, branch AD-binds

Make certificate renewal process synchronized

2015-01-13T18:34:59+00:00

Synchronization is achieved using a global renewal lock.

https://fedorahosted.org/freeipa/ticket/4803

Reviewed-By: David Kupka

ipaplatform: Remove redundant imports of ipaservices

2014-06-16T17:48:20+00:00

Also fixes few incorrect imports.

https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin

ipaplatform: Change service code in freeipa to use ipaplatform services

2014-06-16T17:48:19+00:00

https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin

Log unhandled exceptions in certificate renewal scripts.

2014-03-10T17:41:10+00:00

https://fedorahosted.org/freeipa/ticket/4093

Reviewed-By: Petr Viktorin

Revert restart scripts file permissions change

2014-01-08T08:54:53+00:00

Previous commit accidentally added executable permission to
restart_pkicad and stop_pkicad.

PKI service restart after CA renewal failed

2014-01-08T08:47:23+00:00

Fix both the service restart procedure and registration of old
pki-cad well known service name.

This patch was adapted from original patch of Jan Cholasta 178 to
fix ticket 4092.

https://fedorahosted.org/freeipa/ticket/4092

Use /usr/bin/python2

2014-01-03T08:46:05+00:00

Part of the effort to port FreeIPA to Arch Linux,
where Python 3 is the default.

FreeIPA hasn't been ported to Python 3, so the code must be modified to
run /usr/bin/python2

https://fedorahosted.org/freeipa/ticket/3438

Updated by pviktori@redhat.com

Do actually stop pki_cad in stop_pkicad instead of starting it.

2013-04-09T14:22:23+00:00

https://fedorahosted.org/freeipa/ticket/3554

Use new certmonger locking to prevent NSS database corruption.

2013-01-29T16:16:38+00:00

dogtag opens its NSS database in read/write mode so we need to be very
careful during renewal that we don't also open it up read/write. We
basically need to serialize access to the database. certmonger does the
majority of this work via internal locking from the point where it generates
a new key/submits a rewewal through the pre_save and releases the lock after
the post_save command. This lock is held per NSS database so we're save
from certmonger. dogtag needs to be shutdown in the pre_save state so
certmonger can safely add the certificate and we can manipulate trust
in the post_save command.

Fix a number of bugs in renewal. The CA wasn't actually being restarted
at all due to a naming change upstream. In python we need to reference
services using python-ish names but the service is pki-cad. We need a
translation for non-Fedora systems as well.

Update the CA ou=People entry when he CA subsystem certificate is
renewed. This certificate is used as an identity certificate to bind
to the DS instance.

https://fedorahosted.org/freeipa/ticket/3292
https://fedorahosted.org/freeipa/ticket/3322