freeipa.git/install/restart_scripts, branch mindatefix

Update lightweight CA serial after renewal

2016-06-29T06:52:29+00:00

For CA replicas to pick up renewed lightweight CA signing
certificates, the authoritySerial attribute can be updated with the
new serial number.

Update the renew_ca_cert script, which is executed by Certmonger
after writing a renewed CA certificate to the NSSDB, to update the
authoritySerial attribute if the certificate belongs to a
lightweight CA.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta

restart scripts: bootstrap api with in_server=True

2016-06-21T06:30:35+00:00

renew_ca_cert fails because it cannot access the 'config' plugin.
Bootstrap all the restart scripts to avoid such issues.

Fixes: https://fedorahosted.org/freeipa/ticket/5968
Reviewed-By: Jan Cholasta

Move freeipa certmonger helpers to libexecdir.

2016-02-26T07:29:44+00:00

The scripts in this directory are simple python scripts, nothing arch-specific
in them. Having them under libexec would simplify the code a bit too, since
there would be no need to worry about lib vs lib64 (which also cause trouble
on Debian).

https://fedorahosted.org/freeipa/ticket/5586

Reviewed-By: David Kupka

cert renewal: import all external CA certs on IPA CA cert renewal

2016-01-27T13:38:10+00:00

Import all external CA certs to the Dogtag NSS database on IPA CA cert
renewal. This fixes Dogtag not being able to connect to DS which uses 3rd
party server cert after ipa-certupdate.

https://fedorahosted.org/freeipa/ticket/5595

Reviewed-By: Martin Babinsky

Remove unused imports

2015-12-23T06:59:22+00:00

This patch removes unused imports, alse pylint has been configured to
check unused imports.

Reviewed-By: Jan Cholasta

install: drop support for Dogtag 9

2015-11-25T08:12:25+00:00

Dogtag 9 CA and CA DS install and uninstall code was removed. Existing
Dogtag 9 CA and CA DS instances are disabled on upgrade.

Creating a replica of a Dogtag 9 IPA master is still supported.

https://fedorahosted.org/freeipa/ticket/5197

Reviewed-By: David Kupka

cert renewal: make renewal of ipaCert atomic

2015-11-19T12:06:12+00:00

This prevents errors when renewing other certificates during the renewal of
ipaCert.

https://fedorahosted.org/freeipa/ticket/5436

Reviewed-By: David Kupka

install: always export KRA agent PEM file

2015-10-08T11:42:58+00:00

Export the file even when KRA is not installed locally so that vault commands
work on all IPA replicas.

https://fedorahosted.org/freeipa/ticket/5302

Reviewed-By: Martin Basti

install: fix KRA agent PEM file permissions

2015-10-08T11:41:08+00:00

This fixes CVE-2015-5284.

https://fedorahosted.org/freeipa/ticket/5347

Reviewed-By: Martin Basti

cert renewal: Automatically update KRA agent PEM file

2015-08-27T13:53:42+00:00

https://fedorahosted.org/freeipa/ticket/5253

Reviewed-By: Alexander Bokovoy