diff options
| -rwxr-xr-x | install/certmonger/dogtag-ipa-ca-renew-agent-submit | 12 | ||||
| -rw-r--r-- | ipalib/install/certmonger.py | 5 |
2 files changed, 16 insertions, 1 deletions
diff --git a/install/certmonger/dogtag-ipa-ca-renew-agent-submit b/install/certmonger/dogtag-ipa-ca-renew-agent-submit index 750893dac..2e67c7e5a 100755 --- a/install/certmonger/dogtag-ipa-ca-renew-agent-submit +++ b/install/certmonger/dogtag-ipa-ca-renew-agent-submit @@ -35,6 +35,9 @@ import base64 import contextlib import json +from cryptography import x509 as crypto_x509 +from cryptography.hazmat.backends import default_backend + import six from ipapython import ipautil @@ -64,8 +67,15 @@ if six.PY3: IPA_CA_NICKNAME = 'caSigningCert cert-pki-ca' + def get_nickname(): - subject = os.environ.get('CERTMONGER_REQ_SUBJECT') + # we need to get the subject from a CSR in case we are requesting + # an OpenSSL certificate for which we have to reverse the order of its DN + # components thus changing the CERTMONGER_REQ_SUBJECT + # https://pagure.io/certmonger/issue/62 + csr = os.environ.get('CERTMONGER_CSR') + csr_obj = crypto_x509.load_pem_x509_csr(csr, default_backend()) + subject = csr_obj.subject if not subject: return None diff --git a/ipalib/install/certmonger.py b/ipalib/install/certmonger.py index 951ca9ab8..812fa0455 100644 --- a/ipalib/install/certmonger.py +++ b/ipalib/install/certmonger.py @@ -32,6 +32,7 @@ import subprocess import tempfile from ipalib import api from ipapython.ipa_log_manager import root_logger +from ipapython.dn import DN from ipaplatform.paths import paths from ipaplatform import services @@ -329,6 +330,10 @@ def request_cert( """ if storage == 'FILE': certfile, keyfile = certpath + # This is a workaround for certmonger having different Subject + # representation with NSS and OpenSSL + # https://pagure.io/certmonger/issue/62 + subject = str(DN(*reversed(DN(subject)))) else: certfile = certpath keyfile = certpath |