summaryrefslogtreecommitdiffstats
path: root/ipapython/certdb.py
Commit message (Collapse)AuthorAgeFilesLines
* upgrade: remove ipaCert and key from /etc/httpd/aliasFlorence Blanc-Renaud2019-07-151-0/+26
| | | | | | | | | | | | | With ipa 4.5+, the RA cert is stored in files in /var/lib/ipa/ra-agent.{key|pem}. The upgrade code handles the move from /etc/httpd/alias to the files but does not remove the private key from /etc/httpd/alias. The fix calls certutil -F -n ipaCert to remove cert and key, instead of -D -n ipaCert which removes only the cert. Fixes: https://pagure.io/freeipa/issue/7329 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* NSSDatabase: fix get_trust_chainFlorence Blanc-Renaud2019-05-241-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the get_trust_chain method, use certutil -O with the option --simple-self-signed to make sure that self-signed certs properly get processed. Note: this option has been introduced in nss 3.38 and our spec file already requires nss >= 3.41. Scenario: when IPA CA is switched from self-signed to externally-signed, then back to self-signed, the same nickname can be used in /etc/pki/pki-tomcat/alias for the initial cert and the renewed certs. If the original and renewed certs are present in the NSS db, running $ certutil -O -n <IPA CA alias> produces a complex output like the following (this command is used to find the trust chain): "CN=Cert Auth,O=ExtAuth" [CN=Cert Auth,O=ExtAuth] "caSigningCert cert-pki-ca" [CN=Certificate Authority,O=DOMAIN.COM] "caSigningCert cert-pki-ca" [CN=Certificate Authority,O=DOMAIN.COM] The renewal code is disturbed by this output. If, on the contrary, certutil -O --simple-self-signed -n <IPA CA alias> is used to extract the trust chain, the output is as expected for a self-signed cert: "caSigningCert cert-pki-ca" [CN=Certificate Authority,O=DOMAIN.COM] As a result, the scenario self-signed > externally signed > self-signed works. Fixes: https://pagure.io/freeipa/issue/7926 Reviewed-By: Oleg Kozlov <okozlov@redhat.com>
* Use AES-128-CBC for PKCS#12 encryption when creating files (FIPS)Rob Crittenden2019-05-141-0/+2
| | | | | | | | | | | | | | | | | A PKCS#12 file is generated from a set of input files in various formats. This file is then used to provide the public and private keys and certificate chain fro importing into an NSS database. In order to work in FIPS mode stronger encryption is required. The default OpenSSL certificate algo is 40-bit RC2 which is not allowed in FIPS mode. The default private key algo is 3DES. Use AES-128 instead for both. Fixes: https://pagure.io/freeipa/issue/7948 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Verify external CA's basic constraint pathlenChristian Heimes2019-04-041-1/+13
| | | | | | | | | | IPA no verifies that intermediate certs of external CAs have a basic constraint path len of at least 1 and increasing. Fixes: https://pagure.io/freeipa/issue/7877 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pylint 2.2: Fix unnecessary pass statementChristian Heimes2018-11-261-3/+0
| | | | | | | | | | pylint 2.2.0 has a new checker for unnecessary pass statements. There is no need to have a pass statement in functions or classes with a doc string. Fixes: https://pagure.io/freeipa/issue/7772 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* certdb: validate server cert signatureChristian Heimes2018-11-141-2/+9
| | | | | | | | | | | PR https://github.com/freeipa/freeipa/pull/2554 added the '-e' option for CA cert validation. Let's also verify signature, key size, and signing algorithm of server certs. With the '-e' option, the installer and other tools will catch weak certs early. Fixes: pagure.io/freeipa/issue/7761 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* certdb: validate certificate signaturesFraser Tweedale2018-11-131-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | When verifying a CA certificate, validate its signature. This causes FreeIPA to reject certificate chains with bad signatures, signatures using unacceptable algorithms, or certificates with unacceptable key sizes. The '-e' option to 'certutil -V' was the missing ingredient. An an example of a problem prevented by this change, a certifiate signed by a 1024-bit intermediate CA, would previously have been imported by ipa-cacert-manage, but would cause Dogtag startup failure due to failing self-test. With this change, ipa-cacert-manage will reject the certificate: # ipa-cacert-manage renew --external-cert-file /tmp/ipa.p7 Importing the renewed CA certificate, please wait CA certificate CN=Certificate Authority,O=IPA.LOCAL 201809261455 in /tmp/ipa.p7 is not valid: certutil: certificate is invalid: The certificate was signed using a signature algorithm that is disabled because it is not secure. Fixes: https://pagure.io/freeipa/issue/7761 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certdb: ensure non-empty Subject Key IdentifierFraser Tweedale2018-11-121-1/+4
| | | | | | | | | | | | | | Installation or IPA CA renewal with externally-signed CA accepts an IPA CA certificate with empty Subject Key Identifier. This is technically legal in X.509, but is an operational issue. Furthermore, due to an extant bug in Dogtag (https://pagure.io/dogtagpki/issue/3079) it will cause Dogtag startup failure. Reject CA certificates with empty Subject Key Identifier. Fixes: https://pagure.io/freeipa/issue/7762 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* certdb: provide meaningful err msg for wrong PINFlorence Blanc-Renaud2018-10-091-7/+34
| | | | | | | | | | | | ipa-server-install or ipa-replica-install do not provide a meaningful error message in CA-less mode when the install fails because of a wrong PIN. Update the err msg so that it provides a hint to the user. Fixes https://pagure.io/freeipa/issue/5378 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Py3: Remove subclassing from objectChristian Heimes2018-09-271-1/+1
| | | | | | | | | Python 2 had old style and new style classes. Python 3 has only new style classes. There is no point to subclass from object any more. See: https://pagure.io/freeipa/issue/7715 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Add docstring to verify_kdc_cert_validityAlexander Scheel2018-08-201-0/+5
| | | | | Signed-off-by: Alexander Scheel <ascheel@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Replace file.flush() calls with flush_sync() helperArmando Neto2018-07-071-0/+2
| | | | | | | | | | | | | | | | | Calls to `os.fsync(f.fileno())` need to be accompained by `f.flush()`. Commit 8bbeedc93fd442cbbb9bb70e5f446011e95211db introduces the helper `ipapython.ipautil.flush_sync()`, which handles all calls in the right order. However, `flush_sync()` takes as parameter a file object with fileno and name, where name must be a path to the file, this isn't possible in some cases where file descriptors are used. Issue: https://pagure.io/freeipa/issue/7251 Signed-off-by: Armando Neto <abiagion@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Extend Sub CA replication testChristian Heimes2018-07-041-6/+21
| | | | | | | | | | | | Test more scenarios like replication replica -> master. Verify that master and replica have all expected certs with correct trust flags and all keys. See: https://pagure.io/freeipa/issue/7590 See: https://pagure.io/freeipa/issue/7589 Fixes: https://pagure.io/freeipa/issue/7611 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Revert run_pk12util part of 807a5cbe7cc52690336c5095ec6aeeb0a4e8483cRob Crittenden2018-04-201-1/+1
| | | | | | | | | | | Only certutil creates files in the local directory. Changing the directory for pk12util breaks ipa-server-certinstall if the PKCS#12 file is not passed in as an absolute path. https://pagure.io/freeipa/issue/7489 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexey Slaykovsky <alexey@slaykovsky.com>
* certdb: Move chdir into subprocess callChristian Heimes2018-04-101-5/+8
| | | | | | | | | | According to a comment, certutil may create files in the current working directory. Rather than changing the cwd of the current process, FreeIPA's certutil wrapper now changes cwd for the subprocess only. See: https://pagure.io/freeipa/issue/7416 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Remove unused modutils wrappers from NSS/CertDBChristian Heimes2018-02-231-9/+0
| | | | | | | The disable system trust feature is no longer used. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* NSS: Force restore of SELinux contextChristian Heimes2018-02-231-7/+7
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* NSSDB: Let certutil decide its default db typeChristian Heimes2018-02-231-23/+51
| | | | | | | | | CertDB no longer makes any assumptions about the default db type of a NSS DB. Instead it let's certutil decide when dbtype is set to 'auto'. This makes it much easier to support F27 and F28 from a single code base. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Prepare migration of mod_nss NSSDB to sql formatChristian Heimes2018-02-231-11/+37
| | | | | | | | | | | | | | | | | | - Refactor CertDB to look up values from its NSSDatabase. - Add run_modutil() helpers to support sql format. modutil does not auto-detect the NSSDB format. - Add migration helpers to CertDB. - Add explicit DB format to NSSCertificateDatabase stanza - Restore SELinux context when migrating NSSDB. - Add some debugging and sanity checks to httpinstance. The actual database format is still dbm. Certmonger on Fedora 27 does neither auto-detect DB format nor support SQL out of the box. https://pagure.io/freeipa/issue/7354 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* LGTM: Remove redundant assignmentChristian Heimes2018-01-091-2/+0
| | | | | | | https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Use pylint 1.7.5 with fix for bad python3 importChristian Heimes2017-12-191-1/+1
| | | | | | Closes: https://pagure.io/freeipa/issue/7315 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Cech <pcech@redhat.com>
* NSSDB: use preferred convert commandChristian Heimes2017-12-071-8/+12
| | | | | | | | | | | | After further testing, Kai Engert proposed to use -N with -f -@ to convert a NSSDB from DBM to SQL format. https://fedoraproject.org/wiki/Changes/NSSDefaultFileFormatSql#Upgrade.2Fcompatibility_impact https://pagure.io/freeipa/issue/7049 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix ca less IPA install on fips modeFlorence Blanc-Renaud2017-11-271-0/+4
| | | | | | | | | | | | | | | | | When ipa-server-install is run in fips mode and ca-less, the installer fails when the keys are provided with --{http|dirsrv|pkinit}-cert-file in a separate key file. The installer transforms the key into PKCS#8 format using openssl pkcs8 -topk8 but this command fails on a fips-enabled server, unless the options -v2 aes256 -v2prf hmacWithSHA256 are also provided. Fixes: https://pagure.io/freeipa/issue/7280 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Run tox tests for PyPI packages on TravisChristian Heimes2017-11-201-1/+1
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Support sqlite NSSDBChristian Heimes2017-11-161-21/+136
| | | | | | | | | | | Prepare CertDB and NSSDatabase to support sqlite DB format. NSSDatabase will automatically detect and use either old DBM or new SQL format. Old databases are not migrated yet. https://pagure.io/freeipa/issue/7049 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use namespace-aware meta importer for ipaplatformChristian Heimes2017-11-151-19/+9
| | | | | | | | | | | | | | | | Instead of symlinks and build-time configuration the ipaplatform module is now able to auto-detect platforms on import time. The meta importer uses the platform 'ID' from /etc/os-releases. It falls back to 'ID_LIKE' on platforms like CentOS, which has ID=centos and ID_LIKE="rhel fedora". The meta importer is able to handle namespace packages and the ipaplatform package has been turned into a namespace package in order to support external platform specifications. https://fedorahosted.org/freeipa/ticket/6474 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix cert file creation during CA-less installationStanislav Laznicka2017-08-251-1/+2
| | | | | | | | | | | | When writing extracted certs and keys to the file, we opened the same file at a different spot but the original file position indicator would not be moved when the certificate is written there. The result is that the certificate gets rewritten by the private key. This commit fixes it. Fixes: https://pagure.io/freeipa/issue/7118 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Fix incorrect 'with' statement in CA-less installationFraser Tweedale2017-08-251-2/+2
| | | | | | | Part of: https://pagure.io/freeipa/issue/7118 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* x509,certdb: handle certificates as bytesStanislav Laznicka2017-07-271-12/+22
| | | | | | | | | | | Certificates, both in PEM and DER format, should be handled as bytes in Python 3. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* x509: Make certificates represented as objectsStanislav Laznicka2017-07-271-61/+45
| | | | | | | | https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Split x509.load_certificate() into PEM/DER functionsStanislav Laznicka2017-07-271-6/+6
| | | | | | | | | | | | | Splitting the load_certificate() function into two separate helps us word the requirements for the input explicitly. It also makes our backend similar to the one of python-cryptography so eventually we can swap python-cryptography for IPA x509 module. https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-141-10/+14
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* More verbose error message on kdc cert validationStanislav Laznicka2017-06-161-3/+7
| | | | | | | | | | KDC cert validation was added but provides rather non-descriptive error should there be something wrong with a certificate. Pass the error message from the `openssl` tool in such cases. https://pagure.io/freeipa/issue/6945 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* cert-validate: keep all messages in cert validationStanislav Laznicka2017-06-161-10/+2
| | | | | | | | | | Previous attempt to improve error messages during certificate validation would only work in English locale so we're keeping the whole NSS messages for all cases. https://pagure.io/freeipa/issue/6945 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add Subject Key Identifier to CA cert validity checkFraser Tweedale2017-05-301-0/+6
| | | | | | | | | | | | | | | CA certificates MUST have the Subject Key Identifier extension to facilitiate certification path construction. Not having this extension on the IPA CA certificate will cause failures in Dogtag during signing; it tries to copy the CA's Subject Key Identifier to the new certificate's Authority Key Identifier extension, which fails. When installing an externally-signed CA, check that the Subject Key Identifier extension is present in the CA certificate. Fixes: https://pagure.io/freeipa/issue/6976 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* server install: fix KDC certificate validation in CA-lessJan Cholasta2017-05-191-0/+41
| | | | | | | | | | | Verify that the provided certificate has the extended key usage and subject alternative name required for KDC. https://pagure.io/freeipa/issue/6831 https://pagure.io/freeipa/issue/6869 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* install: trust IPA CA for PKINITJan Cholasta2017-05-191-0/+2
| | | | | | | | | | Trust IPA CA to issue PKINIT KDC and client authentication certificates in the IPA certificate store. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb: use custom object for trust flagsJan Cholasta2017-05-191-6/+103
| | | | | | | | | | | Replace trust flag strings with `TrustFlags` objects. The `TrustFlags` class encapsulates `certstore` key policy and has an additional flag indicating the presence of a private key. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb, certs: make trust flags argument mandatoryJan Cholasta2017-05-191-3/+1
| | | | | | | | | | Make the trust flags argument mandatory in all functions in `certdb` and `certs`. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb: add named trust flag constantsJan Cholasta2017-05-191-2/+7
| | | | | | | | | | | Add named constants for common trust flag combinations. Use the named constants instead of trust flags strings in the code. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Provide useful messages during cert validationStanislav Laznicka2017-05-181-6/+20
| | | | | | | | | When the certificate validation was replaced, some error messages were omitted (like "Peer's certificate expired."). Bring these back. https://pagure.io/freeipa/issue/6945 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Remove publish_ca_cert() method from NSSDatabaseStanislav Laznicka2017-04-031-9/+0
| | | | | | | | NSSDatabase.publish_ca_cert() is not used anymore, remove it. https://pagure.io/freeipa/issue/6806 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* certdb: fix `AttributeError` in `verify_ca_cert_validity`Jan Cholasta2017-04-031-1/+1
| | | | | | | | | `NSSDatabase.verify_ca_cert_validity` tries to access a property of basic constraints extension on the extension object itself rather than its value. Access the attribute on the correct object to fix the issue. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certdb: use certutil and match_hostname for cert verificationJan Cholasta2017-03-311-50/+30
| | | | | | | Use certutil and ssl.match_hostname calls instead of python-nss for certificate verification. Reviewed-By: Christian Heimes <cheimes@redhat.com>
* httpinstance: clean up /etc/httpd/alias on uninstallJan Cholasta2017-03-221-0/+13
| | | | | | | | | | | Restore cert8.db, key3.db, pwdfile.txt and secmod.db in /etc/httpd/alias from backup on uninstall. Files modified by IPA are kept with .ipasave suffix. https://pagure.io/freeipa/issue/4639 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* pylint_plugins: add forbidden import checkerJan Cholasta2017-03-101-2/+4
| | | | | | | | | | Add new pylint AST checker plugin which implements a check for imports forbidden in IPA. Which imports are forbidden is configurable in pylintrc. Provide default forbidden import configuration and disable the check for existing forbidden imports in our code base. Reviewed-By: Martin Basti <mbasti@redhat.com>
* certdb: Don't restore_context() of new NSSDBChristian Heimes2017-03-011-5/+1
| | | | | | | | | | | It's not necesary to restore the context of newly created files. SELinux ensures that new files have the correct permission. An explicit restore_context() is only required when either policies have changed or the context was changed manually. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* client install: create /etc/ipa/nssdb with correct modeJan Cholasta2017-02-201-2/+8
| | | | | | | | | | | | The NSS database directory is created with mode 640, which causes the IPA client to fail to connect to any IPA server, because it is unable to read trusted CA certificates from the NSS database. Create the directory with mode 644 to fix the issue. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add password to certutil calls in NSSDatabaseStanislav Laznicka2017-02-171-13/+7
| | | | | | | | | | NSSDatabases should call certutil with a password. Also, removed `password_filename` argument from `.create_db()`. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Simplify NSSDatabase password file handlingSimo Sorce2017-02-151-17/+12
| | | | | | | https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-03 13:28:37 +0000