From c2b1b2a36200b50babfda1eca37fb4b51fefa9c6 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 22 Dec 2016 13:34:34 -0500 Subject: Always use /etc/ipa/ca.crt as CA cert file It seem like ALIAS_CACERT_ASC was just a redundant location for the CA cert file which is always available in /etc/ipa/ca.crt Just use the canonical CA cert location in /etc/ipa for all cases and stop creating a separate cacert file. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce Reviewed-By: Jan Cholasta --- ipaplatform/base/paths.py | 1 - ipaserver/install/certs.py | 10 +++++----- ipaserver/install/dsinstance.py | 6 +----- ipaserver/install/server/upgrade.py | 2 +- 4 files changed, 7 insertions(+), 12 deletions(-) diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py index 95f8b9050..b8cd5ca5e 100644 --- a/ipaplatform/base/paths.py +++ b/ipaplatform/base/paths.py @@ -40,7 +40,6 @@ class BasePathNamespace(object): ETC_HTTPD_DIR = "/etc/httpd" HTTPD_ALIAS_DIR = "/etc/httpd/alias" IPA_RADB_DIR = "/var/lib/ipa/radb" - ALIAS_CACERT_ASC = "/var/lib/ipa/radb/cacert.asc" HTTPD_CONF_D_DIR = "/etc/httpd/conf.d/" HTTPD_IPA_KDCPROXY_CONF = "/etc/ipa/kdcproxy/ipa-kdc-proxy.conf" HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/conf.d/ipa-kdc-proxy.conf" diff --git a/ipaserver/install/certs.py b/ipaserver/install/certs.py index f3478630d..83a4bb057 100644 --- a/ipaserver/install/certs.py +++ b/ipaserver/install/certs.py @@ -217,12 +217,12 @@ class CertDB(object): return False - def export_ca_cert(self, nickname, create_pkcs12=False, - cacert_fname=paths.ALIAS_CACERT_ASC): + def export_ca_cert(self, nickname, create_pkcs12=False): """create_pkcs12 tells us whether we should create a PKCS#12 file of the CA or not. If we are running on a replica then we won't have the private key to make a PKCS#12 file so we don't need to do that step.""" + cacert_fname = paths.IPA_CA_CRT # export the CA cert for use with other apps ipautil.backup_file(cacert_fname) root_nicknames = self.find_root_cert(nickname)[:-1] @@ -533,8 +533,8 @@ class CertDB(object): "-in", pem_fname, "-out", pkcs12_fname, "-passout", "file:" + pkcs12_pwd_fname]) - def create_from_cacert(self, cacert_fname=paths.ALIAS_CACERT_ASC, - passwd=None): + def create_from_cacert(self): + cacert_fname = paths.IPA_CA_CRT if ipautil.file_exists(self.certdb_fname): # We already have a cert db, see if it is for the same CA. # If it is we leave things as they are. @@ -553,7 +553,7 @@ class CertDB(object): # The CA certificates are different or something went wrong. Start with # a new certificate database. - self.create_passwd_file(passwd) + self.create_passwd_file() self.create_certdbs() self.load_cacert(cacert_fname, 'CT,C,C') diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py index 31358957b..9172b65f3 100644 --- a/ipaserver/install/dsinstance.py +++ b/ipaserver/install/dsinstance.py @@ -810,10 +810,6 @@ class DsInstance(service.Service): self.nickname, self.principal, dsdb.passwd_fname, 'restart_dirsrv %s' % self.serverid) else: - cadb = certs.CertDB(self.realm, host_name=self.fqdn, subject_base=self.subject_base) - - # FIXME, need to set this nickname in the RA plugin - cadb.export_ca_cert('ipaCert', False) dsdb.create_from_cacert() ca_args = ['/usr/libexec/certmonger/dogtag-submit', '--ee-url', 'https://%s:8443/ca/ee/ca' % self.fqdn, @@ -1241,7 +1237,7 @@ class DsInstance(service.Service): subject_base=self.subject_base, ca_subject=self.ca_subject, ) - db.create_from_cacert(paths.IPA_CA_CRT) + db.create_from_cacert() db.request_service_cert(self.nickname, self.principal, self.fqdn) db.create_pin_file() diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py index 549158270..f116e856a 100644 --- a/ipaserver/install/server/upgrade.py +++ b/ipaserver/install/server/upgrade.py @@ -185,7 +185,7 @@ def check_certs(): """Check ca.crt is in the right place, and try to fix if not""" root_logger.info('[Verifying that root certificate is published]') if not os.path.exists(paths.CA_CRT): - ca_file = paths.ALIAS_CACERT_ASC + ca_file = paths.IPA_CA_CRT if os.path.exists(ca_file): old_umask = os.umask(0o22) # make sure its readable by httpd try: -- cgit