diff options
author | Martin Kosek <mkosek@redhat.com> | 2012-11-19 10:32:28 -0500 |
---|---|---|
committer | Rob Crittenden <rcritten@redhat.com> | 2012-12-07 11:00:17 -0500 |
commit | 867f7691e9e8d4dc101d227ca56a94f9b947897f (patch) | |
tree | dcd1529b6a530091bdb1f446b34bf71bae3836a9 /install/tools/ipa-server-install | |
parent | 0d836cd6ee9d7b29808cbf36582eed71a5b6a32a (diff) | |
download | freeipa-867f7691e9e8d4dc101d227ca56a94f9b947897f.tar.gz freeipa-867f7691e9e8d4dc101d227ca56a94f9b947897f.tar.xz freeipa-867f7691e9e8d4dc101d227ca56a94f9b947897f.zip |
Add OCSP and CRL URIs to certificates
Modify the default IPA CA certificate profile to include CRL and
OCSP extensions which will add URIs to IPA CRL&OCSP to published
certificates.
Both CRL and OCSP extensions have 2 URIs, one pointing directly to
the IPA CA which published the certificate and one to a new CNAME
ipa-ca.$DOMAIN which was introduced as a general CNAME pointing
to all IPA replicas which have CA configured.
The new CNAME is added either during new IPA server/replica/CA
installation or during upgrade.
https://fedorahosted.org/freeipa/ticket/3074
https://fedorahosted.org/freeipa/ticket/1431
Diffstat (limited to 'install/tools/ipa-server-install')
-rwxr-xr-x | install/tools/ipa-server-install | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install index 92e9dcf2f..306d1e07b 100755 --- a/install/tools/ipa-server-install +++ b/install/tools/ipa-server-install @@ -965,8 +965,8 @@ def main(): ca = cainstance.CAInstance(realm_name, certs.NSS_DIR, dogtag_constants=dogtag.install_constants) if external == 0: - ca.configure_instance(host_name, dm_password, dm_password, - subject_base=options.subject) + ca.configure_instance(host_name, domain_name, dm_password, + dm_password, subject_base=options.subject) elif external == 1: # stage 1 of external CA installation options.realm_name = realm_name @@ -979,12 +979,13 @@ def main(): options.forwarders = dns_forwarders options.reverse_zone = reverse_zone write_cache(vars(options)) - ca.configure_instance(host_name, dm_password, dm_password, - csr_file="/root/ipa.csr", + ca.configure_instance(host_name, domain_name, dm_password, + dm_password, csr_file="/root/ipa.csr", subject_base=options.subject) else: # stage 2 of external CA installation - ca.configure_instance(host_name, dm_password, dm_password, + ca.configure_instance(host_name, domain_name, dm_password, + dm_password, cert_file=options.external_cert_file, cert_chain_file=options.external_ca_file, subject_base=options.subject) @@ -1079,7 +1080,8 @@ def main(): options.conf_ntp, reverse_zone, zonemgr=options.zonemgr, zone_refresh=options.zone_refresh, persistent_search=options.persistent_search, - serial_autoincrement=options.serial_autoincrement) + serial_autoincrement=options.serial_autoincrement, + ca_configured=not options.selfsign) if options.setup_dns: api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')), bind_pw=dm_password) |