IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Don't move keys when key backup is disabled

Browse Source 
The CA_BACKUP_KEYS_P12 file is not enabled when pki_backup_keys is
set to False. It's the case when FreeIPA is configured with HSM support.

Related: https://pagure.io/freeipa/issue/7677
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
This commit is contained in:
Christian Heimes 2019-08-13 06:37:21 +02:00
parent 0000fe0502
commit 17c2e31fdc
2 changed files with 7 additions and 4 deletions

8
ipaserver/install/cainstance.py
View File

@ -599,8 +599,12 @@ class CAInstance(DogtagInstance):
print("%s --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate" % sys.argv[0])
sys.exit(0)
else:
shutil.move(paths.CA_BACKUP_KEYS_P12,
paths.CACERT_P12)
if config.getboolean(
self.subsystem, 'pki_backup_keys', fallback=True
):
shutil.move(
paths.CA_BACKUP_KEYS_P12, paths.CACERT_P12
)
logger.debug("completed creating ca instance")

3
ipaserver/install/dogtaginstance.py
View File

@ -875,8 +875,7 @@ class PKIIniLoader:
)
# key backup is not compatible with HSM support
if (cfgtpl.has_option(section_name, 'pki_hsm_enable') and
cfgtpl.getboolean(section_name, 'pki_hsm_enable')):
if cfgtpl.getboolean(section_name, 'pki_hsm_enable', fallback=False):
cfgtpl.set(section_name, 'pki_backup_keys', 'False')
cfgtpl.set(section_name, 'pki_backup_password', '')