IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-11 00:31:56 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix external renewal for CA with non-default subject DN

Browse Source 
When running ``ipa-cacert-manage renew --external-ca`` with an IPA
CA having a subject DN that does not correspond to ``CN=Certificate
Authority, {subject-base}``, the CSR for submission to the external
CA does not generated.  dogtag-ipa-ca-renew-agent-submit is wrongly
assuming the default form of the CA subject DN.

Update dogtag-ipa-ca-renew-agent-submit to look up the actual
subject DN.

Fixes: https://pagure.io/freeipa/issue/7123
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
This commit is contained in:
Fraser Tweedale 2017-08-25 14:32:42 +10:00 committed by Tomas Krizek
parent 76f217b289
commit 504c303ec4
No known key found for this signature in database
GPG Key ID: 22A2A94B5E49415A
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
install/certmonger/dogtag-ipa-ca-renew-agent-submit
View File

@ -45,7 +45,7 @@ from ipapython.dn import DN
from ipalib import api, errors, x509
from ipaplatform.paths import paths
from ipaserver.plugins.ldap2 import ldap2
from ipaserver.install import cainstance, dsinstance, certs
from ipaserver.install import ca, cainstance, dsinstance, certs
# This is a certmonger CA helper script for IPA CA subsystem cert renewal. See
# https://git.fedorahosted.org/cgit/certmonger.git/tree/doc/submit.txt for more
@ -83,9 +83,10 @@ def get_nickname():
if not subject_base:
return None
ca_subject_dn = ca.lookup_ca_subject(api, subject_base)
nickname_by_subject_dn = {
DN('CN=Certificate Authority', subject_base):
'caSigningCert cert-pki-ca',
DN(ca_subject_dn): 'caSigningCert cert-pki-ca',
DN('CN=CA Audit', subject_base): 'auditSigningCert cert-pki-ca',
DN('CN=OCSP Subsystem', subject_base): 'ocspSigningCert cert-pki-ca',
DN('CN=CA Subsystem', subject_base): 'subsystemCert cert-pki-ca',