From 9607fe3b9676d88904de91e9dfd21f6fb691cf39 Mon Sep 17 00:00:00 2001
From: Jan Cholasta <jcholast@redhat.com>
Date: Tue, 7 Oct 2014 18:16:53 +0200
Subject: [PATCH] Fix CA cert validity check for CA-less and external CA
 installer options

https://fedorahosted.org/freeipa/ticket/4612

Reviewed-By: Martin Kosek <mkosek@redhat.com>
---
 ipapython/certdb.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/ipapython/certdb.py b/ipapython/certdb.py
index 4645b406e..5a6e494fb 100644
--- a/ipapython/certdb.py
+++ b/ipapython/certdb.py
@@ -494,7 +494,12 @@ class NSSDatabase(object):
             cert = nss.find_cert_from_nickname(nickname)
             if not cert.subject:
                 raise ValueError("has empty subject")
-            if not cert.is_ca_cert():
+            try:
+                bc = cert.get_extension(nss.SEC_OID_X509_BASIC_CONSTRAINTS)
+            except KeyError:
+                raise ValueError("missing basic constraints")
+            bc = nss.BasicConstraints(bc.value)
+            if not bc.is_ca:
                 raise ValueError("not a CA certificate")
             intended_usage = nss.certificateUsageSSLCA
             try: