IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Allow specifying trust flags in NSSDatabase and CertDB method trust_root_cert.

Browse Source 
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Jan Cholasta 2014-06-12 18:06:43 +02:00 committed by Petr Viktorin
parent a8a44c1c71
commit 9d4eeeda55
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ipaserver/install/certs.py
View File

@ -196,15 +196,17 @@ class NSSDatabase(object):
raise RuntimeError("unknown error import pkcs#12 file %s" %
pkcs12_filename)
def trust_root_cert(self, root_nickname):
def trust_root_cert(self, root_nickname, trust_flags=None):
if root_nickname[:7] == "Builtin":
root_logger.debug(
"No need to add trust for built-in root CAs, skipping %s" %
root_nickname)
else:
if trust_flags is None:
trust_flags = 'CT,CT,'
try:
self.run_certutil(["-M", "-n", root_nickname,
"-t", "CT,CT,"])
"-t", trust_flags])
except ipautil.CalledProcessError, e:
raise RuntimeError(
"Setting trust on %s failed" % root_nickname)
@ -782,13 +784,13 @@ class CertDB(object):
return root_nicknames
def trust_root_cert(self, root_nickname):
def trust_root_cert(self, root_nickname, trust_flags=None):
if root_nickname is None:
root_logger.debug("Unable to identify root certificate to trust. Continuing but things are likely to fail.")
return
try:
self.nssdb.trust_root_cert(root_nickname)
self.nssdb.trust_root_cert(root_nickname, trust_flags)
except RuntimeError:
pass