IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-08-14 06:54:55 -05:00
Code Issues Packages Projects Releases Wiki Activity

Specify cert_paths when calling PKIConnection

Browse Source 
PKIConnection now defaults to specifying verify=True. We've introduced
a new parameter, cert_paths, to specify additional paths (directories or
files) to load as certificates. Specify the IPA CA certificate file so
we can guarantee connections succeed and validate the peer's certificate.

Point to IPA CA certificate during pkispawn

Bump pki_version to 10.9.0-0.4 (aka -b2)

Fixes: https://pagure.io/freeipa/issue/8379
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1849155
Related: https://github.com/dogtagpki/pki/pull/443
Related: https://bugzilla.redhat.com/show_bug.cgi?id=1426572
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
This commit is contained in:
Alexander Scheel
2020-07-08 11:50:37 +02:00
committed by Christian Heimes
parent 6a0901f6fd
commit a087d82e78
5 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipaserver/plugins/dogtag.py
+5 -6
View File
@@ -1969,13 +1969,12 @@ class kra(Backend):
'https',
self.kra_host,
str(self.kra_port),
'kra')
'kra',
cert_paths=paths.IPA_CA_CRT
)
connection.session.cert = (paths.RA_AGENT_PEM, paths.RA_AGENT_KEY)
# uncomment the following when this commit makes it to release
# https://git.fedorahosted.org/cgit/pki.git/commit/?id=71ae20c
# connection.set_authentication_cert(paths.RA_AGENT_PEM,
# paths.RA_AGENT_KEY)
connection.set_authentication_cert(paths.RA_AGENT_PEM,
paths.RA_AGENT_KEY)
try:
yield KRAClient(connection, crypto)