Only request VALID certs when revoking certs for a host/service

This utilizes the new status option so that we only retrieve
VALID certificates when revoking certificates issued for a
specific host or service.

ae74d348c3 made a special case
in cert_find when searching for hosts and services so that if only
one host/service was searched on do a subject search. It only
works when there is exactly one option requested.

Since we want to restrict to only VALID certificates, pass
the hostname as subject directly when revoking certs when deleting
an entry to limit the number of certificates to consider.

https://pagure.io/freeipa/issue/7835

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>

ipaserver/plugins/cert.py

@@ -1687,8 +1687,6 @@ class cert_find(Search, CertMethod):
                 ra_options['subject'] = hosts[0]
             elif len(users) == 1 and not services and not hosts:
                 ra_options['subject'] = users[0]
-        if 'status' in options:
-            ra_options['status'] = options.get('status')
 
         try:
             ca_enabled_check(self.api)

ipaserver/plugins/host.py

@@ -871,7 +871,9 @@ class host_del(LDAPDelete):
                 )
 
         if self.api.Command.ca_is_enabled()['result']:
-            certs = self.api.Command.cert_find(host=keys)['result']
+            certs = self.api.Command.cert_find(
+                subject=fqdn, status='VALID'
+            )['result']
             revoke_certs(certs)
 
         return dn

ipaserver/plugins/service.py

@@ -825,8 +825,16 @@ class service_del(LDAPDelete):
         # custom services allow them to manage them.
         check_required_principal(ldap, keys[-1])
         if self.api.Command.ca_is_enabled()['result']:
-            certs = self.api.Command.cert_find(service=keys)['result']
-            revoke_certs(certs)
+            # only try to revoke certs for valid principals
+            try:
+                subject = keys[-1].hostname
+            except ValueError:
+                pass
+            else:
+                certs = self.api.Command.cert_find(
+                    subject=subject, status='VALID'
+                )['result']
+                revoke_certs(certs)
 
         return dn
 
@@ -1100,14 +1108,21 @@ class service_disable(LDAPQuery):
         done_work = False
 
         if self.api.Command.ca_is_enabled()['result']:
-            certs = self.api.Command.cert_find(service=keys)['result']
+            try:
+                subject = keys[-1].hostname
+            except ValueError:
+                pass
+            else:
+                certs = self.api.Command.cert_find(
+                    subject=subject, status='VALID'
+                )['result']
 
-            if len(certs) > 0:
-                revoke_certs(certs)
-                # Remove the usercertificate altogether
-                entry_attrs['usercertificate'] = None
-                ldap.update_entry(entry_attrs)
-                done_work = True
+                if len(certs) > 0:
+                    revoke_certs(certs)
+                    # Remove the usercertificate altogether
+                    entry_attrs['usercertificate'] = None
+                    ldap.update_entry(entry_attrs)
+                    done_work = True
 
         self.obj.get_password_attributes(ldap, dn, entry_attrs)
         if entry_attrs['has_keytab']: