Configure renewals to use the IPA JSON API

certmonger defaults to using the PKI XML API for renewing
CA/KRA subsystem certificates. certmonger supports the
IPA API for renewals by providing --jsonrpc-url

The IPA API will forward requests to the CA via the
PKI python API. IPA will be RPC agnostic this way and
rely on the PKI python API to handle communication.

Fixes: https://pagure.io/freeipa/issue/9738

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>

install/certmonger/dogtag-ipa-ca-renew-agent-submit.in

@@ -109,6 +109,7 @@ def ldap_connect():
         if conn is not None and conn.isconnected():
             conn.disconnect()
 
+
 def call_handler(_handler, *args, **kwargs):
     """
     Request handler call wrapper
@@ -206,13 +207,17 @@ def request_cert(reuse_existing, **kwargs):
     syslog.syslog(syslog.LOG_NOTICE,
                   "Forwarding request to dogtag-ipa-renew-agent")
 
-    args = ([paths.DOGTAG_IPA_RENEW_AGENT_SUBMIT,
-             "--cafile", paths.IPA_CA_CRT,
-             "--certfile", paths.RA_AGENT_PEM,
-             "--keyfile", paths.RA_AGENT_KEY] +
-            sys.argv[1:] +
-            ['--submit-option', "requestor_name=IPA"] +
-            ['--force-new', '--approval-option', 'bypassCAnotafter=true']
+    args = (
+        [
+            paths.DOGTAG_IPA_RENEW_AGENT_SUBMIT,
+            "--cafile", paths.IPA_CA_CRT,
+            "--certfile", paths.RA_AGENT_PEM,
+            "--keyfile", paths.RA_AGENT_KEY,
+        ]
+        + sys.argv[1:]
+        + ['--submit-option', "requestor_name=IPA"]
+        + ['--force-new', '--approval-option', 'bypassCAnotafter=true']
+        + ['--jsonrpc-url', 'https://%s/ipa/json' % api.env.host]
     )
     result = ipautil.run(args, raiseonerr=False, env=os.environ,
                          capture_output=True)
@@ -484,6 +489,7 @@ def renew_ca_cert(reuse_existing, force_self_signed, **kwargs):
     else:
         return result
 
+
 def main():
     kwargs = {
         'reuse_existing': False,
@@ -546,7 +552,7 @@ def main():
 
 try:
     sys.exit(main())
-except Exception as e:
+except Exception:
     syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
     print("Internal error")
     sys.exit(UNREACHABLE)

install/share/openssl_cnf.template

@@ -18,19 +18,23 @@ subjectKeyIdentifier = hash
 1.3.6.1.4.1.311.20.2 = ASN1:BMPString:${PROFILE}
 
 [alt_names]
+# The fully-qualified name SAN
 DNS.1 = ${FQDN}
+# An optional SAN, ipa-ca for the HTTP cert is an example. Optional.
 ${DNS_2}
-otherName.1 = 1.3.6.1.4.1.311.20.2.3;UTF8:${SERVICE}/${FQDN}@${REALM}
-otherName.2 = 1.3.6.1.5.2.2;SEQUENCE:princ_name
+# The Kerberos principal of the certificate
+otherName.1 = 1.3.6.1.4.1.311.20.2.3;UTF8:${SERVICE}/${PRINCIPAL}@${REALM}
+# Used for the id-pkinit-san for the pkinit certificate.
+${OTHERNAME_2}
 
 [princ_name]
 realm=EXP:0,GeneralString:${REALM}
 principal_name=EXP:1,SEQUENCE:principal_seq
 
 [principal_seq]
-name_type=EXP:0,INTEGER:1
+name_type=EXP:0,INTEGER:2
 name_string=EXP:1,SEQUENCE:principals
 
 [principals]
 princ1=GeneralString:${SERVICE}
-princ2=GeneralString:${FQDN}
+princ2=GeneralString:${REALM}

ipaserver/install/krbinstance.py

@@ -490,7 +490,7 @@ class KrbInstance(service.Service):
             if use_dogtag_submit:
                 ca_args = [
                     paths.CERTMONGER_DOGTAG_SUBMIT,
-                    '--ee-url', 'https://%s:8443/ca/ee/ca' % self.fqdn,
+                    '--jsonrpc-url', 'https://%s/ipa/json' % self.fqdn,
                     '--certfile', paths.RA_AGENT_PEM,
                     '--keyfile', paths.RA_AGENT_KEY,
                     '--cafile', paths.IPA_CA_CRT,

ipaserver/plugins/dogtag.py

@@ -472,6 +472,14 @@ class APIClient(Backend):
     """
     DEFAULT_PROFILE = dogtag.DEFAULT_PROFILE
     KDC_PROFILE = dogtag.KDC_PROFILE
+    OCSP_PROFILE = dogtag.OCSP_PROFILE
+    SUBSYSTEM_PROFILE = dogtag.SUBSYSTEM_PROFILE
+    AUDIT_PROFILE = dogtag.AUDIT_PROFILE
+    CACERT_PROFILE = dogtag.CACERT_PROFILE
+    CASERVER_PROFILE = dogtag.CASERVER_PROFILE
+    KRA_AUDIT_PROFILE = dogtag.KRA_AUDIT_PROFILE
+    KRA_STORAGE_PROFILE = dogtag.KRA_STORAGE_PROFILE
+    KRA_TRANSPORT_PROFILE = dogtag.KRA_TRANSPORT_PROFILE
 
     def raise_certificate_operation_exception(self, func_name, exc):
         """