From e8425bd88dfe10e0cb4901ac93b87a3110247097 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Tue, 20 May 2025 20:21:44 +0000
Subject: [PATCH] Configure renewals to use the IPA JSON API

certmonger defaults to using the PKI XML API for renewing
CA/KRA subsystem certificates. certmonger supports the
IPA API for renewals by providing --jsonrpc-url

The IPA API will forward requests to the CA via the
PKI python API. IPA will be RPC agnostic this way and
rely on the PKI python API to handle communication.

Fixes: https://pagure.io/freeipa/issue/9738

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>
---
 .../dogtag-ipa-ca-renew-agent-submit.in       | 22 ++++++++++++-------
 install/share/openssl_cnf.template            | 12 ++++++----
 ipaserver/install/krbinstance.py              |  2 +-
 ipaserver/plugins/dogtag.py                   |  8 +++++++
 4 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/install/certmonger/dogtag-ipa-ca-renew-agent-submit.in b/install/certmonger/dogtag-ipa-ca-renew-agent-submit.in
index da81d2a30..89fd717a8 100644
--- a/install/certmonger/dogtag-ipa-ca-renew-agent-submit.in
+++ b/install/certmonger/dogtag-ipa-ca-renew-agent-submit.in
@@ -109,6 +109,7 @@ def ldap_connect():
         if conn is not None and conn.isconnected():
             conn.disconnect()
 
+
 def call_handler(_handler, *args, **kwargs):
     """
     Request handler call wrapper
@@ -206,13 +207,17 @@ def request_cert(reuse_existing, **kwargs):
     syslog.syslog(syslog.LOG_NOTICE,
                   "Forwarding request to dogtag-ipa-renew-agent")
 
-    args = ([paths.DOGTAG_IPA_RENEW_AGENT_SUBMIT,
-             "--cafile", paths.IPA_CA_CRT,
-             "--certfile", paths.RA_AGENT_PEM,
-             "--keyfile", paths.RA_AGENT_KEY] +
-            sys.argv[1:] +
-            ['--submit-option', "requestor_name=IPA"] +
-            ['--force-new', '--approval-option', 'bypassCAnotafter=true']
+    args = (
+        [
+            paths.DOGTAG_IPA_RENEW_AGENT_SUBMIT,
+            "--cafile", paths.IPA_CA_CRT,
+            "--certfile", paths.RA_AGENT_PEM,
+            "--keyfile", paths.RA_AGENT_KEY,
+        ]
+        + sys.argv[1:]
+        + ['--submit-option', "requestor_name=IPA"]
+        + ['--force-new', '--approval-option', 'bypassCAnotafter=true']
+        + ['--jsonrpc-url', 'https://%s/ipa/json' % api.env.host]
     )
     result = ipautil.run(args, raiseonerr=False, env=os.environ,
                          capture_output=True)
@@ -484,6 +489,7 @@ def renew_ca_cert(reuse_existing, force_self_signed, **kwargs):
     else:
         return result
 
+
 def main():
     kwargs = {
         'reuse_existing': False,
@@ -546,7 +552,7 @@ def main():
 
 try:
     sys.exit(main())
-except Exception as e:
+except Exception:
     syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
     print("Internal error")
     sys.exit(UNREACHABLE)
diff --git a/install/share/openssl_cnf.template b/install/share/openssl_cnf.template
index 63891ba49..0f9e79529 100644
--- a/install/share/openssl_cnf.template
+++ b/install/share/openssl_cnf.template
@@ -18,19 +18,23 @@ subjectKeyIdentifier = hash
 1.3.6.1.4.1.311.20.2 = ASN1:BMPString:${PROFILE}
 
 [alt_names]
+# The fully-qualified name SAN
 DNS.1 = ${FQDN}
+# An optional SAN, ipa-ca for the HTTP cert is an example. Optional.
 ${DNS_2}
-otherName.1 = 1.3.6.1.4.1.311.20.2.3;UTF8:${SERVICE}/${FQDN}@${REALM}
-otherName.2 = 1.3.6.1.5.2.2;SEQUENCE:princ_name
+# The Kerberos principal of the certificate
+otherName.1 = 1.3.6.1.4.1.311.20.2.3;UTF8:${SERVICE}/${PRINCIPAL}@${REALM}
+# Used for the id-pkinit-san for the pkinit certificate.
+${OTHERNAME_2}
 
 [princ_name]
 realm=EXP:0,GeneralString:${REALM}
 principal_name=EXP:1,SEQUENCE:principal_seq
 
 [principal_seq]
-name_type=EXP:0,INTEGER:1
+name_type=EXP:0,INTEGER:2
 name_string=EXP:1,SEQUENCE:principals
 
 [principals]
 princ1=GeneralString:${SERVICE}
-princ2=GeneralString:${FQDN}
+princ2=GeneralString:${REALM}
diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py
index 0398f0440..4a521a611 100644
--- a/ipaserver/install/krbinstance.py
+++ b/ipaserver/install/krbinstance.py
@@ -490,7 +490,7 @@ class KrbInstance(service.Service):
             if use_dogtag_submit:
                 ca_args = [
                     paths.CERTMONGER_DOGTAG_SUBMIT,
-                    '--ee-url', 'https://%s:8443/ca/ee/ca' % self.fqdn,
+                    '--jsonrpc-url', 'https://%s/ipa/json' % self.fqdn,
                     '--certfile', paths.RA_AGENT_PEM,
                     '--keyfile', paths.RA_AGENT_KEY,
                     '--cafile', paths.IPA_CA_CRT,
diff --git a/ipaserver/plugins/dogtag.py b/ipaserver/plugins/dogtag.py
index 8081b2c6c..d77ac6c2f 100644
--- a/ipaserver/plugins/dogtag.py
+++ b/ipaserver/plugins/dogtag.py
@@ -472,6 +472,14 @@ class APIClient(Backend):
     """
     DEFAULT_PROFILE = dogtag.DEFAULT_PROFILE
     KDC_PROFILE = dogtag.KDC_PROFILE
+    OCSP_PROFILE = dogtag.OCSP_PROFILE
+    SUBSYSTEM_PROFILE = dogtag.SUBSYSTEM_PROFILE
+    AUDIT_PROFILE = dogtag.AUDIT_PROFILE
+    CACERT_PROFILE = dogtag.CACERT_PROFILE
+    CASERVER_PROFILE = dogtag.CASERVER_PROFILE
+    KRA_AUDIT_PROFILE = dogtag.KRA_AUDIT_PROFILE
+    KRA_STORAGE_PROFILE = dogtag.KRA_STORAGE_PROFILE
+    KRA_TRANSPORT_PROFILE = dogtag.KRA_TRANSPORT_PROFILE
 
     def raise_certificate_operation_exception(self, func_name, exc):
         """