IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-01-24 15:16:40 -06:00
Code Issues Packages Projects Releases Wiki Activity

cert renewal: Automatically update KRA agent PEM file

Browse Source 
https://fedorahosted.org/freeipa/ticket/5253

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Jan Cholasta 2015-08-27 07:37:24 +02:00
parent 43ee695195
commit e9a76c3d12
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
install/restart_scripts/renew_ra_cert
View File

@ -29,7 +29,7 @@ import traceback
from ipapython import ipautil
from ipalib import api
from ipaserver.install import certs, cainstance
from ipaserver.install import certs, cainstance, krainstance
from ipaplatform import services
from ipaplatform.paths import paths
@ -60,6 +60,16 @@ def _main():
# Load it into dogtag
cainstance.update_people_entry(dercert)
kra = krainstance.KRAInstance(api.env.realm)
if kra.is_installed():
# export ipaCert with private key for client authentication
args = ["/usr/bin/pki",
"-d", paths.HTTPD_ALIAS_DIR,
"-C", paths.ALIAS_PWDFILE_TXT,
"client-cert-show", "ipaCert",
"--client-cert", paths.KRA_AGENT_PEM]
ipautil.run(args)
finally:
shutil.rmtree(tmpdir)