mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
Set renewal time for the CA audit certificate to 720 days.
The initial certificate is issued for two years but renewals are for six months for some reason. This fixes it for new and updated IPA installs. https://fedorahosted.org/freeipa/ticket/2951
This commit is contained in:
committed by
Martin Kosek
parent
96decfea26
commit
eb79f5c955
@@ -562,6 +562,7 @@ class CAInstance(service.Service):
|
||||
self.step("set up CRL publishing", self.__enable_crl_publish)
|
||||
self.step("set certificate subject base", self.__set_subject_in_config)
|
||||
self.step("enabling Subject Key Identifier", self.enable_subject_key_identifier)
|
||||
self.step("setting audit signing renewal to 2 years", self.set_audit_renewal)
|
||||
self.step("configuring certificate server to start on boot", self.__enable)
|
||||
if not self.clone:
|
||||
self.step("restarting certificate server", self.__restart_instance)
|
||||
@@ -1420,6 +1421,38 @@ class CAInstance(service.Service):
|
||||
# No update was done
|
||||
return False
|
||||
|
||||
def set_audit_renewal(self):
|
||||
"""
|
||||
The default renewal time for the audit signing certificate is
|
||||
six months rather than two years. Fix it. This is BZ 843979.
|
||||
"""
|
||||
# Check the default validity period of the audit signing cert
|
||||
# and set it to 2 years if it is 6 months.
|
||||
range = installutils.get_directive(
|
||||
'%s/caSignedLogCert.cfg' % self.dogtag_constants.SERVICE_PROFILE_DIR,
|
||||
'policyset.caLogSigningSet.2.default.params.range',
|
||||
separator='='
|
||||
)
|
||||
root_logger.debug('caSignedLogCert.cfg profile validity range is %s' % range)
|
||||
if range == "180":
|
||||
installutils.set_directive(
|
||||
'%s/caSignedLogCert.cfg' % self.dogtag_constants.SERVICE_PROFILE_DIR,
|
||||
'policyset.caLogSigningSet.2.default.params.range',
|
||||
'720',
|
||||
quotes=False,
|
||||
separator='='
|
||||
)
|
||||
installutils.set_directive(
|
||||
'%s/caSignedLogCert.cfg' % self.dogtag_constants.SERVICE_PROFILE_DIR,
|
||||
'policyset.caLogSigningSet.2.constraint.params.range',
|
||||
'720',
|
||||
quotes=False,
|
||||
separator='='
|
||||
)
|
||||
root_logger.debug('updated caSignedLogCert.cfg profile validity range to 720')
|
||||
return True
|
||||
return False
|
||||
|
||||
def is_master(self):
|
||||
"""
|
||||
There are some tasks that are only done on a single dogtag master.
|
||||
|
Reference in New Issue
Block a user