mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 18:01:23 -06:00
6ecc4600e9
PKI change done in ticket https://fedorahosted.org/pki/ticket/816 requires the PKI Clone's SSL Server certificate to be issued by it's associated PKI master. Allow this call on IPA master. https://fedorahosted.org/freeipa/ticket/4265 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
31 lines
1.8 KiB
Plaintext
31 lines
1.8 KiB
Plaintext
# VERSION 4 - DO NOT REMOVE THIS LINE
|
|
|
|
ProxyRequests Off
|
|
|
|
# matches for ee port
|
|
<LocationMatch "^/ca/ee/ca/checkRequest|^/ca/ee/ca/getCertChain|^/ca/ee/ca/getTokenInfo|^/ca/ee/ca/tokenAuthenticate|^/ca/ocsp|^/ca/ee/ca/updateNumberRange|^/ca/ee/ca/getCRL|^/ca/ee/ca/profileSubmit">
|
|
NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
|
|
NSSVerifyClient none
|
|
ProxyPassMatch ajp://localhost:$DOGTAG_PORT
|
|
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
|
|
</LocationMatch>
|
|
|
|
# matches for admin port and installer
|
|
<LocationMatch "^/ca/admin/ca/getCertChain|^/ca/admin/ca/getConfigEntries|^/ca/admin/ca/getCookie|^/ca/admin/ca/getStatus|^/ca/admin/ca/securityDomainLogin|^/ca/admin/ca/getDomainXML|^/ca/rest/installer/installToken|^/ca/admin/ca/updateNumberRange|^/ca/rest/securityDomain/domainInfo|^/ca/rest/account/login|^/ca/admin/ca/tokenAuthenticate|^/ca/admin/ca/updateNumberRange|^/ca/admin/ca/updateDomainXML|^/ca/rest/account/logout|^/ca/rest/securityDomain/installToken">
|
|
NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
|
|
NSSVerifyClient none
|
|
ProxyPassMatch ajp://localhost:$DOGTAG_PORT
|
|
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
|
|
</LocationMatch>
|
|
|
|
# matches for agent port and eeca port
|
|
<LocationMatch "^/ca/agent/ca/displayBySerial|^/ca/agent/ca/doRevoke|^/ca/agent/ca/doUnrevoke|^/ca/agent/ca/updateDomainXML|^/ca/eeca/ca/profileSubmitSSLClient">
|
|
NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
|
|
NSSVerifyClient require
|
|
ProxyPassMatch ajp://localhost:$DOGTAG_PORT
|
|
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
|
|
</LocationMatch>
|
|
|
|
# Only enable this on servers that are not generating a CRL
|
|
${CLONE}RewriteRule ^/ipa/crl/MasterCRL.bin https://$FQDN/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]
|