mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-11-02 20:30:26 -06:00
Pavel Vomacka
e0b32dac54
Turn on NSSOCSP directive during install/replica install/upgrade.
That check whether the certificate which is used for login is
revoked or not using OSCP.
Marks the server cert in httpd NSS DB as trusted peer ('P,,')
to avoid chicken and egg problem when it is needed to contact
the OCSP responder when httpd is starting.
https://pagure.io/freeipa/issue/6370
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
59 lines
1.7 KiB
Python
59 lines
1.7 KiB
Python
#!/usr/bin/python2 -E
|
|
#
|
|
# Authors:
|
|
# Rob Crittenden <rcritten@redhat.com>
|
|
#
|
|
# Copyright (C) 2012 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
import syslog
|
|
import traceback
|
|
from ipalib import api
|
|
from ipaplatform import services
|
|
from ipaplatform.paths import paths
|
|
from ipaserver.install import certs, installutils
|
|
|
|
|
|
def _main():
|
|
|
|
api.bootstrap(in_server=True, context='restart', confdir=paths.ETC_IPA)
|
|
api.finalize()
|
|
|
|
db = certs.CertDB(api.env.realm, nssdir=paths.HTTPD_ALIAS_DIR)
|
|
nickname = installutils.get_directive(paths.HTTPD_NSS_CONF, "NSSNickname")
|
|
|
|
# Add trust flag which set certificate trusted for SSL connections.
|
|
db.trust_root_cert(nickname, "P,,")
|
|
|
|
syslog.syslog(syslog.LOG_NOTICE, 'certmonger restarted httpd')
|
|
|
|
try:
|
|
if services.knownservices.httpd.is_running():
|
|
services.knownservices.httpd.restart()
|
|
except Exception as e:
|
|
syslog.syslog(syslog.LOG_ERR, "Cannot restart httpd: %s" % str(e))
|
|
|
|
|
|
def main():
|
|
with certs.renewal_lock:
|
|
_main()
|
|
|
|
|
|
try:
|
|
main()
|
|
except Exception:
|
|
syslog.syslog(syslog.LOG_ERR, traceback.format_exc())
|