From aca3ae8039e319c684b4418789127824783e7ac1 Mon Sep 17 00:00:00 2001
From: Matus Honek <mhonek@redhat.com>
Date: Mar 24 2020 10:44:15 +0000
Subject: Issue 50952- SSCA lacks basicConstraint:CA


Bug Description:
SSCA CA cert lacks basicConstraint:CA and for that reason it may not be
acknowledged as a CA cert by some tools, e.g. in case of system-wide
update-ca-trust tool.

Fix Description:
Add the constraint while generating the cert. And yes, we need to use stdin
since certutil does not provide a silent mode for this option.

Fixes https://pagure.io/389-ds-base/issue/50952

Author: Matus Honek <mhonek@redhat.com>

Review by: Mark, William (thanks!)

---

diff --git a/src/lib389/lib389/nss_ssl.py b/src/lib389/lib389/nss_ssl.py
index 205773e..a772c5e 100644
--- a/src/lib389/lib389/nss_ssl.py
+++ b/src/lib389/lib389/nss_ssl.py
@@ -19,7 +19,7 @@ import logging
 # from nss import nss
 import subprocess
 from datetime import datetime, timedelta, date
-from subprocess import check_output
+from subprocess import check_output, run
 from lib389.passwd import password_generate
 from lib389.lint import DSCERTLE0001, DSCERTLE0002
 from lib389.utils import ensure_str, format_cmd_list
@@ -242,6 +242,7 @@ only.
             'CT,,',
             '-v',
             '%s' % months,
+            '-2',
             '--keyUsage',
             'certSigning',
             '-d',
@@ -251,8 +252,9 @@ only.
             '-f',
             '%s/%s' % (self._certdb, PWD_TXT),
         ]
+        cmd_input = b'y\n\n'  # responses to certutil questions
         self.log.debug("nss cmd: %s", format_cmd_list(cmd))
-        result = ensure_str(check_output(cmd, stderr=subprocess.STDOUT))
+        result = ensure_str(run(cmd, check=True, capture_output=True, input=cmd_input).stdout)
         self.log.debug("nss output: %s", result)
         # Now extract the CAcert to a well know place.
         # This allows us to point the cacert dir here and it "just works"