• [pspacek] we might want to do the same for DNSSEC at the same time, configuration options and user interface will be similar
• mbasti: then DNSSEC will need CA to be installed, how it will cooperate with ca-less instalation
• [pspacek] No, I mean that user interface needed for configuring HSM is the same - same options with same meaning etc. So it could make sense to do both at the same time.
• RHCS itself and NSS supports HSM, it is not integrated in our installer.
• mkosek: currently 4.6? considereation (i.e. Future Releases), unless it is something very easy to do.
• HSM configuration in OpenDNSSEC, for example, is ~ 5 lines in configuration file.

Linked to Bugzilla bug: https://bugzilla.redhat.com/show_bug.cgi?id=1405935 (Red Hat Enterprise Linux 7)

master:

• 8c4d75fd2e2972495a0693f1f86a64f09fc929f2 Add current default.cfg from Dogtag
• 0a2b02fc620ef16af87be5ec2ba47cd6831059f5 Simplify and slim down ipaca_default.ini
• 70beccada2e439b9d8d32dbeab369cdb7f0a8383 Add IPA specific vars to ipaca_default.ini
• f847d7756f8d15e47930a709374cf3d95e4b4d8a Use new pki_ipaca.ini to spawn instances
• dd47cfc75a69618f486abefb70f2649ebf8264e7 Add pki.ini override option
• 94937424b12da3e7294ebbcb256b9423ee2d150e Simplify and consolidate ipaca.ini
• dba89712c6a67390c616d5950efab39a73dd8c16 Verify pki ini override early
• 42efdc7bb1c208ac02d45865d68df959f87d5148 Add test case for pki config override
• 2b2c5d6c931660e73cc1c9e75aa3055ab20f386b Add --pki-config-override to man pages

For future reference: https://github.com/freeipa/freeipa/pull/3023 is an abandoned backport to 4.7 branch. We decided to keep the changes in master / 4.8 for now.

master:

• dd58a705e5c92934604f8a0324125f2a77a50c54 Fix and extend pki config override test

master:

• 8686cd3b4b69f725aee05c9cdd3034d7436055d3 Pass token_name to certmonger

master:

• 130e1dc3433977f7a80aed139d29d21c5d30d558 move MSCSTemplate classes to ipalib
• 21a9a7107a2028354c0fc15540b8f15d279e5fce install: fix --external-ca-profile option
• 7171142aaf91d6079798d015af9862d6e5474c8c Fix use of incorrect variable
• b15bd50e6db919279e25a8bed796df4836b845a8 Add more tests for --external-ca-profile handling
• 80e76f094c234710ff58917e7ce4661d823c4de7 Collapse --external-ca-profile tests into single class
• 2c8352fe8536be0e630fdb910dc90831847ad119 ci: add --external-ca-profile tests to nightly
• 33f39d88bf0bb871e3868c827aeb335eb40f5ae3 ci: add --external-ca-profile tests to gating

ipa-4-8:

• d0d29ccc324bb9f95bffbe3162ee5c3c61c6086a move MSCSTemplate classes to ipalib
• e632b220798833bcd65c6b266610c800ed0914d7 install: fix --external-ca-profile option
• 71af731b3069fa1b2c0b51a3b917b5bc4da54350 Fix use of incorrect variable
• 83ed05725110de19a7098678274ecaaaf6a2c9c9 Add more tests for --external-ca-profile handling
• a627df87c31e4d8399bd9fab43c0c4772ddd8955 Collapse --external-ca-profile tests into single class
• 740964c3c47fd2cd216c233d8d9df1840eaa01ee ci: add --external-ca-profile tests to nightly
• 011c5283cec28ea4361eff5d2ee98da9cd3db41a ci: add --external-ca-profile tests to gating

master:

• 076d955b9373ad8603f3885ea6841d367f866327 Store HSM token and state

master:

• bebe09f3e4ddcc1332395aaa6b662fa4580d8304 Fix ca_initialize_hsm_state

ipa-4-8:

• f98c9f2d1dfa7f9fee3c1bbaf200aedee154c9be Fix ca_initialize_hsm_state

Re-opening to track additional changes needed for full HSM support.

On second thought, I'll create a new ticket. This isn't about general HSM support but the override file.