From 7130e0a2d0092ea4b1e1d9e1ff6a4617d0fd248a Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 31 Jan 2023 15:55:50 -0500 Subject: [PATCH] Update KRA certificates in CS.cfg on renewal We already updated the CA certificates on renewal. Do the same for the KRA certificates. This will suppress an error in freeipa-healthcheck and bring partity to the CA and KRA certificates in CS.cfg. Fixes: https://pagure.io/freeipa/issue/9277 Signed-off-by: Rob Crittenden --- install/restart_scripts/renew_ca_cert.in | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/install/restart_scripts/renew_ca_cert.in b/install/restart_scripts/renew_ca_cert.in index b265e62d5..dce422345 100644 --- a/install/restart_scripts/renew_ca_cert.in +++ b/install/restart_scripts/renew_ca_cert.in @@ -33,7 +33,7 @@ from ipapython import ipautil from ipalib import api, errors from ipalib import x509 from ipalib.install.kinit import kinit_keytab -from ipaserver.install import certs, cainstance +from ipaserver.install import certs, cainstance, krainstance from ipaserver.plugins.ldap2 import ldap2 from ipaplatform import services from ipaplatform.paths import paths @@ -50,6 +50,9 @@ def _main(): dogtag_service = services.knownservices['pki_tomcatd'] + ca = cainstance.CAInstance(host_name=api.env.host) + kra = krainstance.KRAInstance(api.env.realm) + # dogtag opens its NSS database in read/write mode so we need it # shut down so certmonger can open it read/write mode. This avoids # database corruption. It should already be stopped by the pre-command @@ -85,11 +88,15 @@ def _main(): ca = cainstance.CAInstance(host_name=api.env.host) ca.update_cert_config(nickname, cert) + kra.update_cert_config(nickname, cert) if ca.is_renewal_master(): cainstance.update_people_entry(cert) cainstance.update_authority_entry(cert) - if nickname == 'auditSigningCert cert-pki-ca': + if nickname in ( + 'auditSigningCert cert-pki-ca', + 'auditSigningCert cert-pki-kra' + ): # Fix trust on the audit cert try: db.run_certutil(['-M', -- 2.39.1