[Freeipa-devel] [freeipa PR#728][opened] ipa-cacert-manage: add --external-ca-type

[HonzaCholasta]

   URL: https://github.com/freeipa/freeipa/pull/728
Author: HonzaCholasta
 Title: #728: ipa-cacert-manage: add --external-ca-type
Action: opened

PR body:
"""
**server upgrade: always fix certmonger tracking request**

Fix certmonger tracking requests on every run of ipa-server-upgrade rather
than only when the tracking configuration has changed and the requests have
not yet been updated.

This allows fixing broken tracking requests just by re-running
ipa-server-upgrade.

**cainstance: use correct profile for lightweight CA certificates**

Use Dogtag's `caCACert` CA certificate profile rather than the
`ipaCACertRenewal` virtual profile for lightweight CA certificates.

The `ipaCACertRenewal` virtual profile adds special handling of externally
signed CA certificates and LDAP replication of issued certificates on top
of `caCACert`, neither of which is relevant for lightweight CA
certificates.

Remove all of the special casing of lightweight CA certificates from
dogtag-ipa-ca-renew-agent-submit.

Make sure existing lightweight CA certmonger tracking requests are updated
on server upgrade.

**renew agent: allow reusing existing certs**

Add a switch which makes `dogtag-ipa-ca-renew-agent-submit` reuse the
existing certificate rather than request a new one from the CA while
maintaining LDAP replication of the certificate.

Make this available as a new `dogtag-ipa-ca-renew-agent-reuse` certmonger
CA.

This allows redoing the LDAP replication and reexecuting pre- and post-save
commands of a tracking request without reissuing the certificate.

**renew agent: always export CSR on IPA CA certificate renewal**

Make sure a CSR is exported for the IPA CA whenever certmonger detects that
the CA certificate is about to expire.

This is a pre-requisite for using the `dogtag-ipa-ca-renew-agent-reuse` CA
instead of the `ipaCSRExport` virtual profile to export the CSR.

**renew agent: get rid of virtual profiles**

Replace all uses of virtual profiles with `dogtag-ipa-ca-renew-agent-reuse`
and remove profile from the IPA CA certificate tracking request.

This prevents virtual profiles from making their way into CSRs and in turn
being rejected by certain CAs. This affected the IPA CA CSR with Microsoft
CS in particular.

**ipa-cacert-manage: add --external-ca-type**

Add the `--external-ca-type`, as known from `ipa-server-install` and
`ipa-ca-install`, to `ipa-cacert-manage`.

This allows creating IPA CA CSRs suitable for use with Microsoft CS using
`ipa-cacert-manage`:

```
ipa-cacert-manage renew --external-ca --external-ca-type=ms-cs
```

https://pagure.io/freeipa/issue/5799
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/728/head:pr728
git checkout pr728
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-pr-728.patch
Type: text/x-diff
Size: 37531 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20170424/9ea0299b/attachment.bin>