Fix pki-server cert-fix #4937
Merged
Fix pki-server cert-fix #4937
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The pki-server cert-fix has been updated to skip ACME and EST subsystems since they don't have CS.cfg and are not needed to renew expired system certificates. The --cert and --extra-cert options have also been updated to accept multiple values which are required by ipa-cert-fix. A new --dm-password option has been added for specifying the Directory Manager password to simplify testing. See also: * https://github.com/dogtagpki/pki/blob/master/docs/admin/Offline_System_Certificate_Renewal.md * https://github.com/dogtagpki/freeipa/wiki/Renewing-System-Certificates Resolves: dogtagpki#4873
A new test has been added to install IPA with short-lived system certs then renew the certs using ipa-cert-fix which internally calls pki-server cert-fix.
|
|
@fmarco76 Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The
pki-server cert-fixhas been updated to skip ACME and EST subsystems since they don't haveCS.cfgand are not needed to renew expired system certificates.The
--certand--extra-certoptions have also been updated to accept multiple values which are required byipa-cert-fix.A new
--dm-passwordoption has been added for specifying the Directory Manager password to simplify testing.A new test has been added to install IPA with short-lived system certs then renew the certs using
ipa-cert-fixwhich internally callspki-server cert-fix.See also:
Resolves: #4873