>From 38b194ab00687cf04ecadceccafe7c27ecda46f7 Mon Sep 17 00:00:00 2001
From: Matthew Harmsen <mharmsen@redhat.com>
Date: Sat, 23 Aug 2014 11:27:07 -0700
Subject: [PATCH] Create 'pki-admin' package

* PKI TRAC Ticket #1118 - Move 'pkispawn' and 'pkidestroy' to a separate
  package called 'pki-admin'
---
 .pydevproject                                      |    1 +
 base/CMakeLists.txt                                |    1 +
 base/admin/CMakeLists.txt                          |   68 +
 base/admin/LICENSE                                 |  291 ++
 base/admin/config/pkislots.cfg                     |  104 +
 base/admin/config/sample.cfg                       |    6 +
 base/admin/config/sampleCAclone.cfg                |   15 +
 base/admin/config/sampleExternalSignedCA-step1.cfg |   10 +
 base/admin/config/sampleExternalSignedCA-step2.cfg |   12 +
 base/admin/config/sampleKRA.cfg                    |   12 +
 base/admin/config/sampleKRAclone.cfg               |   16 +
 base/admin/config/sampleSubordinateCA.cfg          |   13 +
 base/admin/etc/default.cfg                         |  619 +++
 base/admin/man/man5/pki_default.cfg.5              |  348 ++
 base/admin/man/man8/pkidestroy.8                   |   67 +
 base/admin/man/man8/pkispawn.8                     |  460 +++
 base/admin/python/pki/admin/__init__.py            |   22 +
 base/admin/python/pki/admin/deployment/__init__.py |    0
 .../admin/python/pki/admin/deployment/pkiconfig.py |  181 +
 .../admin/python/pki/admin/deployment/pkihelper.py | 4192 ++++++++++++++++++++
 .../python/pki/admin/deployment/pkilogging.py      |   78 +
 .../python/pki/admin/deployment/pkimanifest.py     |  104 +
 .../python/pki/admin/deployment/pkimessages.py     |  421 ++
 .../admin/python/pki/admin/deployment/pkiparser.py | 1273 ++++++
 .../python/pki/admin/deployment/pkiscriptlet.py    |   42 +
 .../pki/admin/deployment/scriptlets/__init__.py    |    0
 .../admin/deployment/scriptlets/configuration.py   |  149 +
 .../admin/deployment/scriptlets/finalization.py    |  102 +
 .../deployment/scriptlets/infrastructure_layout.py |  121 +
 .../admin/deployment/scriptlets/initialization.py  |  118 +
 .../admin/deployment/scriptlets/instance_layout.py |  331 ++
 .../deployment/scriptlets/security_databases.py    |  118 +
 .../admin/deployment/scriptlets/selinux_setup.py   |  241 ++
 .../deployment/scriptlets/slot_substitution.py     |  113 +
 .../deployment/scriptlets/subsystem_layout.py      |  153 +
 .../deployment/scriptlets/webapp_deployment.py     |  177 +
 base/admin/sbin/pkidestroy                         |  278 ++
 base/admin/sbin/pkispawn                           |  586 +++
 base/server/CMakeLists.txt                         |   15 -
 base/server/config/pkislots.cfg                    |  104 -
 base/server/config/sample.cfg                      |    6 -
 base/server/config/sampleCAclone.cfg               |   15 -
 .../server/config/sampleExternalSignedCA-step1.cfg |   10 -
 .../server/config/sampleExternalSignedCA-step2.cfg |   12 -
 base/server/config/sampleKRA.cfg                   |   12 -
 base/server/config/sampleKRAclone.cfg              |   16 -
 base/server/config/sampleSubordinateCA.cfg         |   13 -
 base/server/etc/default.cfg                        |  619 ---
 base/server/man/man5/pki_default.cfg.5             |  348 --
 base/server/man/man8/pkidestroy.8                  |   67 -
 base/server/man/man8/pkispawn.8                    |  460 ---
 .../python/pki/server/deployment/__init__.py       |    0
 .../python/pki/server/deployment/pkiconfig.py      |  181 -
 .../python/pki/server/deployment/pkihelper.py      | 4192 --------------------
 .../python/pki/server/deployment/pkilogging.py     |   78 -
 .../python/pki/server/deployment/pkimanifest.py    |  104 -
 .../python/pki/server/deployment/pkimessages.py    |  421 --
 .../python/pki/server/deployment/pkiparser.py      | 1273 ------
 .../python/pki/server/deployment/pkiscriptlet.py   |   42 -
 .../pki/server/deployment/scriptlets/__init__.py   |    0
 .../server/deployment/scriptlets/configuration.py  |  149 -
 .../server/deployment/scriptlets/finalization.py   |  102 -
 .../deployment/scriptlets/infrastructure_layout.py |  121 -
 .../server/deployment/scriptlets/initialization.py |  118 -
 .../deployment/scriptlets/instance_layout.py       |  331 --
 .../deployment/scriptlets/security_databases.py    |  118 -
 .../server/deployment/scriptlets/selinux_setup.py  |  241 --
 .../deployment/scriptlets/slot_substitution.py     |  113 -
 .../deployment/scriptlets/subsystem_layout.py      |  153 -
 .../deployment/scriptlets/webapp_deployment.py     |  177 -
 base/server/sbin/pkidestroy                        |  278 --
 base/server/sbin/pkispawn                          |  586 ---
 scripts/compose_pki_core_packages                  |    2 +-
 specs/pki-core.spec                                |   51 +-
 74 files changed, 10883 insertions(+), 10488 deletions(-)
 create mode 100644 base/admin/CMakeLists.txt
 create mode 100644 base/admin/LICENSE
 create mode 100644 base/admin/config/pkislots.cfg
 create mode 100644 base/admin/config/sample.cfg
 create mode 100644 base/admin/config/sampleCAclone.cfg
 create mode 100644 base/admin/config/sampleExternalSignedCA-step1.cfg
 create mode 100644 base/admin/config/sampleExternalSignedCA-step2.cfg
 create mode 100644 base/admin/config/sampleKRA.cfg
 create mode 100644 base/admin/config/sampleKRAclone.cfg
 create mode 100644 base/admin/config/sampleSubordinateCA.cfg
 create mode 100644 base/admin/etc/default.cfg
 create mode 100644 base/admin/man/man5/pki_default.cfg.5
 create mode 100644 base/admin/man/man8/pkidestroy.8
 create mode 100644 base/admin/man/man8/pkispawn.8
 create mode 100644 base/admin/python/pki/admin/__init__.py
 create mode 100644 base/admin/python/pki/admin/deployment/__init__.py
 create mode 100644 base/admin/python/pki/admin/deployment/pkiconfig.py
 create mode 100644 base/admin/python/pki/admin/deployment/pkihelper.py
 create mode 100644 base/admin/python/pki/admin/deployment/pkilogging.py
 create mode 100644 base/admin/python/pki/admin/deployment/pkimanifest.py
 create mode 100644 base/admin/python/pki/admin/deployment/pkimessages.py
 create mode 100644 base/admin/python/pki/admin/deployment/pkiparser.py
 create mode 100644 base/admin/python/pki/admin/deployment/pkiscriptlet.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/__init__.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/configuration.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/finalization.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/infrastructure_layout.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/initialization.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/instance_layout.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/security_databases.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/selinux_setup.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/slot_substitution.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/subsystem_layout.py
 create mode 100644 base/admin/python/pki/admin/deployment/scriptlets/webapp_deployment.py
 create mode 100755 base/admin/sbin/pkidestroy
 create mode 100755 base/admin/sbin/pkispawn
 delete mode 100644 base/server/config/pkislots.cfg
 delete mode 100644 base/server/config/sample.cfg
 delete mode 100644 base/server/config/sampleCAclone.cfg
 delete mode 100644 base/server/config/sampleExternalSignedCA-step1.cfg
 delete mode 100644 base/server/config/sampleExternalSignedCA-step2.cfg
 delete mode 100644 base/server/config/sampleKRA.cfg
 delete mode 100644 base/server/config/sampleKRAclone.cfg
 delete mode 100644 base/server/config/sampleSubordinateCA.cfg
 delete mode 100644 base/server/etc/default.cfg
 delete mode 100644 base/server/man/man5/pki_default.cfg.5
 delete mode 100644 base/server/man/man8/pkidestroy.8
 delete mode 100644 base/server/man/man8/pkispawn.8
 delete mode 100644 base/server/python/pki/server/deployment/__init__.py
 delete mode 100644 base/server/python/pki/server/deployment/pkiconfig.py
 delete mode 100644 base/server/python/pki/server/deployment/pkihelper.py
 delete mode 100644 base/server/python/pki/server/deployment/pkilogging.py
 delete mode 100644 base/server/python/pki/server/deployment/pkimanifest.py
 delete mode 100644 base/server/python/pki/server/deployment/pkimessages.py
 delete mode 100644 base/server/python/pki/server/deployment/pkiparser.py
 delete mode 100644 base/server/python/pki/server/deployment/pkiscriptlet.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/__init__.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/configuration.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/finalization.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/infrastructure_layout.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/initialization.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/instance_layout.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/security_databases.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/selinux_setup.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/slot_substitution.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py
 delete mode 100644 base/server/python/pki/server/deployment/scriptlets/webapp_deployment.py
 delete mode 100755 base/server/sbin/pkidestroy
 delete mode 100755 base/server/sbin/pkispawn

diff --git a/.pydevproject b/.pydevproject
index fdc8738..9e222d1 100644
--- a/.pydevproject
+++ b/.pydevproject
@@ -4,6 +4,7 @@
 <pydev_property name="org.python.pydev.PYTHON_PROJECT_VERSION">python 2.7</pydev_property>
 <pydev_pathproperty name="org.python.pydev.PROJECT_SOURCE_PATH">
 <path>/pki/base/common/python/pki</path>
+<path>/pki/base/admin/python/pki/admin</path>
 <path>/pki/base/server/python/pki/server</path>
 <path>/pki/base/kra/functional</path>
 <path>/pki</path>
diff --git a/base/CMakeLists.txt b/base/CMakeLists.txt
index ad3410c..fdd0e65 100644
--- a/base/CMakeLists.txt
+++ b/base/CMakeLists.txt
@@ -8,6 +8,7 @@ if (APPLICATION_FLAVOR_PKI_CORE)
     add_subdirectory(common)
     add_subdirectory(native-tools)
     add_subdirectory(java-tools)
+    add_subdirectory(admin)
 
     if(WITH_SERVER)
         add_subdirectory(server)
diff --git a/base/admin/CMakeLists.txt b/base/admin/CMakeLists.txt
new file mode 100644
index 0000000..9b95975
--- /dev/null
+++ b/base/admin/CMakeLists.txt
@@ -0,0 +1,68 @@
+project(admin NONE)
+
+set(PKI_SUBSYSTEMS
+    ca
+    kra
+    ocsp
+    ra
+    tks
+    tps
+)
+
+set(TOMCAT_SUBSYSTEMS
+    ca
+    kra
+    ocsp
+    tks
+)
+
+set(APACHE_SUBSYSTEMS
+    ra
+    tps
+)
+
+install(
+    DIRECTORY
+        man/
+    DESTINATION
+        ${MAN_INSTALL_DIR}
+    FILE_PERMISSIONS
+        OWNER_READ OWNER_WRITE
+        GROUP_READ
+        WORLD_READ
+)
+
+# install Python libraries
+install(
+    DIRECTORY
+        python/
+    DESTINATION
+        ${PYTHON_SITE_PACKAGES}
+)
+
+# install executables
+install(
+    DIRECTORY
+        sbin/
+    DESTINATION
+        ${SBIN_INSTALL_DIR}
+    FILE_PERMISSIONS
+        OWNER_EXECUTE OWNER_WRITE OWNER_READ
+        GROUP_EXECUTE GROUP_READ
+        WORLD_EXECUTE WORLD_READ
+)
+
+install(
+    DIRECTORY
+        config
+    DESTINATION
+        ${DATA_INSTALL_DIR}/deployment
+)
+
+# install server configuration files
+install(
+    DIRECTORY
+        etc/
+    DESTINATION
+        ${SYSCONF_INSTALL_DIR}/pki
+)
diff --git a/base/admin/LICENSE b/base/admin/LICENSE
new file mode 100644
index 0000000..e281f43
--- /dev/null
+++ b/base/admin/LICENSE
@@ -0,0 +1,291 @@
+This Program is free software; you can redistribute it and/or modify 
+it under the terms of the GNU General Public License as published 
+by the Free Software Foundation; version 2 of the License.
+ 
+This Program is distributed in the hope that it will be useful, but 
+WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 
+or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 
+for more details.
+ 
+You should have received a copy of the GNU General Public License 
+along with this Program; if not, write to the Free Software 
+Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ 
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
diff --git a/base/admin/config/pkislots.cfg b/base/admin/config/pkislots.cfg
new file mode 100644
index 0000000..ce1ac78
--- /dev/null
+++ b/base/admin/config/pkislots.cfg
@@ -0,0 +1,104 @@
+[Apache]
+FORTITUDE_APACHE_SLOT=[FORTITUDE_APACHE]
+FORTITUDE_AUTH_MODULES_SLOT=[FORTITUDE_AUTH_MODULES]
+FORTITUDE_DIR_SLOT=[FORTITUDE_DIR]
+FORTITUDE_LIB_DIR_SLOT=[FORTITUDE_LIB_DIR]
+FORTITUDE_MODULE_SLOT=[FORTITUDE_MODULE]
+FORTITUDE_NSS_MODULES_SLOT=[FORTITUDE_NSS_MODULES]
+HTTPD_CONF_SLOT=[HTTPD_CONF]
+LIB_PREFIX_SLOT=[LIB_PREFIX]
+NON_CLIENTAUTH_SECURE_PORT_SLOT=[NON_CLIENTAUTH_SECURE_PORT]
+NSS_CONF_SLOT=[NSS_CONF]
+OBJ_EXT_SLOT=[OBJ_EXT]
+PKI_INSTANCE_NAME_SLOT=[PKI_INSTANCE_NAME]
+PKI_INSTANCE_INITSCRIPT_SLOT=[PKI_INSTANCE_INITSCRIPT]
+PKI_LOCKDIR_SLOT=[PKI_LOCKDIR]
+PKI_PIDDIR_SLOT=[PKI_PIDDIR]
+PKI_REGISTRY_FILE_SLOT=[PKI_REGISTRY_FILE]
+PKI_WEB_SERVER_TYPE_SLOT=[PKI_WEB_SERVER_TYPE]
+PORT_SLOT=[PORT]
+PROCESS_ID_SLOT=[PROCESS_ID]
+REQUIRE_CFG_PL_SLOT=[REQUIRE_CFG_PL]
+SECURE_PORT_SLOT=[SECURE_PORT]
+SECURITY_LIBRARIES_SLOT=[SECURITY_LIBRARIES]
+PKI_HOSTNAME_SLOT=[PKI_HOSTNAME]
+SERVER_ROOT_SLOT=[SERVER_ROOT]
+SYSTEM_LIBRARIES_SLOT=[SYSTEM_LIBRARIES]
+SYSTEM_USER_LIBRARIES_SLOT=[SYSTEM_USER_LIBRARIES]
+TMP_DIR_SLOT=[TMP_DIR]
+[Tomcat]
+application_version=[APPLICATION_VERSION]
+INSTALL_TIME_SLOT=[INSTALL_TIME]
+PKI_ADMIN_SECURE_PORT_SLOT=[PKI_ADMIN_SECURE_PORT]
+PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME_SLOT=[PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME]
+PKI_ADMIN_SECURE_PORT_SERVER_COMMENT_SLOT=[PKI_ADMIN_SECURE_PORT_SERVER_COMMENT]
+PKI_AGENT_CLIENTAUTH_SLOT=[PKI_AGENT_CLIENTAUTH]
+PKI_AGENT_SECURE_PORT_SLOT=[PKI_AGENT_SECURE_PORT]
+PKI_AJP_PORT_SLOT=[PKI_AJP_PORT]
+PKI_AJP_REDIRECT_PORT_SLOT=[PKI_AJP_REDIRECT_PORT]
+PKI_CA_HOSTNAME_SLOT=[PKI_CA_HOSTNAME]
+PKI_CA_PORT_SLOT=[PKI_CA_PORT]
+PKI_CERT_DB_PASSWORD_SLOT=[PKI_CERT_DB_PASSWORD]
+PKI_CFG_PATH_NAME_SLOT=[PKI_CFG_PATH_NAME]
+PKI_CLOSE_AJP_PORT_COMMENT_SLOT=[PKI_CLOSE_AJP_PORT_COMMENT]
+PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT=[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT_SLOT=[PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
+PKI_CLOSE_SEPARATE_PORTS_WEB_COMMENT_SLOT=[PKI_CLOSE_SEPARATE_PORTS_WEB_COMMENT]
+PKI_CLOSE_STANDALONE_COMMENT_SLOT=[PKI_CLOSE_STANDALONE_COMMENT]
+PKI_CLOSE_TOMCAT_ACCESS_LOG_COMMENT_SLOT=[PKI_CLOSE_TOMCAT_ACCESS_LOG_COMMENT]
+PKI_EE_SECURE_CLIENT_AUTH_PORT_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT]
+PKI_EE_SECURE_CLIENT_AUTH_PORT_CONNECTOR_NAME_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT_CONNECTOR_NAME]
+PKI_EE_SECURE_CLIENT_AUTH_PORT_SERVER_COMMENT_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT_SERVER_COMMENT]
+PKI_EE_SECURE_CLIENT_AUTH_PORT_UI_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT_UI]
+PKI_EE_SECURE_PORT_SLOT=[PKI_EE_SECURE_PORT]
+PKI_EE_SECURE_PORT_CONNECTOR_NAME_SLOT=[PKI_EE_SECURE_PORT_CONNECTOR_NAME]
+PKI_EE_SECURE_PORT_SERVER_COMMENT_SLOT=[PKI_EE_SECURE_PORT_SERVER_COMMENT]
+PKI_ENABLE_RANDOM_SERIAL_NUMBERS=[PKI_ENABLE_RANDOM_SERIAL_NUMBERS]
+PKI_GROUP_SLOT=[PKI_GROUP]
+PKI_INSTANCE_NAME_SLOT=[PKI_INSTANCE_NAME]
+PKI_INSTANCE_INITSCRIPT_SLOT=[PKI_INSTANCE_INITSCRIPT]
+PKI_INSTANCE_PATH_SLOT=[PKI_INSTANCE_PATH]
+PKI_INSTANCE_ROOT_SLOT=[PKI_INSTANCE_ROOT]
+PKI_LOCKDIR_SLOT=[PKI_LOCKDIR]
+PKI_HOSTNAME_SLOT=[PKI_HOSTNAME]
+PKI_OPEN_AJP_PORT_COMMENT_SLOT=[PKI_OPEN_AJP_PORT_COMMENT]
+PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT=[PKI_OPEN_ENABLE_PROXY_COMMENT]
+PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT_SLOT=[PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT]
+PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT_SLOT=[PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT]
+PKI_OPEN_STANDALONE_COMMENT_SLOT=[PKI_OPEN_STANDALONE_COMMENT]
+PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT_SLOT=[PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT]
+PKI_PIDDIR_SLOT=[PKI_PIDDIR]
+PKI_PROXY_SECURE_PORT_SLOT=[PKI_PROXY_SECURE_PORT]
+PKI_PROXY_UNSECURE_PORT_SLOT=[PKI_PROXY_UNSECURE_PORT]
+PKI_RANDOM_NUMBER_SLOT=[PKI_RANDOM_NUMBER]
+PKI_REGISTRY_FILE_SLOT=[PKI_REGISTRY_FILE]
+PKI_RESTEASY_LIB_SLOT=[PKI_RESTEASY_LIB]
+PKI_SECURE_PORT_SLOT=[PKI_SECURE_PORT]
+PKI_SECURE_PORT_CONNECTOR_NAME_SLOT=[PKI_SECURE_PORT_CONNECTOR_NAME]
+PKI_SECURE_PORT_SERVER_COMMENT_SLOT=[PKI_SECURE_PORT_SERVER_COMMENT]
+PKI_SECURITY_MANAGER_SLOT=[PKI_SECURITY_MANAGER]
+PKI_SERVER_XML_CONF_SLOT=[PKI_SERVER_XML_CONF]
+PKI_SSL_SERVER_NICKNAME_SLOT=[PKI_SSL_SERVER_NICKNAME]
+PKI_STANDALONE_SLOT=[PKI_STANDALONE]
+PKI_SUBSYSTEM_TYPE_SLOT=[PKI_SUBSYSTEM_TYPE]
+PKI_SYSTEMD_SERVICENAME_SLOT=[PKI_SYSTEMD_SERVICENAME]
+PKI_TMPDIR_SLOT=[PKI_TMPDIR]
+PKI_UNSECURE_PORT_SLOT=[PKI_UNSECURE_PORT]
+PKI_UNSECURE_PORT_CONNECTOR_NAME_SLOT=[PKI_UNSECURE_PORT_CONNECTOR_NAME]
+PKI_UNSECURE_PORT_SERVER_COMMENT_SLOT=[PKI_UNSECURE_PORT_SERVER_COMMENT]
+PKI_USER_SLOT=[PKI_USER]
+PKI_WEB_SERVER_TYPE_SLOT=[PKI_WEB_SERVER_TYPE]
+PKI_WEBAPPS_NAME_SLOT=[PKI_WEBAPPS_NAME]
+TOKENDB_HOST_SLOT=[TOKENDB_HOST]
+TOKENDB_PORT_SLOT={TOKENDB_PORT]
+TOKENDB_ROOT_SLOT=[TOKENDB_ROOT]
+TOMCAT_CFG_SLOT=[TOMCAT_CFG]
+TOMCAT_INSTANCE_COMMON_LIB_SLOT=[TOMCAT_INSTANCE_COMMON_LIB]
+TOMCAT_LOG_DIR_SLOT=[TOMCAT_LOG_DIR]
+TOMCAT_PIDFILE_SLOT=[TOMCAT_PIDFILE]
+TOMCAT_SERVER_PORT_SLOT=[TOMCAT_SERVER_PORT]
+TOMCAT_SSL2_CIPHERS_SLOT=[TOMCAT_SSL2_CIPHERS]
+TOMCAT_SSL3_CIPHERS_SLOT=[TOMCAT_SSL3_CIPHERS]
+TOMCAT_SSL_OPTIONS_SLOT=[TOMCAT_SSL_OPTIONS]
+TOMCAT_TLS_CIPHERS_SLOT=[TOMCAT_TLS_CIPHERS]
+TPS_DIR_SLOT=[TPS_DIR]
diff --git a/base/admin/config/sample.cfg b/base/admin/config/sample.cfg
new file mode 100644
index 0000000..d2334c7
--- /dev/null
+++ b/base/admin/config/sample.cfg
@@ -0,0 +1,6 @@
+[DEFAULT]
+pki_admin_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+##Required for all subsystems that are not root CAs
+#pki_security_domain_password=
diff --git a/base/admin/config/sampleCAclone.cfg b/base/admin/config/sampleCAclone.cfg
new file mode 100644
index 0000000..0aef7b2
--- /dev/null
+++ b/base/admin/config/sampleCAclone.cfg
@@ -0,0 +1,15 @@
+[DEFAULT]
+pki_admin_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+
+[CA]
+pki_clone=True
+pki_clone_pkcs12_password=
+pki_clone_pkcs12_path=
+pki_clone_replicate_schema=
+pki_clone_uri=
\ No newline at end of file
diff --git a/base/admin/config/sampleExternalSignedCA-step1.cfg b/base/admin/config/sampleExternalSignedCA-step1.cfg
new file mode 100644
index 0000000..35b3d24
--- /dev/null
+++ b/base/admin/config/sampleExternalSignedCA-step1.cfg
@@ -0,0 +1,10 @@
+[DEFAULT]
+pki_admin_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+
+[CA]
+pki_external=True
+pki_external_csr_path=
+pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/admin/config/sampleExternalSignedCA-step2.cfg b/base/admin/config/sampleExternalSignedCA-step2.cfg
new file mode 100644
index 0000000..c106d63
--- /dev/null
+++ b/base/admin/config/sampleExternalSignedCA-step2.cfg
@@ -0,0 +1,12 @@
+[DEFAULT]
+pki_admin_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+
+[CA]
+pki_external=True
+pki_external_ca_cert_chain_path=
+pki_external_ca_cert_path=
+pki_external_step_two=True
+pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/admin/config/sampleKRA.cfg b/base/admin/config/sampleKRA.cfg
new file mode 100644
index 0000000..8cdfb9f
--- /dev/null
+++ b/base/admin/config/sampleKRA.cfg
@@ -0,0 +1,12 @@
+[DEFAULT]
+pki_admin_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+pki_issuing_ca_uri=
+
+[KRA]
+pki_import_admin_cert=
\ No newline at end of file
diff --git a/base/admin/config/sampleKRAclone.cfg b/base/admin/config/sampleKRAclone.cfg
new file mode 100644
index 0000000..96025cf
--- /dev/null
+++ b/base/admin/config/sampleKRAclone.cfg
@@ -0,0 +1,16 @@
+[DEFAULT]
+pki_admin_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+
+[KRA]
+pki_clone=True
+pki_clone_pkcs12_password=
+pki_clone_pkcs12_path=
+pki_clone_replicate_schema=
+pki_clone_uri=
+pki_issuing_ca=
\ No newline at end of file
diff --git a/base/admin/config/sampleSubordinateCA.cfg b/base/admin/config/sampleSubordinateCA.cfg
new file mode 100644
index 0000000..8b61616
--- /dev/null
+++ b/base/admin/config/sampleSubordinateCA.cfg
@@ -0,0 +1,13 @@
+[DEFAULT]
+pki_admin_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+
+[CA]
+pki_subordinate=True
+pki_issuing_ca=
+pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/admin/etc/default.cfg b/base/admin/etc/default.cfg
new file mode 100644
index 0000000..7ecbf10
--- /dev/null
+++ b/base/admin/etc/default.cfg
@@ -0,0 +1,619 @@
+###############################################################################
+##  Default Configuration:                                                   ##
+##                                                                           ##
+##  Values in this section are common to more than one PKI subsystem, and    ##
+##  contain required information which MAY be overridden by users as         ##
+##  necessary.                                                               ##
+##                                                                           ##
+##  There are also some meta-parameters that determine how the PKI           ##
+##  configuratiion should work.                                              ##
+##                                                                           ##
+###############################################################################
+[DEFAULT]
+
+# The sensitive_parameters contains a list of parameters which may contain
+# sensitive information which must not be displayed to the console nor stored
+# in log files for security reasons.
+sensitive_parameters=
+    pki_admin_password
+    pki_backup_password
+    pki_client_database_password
+    pki_client_pin
+    pki_client_pkcs12_password
+    pki_clone_pkcs12_password
+    pki_ds_password
+    pki_one_time_pin
+    pki_pin
+    pki_security_domain_password
+    pki_token_password
+
+# The spawn_scriplets contains a list of scriplets to be executed by pkispawn.
+spawn_scriplets=
+    initialization
+    infrastructure_layout
+    instance_layout
+    subsystem_layout
+    selinux_setup
+    webapp_deployment
+    slot_substitution
+    security_databases
+    configuration
+    finalization
+
+# The destroy_scriplets contains a list of scriplets to be executed by pkidestroy.
+destroy_scriplets=
+    initialization
+    configuration
+    webapp_deployment
+    subsystem_layout
+    security_databases
+    instance_layout
+    selinux_setup
+    infrastructure_layout
+    finalization
+
+# By default, the following parameters will be set for Tomcat and Apache instances.
+# There is no reason to uncomment these.  They are provided for reference in 
+# case someone wants to override them in their config file.
+#
+# Tomcat instances:
+# pki_instance_name=pki-tomcat
+# pki_https_port=8443
+# pki_http_port=8080
+#
+# Apache instances:
+# pki_instance_name=pki-apache
+# pki_https_port=443
+# pki_http_port=80
+
+pki_admin_cert_file=%(pki_client_dir)s/ca_admin.cert
+pki_admin_cert_request_type=pkcs10
+pki_admin_dualkey=False
+pki_admin_keysize=2048
+pki_admin_password=
+pki_audit_group=pkiaudit
+pki_audit_signing_key_algorithm=SHA256withRSA
+pki_audit_signing_key_size=2048
+pki_audit_signing_key_type=rsa
+pki_audit_signing_signing_algorithm=SHA256withRSA
+pki_audit_signing_token=Internal Key Storage Token
+pki_backup_keys=False
+pki_backup_password=
+pki_ca_hostname=%(pki_security_domain_hostname)s
+pki_ca_port=%(pki_security_domain_https_port)s
+pki_client_admin_cert_p12=%(pki_client_dir)s/%(pki_subsystem_type)s_admin_cert.p12
+pki_client_database_password=
+pki_client_database_purge=True
+pki_client_dir=%(home_dir)s/.dogtag/%(pki_instance_name)s
+pki_client_pkcs12_password=
+pki_ds_bind_dn=cn=Directory Manager
+pki_ds_create_new_db=True
+pki_ds_ldap_port=389
+pki_ds_ldaps_port=636
+pki_ds_password=
+pki_ds_remove_data=True
+pki_ds_secure_connection=False
+pki_group=pkiuser
+pki_issuing_ca_hostname=%(pki_security_domain_hostname)s
+pki_issuing_ca_https_port=%(pki_security_domain_https_port)s
+pki_issuing_ca_uri=https://%(pki_issuing_ca_hostname)s:%(pki_issuing_ca_https_port)s
+pki_issuing_ca=%(pki_issuing_ca_uri)s
+pki_restart_configured_instance=True
+pki_security_domain_hostname=%(pki_hostname)s
+pki_security_domain_https_port=8443
+pki_security_domain_name=%(pki_dns_domainname)s Security Domain
+pki_security_domain_password=
+pki_security_domain_user=caadmin
+pki_skip_configuration=False
+pki_skip_installation=False
+pki_ssl_server_key_algorithm=SHA256withRSA
+pki_ssl_server_key_size=2048
+pki_ssl_server_key_type=rsa
+pki_ssl_server_nickname=Server-Cert cert-%(pki_instance_name)s
+pki_ssl_server_subject_dn=cn=%(pki_hostname)s,o=%(pki_security_domain_name)s
+pki_ssl_server_token=Internal Key Storage Token
+pki_subsystem_key_algorithm=SHA256withRSA
+pki_subsystem_key_size=2048
+pki_subsystem_key_type=rsa
+pki_subsystem_nickname=subsystemCert cert-%(pki_instance_name)s
+pki_subsystem_subject_dn=cn=Subsystem Certificate,o=%(pki_security_domain_name)s
+pki_subsystem_token=Internal Key Storage Token
+pki_theme_enable=True
+pki_theme_server_dir=/usr/share/pki/common-ui
+pki_token_name=internal
+pki_token_password=
+pki_user=pkiuser
+
+# Paths:
+# These are used in the processing of pkispawn and are not supposed
+# to be overwritten by user configuration files.
+#
+pki_client_database_dir=%(pki_client_subsystem_dir)s/alias
+pki_client_subsystem_dir=%(pki_client_dir)s/%(pki_subsystem_type)s
+pki_client_password_conf=%(pki_client_subsystem_dir)s/password.conf
+pki_client_pkcs12_password_conf=%(pki_client_subsystem_dir)s/pkcs12_password.conf
+pki_client_cert_database=%(pki_client_database_dir)s/cert8.db
+pki_client_key_database=%(pki_client_database_dir)s/key3.db
+pki_client_secmod_database=%(pki_client_database_dir)s/secmod.db
+pki_client_admin_cert=%(pki_client_dir)s/%(pki_subsystem_type)s_admin.cert
+pki_source_conf_path=/usr/share/pki/%(pki_subsystem_type)s/conf
+pki_source_setup_path=/usr/share/pki/setup
+pki_source_server_path=/usr/share/pki/server/conf
+pki_source_cs_cfg=/usr/share/pki/%(pki_subsystem_type)s/conf/CS.cfg
+pki_source_registry=/usr/share/pki/setup/pkidaemon_registry
+pki_source_subsystem_path=/usr/share/pki/%(pki_subsystem_type)s
+pki_path=%(pki_root_prefix)s/var/lib/pki
+pki_log_path=%(pki_root_prefix)s/var/log/pki
+pki_configuration_path=%(pki_root_prefix)s/etc/pki
+pki_registry_path=%(pki_root_prefix)s/etc/sysconfig/pki
+pki_instance_path=%(pki_path)s/%(pki_instance_name)s
+pki_instance_log_path=%(pki_log_path)s/%(pki_instance_name)s
+pki_instance_configuration_path=%(pki_configuration_path)s/%(pki_instance_name)s
+pki_database_path=%(pki_instance_configuration_path)s/alias
+pki_instance_database_link=%(pki_instance_path)s/alias
+pki_instance_conf_link=%(pki_instance_path)s/conf
+pki_instance_logs_link=%(pki_instance_path)s/logs
+pki_subsystem_path=%(pki_instance_path)s/%(pki_subsystem_type)s
+pki_subsystem_log_path=%(pki_instance_log_path)s/%(pki_subsystem_type)s
+pki_subsystem_archive_log_path=%(pki_subsystem_log_path)s/archive
+pki_subsystem_configuration_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s
+pki_subsystem_database_link=%(pki_subsystem_path)s/alias
+pki_subsystem_conf_link=%(pki_subsystem_path)s/conf
+pki_subsystem_logs_link=%(pki_subsystem_path)s/logs
+pki_subsystem_registry_link=%(pki_subsystem_path)s/registry
+
+ 
+###############################################################################
+##  Apache Configuration:                                                    ##
+##                                                                           ##
+##  Values in this section are common to PKI subsystems that run             ##
+##  as an instance of 'Apache' (RA and TPS subsystems), and contain          ##
+##  required information which MAY be overridden by users as necessary.      ##
+###############################################################################
+[Apache]
+
+# Paths
+# These are used in the processing of pkispawn and are not supposed
+# to be overwritten by user configuration files.
+#
+pki_systemd_service=/lib/systemd/system/pki-apached@.service
+pki_systemd_target=/lib/systemd/system/pki-apached.target
+pki_systemd_target_wants=/etc/systemd/system/pki-apached.target.wants
+pki_systemd_service_link=%(pki_systemd_target_wants)s/pki-apached@%(pki_instance_name)s.service
+pki_cgroup_systemd_service_path=/sys/fs/cgroup/systemd/system/%(pki_systemd_service)s
+pki_cgroup_systemd_service=%(pki_cgroup_systemd_service_path)s/%(pki_instance_name)s
+pki_cgroup_cpu_systemd_service_path=/sys/fs/cgroup/cpu\,cpuacct/system/%(pki_systemd_service)s
+pki_cgroup_cpu_systemd_service=%(pki_cgroup_cpu_systemd_service_path)s/%(pki_systemd_service)s
+pki_instance_type=Apache
+pki_instance_type_registry_path =%(pki_registry_path)s/apache
+pki_instance_registry_path=%(pki_instance_type_registry_path)s/%(pki_instance_name)s
+pki_subsystem_registry_path=%(pki_instance_registry_path)s/%(pki_subsystem_type)s
+
+###############################################################################
+##  Tomcat Configuration:                                                    ##
+##                                                                           ##
+##  Values in this section are common to PKI subsystems that run             ##
+##  as an instance of 'Tomcat' (CA, KRA, OCSP, TKS, and TPS subsystems       ##
+##  including 'Clones', 'Subordinate CAs', and 'External CAs'), and contain  ##
+##  required information which MAY be overridden by users as necessary.      ##
+##                                                                           ##
+##  PKI CLONES:  To specify a 'CA Clone', a 'KRA Clone', an 'OCSP Clone',    ##
+##               a 'TKS Clone', or a 'TPS Clone', change the value of        ##
+##               'pki_clone' from 'False' to 'True'.                         ##
+##                                                                           ##
+##    REMINDER:  PKI CA Clones, Subordinate CAs, and External CAs            ##
+##               are MUTUALLY EXCLUSIVE entities!!!                          ##
+###############################################################################
+[Tomcat]
+pki_ajp_port=8009
+pki_clone=False
+pki_clone_pkcs12_password=
+pki_clone_pkcs12_path=
+pki_clone_replicate_schema=True
+pki_clone_replication_master_port=
+pki_clone_replication_clone_port=
+pki_clone_replication_security=None
+pki_clone_setup_replication=True
+pki_clone_uri=
+pki_enable_access_log=True
+pki_enable_java_debugger=False
+pki_enable_proxy=False
+pki_proxy_http_port=80
+pki_proxy_https_port=443
+pki_security_manager=true
+pki_tomcat_server_port=8005
+
+# Paths
+# These are used in the processing of pkispawn and are not supposed
+# to be overwritten by user configuration files.
+#
+pki_systemd_service=/lib/systemd/system/pki-tomcatd@.service
+pki_systemd_target=/lib/systemd/system/pki-tomcatd.target
+pki_systemd_target_wants=/etc/systemd/system/pki-tomcatd.target.wants
+pki_systemd_service_link=%(pki_systemd_target_wants)s/pki-tomcatd@%(pki_instance_name)s.service
+pki_cgroup_systemd_service_path=/sys/fs/cgroup/systemd/system/%(pki_systemd_service)s
+pki_cgroup_systemd_service=%(pki_cgroup_systemd_service_path)s/%(pki_instance_name)s
+pki_cgroup_cpu_systemd_service_path=/sys/fs/cgroup/cpu\,cpuacct/system/%(pki_systemd_service)s
+pki_cgroup_cpu_systemd_service=%(pki_cgroup_cpu_systemd_service_path)s/%(pki_systemd_service)s
+pki_tomcat_bin_path=/usr/share/tomcat/bin
+pki_tomcat_lib_path=/usr/share/tomcat/lib
+pki_tomcat_systemd=/usr/sbin/tomcat
+pki_source_catalina_properties=%(pki_source_server_path)s/catalina.properties
+pki_source_servercertnick_conf=%(pki_source_server_path)s/serverCertNick.conf
+pki_source_server_xml=%(pki_source_server_path)s/server.xml
+pki_source_context_xml=%(pki_source_server_path)s/context.xml
+pki_source_tomcat_conf=%(pki_source_server_path)s/tomcat.conf
+pki_instance_type=Tomcat
+pki_tomcat_common_path=%(pki_instance_path)s/common
+pki_tomcat_common_lib_path=%(pki_tomcat_common_path)s/lib
+pki_tomcat_tmpdir_path=%(pki_instance_path)s/temp
+pki_tomcat_webapps_path=%(pki_instance_path)s/webapps
+pki_tomcat_work_path=%(pki_instance_path)s/work
+pki_tomcat_work_catalina_path=%(pki_tomcat_work_path)s/Catalina
+pki_tomcat_work_catalina_host_path=%(pki_tomcat_work_catalina_path)s/localhost
+pki_tomcat_work_catalina_host_run_path=%(pki_tomcat_work_catalina_host_path)s/_
+pki_tomcat_work_catalina_host_subsystem_path=%(pki_tomcat_work_catalina_host_path)s/%(pki_subsystem_type)s
+pki_instance_conf_log4j_properties=%(pki_instance_configuration_path)s/log4j.properties
+pki_instance_type_registry_path=%(pki_registry_path)s/tomcat
+pki_instance_registry_path=%(pki_instance_type_registry_path)s/%(pki_instance_name)s
+pki_subsystem_registry_path=%(pki_instance_registry_path)s/%(pki_subsystem_type)s
+pki_tomcat_bin_link=%(pki_instance_path)s/bin
+pki_instance_lib=%(pki_instance_path)s/lib
+pki_instance_lib_log4j_properties=%(pki_instance_lib)s/log4j.properties
+pki_instance_systemd_link=%(pki_instance_path)s/%(pki_instance_name)s
+pki_subsystem_signed_audit_log_path=%(pki_subsystem_log_path)s/signedAudit
+pki_subsystem_tomcat_webapps_link=%(pki_subsystem_path)s/webapps
+pki_tomcat_webapps_subsystem_path=%(pki_tomcat_webapps_path)s/%(pki_subsystem_type)s
+pki_tomcat_webapps_subsystem_webinf_classes_path=%(pki_tomcat_webapps_subsystem_path)s/WEB-INF/classes
+pki_tomcat_webapps_subsystem_webinf_lib_path=%(pki_tomcat_webapps_subsystem_path)s/WEB-INF/lib
+pki_certsrv_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-certsrv.jar
+pki_cmsbundle_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cmsbundle.jar
+pki_cmscore_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cmscore.jar
+pki_cms_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cms.jar
+pki_cmsutil_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cmsutil.jar
+pki_nsutil_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-nsutil.jar
+
+
+# JAR paths
+# These are used in the processing of pkispawn and are not supposed
+# to be overwritten by user configuration files
+pki_jss_jar=%(jni_jar_dir)s/jss4.jar
+pki_symkey_jar=%(jni_jar_dir)s/symkey.jar
+pki_apache_commons_collections_jar=/usr/share/java/apache-commons-collections.jar
+pki_apache_commons_io_jar=/usr/share/java/apache-commons-io.jar
+pki_apache_commons_lang_jar=/usr/share/java/apache-commons-lang.jar
+pki_apache_commons_logging_jar=/usr/share/java/apache-commons-logging.jar
+pki_commons_codec_jar=/usr/share/java/commons-codec.jar
+pki_httpclient_jar=/usr/share/java/httpcomponents/httpclient.jar
+pki_httpcore_jar=/usr/share/java/httpcomponents/httpcore.jar
+pki_javassist_jar=/usr/share/java/javassist.jar
+pki_ldapjdk_jar=/usr/share/java/ldapjdk.jar
+pki_certsrv_jar=/usr/share/java/pki/pki-certsrv.jar
+pki_cmsbundle=/usr/share/java/pki/pki-cmsbundle.jar
+pki_cmscore=/usr/share/java/pki/pki-cmscore.jar
+pki_cms=/usr/share/java/pki/pki-cms.jar
+pki_cmsutil=/usr/share/java/pki/pki-cmsutil.jar
+pki_nsutil=/usr/share/java/pki/pki-nsutil.jar
+pki_tomcat_jar=/usr/share/java/pki/pki-tomcat.jar
+pki_scannotation_jar=/usr/share/java/scannotation.jar
+pki_tomcatjss_jar=/usr/share/java/tomcatjss.jar
+pki_velocity_jar=/usr/share/java/velocity.jar
+pki_xerces_j2_jar=/usr/share/java/xerces-j2.jar
+pki_xml_commons_apis_jar=/usr/share/java/xml-commons-apis.jar
+pki_xml_commons_resolver_jar=/usr/share/java/xml-commons-resolver.jar
+pki_jss_jar_link=%(pki_tomcat_common_lib_path)s/jss4.jar
+pki_symkey_jar_link=%(pki_tomcat_common_lib_path)s/symkey.jar
+pki_apache_commons_collections_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-collections.jar
+pki_apache_commons_io_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-io.jar
+pki_apache_commons_lang_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-lang.jar
+pki_apache_commons_logging_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-logging.jar
+pki_commons_codec_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-codec.jar
+pki_httpclient_jar_link=%(pki_tomcat_common_lib_path)s/httpclient.jar
+pki_httpcore_jar_link=%(pki_tomcat_common_lib_path)s/httpcore.jar
+pki_javassist_jar_link=%(pki_tomcat_common_lib_path)s/javassist.jar
+pki_ldapjdk_jar_link=%(pki_tomcat_common_lib_path)s/ldapjdk.jar
+pki_tomcat_jar_link=%(pki_tomcat_common_lib_path)s/pki-tomcat.jar
+pki_scannotation_jar_link=%(pki_tomcat_common_lib_path)s/scannotation.jar
+pki_tomcatjss_jar_link=%(pki_tomcat_common_lib_path)s/tomcatjss.jar
+pki_velocity_jar_link=%(pki_tomcat_common_lib_path)s/velocity.jar
+pki_xerces_j2_jar_link=%(pki_tomcat_common_lib_path)s/xerces-j2.jar
+pki_xml_commons_apis_jar_link=%(pki_tomcat_common_lib_path)s/xml-commons-apis.jar
+pki_xml_commons_resolver_jar_link=%(pki_tomcat_common_lib_path)s/xml-commons-resolver.jar
+pki_ca_jar=/usr/share/java/pki/pki-ca.jar
+pki_ca_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-ca.jar
+pki_kra_jar=/usr/share/java/pki/pki-kra.jar
+pki_kra_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-kra.jar
+pki_ocsp_jar=/usr/share/java/pki/pki-ocsp.jar
+pki_ocsp_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-ocsp.jar
+pki_tks_jar=/usr/share/java/pki/pki-tks.jar
+pki_tks_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-tks.jar
+pki_tps_jar=/usr/share/java/pki/pki-tps.jar
+pki_tps_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-tps.jar
+
+# Jackson
+pki_jackson_annotations_jar=/usr/share/java/jackson-annotations.jar
+pki_jackson_core_asl_jar=/usr/share/java/jackson/jackson-core-asl.jar
+pki_jackson_core_jar=/usr/share/java/jackson-core.jar
+pki_jackson_databind_jar=/usr/share/java/jackson-databind.jar
+pki_jackson_jaxrs_base_jar=/usr/share/java/jackson-jaxrs-providers/jackson-jaxrs-base.jar
+pki_jackson_jaxrs_jar=/usr/share/java/jackson/jackson-jaxrs.jar
+pki_jackson_jaxrs_json_provider_jar=/usr/share/java/jackson-jaxrs-providers/jackson-jaxrs-json-provider.jar
+pki_jackson_mapper_asl_jar=/usr/share/java/jackson/jackson-mapper-asl.jar
+pki_jackson_module_jaxb_annotations_jar=/usr/share/java/jackson-module-jaxb-annotations.jar
+pki_jackson_mrbean_jar=/usr/share/java/jackson/jackson-mrbean.jar
+pki_jackson_smile_jar=/usr/share/java/jackson/jackson-smile.jar
+pki_jackson_xc_jar=/usr/share/java/jackson/jackson-xc.jar
+
+# RESTEasy
+pki_resteasy_atom_provider_jar=%(resteasy_lib)s/resteasy-atom-provider.jar
+pki_resteasy_client_jar=%(resteasy_lib)s/resteasy-client.jar
+pki_resteasy_jaxb_provider_jar=%(resteasy_lib)s/resteasy-jaxb-provider.jar
+pki_resteasy_jaxrs_api_jar=%(resteasy_lib)s/jaxrs-api.jar
+pki_resteasy_jaxrs_jar=%(resteasy_lib)s/resteasy-jaxrs.jar
+pki_resteasy_jackson_provider_jar=%(resteasy_lib)s/resteasy-jackson-provider.jar
+
+
+###############################################################################
+##  CA Configuration:                                                        ##
+##                                                                           ##
+##  Values in this section are common to CA subsystems including 'PKI CAs',  ##
+##  'Cloned CAs', 'Subordinate CAs', and 'External CAs', and contain         ##
+##  required information which MAY be overridden by users as necessary.      ##
+##                                                                           ##
+##     EXTERNAL CAs:  To specify an 'External CA', change the value          ##
+##                    of 'pki_external' from 'False' to 'True'.              ##
+##                                                                           ##
+##  SUBORDINATE CAs:  To specify a 'Subordinate CA', change the value        ##
+##                    of 'pki_subordinate' from 'False' to 'True'.           ##
+##                                                                           ##
+##         REMINDER:  PKI CA Clones, Subordinate CAs, and External CAs       ##
+##                    are MUTUALLY EXCLUSIVE entities!!!                     ##
+###############################################################################
+[CA]
+pki_ca_signing_key_algorithm=SHA256withRSA
+pki_ca_signing_key_size=2048
+pki_ca_signing_key_type=rsa
+pki_ca_signing_nickname=caSigningCert cert-%(pki_instance_name)s CA
+pki_ca_signing_signing_algorithm=SHA256withRSA
+pki_ca_signing_subject_dn=cn=CA Signing Certificate,o=%(pki_security_domain_name)s
+pki_ca_signing_token=Internal Key Storage Token
+pki_external=False
+pki_external_csr_path=%(pki_instance_configuration_path)s/ca_signing.csr
+pki_external_step_two=False
+pki_external_ca_cert_chain_path=%(pki_instance_configuration_path)s/external_ca_chain.cert
+pki_external_ca_cert_path=%(pki_instance_configuration_path)s/external_ca.cert
+pki_import_admin_cert=False
+pki_ocsp_signing_key_algorithm=SHA256withRSA
+pki_ocsp_signing_key_size=2048
+pki_ocsp_signing_key_type=rsa
+pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s CA
+pki_ocsp_signing_signing_algorithm=SHA256withRSA
+pki_ocsp_signing_subject_dn=cn=CA OCSP Signing Certificate,o=%(pki_security_domain_name)s
+pki_ocsp_signing_token=Internal Key Storage Token
+pki_random_serial_numbers_enable=False
+pki_subordinate=False
+pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
+pki_admin_name=%(pki_admin_uid)s
+pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
+pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
+pki_admin_uid=caadmin
+pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s CA
+pki_audit_signing_subject_dn=cn=CA Audit Signing Certificate,o=%(pki_security_domain_name)s
+pki_ds_base_dn=o=%(pki_instance_name)s-CA
+pki_ds_database=%(pki_instance_name)s-CA
+pki_ds_hostname=%(pki_hostname)s
+pki_subsystem_name=CA %(pki_hostname)s %(pki_https_port)s
+pki_share_db=False
+
+# Paths
+# These are used in the processing of pkispawn and are not supposed
+# to be overwritten by user configuration files.
+#
+pki_source_emails=/usr/share/pki/ca/emails
+pki_source_flatfile_txt=%(pki_source_conf_path)s/flatfile.txt
+pki_source_profiles=/usr/share/pki/ca/profiles
+pki_source_proxy_conf=%(pki_source_conf_path)s/proxy.conf
+pki_source_registry_cfg=%(pki_source_conf_path)s/registry.cfg
+pki_source_admincert_profile=%(pki_source_conf_path)s/adminCert.profile
+pki_source_caauditsigningcert_profile=%(pki_source_conf_path)s/caAuditSigningCert.profile
+pki_source_cacert_profile=%(pki_source_conf_path)s/caCert.profile
+pki_source_caocspcert_profile=%(pki_source_conf_path)s/caOCSPCert.profile
+pki_source_servercert_profile=%(pki_source_conf_path)s/serverCert.profile
+pki_source_subsystemcert_profile=%(pki_source_conf_path)s/subsystemCert.profile
+pki_subsystem_emails_path=%(pki_subsystem_path)s/emails
+pki_subsystem_profiles_path=%(pki_subsystem_path)s/profiles
+
+
+
+
+###############################################################################
+##  KRA Configuration:                                                       ##
+##                                                                           ##
+##  Values in this section are common to KRA subsystems                      ##
+##  including 'PKI KRAs', 'Cloned KRAs', and 'Stand-alone KRAs' and contain  ##
+##  required information which MAY be overridden by users as necessary.      ##
+##                                                                           ##
+##      STAND-ALONE KRAs:  To specify a 'Stand-alone KRA', change the value  ##
+##                         of 'pki_standalone' from 'False' to 'True', and   ##
+##                         specify the various 'pki_external' parameters     ##
+##                         as appropriate.                                   ##
+##                                                                           ##
+###############################################################################
+[KRA]
+pki_import_admin_cert=True
+pki_standalone=False
+pki_external_admin_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.csr
+pki_external_audit_signing_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.csr
+pki_external_sslserver_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.csr
+pki_external_storage_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_storage.csr
+pki_external_subsystem_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.csr
+pki_external_transport_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_transport.csr
+pki_external_step_two=False
+pki_external_ca_cert_chain_path=%(pki_instance_configuration_path)s/external_ca_chain.cert
+pki_external_ca_cert_path=%(pki_instance_configuration_path)s/external_ca.cert
+pki_external_admin_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.cert
+pki_external_audit_signing_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.cert
+pki_external_sslserver_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.cert
+pki_external_storage_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_storage.cert
+pki_external_subsystem_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.cert
+pki_external_transport_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_transport.cert
+pki_storage_key_algorithm=SHA256withRSA
+pki_storage_key_size=2048
+pki_storage_key_type=rsa
+pki_storage_nickname=storageCert cert-%(pki_instance_name)s KRA
+pki_storage_signing_algorithm=SHA256withRSA
+pki_storage_subject_dn=cn=DRM Storage Certificate,o=%(pki_security_domain_name)s
+pki_storage_token=Internal Key Storage Token
+pki_transport_key_algorithm=SHA256withRSA
+pki_transport_key_size=2048
+pki_transport_key_type=rsa
+pki_transport_nickname=transportCert cert-%(pki_instance_name)s KRA
+pki_transport_signing_algorithm=SHA256withRSA
+pki_transport_subject_dn=cn=DRM Transport Certificate,o=%(pki_security_domain_name)s
+pki_transport_token=Internal Key Storage Token
+pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
+pki_admin_name=%(pki_admin_uid)s
+pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
+pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
+pki_admin_uid=kraadmin
+pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s KRA
+pki_audit_signing_subject_dn=cn=KRA Audit Signing Certificate,o=%(pki_security_domain_name)s
+pki_ds_base_dn=o=%(pki_instance_name)s-KRA
+pki_ds_database=%(pki_instance_name)s-KRA
+pki_ds_hostname=%(pki_hostname)s
+pki_subsystem_name=KRA %(pki_hostname)s %(pki_https_port)s
+pki_share_db=True
+pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=%(pki_instance_name)s-CA
+
+
+# Paths
+# These are used in the processing of pkispawn and are not supposed
+# to be overwritten by user configuration files.
+#
+pki_source_servercert_profile=%(pki_source_conf_path)s/serverCert.profile
+pki_source_storagecert_profile=%(pki_source_conf_path)s/storageCert.profile
+pki_source_subsystemcert_profile=%(pki_source_conf_path)s/subsystemCert.profile
+pki_source_transportcert_profile=%(pki_source_conf_path)s/transportCert.profile
+
+###############################################################################
+##  OCSP Configuration:                                                      ##
+##                                                                           ##
+##  Values in this section are common to OCSP subsystems                     ##
+##  including 'PKI OCSPs', 'Cloned OCSPs', and 'Stand-alone OCSPs' and       ##
+##  contain required information which MAY be overridden by users as         ##
+##  necessary.                                                               ##
+##                                                                           ##
+##      STAND-ALONE OCSPs:  To specify a 'Stand-alone OCSP', change the      ##
+##                          value of 'pki_standalone' from 'False' to        ##
+##                          'True', and specify the various 'pki_external'   ##
+##                          parameters as appropriate.                       ##
+##                          (NOTE:  Stand-alone OCSP is not yet supported!)  ##
+##                                                                           ##
+###############################################################################
+[OCSP]
+pki_import_admin_cert=True
+pki_standalone=False
+pki_external_admin_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.csr
+pki_external_audit_signing_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.csr
+pki_external_signing_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_signing.csr
+pki_external_sslserver_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.csr
+pki_external_subsystem_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.csr
+pki_external_step_two=False
+pki_external_ca_cert_chain_path=%(pki_instance_configuration_path)s/external_ca_chain.cert
+pki_external_ca_cert_path=%(pki_instance_configuration_path)s/external_ca.cert
+pki_external_admin_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.cert
+pki_external_audit_signing_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.cert
+pki_external_signing_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_signing.cert
+pki_external_sslserver_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.cert
+pki_external_subsystem_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.cert
+pki_ocsp_signing_key_algorithm=SHA256withRSA
+pki_ocsp_signing_key_size=2048
+pki_ocsp_signing_key_type=rsa
+pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s OCSP
+pki_ocsp_signing_signing_algorithm=SHA256withRSA
+pki_ocsp_signing_subject_dn=cn=OCSP Signing Certificate,o=%(pki_security_domain_name)s
+pki_ocsp_signing_token=Internal Key Storage Token
+pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
+pki_admin_name=%(pki_admin_uid)s
+pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
+pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
+pki_admin_uid=ocspadmin
+pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s OCSP
+pki_audit_signing_subject_dn=cn=OCSP Audit Signing Certificate,o=%(pki_security_domain_name)s
+pki_ds_base_dn=o=%(pki_instance_name)s-OCSP
+pki_ds_database=%(pki_instance_name)s-OCSP
+pki_ds_hostname=%(pki_hostname)s
+pki_subsystem_name=OCSP %(pki_hostname)s %(pki_https_port)s
+pki_share_db=True
+pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=%(pki_instance_name)s-CA
+
+
+###############################################################################
+##  RA Configuration:                                                        ##
+##                                                                           ##
+##  Values in this section are common to PKI RA subsystems, and contain      ##
+##  required information which MAY be overridden by users as necessary.      ##
+###############################################################################
+[RA]
+
+###############################################################################
+##  TKS Configuration:                                                       ##
+##                                                                           ##
+##  Values in this section are common to TKS subsystems                      ##
+##  including 'PKI TKSs' and 'Cloned TKSs', and contain                      ##
+##  required information which MAY be overridden by users as necessary.      ##
+###############################################################################
+[TKS]
+pki_import_admin_cert=True
+pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
+pki_admin_name=%(pki_admin_uid)s
+pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
+pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
+pki_admin_uid=tksadmin
+pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s TKS
+pki_audit_signing_subject_dn=cn=TKS Audit Signing Certificate,o=%(pki_security_domain_name)s
+pki_ds_base_dn=o=%(pki_instance_name)s-TKS
+pki_ds_database=%(pki_instance_name)s-TKS
+pki_ds_hostname=%(pki_hostname)s
+pki_subsystem_name=TKS %(pki_hostname)s %(pki_https_port)s
+pki_share_db=True
+pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=%(pki_instance_name)s-CA
+
+###############################################################################
+##  TPS Configuration:                                                       ##
+##                                                                           ##
+##  Values in this section are common to PKI TPS subsystems, and contain     ##
+##  required information which MAY be overridden by users as necessary.      ##
+###############################################################################
+[TPS]
+pki_import_admin_cert=True
+pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
+pki_admin_name=%(pki_admin_uid)s
+pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
+pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
+pki_admin_uid=tpsadmin
+pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s TPS
+pki_audit_signing_subject_dn=cn=TPS Audit Signing Certificate,o=%(pki_security_domain_name)s
+pki_ds_base_dn=o=%(pki_instance_name)s-TPS
+pki_ds_database=%(pki_instance_name)s-TPS
+pki_ds_hostname=%(pki_hostname)s
+pki_subsystem_name=TPS %(pki_hostname)s %(pki_https_port)s
+pki_authdb_hostname=%(pki_hostname)s
+pki_authdb_port=389
+pki_authdb_secure_conn=False
+pki_ca_uri=https://%(pki_hostname)s:%(pki_https_port)s
+pki_kra_uri=https://%(pki_hostname)s:%(pki_https_port)s
+pki_tks_uri=https://%(pki_hostname)s:%(pki_https_port)s
+pki_enable_server_side_keygen=False
+pki_import_shared_secret=False
+pki_share_db=True
+pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=%(pki_instance_name)s-CA
+pki_source_phone_home_xml=/usr/share/pki/%(pki_subsystem_type)s/conf/phoneHome.xml
+pki_source_registry_cfg=%(pki_source_conf_path)s/registry.cfg
+
+# Paths
+# These are used in the processing of pkispawn and are not supposed
+# to be overwritten by user configuration files.
+#
+pki_subsystem_signed_audit_log_path=%(pki_subsystem_log_path)s/signedAudit
+
diff --git a/base/admin/man/man5/pki_default.cfg.5 b/base/admin/man/man5/pki_default.cfg.5
new file mode 100644
index 0000000..040eb1b
--- /dev/null
+++ b/base/admin/man/man5/pki_default.cfg.5
@@ -0,0 +1,348 @@
+.\" First parameter, NAME, should be all caps
+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
+.\" other parameters are allowed: see man(7), man(1)
+.TH pki_default.cfg 5 "December 13, 2012" "version 1.0" "PKI Default Instance Configuration" Ade Lee
+.\" Please adjust this date whenever revising the man page.
+.\"
+.\" Some roff macros, for reference:
+.\" .nh        disable hyphenation
+.\" .hy        enable hyphenation
+.\" .ad l      left justify
+.\" .ad b      justify to both left and right margins
+.\" .nf        disable filling
+.\" .fi        enable filling
+.\" .br        insert line break
+.\" .sp <n>    insert n+1 empty lines
+.\" for man page specific macros, see man(7)
+.SH NAME
+pki_default.cfg \- Certificate Server instance default config file.
+
+.SH LOCATION
+/etc/pki/default.cfg
+
+.SH DESCRIPTION
+This file contains the default settings for a Certificate Server instance created using \fBpkispawn\fP.  This file should not be edited, as it can be modified when the Certificate Server packages are updated.  Rather, when setting up a Certificate Server instance, a user-provided configuration file can provide overrides to the defaults in /etc/pki/default.cfg.  See \fBpkispawn(8)\fR for details.
+
+.SH SECTIONS
+\fIdefault.cfg\fP is divided into subsystem-based sections ([DEFAULT] for general configuration and subsystem-type sections such as [CA] and [KRA]).  These sections are stacked, so that parameters read in earlier sections can be overwritten by parameters in later sections.  For the Java subsystems (CA, KRA, OCSP, and TKS), the sections read are [DEFAULT], [Tomcat] and the subsystem type section -- [CA], [KRA], [OCSP], and [TKS] -- in that order.  This allows the ability to specify parameters to be shared by all subsystems in [DEFAULT] or [Tomcat], and subsystem-specific upgrades in the other sections.
+.PP
+There are a small number of bootstrap parameters which are passed in the configuration file by \fBpkispawn\fP. Other parameter's values can be interpolated tokens rather than explicit values. For example:
+.PP
+\fBpki_ca_signing_nickname=caSigningCert cert-%(pki_instance_name)s CA\fP
+.PP
+This substitutes the value of pki_instance_name into the parameter value.  It is possible to interpolate any non-password parameter within a section or in [DEFAULT]. Any parameter used in interpolation can \fBONLY\fP be overridden within the same section.  So, for example, pki_instance_name should only be overridden in [DEFAULT]; otherwise, interpolations can fail.
+.TP
+\fBNote:\fP
+Any non-password related parameter values in the configuration file that needs to contain a \fB%\fP character must be properly escaped.  For example, a value of \fBfoo%bar\fP would be specified as \fBfoo%%bar\fP in the configuration file.
+
+.SH GENERAL INSTANCE PARAMETERS
+The parameters described below, as well as the parameters located in the following sections, can be customized as part of a deployment.  This list is not exhaustive.
+.TP
+.B pki_instance_name
+.IP
+Name of the instance. The instance is located at /var/lib/pki/<instance_name>.  For Java subsystems, the default is specified as pki-tomcat.
+.TP
+.B pki_https_port, pki_http_port
+.IP
+Secure and unsecure ports.  Defaults to standard Tomcat ports 8443 and 8080, respectively, for Java subsystems, and 443 and 80 for Apache subsystems.
+.TP
+.B pki_ajp_port, pki_tomcat_server_port
+.IP
+Ports for Tomcat subsystems.  Defaults to standard Tomcat ports of 8009 and 8005, respectively.
+.TP
+.B pki_proxy_http_port, pki_proxy_https_port, pki_enable_proxy
+.IP
+Ports for an Apache proxy server. Certificate Server instances can be run behind an Apache proxy server, which will communicate with the Tomcat instance through the AJP port.  See the Red Hat Certificate System documentation at https://access.redhat.com/knowledge/docs/Red_Hat_Certificate_System/ for details.
+.TP
+.B pki_user, pki_group, pki_audit_group
+.IP
+Specifies the default administrative user, group, and auditor group identities for PKI instances.  The default user and group are both specified as \fBpkiuser\fR, and the default audit group is specified as \fBpkiaudit\fR.
+.TP
+.B pki_token_name, pki_token_password
+.IP
+The token and password where this instance's system certificate and keys are stored.  Defaults to the NSS internal software token.
+
+.SS SYSTEM CERTIFICATE PARAMETERS
+\fBpkispawn\fP sets up a number of system certificates for each subsystem.  The system certificates which are required differ between subsystems.  Each system certificate is denoted by a tag, as noted below.  The different system certificates are:
+.IP
+* signing certificate ("signing").  Used to sign other certificates.  Required for CA.
+.IP
+* OCSP signing certificate ("ocsp_signing" in CA, "signing" in OCSP).  Used to sign CRLs.  Required for OCSP and CA.
+.IP
+* storage certificate ("storage").  Used to encrypt keys for storage in KRA.  Required for KRA only.
+.IP
+* transport certificate ("transport").  Used to encrypt keys in transport to the KRA.  Required for KRA only.
+.IP
+* subsystem certificate ("subsystem").  Used to communicate between subsystems within the security domain.  Issued by the security domain CA.  Required for all subsystems.
+.IP
+* server certificate ("sslserver").  Used for communication with the server.  One server certificate is required for each Certificate Server instance.
+.IP
+* audit signing certificate ("audit_signing").  Used to sign audit logs.  Required for all subsystems except the RA.
+.PP
+Each system certificate can be customized using the parameters below:
+.TP
+.B pki_<tag>_key_type, pki_<type>_keysize, pki_<tag>_key_algorithm
+.IP
+Characteristics of the private key. See the Red Hat Certificate System documentation at https://access.redhat.com/knowledge/docs/Red_Hat_Certificate_System/ for possible options.  The defaults are RSA for the type, 2048 bits for the key size, and SHA256withRSA for the algorithm.
+.TP 
+.B pki_<tag>_signing_algorithm
+.IP
+For signing certificates, the algorithm used for signing.  Defaults to SHA256withRSA.
+.TP
+.B pki_<tag>_token
+.IP
+Location where the certificate and private key are stored.  Defaults to the internal software NSS token database.
+.TP
+.B pki_<tag>_nickname
+.IP
+Nickname for the certificate in the token database.
+.TP
+.B pki_<tag>_subject_dn
+.IP
+Subject DN for the certificate.  The subject DN for the SSL Server certificate must include CN=<hostname>.
+.SS ADMIN USER PARAMETERS
+\fBpkispawn\fP creates a bootstrap administrative user that is a member of all the necessary groups to administer the installed subsystem.  On a security domain CA, the CA administrative user is also a member of the groups required to register a new subsystem on the security domain.  The certificate and keys for this administrative user are stored in a PKCS #12 file in \fBpki_client_dir\fP, and can be imported into a browser to administer the system.
+.TP
+.B pki_admin_name, pki_admin_uid
+.IP
+Name and UID of this administrative user.  Defaults to caadmin for CA, kraadmin for KRA, etc.
+.TP
+.B pki_admin_password
+.IP
+Password for the admin user.  This password is used to log into the pki-console (unless client authentication is enabled), as well as log into the security domain CA.
+.TP
+.B pki_admin_email
+.IP
+Email address for the admin user.
+.TP
+.B pki_admin_dualkey, pki_admin_keysize, pki_admin_keytype
+.IP
+Settings for the administrator certificate and keys.
+.TP
+.B pki_admin_subject_dn
+.IP
+Subject DN for the administrator certificate.  Defaults to \fBcn=PKI Administrator, e=%(pki_admin_email)s, o=%(pki_security_domain_name)s\fP.
+.TP
+.B pki_admin_nickname
+Nickname for the administrator certificate.
+.TP
+.B pki_import_admin_cert
+.IP
+Set to True to import an existing admin certificate for the admin user, rather than generating a new one.  A subsystem-specific administrator will still be created within the subsystem's LDAP tree.  This is useful to allow multiple subsystems within the same instance to be more easily administered from the same browser by using a single certificate.
+
+By default, this is set to False for CA subsystems and true for KRA, OCSP, and TKS subsystems.  In this case, the admin certificate is read from the file ca_admin.cert in \fBpki_client_dir\fP.
+
+Note that cloned subsystems do not create a new administrative user.  The administrative user of the master subsystem is used instead, and the details of this master user are replicated during the install.
+.TP
+.B pki_client_admin_cert_p12
+.IP
+Location for the PKCS #12 file containing the administrative user's certificate and keys.  For a CA, this defaults to \fIca_admin_cert.p12\fP in the \fBpki_client_dir\fP directory.
+.SS BACKUP PARAMETERS
+.TP
+.B pki_backup_keys, pki_backup_password
+.IP
+Set to True to back up the subsystem certificates and keys to a PKCS #12 file.  This file will be located in \fI/var/lib/pki/<instance_name>/alias\fP.  pki_backup_password is the password of the PKCS#12 file.
+  
+.SS CLIENT DIRECTORY PARAMETERS
+.TP
+.B pki_client_dir
+.IP
+This is the location where all client data used during the installation is stored.  At the end of the invocation of \fBpkispawn\fP, the administrative user's certificate and keys are stored in a PKCS #12 file in this location.
+.TP
+.B pki_client_database_dir,  pki_client_database_password
+.IP
+Location where an NSS token database is created in order to generate a key for the administrative user.  Usually, the data in this location is removed at the end of the installation, as the keys and certificates are stored in a PKCS #12 file in \fBpki_client_dir\fP.
+.TP
+.B pki_client_database_purge
+.IP
+Set to True to remove \fBpki_client_database_dir\fP at the end of the installation.  Defaults to True.
+.SS INTERNAL DATABASE PARAMETERS
+\x'-1'\fBpki_ds_hostname, pki_ds_ldap_port, pki_ds_ldaps_port\fR
+.IP
+Hostname and ports for the internal database.  Defaults to localhost, 389, and 636, respectively.
+.PP
+.B pki_ds_bind_dn, pki_ds_password
+.IP
+Credentials to connect to the database during installation.  Directory Manager-level access is required during installation to set up the relevant schema and database.  During the installation, a more restricted Certificate Server user is set up to client authentication connections to the database.  Some additional configuration is required, including setting up the directory server to use SSL.  See the documentation for details. 
+.PP
+.B pki_ds_secure_connection
+.IP
+Sets whether to require connections to the Directory Server using LDAPS.  This requires SSL to be set up on the Directory Server first.  Defaults to false.
+.PP
+.B pki_ds_remove_data
+.IP
+Sets whether to remove any data from the base DN before starting the installation.  Defaults to True.
+.PP
+.B pki_ds_base_dn
+.IP
+The base DN for the internal database.  It is advised that the Certificate Server have its own base DN for its internal database.  If the base DN does not exist, it will be created during the running of \fBpkispawn\fP.  For a cloned subsystem, the base DN for the clone subsystem MUST be the same as for the master subsystem.
+.PP
+.B pki_ds_database
+.IP
+Name of the back-end database.  It is advised that the Certificate Server have its own base DN for its internal database.  If the back-end does not exist, it will be created during the running of \fBpkispawn\fP.
+.SS ISSUING CA PARAMETERS
+\x'-1'\fBpki_issuing_ca_hostname, pki_issuing_ca_https_port, pki_issuing_ca_uri\fR
+.IP
+Hostname and port, or URI of the issuing CA.  Required for installations of subordinate CA and non-CA subsystems.  This should point to the CA that will issue the relevant system certificates for the subsystem.  In a default install, this defaults to the CA subsystem within the same instance.  The URI has the format https://<ca_hostname>:<ca_https_port>.
+
+.SS MISCELLANEOUS PARAMETERS
+\x'-1'\fBpki_restart_configured_instance\fR
+.IP
+Sets whether to restart the instance after configuration is complete.  Defaults to True.
+.PP
+.B pki_skip_configuration
+.IP
+Sets whether to execute the configuration steps when running \fBpkispawn\fP.  If this is true, then the process is analogous to running \fBpkicreate\fP, when the configuration was performed separately from the instance creation.  A configuration URL will be provided.  This URL can be used as a starting point for the browser-based configuration panels.  Defaults to False.
+.PP
+.B pki_skip_installation
+.IP
+Sets whether to skip the installation steps.  With pki_skip_configuration set to False, this is analogous to running pkisilent.  Defaults to False.
+.PP
+.B pki_enable_access_log
+.IP
+Located in the [Tomcat] section, this variable determines whether the instance will enable (True) or disable (False) Tomcat access logging.  Defaults to True.
+.PP
+.B pki_enable_java_debugger
+.IP
+Sets whether to attach a Java debugger such as Eclipse to the instance for troubleshooting.  Defaults to False.
+.PP
+.B pki_security_manager
+.IP
+Enables the Java security manager policies provided by the JDK to be used with the instance.  Defaults to True.
+.PP
+.SS SECURITY DOMAIN PARAMETERS
+The security domain is a component that facilitates communication between subsystems.  The first CA installed hosts this component and is used to register subsequent subsystems with the security domain.  These subsystems can communicate with each other using their subsystem certificate, which is issued by the security domain CA.  For more information about the security domain component, see the Red Hat Certificate System documentation at https://access.redhat.com/knowledge/docs/Red_Hat_Certificate_System/.
+.TP
+.B pki_security_domain_hostname, pki_security_domain_https_port
+.IP
+Location of the security domain.  Required for KRA, OCSP, and TKS subsystems and for CA subsystems joining a security domain.  Defaults to the location of the CA subsystem within the same instance.
+.TP
+.B pki_security_domain_user, pki_security_domain_password
+.IP
+Administrative user of the security domain.  Required for KRA, OCSP, and TKS subsystems, and for CA subsystems joining a security domain.  Defaults to the administrative user for the CA subsystem within the same instance (caadmin).
+.TP
+.B pki_security_domain_name
+.IP
+The name of the security domain. This is required for the security domain CA.
+
+.SS CLONE PARAMETERS
+.TP
+.B pki_clone
+.IP
+Installs a clone, rather than original, subsystem.
+.TP
+.B pki_clone_pkcs12_password, pki_clone_pkcs12_path
+.IP
+Location and password of the PKCS #12 file containing the system certificates for the master subsystem being cloned.  This file should be readable by the user that the Certificate Server is running as (default of pkiuser), and have the correct selinux context (pki_tomcat_cert_t).  This can be achieved by placing the file in \fI/var/lib/pki/<instance_name>/alias\fP.
+.TP
+.B pki_clone_replication_master_port, pki_clone_replication_clone_port
+.IP
+Ports on which replication occurs.  These are the ports on the master and clone databases respectively.  Defaults to the internal database port. 
+.TP
+.B pki_clone_repicate_schema
+.IP
+Replicate schema when the replication agreement is set up and the new instance (consumer) is initialized.  Otherwise, the schema must be installed in the clone as a separate step beforehand.  This does not usually have to be changed.  Defaults to True.
+.TP
+.B pki_clone_replication_security
+.IP
+The type of security used for the replication data.  This can be set to SSL (using LDAPS), TLS, or None.  Defaults to None.  For SSL and TLS, SSL must be set up for the database instances beforehand.
+.TP
+.B pki_clone_uri
+.IP
+A pointer to the subsystem being cloned.  The format is https://<master_hostname>:<master_https_port>.
+
+.SS EXTERNAL CA CERTIFICATE PARAMETERS
+\x'-1'\fBpki_external\fR
+.IP
+Sets whether the new CA will have a signing certificate that will be issued by an external CA.  This is a two step process.  In the first step, a CSR to be presented to the external CA is generated.  In the second step, the issued signing certificate and certificate chain are provided to the \fBpkispawn\fP utility to complete the installation.  Defaults to False.
+.PP
+.B pki_external_csr_path
+.IP
+Required in the first step of the external CA signing process.  The CSR will be printed to the screen and stored in this location.
+.PP
+.B pki_external_step_two
+.IP
+Specifies that this is the second step of the external CA process.  Defaults to False.
+.PP
+.B pki_external_ca_cert_path, pki_external_ca_cert_chain_path
+.IP
+Required for the second step of the external CA signing process.  This is the location of the CA signing cert (as issued by the external CA) and the external CA's certificate chain.
+.SS SUBORDINATE CA CERTIFICATE PARAMETERS
+\x'-1'\fBpki_subordinate\fR
+.IP
+Specifies whether the new CA which will be a subordinate of another CA.  The master CA is specified by \fBpki_issuing_ca\fP.  Defaults to False.
+.SS STANDALONE PKI PARAMETERS
+A stand-alone PKI subsystem is defined as a non-CA PKI subsystem that does not contain a CA as a part of its deployment, and functions as its own security domain.  Currently, only stand-alone DRMs are supported.
+.TP
+.B pki_standalone
+.IP
+Sets whether or not the new PKI subsystem will be stand-alone.  This is a two step process.  In the first step, CSRs for each of this stand-alone PKI subsystem's certificates will be generated so that they may be presented to the external CA.  In the second step, the issued certificates, external CA certificate, and external CA certificate chain are provided to the \fBpkispawn\fP utility to complete the installation.  Defaults to False.
+.PP
+.B pki_external_admin_csr_path
+.IP
+Will be generated by the first step of a stand-alone PKI process.  This is the location of the file containing the administrator's CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.csr'.
+.PP
+.B pki_external_audit_signing_csr_path
+.IP
+Will be generated by the first step of a stand-alone PKI process.  This is the location of the file containing the audit signing CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.csr'.
+.PP
+.B pki_external_sslserver_csr_path
+.IP
+Will be generated by the first step of a stand-alone PKI process.  This is the location of the file containing the SSL server CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.csr'.
+.PP
+.B pki_external_storage_csr_path
+.IP
+[DRM ONLY] Will be generated by the first step of a stand-alone DRM process.  This is the location of the file containing the storage CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/kra_storage.csr'.
+.PP
+.B pki_external_subsystem_csr_path
+.IP
+Will be generated by the first step of a stand-alone PKI process.  This is the location of the file containing the subsystem CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.csr'.
+.PP
+.B pki_external_transport_csr_path
+.IP
+[DRM ONLY] Will be generated by the first step of a stand-alone DRM process.  This is the location of the file containing the transport CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/kra_transport.csr'.
+.PP
+.B pki_external_step_two
+.IP
+Specifies that this is the second step of a standalone PKI process.  Defaults to False.
+.PP
+.B pki_external_ca_cert_chain_path
+.IP
+Required for the second step of a stand-alone PKI process.  This is the location of the file containing the external CA signing certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/external_ca.cert'.
+.PP
+.B pki_external_ca_cert_path
+.IP
+Required for the second step of a stand-alone PKI process.  This is the location of the file containing the external CA's certificate chain (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/external_ca_chain.cert'.
+.PP
+.B pki_external_admin_cert_path
+.IP
+Required for the second step of a stand-alone PKI process.  This is the location of the file containing the administrator's certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.cert'.
+.PP
+.B pki_external_audit_signing_cert_path
+.IP
+Required for the second step of a stand-alone PKI process.  This is the location of the file containing the audit signing certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.cert'.
+.PP
+.B pki_external_sslserver_cert_path
+.IP
+Required for the second step of a stand-alone PKI process.  This is the location of the file containing the sslserver certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.cert'.
+.PP
+.B pki_external_storage_cert_path
+.IP
+[DRM ONLY] Required for the second step of a stand-alone DRM process.  This is the location of the file containing the storage certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/kra_storage.cert'.
+.PP
+.B pki_external_subsystem_cert_path
+.IP
+Required for the second step of a stand-alone PKI process.  This is the location of the file containing the subsystem certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.cert'.
+.PP
+.B pki_external_transport_cert_path
+.IP
+[DRM ONLY] Required for the second step of a stand-alone DRM process.  This is the location of the file containing the transport certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/kra_transport.cert'.
+
+.SH AUTHORS
+Ade Lee <alee@redhat.com>.  \fBpkispawn\fP was written by the Dogtag project.
+
+.SH COPYRIGHT
+Copyright (c) 2012 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+
+.SH SEE ALSO
+.BR pkispawn(8)
diff --git a/base/admin/man/man8/pkidestroy.8 b/base/admin/man/man8/pkidestroy.8
new file mode 100644
index 0000000..407a915
--- /dev/null
+++ b/base/admin/man/man8/pkidestroy.8
@@ -0,0 +1,67 @@
+.\" First parameter, NAME, should be all caps
+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
+.\" other parameters are allowed: see man(7), man(1)
+.TH pkidestroy 8 "December 13, 2012" "version 1.0" "PKI Instance Removal Utility" Ade Lee
+.\" Please adjust this date whenever revising the man page.
+.\"
+.\" Some roff macros, for reference:
+.\" .nh        disable hyphenation
+.\" .hy        enable hyphenation
+.\" .ad l      left justify
+.\" .ad b      justify to both left and right margins
+.\" .nf        disable filling
+.\" .fi        enable filling
+.\" .br        insert line break
+.\" .sp <n>    insert n+1 empty lines
+.\" for man page specific macros, see man(7)
+.SH NAME
+pkidestroy \- Removes a subsystem from an instance of Certificate Server.
+
+.SH SYNOPSIS
+pkidestroy -s <subsystem> -i <instance> [-u <secutiry domain username>] [-W <security domain password file>] [-h] [-v] [-p <prefix>]
+
+.SH DESCRIPTION
+Removes a subsystem from an instance of Certificate Server.  This utility removes any of the Java-based Certificate Server subsystems (CA, KRA, OCSP, and TKS).
+.PP
+.TP
+\fBNote:\fP 
+This utility is only used for Java-based subsystems. The Apache-based Certificate Server subsystems (RA and TPS) are removed using \fBpkiremove\fP.
+.PP
+An instance can contain multiple subsystems, although it may contain at most one of each type of subsystem.  So, for example, an instance could contain CA and KRA subsystems,  but not two CA subsystems.  If \fBpkidestroy\fP is invoked on the last subsystem in the instance, then that instance is removed.  Typically, as subsystems need to contact the CA to update the security domain, the CA instance should be the last instance to be removed.
+
+.SH OPTIONS
+.TP
+.B -s <subsystem>
+Specifies the subsystem to be removed, where <subsystem> is CA, KRA, OCSP, or TKS. If this option is not specified, \fBpkidestroy\fP
+will prompt for its value.
+.TP
+.B -i <instance>
+Specifies the name of the instance from which the subsystem should be removed.  The instance is located at /var/log/pki/<instance>. If this option is not specified, \fBpkidestroy\fP
+will prompt for its value.
+.TP
+.B -u <security domain username> 
+Specifies the username of the security domain of the subsystem. This is an \fBoptional\fP parameter.
+.TP
+.B -W <security domain password file> 
+Specifies the file containing the password of the security domain of the subsystem. This is an \fBoptional\fP parameter. 
+.TP
+.B -h, --help
+Prints additional help information.
+.TP
+.B -v
+Displays verbose information about the installation.  This flag can be provided multiple times to increase verbosity.  See
+.B pkidestroy -h 
+for details.
+
+
+.SH BUGS
+Report bugs to http://bugzilla.redhat.com.
+
+.SH AUTHORS
+Ade Lee <alee@redhat.com>.  \fBpkidestroy\fP was written by the Certificate Server project.
+
+.SH COPYRIGHT
+Copyright (c) 2012 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+
+.SH SEE ALSO
+.BR pkispawn(8)
diff --git a/base/admin/man/man8/pkispawn.8 b/base/admin/man/man8/pkispawn.8
new file mode 100644
index 0000000..ebed2cb
--- /dev/null
+++ b/base/admin/man/man8/pkispawn.8
@@ -0,0 +1,460 @@
+.\" First parameter, NAME, should be all caps
+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
+.\" other parameters are allowed: see man(7), man(1)
+.TH pkispawn 8 "December 13, 2012" "version 1.0" "PKI Instance Creation Utility" Ade Lee
+.\" Please adjust this date whenever revising the man page.
+.\"
+.\" Some roff macros, for reference:
+.\" .nh        disable hyphenation
+.\" .hy        enable hyphenation
+.\" .ad l      left justify
+.\" .ad b      justify to both left and right margins
+.\" .nf        disable filling
+.\" .fi        enable filling
+.\" .br        insert line break
+.\" .sp <n>    insert n+1 empty lines
+.\" for man page specific macros, see man(7)
+.SH NAME
+pkispawn \- Sets up an instance of Certificate Server.
+
+.SH SYNOPSIS
+pkispawn -s <subsystem> -f <config_file> [-h] [-v] [-p <prefix>]
+
+.SH DESCRIPTION
+Sets up an instance of Certificate Server.  This utility creates any of the Java-based Certificate Server subsystems (CA, KRA, OCSP, and TKS). 
+.TP
+\fBNote:\fP 
+A 389 Directory Server instance must be configured and running before this script can be run. Certificate Server requires an internal directory database. The default configuration assumes a Directory Server instance running on the same machine on port 389.  For more information on creating a Directory Server instance, see
+.B setup-ds.pl(8).
+.TP
+\fBNote:\fP 
+This utility creates only Java-based subsystems. The Apache-based Certificate Server subsystems (RA and TPS) are created using \fBpkicreate\fP. 
+.PP
+An instance can contain multiple subsystems, although it may contain at most one of each type of subsystem on a single machine.  So, for example, an instance could contain CA and KRA subsystems,  but not two CA subsystems.  To create an instance with a CA and a KRA, simply run pkispawn twice, with values 
+.I -s CA 
+and 
+.I -s KRA 
+respectively.
+.PP
+The instances are created based on values for configuration parameters in the default configuration (/etc/pki/default.cfg) and the user-provided configuration file.  The user-provided configuration file is read after the default configuration file, so any parameters defined in that file will override parameters in the default configuration file.  In general, most users will store only those parameters which are different from the default configuration in their user-provided configuration file.
+.PP
+This configuration file contains directives that are divided into sections for different subsystem types (such as [DEFAULT], [CA], and [KRA]).  These sections are stacked, so that parameters read in earlier sections can be overwritten by parameters in later sections.  For the Java subsystems (CA, KRA, OCSP and TKS), the sections read are [DEFAULT], [Tomcat] and the subsystem-type section ([CA], [KRA], [OCSP], or [TKS]), in that order.  This allows the ability to specify parameters to be shared by all subsystems in [DEFAULT] or [Tomcat], and system-specific upgrades in the [CA], [KRA], and other sections.
+.TP
+\fBNote:\fP
+Any non-password related parameter values in the configuration file that needs to contain a \fB%\fP character must be properly escaped.  For example, a value of \fBfoo%bar\fP would be specified as \fBfoo%%bar\fP in the configuration file.
+.PP
+At a minimum, the user-defined configuration file must provide some passwords needed for the install.  An example configuration file is provided in the 
+.B EXAMPLES
+section below.  For more information on the default configuration file and the parameters it contains (and can be customized), see
+.B pki_default.cfg(5).
+.PP
+The \fBpkispawn\fP run creates several different installation files that can be referenced later, if need be:
+.IP
+* For Tomcat-based instances, a Tomcat instance is created at \fT/var/lib/pki/<pki_instance_name>\fP, where pki_instance_name is defined in the configuration file.  
+.IP
+* A log file of \fBpkispawn\fP operations is written to \fI/var/log/pki/pki-<subsystem>-spawn.<timestamp>.log\fP.  
+.IP
+* A .p12 (PKCS #12) file containing a certificate for a subsystem administrator is stored in pki_client_dir. 
+.PP
+When the utility is done running, the CA can be accessed by pointing a browser to https://<hostname>:<pki_https_port>/. The agent pages can be accessed by importing the CA certificate and administrator certificate into the browser. 
+.PP
+The Certificate Server instance can also be accessed using the \fBpki\fP command line interface.  See 
+\fBpki(1)\fP. For more extensive documentation on how to use Certificate Server features, see the Red Hat Certificate System Documentation at https://access.redhat.com/knowledge/docs/Red_Hat_Certificate_System/.
+.PP
+Instances created using \fBpkispawn\fP can be removed using \fBpkidestroy\fP.  See
+.BR pkidestroy(8).
+.PP
+\fBpkispawn\fP supersedes and combines the functionality of \fBpkicreate\fP and \fBpkisilent\fP, which were available in earlier releases of Certificate Server.  It is now possible to completely create and configure the Certificate Server subsystem in a single step using \fBpkispawn\fP.
+ 
+.PP
+Although \fBpkispawn\fP can be used to install and configure an instance in a single invocation, it can also still be directed to split this work into separate 'installation' and 'configuration' tasks (e. g. - to support an organization's policy where 'installation' and 'configuration' tasks must be fulfilled by separate roles).
+
+.PP
+To run \fBpkispawn\fP for instance installation only, leave the configuration parameter \fBpki_skip_installation\fP set to False (the default), and set the configuration parameter \fBpki_skip_configuration\fP to True. This instance must then be configured using either a \fBpkispawn\fP command line interface (CLI) configuration, or a browser-based (GUI) configuration.
+
+.PP
+To configure an instance using the CLI-based configuration, set the configuration parameter \fBpki_skip_installation\fP to True, leave the configuration parameter \fBpki_skip_configuration\fP to False (the default), and run \fBpkispawn\fP for configuration only.
+
+.PP
+To configure an instance using the GUI-based configuration, launch a browser, input the configuration URL located inside the \fI/var/log/pki/pki-<subsystem>-spawn.<timestamp>.log\fP file, and fill-in the desired/required information for each panel.  The final panel will instruct the user to restart the server.
+
+.TP
+\fBNote:\fP 
+CLI-based configuration and GUI-based configuration go through different code. There is additional code in the CLI-based configuration to support instances that contain more than one subsystem; the GUI-based configuration does not contain this code.  Consequently, GUI-based configuration must not be used to configure a PKI instance which contains more than one subsystem.
+
+.SH OPTIONS
+.TP
+.B -s <subsystem>
+Specifies the subsystem to be installed and configured, where <subsystem> is CA, KRA, OCSP, or TKS.
+.TP
+.B -f <config_file>
+Specifies the path to the user-defined configuration file.  This file contains differences between the default configuration and the custom configuration.
+.TP
+.B -h, --help
+Prints additional help information.
+.TP
+.B -v
+Displays verbose information about the installation.  This flag can be provided multiple times to increase verbosity.  See
+.B pkispawn -h 
+for details.
+
+.SH INTERACTIVE MODE
+.PP
+If no options are specified, pkispawn will provide an interactive menu to collect the parameters needed to install
+the Certificate Server instance.  Note that only the most basic installation options are provided.  This includes root CAs,
+KRAs, OCSPs and TKS, connecting to the LDAP port of a directory server.  More complicated setups such as: cloned subsystems, subordinate or externally signed CAs, subsystems that connect to the directory server using LDAPS, and subsystems that are customized beyond the options described below -  require the use of a configuration file with the
+-f option.
+.PP
+The interactive option is most useful for those users getting familiar with Certificate Server.  The parameters collected are
+written to the installation file of the subsystem, which can be found at \fB/etc/sysconfig/pki/tomcat/<instance name>/<subsystem>/deployment.cfg.\fP
+.PP
+The following parameters are queried interactively during the installation process:
+.PP
+\fBSubsystem Type\fP
+.TP
+\fISubsystem (CA/KRA/OCSP/TKS):\fP
+the type of subsystem to be installed. Prompted when the -s option is not specified.  The default value chosen is CA.
+.PP
+\fBInstance Specific Parameters\fP
+.TP
+\fIInstance name:\fP
+the name of the tomcat instance in which the subsystem is to be installed. The default value is pki-tomcat.
+.br
+\fBNote:\fP Only one subsystem of a given type (CA, KRA, OCSP, TKS) can exist within a given instance.
+.TP
+\fIHTTP port:\fP
+the HTTP port of the Tomcat instance. The default value is 8080.
+.TP
+\fISecure HTTP port:\fP
+the HTTPS port of the Tomcat instance. The default value is 8443.
+.TP
+\fIAJP port:\fP
+the AJP port of the Tomcat instance. The default value is 8009.
+.TP
+\fIManagement port:\fP
+the management port of the Tomcat instance. The default value is 8005.
+.PP
+\fBAdministrative User Parameters\f
+.TP
+\fIUsername:\fP
+the username of the administrator of this subsystem. The default value is <ca/kra/tks/ocsp>admin.
+.TP
+\fIPassword:\fP
+password for the administrator user.
+.TP
+\fIImport certificate:\fP
+An optional parameter that can be used to import an already available CA admin certificate into this instance.
+.TP
+\fIExport certificate:\fP
+setup the path where the admin certificate of this <subsystem> should be stored. The default value is /root/.dogtag/pki-tomcat/<ca/kra/tks/ocsp>_admin.cert.
+.PP
+\fBDirectory Server Parameters\f
+.TP
+\fIHostname:\fP
+Hostname of the directory server instance.  The default value is the hostname of the system.
+.TP
+\fIPort:\fP
+Port for the directory server instance. The default value is 389.
+.TP
+\fIBase DN:\fP
+the Base DN to be used for the internal database for this subsystem. The default value is o=pki-tomcat-<subsystem>.
+.TP
+\fIBind DN:\fP
+the bind DN required to connect for the directory server. This user must have sufficient permissions to install the required schema and database.  The default value is cn=Directory Manager.
+.TP
+\fIPassword:\fP
+password for the bind DN.
+.PP
+\fBSecurity Domain Parameters\f
+.TP
+\fIName:\fP
+the name of the security domain. Required only if installing a root CA. Default value: <DNS domain name> Security Domain.
+.TP
+\fIHostname:\fP
+the hostname for the security domain CA. Required only for non-CA subsystems. The default value is the hostname of this system.
+.TP
+\fISecure HTTP port:\fP
+the https port for the security domain. Required only for non-CA subsystems. The default value is 8443.
+.TP
+\fIUsername:\fP
+the username of the security domain administrator of the CA. Required only for non-CA subsystems. The default value is caadmin.
+.TP
+\fIPassword:\fP
+password for the security domain administrator. Required for all subsystems that are not root CAs.
+
+.SH EXAMPLES
+.SS CA using default configuration
+\x'-1'\fBpkispawn -s CA -f myconfig.txt\fR
+.PP
+where \fImyconfig.txt\fP contains the following text:
+.IP
+.nf
+[DEFAULT]
+pki_admin_password=\fIpassword123\fP
+pki_client_pkcs12_password=\fIpassword123\fP
+pki_ds_password=\fIpassword123\fP
+.fi
+.PP
+Prior to running this command, a Directory Server instance should be created and running. This command assumes that the Directory Server instance is using its default configuration:
+.IP
+* Installed on the local machine
+.IP
+* Listening on port 389 
+.IP
+* The user is cn=Directory Manager, with the password specified in pki_ds_password
+
+This invocation of \fBpkispawn\fP creates a Tomcat instance containing a CA running on the local machine with secure port 8443 and unsecure port 8080.  To access this CA, simply point a browser to https://<hostname>:8443.
+.PP
+The instance name (defined by pki_instance_name) is pki-tomcat, and it is located at \fI/var/lib/pki/pki-tomcat\fP.  Logs for the instance are located at \fI/var/log/pki/pki-tomcat\fP, and an installation log is written to \fI/var/log/pki/pki-<subsystem>-spawn.<timestamp>.log\fP.
+.PP
+A PKCS #12 file containing the administrator certificate is created in \fI$HOME/.dogtag/pki-tomcat\fP.  This PKCS #12 file uses the password designated by pki_client_pkcs12_password in the configuration file.
+.PP
+To access the agent pages, first import the CA certificate by accessing the CA End Entity Pages and clicking on the Retrieval Tab.  Be sure to trust the CA certificate.  Then, import the administrator certificate in the PKCS #12 file.
+.SS KRA, OCSP, or TKS using default configuration
+\x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
+.PP
+where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP contains the following text: 
+.IP
+.nf
+[DEFAULT]
+pki_admin_password=\fIpassword123\fP
+pki_client_pkcs12_password=\fIpassword123\fP
+pki_ds_password=\fIpassword123\fP
+pki_security_domain_password=\fIpassword123\fP
+.fi
+.PP
+The \fBpki_security_domain_password\fP is the admin password of the CA installed in the same default instance. This command should be run after a CA is installed.  This installs another subsystem within the same default instance using the certificate generated for the CA administrator for the subsystem's administrator.  This allows a user to access both subsystems on the browser with a single administrator certificate.  To access the new subsystem's functionality, simply point the browser to https://<hostname>:8443 and click the relevant top-level links.
+.SS KRA, OCSP, or TKS connecting to a remote CA
+\x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
+.PP
+where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP contains the following text:
+.IP
+.nf
+[DEFAULT]
+pki_admin_password=\fIpassword123\fP
+pki_client_pkcs12_password=\fIpassword123\fP
+pki_ds_password=\fIpassword123\fP
+pki_security_domain_password=\fIpassword123\fP
+pki_security_domain_hostname=<ca_hostname>
+pki_security_domain_https_port=<ca_port>
+pki_security_domain_user=caadmin
+pki_issuing_ca_uri=https://<ca_hostname>:<ca_port>
+
+[KRA]
+pki_import_admin_cert=False
+.fi
+.PP
+A remote CA is one where the CA resides in another Certificate Server instance, either on the local machine or a remote machine.  In this case, \fImyconfig.txt\fP must specify the connection information for the remote CA and the information about the security domain (the trusted collection of subsystems within an instance).
+.PP
+The subsystem section is [KRA], [OCSP], or [TKS].  This example assumes that the specified CA hosts the security domain.  The CA must be running and accessible.  
+.PP 
+A new administrator certificate is generated for the new subsystem and stored in a PKCS #12 file in \fI$HOME/.dogtag/pki-tomcat\fP.
+.SS Installing a CA clone
+\x'-1'\fBpkispawn -s CA -f myconfig.txt\fR
+.PP 
+where \fImyconfig.txt\fP contains the following text:
+.IP
+.nf
+[DEFAULT]
+pki_admin_password=\fIpassword123\fP
+pki_client_pkcs12_password=\fIpassword123\fP
+pki_ds_password=\fIpassword123\fP
+pki_security_domain_password=\fIpassword123\fP
+pki_security_domain_hostname=<master_ca_hostname>
+pki_security_domain_https_port=<master_ca_https_port>
+pki_security_domain_user=caadmin
+
+[CA]
+pki_clone=True
+pki_clone_pkcs12_password=\fIpassword123\fP
+pki_clone_pkcs12_path=<path_to_pkcs12_file>
+pki_clone_replicate_schema=True
+pki_clone_uri=https://<master_ca_hostname>:<master_ca_https_port>
+.fi
+.PP
+A cloned CA is a CA which uses the same signing, OCSP signing, and audit signing certificates as the master CA, but issues certificates within a different serial number range.  It has its own internal database -- separate from the master CA database -- but using the same base DN, that keeps in sync with the master CA through replication agreements between the databases.  This is very useful for load sharing and disaster recovery. To create a clone, the \fImyconfig.txt\fP uses pki_clone-* parameters in its [CA] section which identify the original CA to use as a master template. Additionally, it connects to the master CA as a remote CA and uses its security domain.
+.PP
+Before the clone can be generated, the Directory Server must be created that is separate from the master CA's Directory Server.  The example assumes that the master CA and cloned CA are on different machines, and that their Directory Servers are on port 389.  In addition, the master's system certs and keys have been stored in a PKCS #12 file that is copied over to the clone subsystem in the location specified in <path_to_pkcs12_file>.  This file is created when the master CA is installed; it can also be generated using \fBPKCS12Export\fP.  The file needs to be readable by the user the Certificate Server runs as (by default, pkiuser) and be given the SELinux context pki_tomcat_cert_t.
+.PP
+.SS Installing a KRA, OCSP, or TKS clone
+\x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
+.PP
+where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP contains the following text:
+.IP
+.nf
+[DEFAULT]
+pki_admin_password=\fIpassword123\fP
+pki_client_pkcs12_password=\fIpassword123\fP
+pki_ds_password=\fIpassword123\fP
+pki_security_domain_password=\fIpassword123\fP
+pki_security_domain_hostname=<master_ca_hostname>
+pki_security_domain_https_port=<master_ca_https_port>
+pki_security_domain_user=caadmin
+
+[KRA]
+pki_clone=True
+pki_clone_pkcs12_password=\fIpassword123\fP
+pki_clone_pkcs12_path=<path_to_pkcs12_file>
+pki_clone_replicate_schema=True
+pki_clone_uri=https://<master_kra_host>:<master_kra_https_port>
+pki_issuing_ca=https://<ca_hostname>:<ca_https_port>
+.fi
+.PP
+As with a CA clone, a KRA, OCSP, or TKS clone uses the same certificates and basic configuration as the original subsystem. The configuration points to the original subsystem to copy its configuration. This example also assumes that the CA is on a remote machine and specifies the CA and security domain information. 
+.PP
+The subsystem section is [KRA], [OCSP], or [TKS].
+.SS Installing a subordinate CA
+\x'-1'\fBpkispawn -s CA -f myconfig.txt\fR
+.PP
+where \fImyconfig.txt\fP contains the following text:
+.IP
+.nf
+[DEFAULT]
+pki_admin_password=\fIpassword123\fP
+pki_client_pkcs12_password=\fIpassword123\fP
+pki_ds_password=\fIpassword123\fP
+pki_security_domain_password=\fIpassword123\fP
+pki_security_domain_hostname=<security_domain_ca_hostname>
+pki_security_domain_https_port=<security_domain_ca_https_port>
+pki_security_domain_user=caadmin
+
+[CA]
+pki_subordinate=True
+pki_issuing_ca=https://<master_ca_hostname>:<master_ca_https_port>
+pki_ca_signing_subject_dn=cn=CA Subordinate Signing ,o=example.com
+.fi
+.PP
+A sub-CA derives its certificate configuration -- such as allowed extensions and validity periods -- from a superior or root CA. Otherwise, the configuration of the CA is independent of the root CA, so it is its own instance rather than a clone. A sub-CA is configured using the pki_subordinate parameter and a pointer to the CA which issues the sub-CA's certificates.
+.PP
+\fBNote:\fP The value of \fBpki_ca_signing_subject_dn\fP of a subordinate CA should be different from the root CA's signing subject DN.
+.SS Installing an externally signed CA
+\x'-1'\fBpkispawn -s CA -f myconfig.txt\fR
+.PP
+This is a two step process.
+.PP
+In the first step, a certificate signing request (CSR) is generated for the signing certificate and \fImyconfig.txt\fP contains the following text:
+.IP
+.nf
+[DEFAULT]
+pki_admin_password=\fIpassword123\fP
+pki_client_pkcs12_password=\fIpassword123\fP
+pki_ds_password=\fIpassword123\fP
+pki_security_domain_password=\fIpassword123\fP
+
+[CA]
+pki_external=True
+pki_external_csr_path=/tmp/ca_signing.csr
+pki_ca_signing_subject_dn=cn=CA Signing,ou=External,o=example.com
+.fi
+.PP
+The CSR is written to pki_external_csr_path.  The pki_ca_signing_subject_dn should be different from the subject DN of the external CA that is signing the request.  The pki_ca_signing_subject_dn parameter can be used to specify the signing certificate's subject DN.
+
+.PP
+The CSR is then submitted to the external CA, and the resulting certificate and certificate chain are saved to files on the system.
+
+.PP
+In the second step, the configuration file has been modified to install the issued certificates. In place of the original CSR, the configuration file now points to the issued CA certificate and certificate chain. There is also a flag to indicate that this completes the installation process (pki_external_step_two). 
+.IP
+.nf
+[DEFAULT]
+pki_admin_password=\fIpassword123\fP
+pki_client_pkcs12_password=\fIpassword123\fP
+pki_ds_password=\fIpassword123\fP
+pki_security_domain_password=\fIpassword123\fP
+
+[CA]
+pki_external=True
+pki_external_ca_cert_chain_path=/tmp/ca_cert_chain.cert
+pki_external_ca_cert_path=/tmp/ca_signing.cert
+pki_external_step_two=True
+pki_ca_signing_subject_dn=cn=CA Signing Certificate,ou=External,o=example.com
+.fi
+.PP
+Then, the \fBpkispawn\fP command is run again:
+.PP
+.B pkispawn -s CA -f myconfig.txt
+
+.SS Execution management of a PKI instance (start, stop, status, etc.)
+.BR
+.PP
+To start all 389 instances (local PKI databases):
+.IP
+.nf
+\fBsystemctl start dirsrv.target\fR
+.fi
+.PP
+To stop all 389 instances (local PKI databases):
+.IP
+.nf
+\fBsystemctl stop dirsrv.target\fR
+.fi
+.PP
+To restart all 389 instances (local PKI databases):
+.IP
+.nf
+\fBsystemctl restart dirsrv.target\fR
+.fi
+.PP
+To obtain the status of all 389 instances (local PKI databases):
+.IP
+.nf
+\fBsystemctl status dirsrv.target\fR
+.fi
+.PP
+To start a PKI instance named <pki_instance_name>:
+.IP
+.nf
+\fBsystemctl start pki-tomcatd@<pki_instance_name>.service\fR
+.fi
+.PP
+To stop a PKI instance named <pki_instance_name>:
+.IP
+.nf
+\fBsystemctl stop pki-tomcatd@<pki_instance_name>.service\fR
+.fi
+.PP
+To restart a PKI instance named <pki_instance_name>:
+.IP
+.nf
+\fBsystemctl restart pki-tomcatd@<pki_instance_name>.service\fR
+.fi
+.PP
+To obtain the status of a PKI instance named <pki_instance_name>:
+.IP
+.nf
+\fBsystemctl status pki-tomcatd@<pki_instance_name>.service\fR
+.fi
+.PP
+To obtain a detailed status of a Tomcat PKI instance named <pki_instance_name>:
+.IP
+.nf
+\fBpkidaemon status tomcat <pki_instance_name>\fR
+.fi
+.PP
+To obtain a detailed status of all Tomcat PKI instances:
+.IP
+.nf
+\fBpkidaemon status tomcat\fR
+.fi
+
+.PP
+To enable a PKI instance named <pki_instance_name> to be started automatically upon system reboot:
+.IP
+.nf
+\x'-1'\fBsystemctl enable pki-tomcatd@<pki_instance_name>.service\fR
+.fi
+
+.SH BUGS
+Report bugs to http://bugzilla.redhat.com.
+
+.SH AUTHORS
+Ade Lee <alee@redhat.com>.  \fBpkispawn\fP was written by the Certificate Server project.
+
+.SH COPYRIGHT
+Copyright (c) 2012 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+
+.SH SEE ALSO
+.BR pkidestroy(8),
+.BR pki_default.cfg(5),
+.BR pki(1),
+.BR setup-ds.pl(8)
diff --git a/base/admin/python/pki/admin/__init__.py b/base/admin/python/pki/admin/__init__.py
new file mode 100644
index 0000000..5a702d5
--- /dev/null
+++ b/base/admin/python/pki/admin/__init__.py
@@ -0,0 +1,22 @@
+#!/usr/bin/python
+# Authors:
+#     Endi S. Dewata <edewata@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2013 Red Hat, Inc.
+# All rights reserved.
+#
+
+import pki
diff --git a/base/admin/python/pki/admin/deployment/__init__.py b/base/admin/python/pki/admin/deployment/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/base/admin/python/pki/admin/deployment/pkiconfig.py b/base/admin/python/pki/admin/deployment/pkiconfig.py
new file mode 100644
index 0000000..67edad1
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/pkiconfig.py
@@ -0,0 +1,181 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# PKI Deployment Constants
+PKI_DEPLOYMENT_DEFAULT_CLIENT_DIR_PERMISSIONS = 00755
+PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS = 00770
+PKI_DEPLOYMENT_DEFAULT_EXE_PERMISSIONS = 00770
+PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS = 00660
+PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS = 00600
+PKI_DEPLOYMENT_DEFAULT_SGID_DIR_PERMISSIONS = 02770
+PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS = 00777
+PKI_DEPLOYMENT_DEFAULT_UMASK = 00002
+
+PKI_DEPLOYMENT_DEFAULT_COMMENT = "'Certificate System'"
+PKI_DEPLOYMENT_DEFAULT_GID = 17
+PKI_DEPLOYMENT_DEFAULT_GROUP = "pkiuser"
+PKI_DEPLOYMENT_DEFAULT_SHELL = "/sbin/nologin"
+PKI_DEPLOYMENT_DEFAULT_UID = 17
+PKI_DEPLOYMENT_DEFAULT_USER = "pkiuser"
+
+PKI_SUBSYSTEMS = ["CA", "KRA", "OCSP", "RA", "TKS", "TPS"]
+PKI_SIGNED_AUDIT_SUBSYSTEMS = ["CA", "KRA", "OCSP", "TKS", "TPS"]
+PKI_APACHE_SUBSYSTEMS = ["RA"]
+PKI_TOMCAT_SUBSYSTEMS = ["CA", "KRA", "OCSP", "TKS", "TPS"]
+PKI_BASE_RESERVED_NAMES = ["alias", "bin", "ca", "common", "conf", "kra",
+                           "lib", "logs", "ocsp", "temp", "tks", "tps",
+                           "webapps", "work"]
+PKI_CONFIGURATION_RESERVED_NAMES = ["CA", "java", "nssdb", "rpm-gpg",
+                                    "rsyslog", "tls"]
+PKI_APACHE_REGISTRY_RESERVED_NAMES = ["ra"]
+PKI_TOMCAT_REGISTRY_RESERVED_NAMES = ["ca", "kra", "ocsp", "tks", "tps"]
+
+PKI_INDENTATION_LEVEL_0 = {'indent': ''}
+PKI_INDENTATION_LEVEL_1 = {'indent': '... '}
+PKI_INDENTATION_LEVEL_2 = {'indent': '....... '}
+PKI_INDENTATION_LEVEL_3 = {'indent': '........... '}
+PKI_INDENTATION_LEVEL_4 = {'indent': '............... '}
+
+PKI_DEPLOYMENT_INTERRUPT_BANNER = "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+"\
+                                  "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-"
+
+PKI_DEPLOYMENT_SOURCE_ROOT = "/usr/share/pki"
+PKI_DEPLOYMENT_BASE_ROOT = "/var/lib/pki"
+# NOTE: Top-level "/etc/pki" is owned by the "filesystem" package!
+PKI_DEPLOYMENT_CONFIGURATION_ROOT = "/etc/pki"
+PKI_DEPLOYMENT_LOG_ROOT = "/var/log/pki"
+# NOTE:  Well-known 'registry root', default 'instance', and default
+#        'configuration file' names MUST be created in order to potentially
+#        obtain an instance-specific configuration file
+#        (presuming one has not been specified during command-line parsing)
+#        because command-line parsing happens prior to reading any
+#        configuration files.  Although the 'registry root' MUST remain fixed,
+#        the default 'instance' name may be overridden by the value specified
+#        in the configuration file (the value in the default configuration file
+#        should always match the 'default' instance name specified below).
+PKI_DEPLOYMENT_DEFAULT_APACHE_INSTANCE_NAME = "pki-apache"
+PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME = "pki-tomcat"
+
+DEFAULT_DEPLOYMENT_CONFIGURATION = "default.cfg"
+USER_DEPLOYMENT_CONFIGURATION = "deployment.cfg"
+
+PKI_DEPLOYMENT_DEFAULT_CONFIGURATION_FILE = \
+    PKI_DEPLOYMENT_CONFIGURATION_ROOT + "/" + DEFAULT_DEPLOYMENT_CONFIGURATION
+PKI_DEPLOYMENT_SLOTS_CONFIGURATION_FILE = \
+    PKI_DEPLOYMENT_SOURCE_ROOT + "/deployment/config/pkislots.cfg"
+
+# subtypes of PKI subsystems
+PKI_DEPLOYMENT_CLONED_PKI_SUBSYSTEM = "Cloned"
+PKI_DEPLOYMENT_EXTERNAL_CA = "External"
+PKI_DEPLOYMENT_SUBORDINATE_CA = "Subordinate"
+
+# default ports (for defined selinux policy)
+PKI_DEPLOYMENT_DEFAULT_TOMCAT_HTTP_PORT = 8080
+PKI_DEPLOYMENT_DEFAULT_TOMCAT_HTTPS_PORT = 8443
+PKI_DEPLOYMENT_DEFAULT_TOMCAT_SERVER_PORT = 8005
+PKI_DEPLOYMENT_DEFAULT_TOMCAT_AJP_PORT = 8009
+
+# PKI Deployment Global Variables
+pki_install_time = None
+pki_timestamp = None
+pki_architecture = None
+pki_hostname = None
+pki_dns_domainname = None
+pki_certificate_timestamp = None
+
+
+# PKI Deployment Command-Line Variables
+pki_deployment_executable = None
+
+# PKI Deployment "Mandatory" Command-Line Variables
+pki_subsystem = None
+#     'pkispawn' ONLY
+default_deployment_cfg = None
+user_deployment_cfg = None
+#     'pkidestroy' ONLY
+pki_deployed_instance_name = None
+pki_secdomain_user = None
+pki_secdomain_pass = None
+
+# PKI Deployment "Test" Command-Line Variables
+pki_root_prefix = None
+
+
+# PKI Deployment Helper Functions
+def str2bool(string):
+    return string.lower() in ("yes", "true", "t", "1")
+
+
+# NOTE:  To utilize the 'preparations_for_an_external_java_debugger(master)'
+#        and 'wait_to_attach_an_external_java_debugger(master)' functions,
+#        change 'pki_enable_java_debugger=False' to
+#        'pki_enable_java_debugger=True' in the appropriate
+#        deployment configuration file.
+def prepare_for_an_external_java_debugger(instance):
+    print
+    print PKI_DEPLOYMENT_INTERRUPT_BANNER
+    print
+    print "The following 'JAVA_OPTS' MUST be edited in"
+    print "'%s':" % instance
+    print
+    print "    JAVA_OPTS=\"-DRESTEASY_LIB=/usr/share/java/resteasy \""
+    print "              \"-Xdebug -Xrunjdwp:transport=dt_socket,\""
+    print "              \"address=8000,server=y,suspend=n \""
+    print "              \"-Djava.awt.headless=true -Xmx128M\""
+    print
+    raw_input("Enable external java debugger 'JAVA_OPTS' "
+              "and press return to continue  . . . ")
+    print
+    print PKI_DEPLOYMENT_INTERRUPT_BANNER
+    print
+    return
+
+
+def wait_to_attach_an_external_java_debugger():
+    print
+    print PKI_DEPLOYMENT_INTERRUPT_BANNER
+    print
+    print "Attach the java debugger to this process on the port specified by"
+    print "the 'address' selected by 'JAVA_OPTS' (e. g. - port 8000) and"
+    print "set any desired breakpoints"
+    print
+    raw_input("Please attach an external java debugger "
+              "and press return to continue  . . . ")
+    print
+    print PKI_DEPLOYMENT_INTERRUPT_BANNER
+    print
+    return
+
+
+# PKI Deployment Logger Variables
+pki_log = None
+pki_log_dir = None
+pki_log_name = None
+pki_log_level = None
+pki_console_log_level = None
+
+# PKI Selinux Constants and parameters
+PKI_INSTANCE_SELINUX_CONTEXT = "pki_tomcat_var_lib_t"
+PKI_LOG_SELINUX_CONTEXT = "pki_tomcat_log_t"
+PKI_CFG_SELINUX_CONTEXT = "pki_tomcat_etc_rw_t"
+PKI_CERTDB_SELINUX_CONTEXT = "pki_tomcat_cert_t"
+PKI_PORT_SELINUX_CONTEXT = "http_port_t"
+pki_selinux_config_ports = []
diff --git a/base/admin/python/pki/admin/deployment/pkihelper.py b/base/admin/python/pki/admin/deployment/pkihelper.py
new file mode 100644
index 0000000..148dab0
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/pkihelper.py
@@ -0,0 +1,4192 @@
+#!/usr/bin/python -t
+
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# System Imports
+import errno
+import sys
+import os
+import fileinput
+import random
+import re
+import shutil
+from shutil import Error, WindowsError
+import string
+import subprocess
+import time
+import types
+from datetime import datetime
+from grp import getgrgid
+from grp import getgrnam
+from pwd import getpwnam
+from pwd import getpwuid
+import xml.etree.ElementTree as ET
+import zipfile
+import selinux
+if selinux.is_selinux_enabled():
+    import seobject
+
+
+# PKI Deployment Imports
+from . import pkiconfig as config
+from .pkiconfig import pki_selinux_config_ports as ports
+from . import pkimanifest as manifest
+from . import pkimessages as log
+from .pkiparser import PKIConfigParser
+import pki.account
+import pki.client
+import pki.system
+
+
+# PKI Deployment Helper Functions
+def pki_copytree(src, dst, symlinks=False, ignore=None):
+    """Recursively copy a directory tree using copy2().
+
+    PATCH:  This code was copied from 'shutil.py' and patched to
+            allow 'The destination directory to already exist.'
+
+    If exception(s) occur, an Error is raised with a list of reasons.
+
+    If the optional symlinks flag is true, symbolic links in the
+    source tree result in symbolic links in the destination tree; if
+    it is false, the contents of the files pointed to by symbolic
+    links are copied.
+
+    The optional ignore argument is a callable. If given, it
+    is called with the `src` parameter, which is the directory
+    being visited by pki_copytree(), and `names` which is the list of
+    `src` contents, as returned by os.listdir():
+
+        callable(src, names) -> ignored_names
+
+    Since pki_copytree() is called recursively, the callable will be
+    called once for each directory that is copied. It returns a
+    list of names relative to the `src` directory that should
+    not be copied.
+
+    *** Consider this example code rather than the ultimate tool.
+
+    """
+    names = os.listdir(src)
+    if ignore is not None:
+        ignored_names = ignore(src, names)
+    else:
+        ignored_names = set()
+
+    # PATCH:  ONLY execute 'os.makedirs(dst)' if the top-level
+    #         destination directory does NOT exist!
+    if not os.path.exists(dst):
+        os.makedirs(dst)
+    errors = []
+    for name in names:
+        if name in ignored_names:
+            continue
+        srcname = os.path.join(src, name)
+        dstname = os.path.join(dst, name)
+        try:
+            if symlinks and os.path.islink(srcname):
+                linkto = os.readlink(srcname)
+                os.symlink(linkto, dstname)
+            elif os.path.isdir(srcname):
+                pki_copytree(srcname, dstname, symlinks, ignore)
+            else:
+                # Will raise a SpecialFileError for unsupported file types
+                shutil.copy2(srcname, dstname)
+        # catch the Error from the recursive pki_copytree so that we can
+        # continue with other files
+        except Error, err:
+            errors.extend(err.args[0])
+        except EnvironmentError, why:
+            errors.append((srcname, dstname, str(why)))
+    try:
+        shutil.copystat(src, dst)
+    except OSError, why:
+        if WindowsError is not None and isinstance(why, WindowsError):
+            # Copying file access times may fail on Windows
+            pass
+        else:
+            errors.extend((src, dst, str(why)))
+    if errors:
+        raise Error(errors)
+
+
+class Identity:
+    """PKI Deployment Identity Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+
+    def __add_gid(self, pki_group):
+        try:
+            # Does the specified 'pki_group' exist?
+            pki_gid = getgrnam(pki_group)[2]
+            # Yes, group 'pki_group' exists!
+            config.pki_log.info(log.PKIHELPER_GROUP_ADD_2, pki_group, pki_gid,
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+        except KeyError as exc:
+            # No, group 'pki_group' does not exist!
+            config.pki_log.debug(log.PKIHELPER_GROUP_ADD_KEYERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            try:
+                # Is the default well-known GID already defined?
+                group = getgrgid(config.PKI_DEPLOYMENT_DEFAULT_GID)[0]
+                # Yes, the default well-known GID exists!
+                config.pki_log.info(log.PKIHELPER_GROUP_ADD_DEFAULT_2,
+                                    group, config.PKI_DEPLOYMENT_DEFAULT_GID,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                # Attempt to create 'pki_group' using a random GID.
+                command = ["/usr/sbin/groupadd", pki_group]
+            except KeyError as exc:
+                # No, the default well-known GID does not exist!
+                config.pki_log.debug(log.PKIHELPER_GROUP_ADD_GID_KEYERROR_1,
+                                     exc, extra=config.PKI_INDENTATION_LEVEL_2)
+                # Is the specified 'pki_group' the default well-known group?
+                if pki_group == config.PKI_DEPLOYMENT_DEFAULT_GROUP:
+                    # Yes, attempt to create the default well-known group
+                    # using the default well-known GID.
+                    command = ["/usr/sbin/groupadd",
+                               "-g", str(config.PKI_DEPLOYMENT_DEFAULT_GID),
+                               "-r", pki_group]
+                else:
+                    # No, attempt to create 'pki_group' using a random GID.
+                    command = ["/usr/sbin/groupadd", pki_group]
+            try:
+                # Execute this "groupadd" command.
+                with open(os.devnull, "w") as fnull:
+                    subprocess.check_call(command, stdout=fnull, stderr=fnull,
+                                          close_fds=True)
+            except subprocess.CalledProcessError as exc:
+                config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise
+            except OSError as exc:
+                config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise
+        return
+
+    def __add_uid(self, pki_user, pki_group):
+        try:
+            # Does the specified 'pki_user' exist?
+            pki_uid = getpwnam(pki_user)[2]
+            # Yes, user 'pki_user' exists!
+            config.pki_log.info(log.PKIHELPER_USER_ADD_2, pki_user, pki_uid,
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+            # NOTE:  For now, never check validity of specified 'pki_group'!
+        except KeyError as exc:
+            # No, user 'pki_user' does not exist!
+            config.pki_log.debug(log.PKIHELPER_USER_ADD_KEYERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            try:
+                # Is the default well-known UID already defined?
+                user = getpwuid(config.PKI_DEPLOYMENT_DEFAULT_UID)[0]
+                # Yes, the default well-known UID exists!
+                config.pki_log.info(log.PKIHELPER_USER_ADD_DEFAULT_2,
+                                    user, config.PKI_DEPLOYMENT_DEFAULT_UID,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                # Attempt to create 'pki_user' using a random UID.
+                command = ["/usr/sbin/useradd",
+                           "-g", pki_group,
+                           "-d", config.PKI_DEPLOYMENT_SOURCE_ROOT,
+                           "-s", config.PKI_DEPLOYMENT_DEFAULT_SHELL,
+                           "-c", config.PKI_DEPLOYMENT_DEFAULT_COMMENT,
+                           pki_user]
+            except KeyError as exc:
+                # No, the default well-known UID does not exist!
+                config.pki_log.debug(log.PKIHELPER_USER_ADD_UID_KEYERROR_1,
+                                     exc, extra=config.PKI_INDENTATION_LEVEL_2)
+                # Is the specified 'pki_user' the default well-known user?
+                if pki_user == config.PKI_DEPLOYMENT_DEFAULT_USER:
+                    # Yes, attempt to create the default well-known user
+                    # using the default well-known UID.
+                    command = ["/usr/sbin/useradd",
+                               "-g", pki_group,
+                               "-d", config.PKI_DEPLOYMENT_SOURCE_ROOT,
+                               "-s", config.PKI_DEPLOYMENT_DEFAULT_SHELL,
+                               "-c", config.PKI_DEPLOYMENT_DEFAULT_COMMENT,
+                               "-u", str(config.PKI_DEPLOYMENT_DEFAULT_UID),
+                               "-r", pki_user]
+                else:
+                    # No, attempt to create 'pki_user' using a random UID.
+                    command = ["/usr/sbin/useradd",
+                               "-g", pki_group,
+                               "-d", config.PKI_DEPLOYMENT_SOURCE_ROOT,
+                               "-s", config.PKI_DEPLOYMENT_DEFAULT_SHELL,
+                               "-c", config.PKI_DEPLOYMENT_DEFAULT_COMMENT,
+                               pki_user]
+            try:
+                # Execute this "useradd" command.
+                with open(os.devnull, "w") as fnull:
+                    subprocess.check_call(command, stdout=fnull, stderr=fnull,
+                                          close_fds=True)
+            except subprocess.CalledProcessError as exc:
+                config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise
+            except OSError as exc:
+                config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise
+        return
+
+    def add_uid_and_gid(self, pki_user, pki_group):
+        self.__add_gid(pki_group)
+        self.__add_uid(pki_user, pki_group)
+        return
+
+    def get_uid(self, critical_failure=True):
+        try:
+            return self.mdict['pki_uid']
+        except KeyError as exc:
+            config.pki_log.error(log.PKI_KEYERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+            return None
+
+    def get_gid(self, critical_failure=True):
+        try:
+            return self.mdict['pki_gid']
+        except KeyError as exc:
+            config.pki_log.error(log.PKI_KEYERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+            return None
+
+    def set_uid(self, name, critical_failure=True):
+        try:
+            config.pki_log.debug(log.PKIHELPER_USER_1, name,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            # id -u <name>
+            pki_uid = getpwnam(name)[2]
+            self.mdict['pki_uid'] = pki_uid
+            config.pki_log.debug(log.PKIHELPER_UID_2, name, pki_uid,
+                                 extra=config.PKI_INDENTATION_LEVEL_3)
+            return pki_uid
+        except KeyError as exc:
+            config.pki_log.error(log.PKI_KEYERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+            return None
+
+    def set_gid(self, name, critical_failure=True):
+        try:
+            config.pki_log.debug(log.PKIHELPER_GROUP_1, name,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            # id -g <name>
+            pki_gid = getgrnam(name)[2]
+            self.mdict['pki_gid'] = pki_gid
+            config.pki_log.debug(log.PKIHELPER_GID_2, name, pki_gid,
+                                 extra=config.PKI_INDENTATION_LEVEL_3)
+            return pki_gid
+        except KeyError as exc:
+            config.pki_log.error(log.PKI_KEYERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+            return None
+
+
+class Namespace:
+    """PKI Deployment Namespace Class"""
+
+    # Silently verify that the selected 'pki_instance_name' will
+    # NOT produce any namespace collisions
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+
+    def collision_detection(self):
+        # Run simple checks for pre-existing namespace collisions
+        if os.path.exists(self.mdict['pki_instance_path']):
+            if os.path.exists(self.mdict['pki_subsystem_path']):
+                # Top-Level PKI base path collision
+                config.pki_log.error(
+                    log.PKIHELPER_NAMESPACE_COLLISION_2,
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_instance_path'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKIHELPER_NAMESPACE_COLLISION_2 % (
+                        self.mdict['pki_instance_name'],
+                        self.mdict['pki_instance_path']))
+        else:
+            if os.path.exists(self.mdict['pki_target_tomcat_conf_instance_id']):
+                # Top-Level "/etc/sysconfig" path collision
+                config.pki_log.error(
+                    log.PKIHELPER_NAMESPACE_COLLISION_2,
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_target_tomcat_conf_instance_id'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKIHELPER_NAMESPACE_COLLISION_2 % (
+                        self.mdict['pki_instance_name'],
+                        self.mdict['pki_target_tomcat_conf_instance_id']))
+            if os.path.exists(self.mdict['pki_cgroup_systemd_service']):
+                # Systemd cgroup path collision
+                config.pki_log.error(
+                    log.PKIHELPER_NAMESPACE_COLLISION_2,
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_cgroup_systemd_service_path'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKIHELPER_NAMESPACE_COLLISION_2 % (
+                        self.mdict['pki_instance_name'],
+                        self.mdict['pki_cgroup_systemd_service_path']))
+            if os.path.exists(self.mdict['pki_cgroup_cpu_systemd_service']):
+                # Systemd cgroup CPU path collision
+                config.pki_log.error(
+                    log.PKIHELPER_NAMESPACE_COLLISION_2,
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_cgroup_cpu_systemd_service_path'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKIHELPER_NAMESPACE_COLLISION_2 % (
+                        self.mdict['pki_instance_name'],
+                        self.mdict['pki_cgroup_cpu_systemd_service_path']))
+        if os.path.exists(self.mdict['pki_instance_log_path']) and\
+           os.path.exists(self.mdict['pki_subsystem_log_path']):
+            # Top-Level PKI log path collision
+            config.pki_log.error(
+                log.PKIHELPER_NAMESPACE_COLLISION_2,
+                self.mdict['pki_instance_name'],
+                self.mdict['pki_instance_log_path'],
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            raise Exception(
+                log.PKIHELPER_NAMESPACE_COLLISION_2 % (
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_instance_log_path']))
+        if os.path.exists(self.mdict['pki_instance_configuration_path']) and\
+           os.path.exists(self.mdict['pki_subsystem_configuration_path']):
+            # Top-Level PKI configuration path collision
+            config.pki_log.error(
+                log.PKIHELPER_NAMESPACE_COLLISION_2,
+                self.mdict['pki_instance_name'],
+                self.mdict['pki_instance_configuration_path'],
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            raise Exception(
+                log.PKIHELPER_NAMESPACE_COLLISION_2 % (
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_instance_configuration_path']))
+        if os.path.exists(self.mdict['pki_instance_registry_path']) and\
+           os.path.exists(self.mdict['pki_subsystem_registry_path']):
+            # Top-Level PKI registry path collision
+            config.pki_log.error(
+                log.PKIHELPER_NAMESPACE_COLLISION_2,
+                self.mdict['pki_instance_name'],
+                self.mdict['pki_instance_registry_path'],
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            raise Exception(
+                log.PKIHELPER_NAMESPACE_COLLISION_2 % (
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_instance_registry_path']))
+        # Run simple checks for reserved name namespace collisions
+        if self.mdict['pki_instance_name'] in config.PKI_BASE_RESERVED_NAMES:
+            # Top-Level PKI base path reserved name collision
+            config.pki_log.error(
+                log.PKIHELPER_NAMESPACE_RESERVED_NAME_2,
+                self.mdict['pki_instance_name'],
+                self.mdict['pki_instance_path'],
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            raise Exception(
+                log.PKIHELPER_NAMESPACE_RESERVED_NAME_2 % (
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_instance_path']))
+        # No need to check for reserved name under Top-Level PKI log path
+        if self.mdict['pki_instance_name'] in \
+                config.PKI_CONFIGURATION_RESERVED_NAMES:
+            # Top-Level PKI configuration path reserved name collision
+            config.pki_log.error(
+                log.PKIHELPER_NAMESPACE_RESERVED_NAME_2,
+                self.mdict['pki_instance_name'],
+                self.mdict['pki_instance_configuration_path'],
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            raise Exception(
+                log.PKIHELPER_NAMESPACE_RESERVED_NAME_2 % (
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_instance_configuration_path']))
+        if self.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
+            # Top-Level Apache PKI registry path reserved name collision
+            if self.mdict['pki_instance_name'] in\
+               config.PKI_APACHE_REGISTRY_RESERVED_NAMES:
+                config.pki_log.error(
+                    log.PKIHELPER_NAMESPACE_RESERVED_NAME_2,
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_instance_registry_path'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKIHELPER_NAMESPACE_RESERVED_NAME_2 % (
+                        self.mdict['pki_instance_name'],
+                        self.mdict['pki_instance_registry_path']))
+        elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+            # Top-Level Tomcat PKI registry path reserved name collision
+            if self.mdict['pki_instance_name'] in\
+               config.PKI_TOMCAT_REGISTRY_RESERVED_NAMES:
+                config.pki_log.error(
+                    log.PKIHELPER_NAMESPACE_RESERVED_NAME_2,
+                    self.mdict['pki_instance_name'],
+                    self.mdict['pki_instance_registry_path'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKIHELPER_NAMESPACE_RESERVED_NAME_2 % (
+                        self.mdict['pki_instance_name'],
+                        self.mdict['pki_instance_registry_path']))
+
+
+class ConfigurationFile:
+    """PKI Deployment Configuration File Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+        # set useful 'boolean' object variables for this class
+        self.clone = config.str2bool(self.mdict['pki_clone'])
+        self.external = config.str2bool(self.mdict['pki_external'])
+        self.external_step_two = config.str2bool(
+            self.mdict['pki_external_step_two'])
+        self.skip_configuration = config.str2bool(
+            self.mdict['pki_skip_configuration'])
+        self.standalone = config.str2bool(self.mdict['pki_standalone'])
+        self.subordinate = config.str2bool(self.mdict['pki_subordinate'])
+        # set useful 'string' object variables for this class
+        self.subsystem = self.mdict['pki_subsystem']
+
+    def log_configuration_url(self):
+        # NOTE:  This is the one and only parameter containing a sensitive
+        #        parameter that may be stored in a log file.
+        config.pki_log.info(log.PKI_CONFIGURATION_WIZARD_URL_1,
+                            self.mdict['pki_configuration_url'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+        config.pki_log.info(log.PKI_CONFIGURATION_WIZARD_RESTART_1,
+                            self.mdict['pki_registry_initscript_command'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+
+    def display_configuration_url(self):
+        # NOTE:  This is the one and only parameter containing a sensitive
+        #        parameter that may be displayed to the screen.
+        print log.PKI_CONFIGURATION_URL_1 % self.mdict['pki_configuration_url']
+        print
+        print log.PKI_CONFIGURATION_RESTART_1 % \
+            self.mdict['pki_registry_initscript_command']
+        print
+
+    def confirm_external(self):
+        # ALWAYS defined via 'pkiparser.py'
+        if self.external:
+            # Only allowed for External CA
+            if self.subsystem != "CA":
+                config.pki_log.error(log.PKI_EXTERNAL_UNSUPPORTED_1,
+                                     self.subsystem,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKI_EXTERNAL_UNSUPPORTED_1,
+                                self.subsystem)
+
+    def confirm_standalone(self):
+        # ALWAYS defined via 'pkiparser.py'
+        if self.standalone:
+            # Only allowed for Stand-alone PKI
+            #
+            # ADD checks for valid types of Stand-alone PKI subsystems here
+            # AND to the 'private void validateData(ConfigurationRequest data)'
+            # Java method located in the file called 'SystemConfigService.java'
+            #
+            if self.subsystem != "KRA":
+                config.pki_log.error(log.PKI_STANDALONE_UNSUPPORTED_1,
+                                     self.subsystem,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKI_STANDALONE_UNSUPPORTED_1,
+                                self.subsystem)
+
+    def confirm_subordinate(self):
+        # ALWAYS defined via 'pkiparser.py'
+        if self.subordinate:
+            # Only allowed for Subordinate CA
+            if self.subsystem != "CA":
+                config.pki_log.error(log.PKI_SUBORDINATE_UNSUPPORTED_1,
+                                     self.subsystem,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKI_SUBORDINATE_UNSUPPORTED_1,
+                                self.subsystem)
+
+    def confirm_external_step_two(self):
+        # ALWAYS defined via 'pkiparser.py'
+        if self.external_step_two:
+            # Only allowed for External CA or Stand-alone PKI
+            if self.subsystem != "CA" and not self.standalone:
+                config.pki_log.error(log.PKI_EXTERNAL_STEP_TWO_UNSUPPORTED_1,
+                                     self.subsystem,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKI_EXTERNAL_STEP_TWO_UNSUPPORTED_1,
+                                self.subsystem)
+
+    def confirm_data_exists(self, param):
+        if not param in self.mdict or not len(self.mdict[param]):
+            config.pki_log.error(
+                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                param,
+                self.mdict['pki_user_deployment_cfg'],
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            raise Exception(
+                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
+                (param, self.mdict['pki_user_deployment_cfg']))
+
+    def confirm_missing_file(self, param):
+        if os.path.exists(self.mdict[param]):
+            config.pki_log.error(log.PKI_FILE_ALREADY_EXISTS_1,
+                                 self.mdict[param],
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 % param)
+
+    def confirm_file_exists(self, param):
+        if not os.path.exists(self.mdict[param]) or\
+           not os.path.isfile(self.mdict[param]):
+            config.pki_log.error(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                                 self.mdict[param],
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % param)
+
+    def verify_sensitive_data(self):
+        # Silently verify the existence of 'sensitive' data
+        if self.subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
+            # Verify existence of Directory Server Password
+            # (unless configuration will not be automatically executed)
+            if not self.skip_configuration:
+                self.confirm_data_exists("pki_ds_password")
+            # Verify existence of Admin Password (except for Clones)
+            if not self.clone:
+                self.confirm_data_exists("pki_admin_password")
+            # If required, verify existence of Backup Password
+            if config.str2bool(self.mdict['pki_backup_keys']):
+                self.confirm_data_exists("pki_backup_password")
+            # Verify existence of Client Pin for NSS client security databases
+            self.confirm_data_exists("pki_client_database_password")
+            # Verify existence of Client PKCS #12 Password for Admin Cert
+            self.confirm_data_exists("pki_client_pkcs12_password")
+            # Verify existence of PKCS #12 Password (ONLY for Clones)
+            if self.clone:
+                self.confirm_data_exists("pki_clone_pkcs12_password")
+            # Verify existence of Security Domain Password
+            # (ONLY for PKI KRA, PKI OCSP, PKI TKS, PKI TPS, Clones, or
+            #  Subordinate CA that will be automatically configured and
+            #  are not Stand-alone PKI)
+            if (self.subsystem == "KRA" or
+                    self.subsystem == "OCSP" or
+                    self.subsystem == "TKS" or
+                    self.subsystem == "TPS" or
+                    self.clone or
+                    self.subordinate):
+                if not self.skip_configuration and not self.standalone:
+                    self.confirm_data_exists("pki_security_domain_password")
+            # If required, verify existence of Token Password
+            if not self.mdict['pki_token_name'] == "internal":
+                self.confirm_data_exists("pki_token_password")
+        return
+
+    def verify_mutually_exclusive_data(self):
+        # Silently verify the existence of 'mutually exclusive' data
+        if self.subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
+            if self.subsystem == "CA":
+                if self.clone and self.external and self.subordinate:
+                    config.pki_log.error(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_SUB_CA,
+                        self.mdict['pki_user_deployment_cfg'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise Exception(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_SUB_CA %
+                        self.mdict['pki_user_deployment_cfg'])
+                elif self.clone and self.external:
+                    config.pki_log.error(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_CA,
+                        self.mdict['pki_user_deployment_cfg'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise Exception(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_CA %
+                        self.mdict['pki_user_deployment_cfg'])
+                elif self.clone and self.subordinate:
+                    config.pki_log.error(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_SUB_CA,
+                        self.mdict['pki_user_deployment_cfg'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise Exception(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_SUB_CA %
+                        self.mdict['pki_user_deployment_cfg'])
+                elif self.external and self.subordinate:
+                    config.pki_log.error(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_EXTERNAL_SUB_CA,
+                        self.mdict['pki_user_deployment_cfg'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise Exception(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_EXTERNAL_SUB_CA %
+                        self.mdict['pki_user_deployment_cfg'])
+            elif self.standalone:
+                if self.clone:
+                    config.pki_log.error(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_STANDALONE_PKI,
+                        self.mdict['pki_user_deployment_cfg'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise Exception(
+                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_STANDALONE_PKI %
+                        self.mdict['pki_user_deployment_cfg'])
+
+    def verify_predefined_configuration_file_data(self):
+        # Silently verify the existence of any required 'predefined' data
+        #
+        # FUTURE:  As much as is possible, alter this routine to verify
+        #          ALL name/value pairs for the requested configuration
+        #          scenario.  This should include checking for the
+        #          "existence" of ALL required "name" parameters, as well as
+        #          the "existence", "type" (e. g. -  string, boolean, number,
+        #          etc.), and "correctness" (e. g. - file, directory, boolean
+        #          'True' or 'False', etc.) of ALL required "value" parameters.
+        #
+        if self.subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
+            self.confirm_external()
+            self.confirm_standalone()
+            self.confirm_subordinate()
+            self.confirm_external_step_two()
+            if self.clone:
+                # Verify existence of clone parameters
+                #
+                #     NOTE:  Although this will be checked prior to getting to
+                #            this method, this clone's 'pki_instance_name' MUST
+                #            be different from the master's 'pki_instance_name'
+                #            IF AND ONLY IF the master and clone are located on
+                #            the same host!
+                #
+                self.confirm_data_exists("pki_ds_base_dn")
+                # FUTURE:  Check for unused port value(s)
+                #          (e. g. - must be different from master if the
+                #                   master is located on the same host)
+                self.confirm_data_exists("pki_ds_ldap_port")
+                self.confirm_data_exists("pki_ds_ldaps_port")
+                self.confirm_data_exists("pki_ajp_port")
+                self.confirm_data_exists("pki_http_port")
+                self.confirm_data_exists("pki_https_port")
+                self.confirm_data_exists("pki_tomcat_server_port")
+                self.confirm_data_exists("pki_clone_pkcs12_path")
+                self.confirm_file_exists("pki_clone_pkcs12_path")
+                self.confirm_data_exists("pki_clone_replication_security")
+                self.confirm_data_exists("pki_clone_uri")
+            elif self.external:
+                # External CA
+                if not self.external_step_two:
+                    # External CA (Step 1)
+                    self.confirm_data_exists("pki_external_csr_path")
+                    self.confirm_missing_file("pki_external_csr_path")
+                else:
+                    # External CA (Step 2)
+                    self.confirm_data_exists("pki_external_ca_cert_chain_path")
+                    self.confirm_file_exists("pki_external_ca_cert_chain_path")
+                    self.confirm_data_exists("pki_external_ca_cert_path")
+                    self.confirm_file_exists("pki_external_ca_cert_path")
+            elif not self.skip_configuration and self.standalone:
+                if not self.external_step_two:
+                    # Stand-alone PKI Admin CSR (Step 1)
+                    self.confirm_data_exists("pki_external_admin_csr_path")
+                    self.confirm_missing_file("pki_external_admin_csr_path")
+                    # Stand-alone PKI Audit Signing CSR (Step 1)
+                    self.confirm_data_exists(
+                        "pki_external_audit_signing_csr_path")
+                    self.confirm_missing_file(
+                        "pki_external_audit_signing_csr_path")
+                    # Stand-alone PKI SSL Server CSR (Step 1)
+                    self.confirm_data_exists("pki_external_sslserver_csr_path")
+                    self.confirm_missing_file("pki_external_sslserver_csr_path")
+                    # Stand-alone PKI Subsystem CSR (Step 1)
+                    self.confirm_data_exists("pki_external_subsystem_csr_path")
+                    self.confirm_missing_file("pki_external_subsystem_csr_path")
+                    # Stand-alone PKI KRA CSRs
+                    if self.subsystem == "KRA":
+                        # Stand-alone PKI KRA Storage CSR (Step 1)
+                        self.confirm_data_exists(
+                            "pki_external_storage_csr_path")
+                        self.confirm_missing_file(
+                            "pki_external_storage_csr_path")
+                        # Stand-alone PKI KRA Transport CSR (Step 1)
+                        self.confirm_data_exists(
+                            "pki_external_transport_csr_path")
+                        self.confirm_missing_file(
+                            "pki_external_transport_csr_path")
+                    # Stand-alone PKI OCSP CSRs
+                    if self.subsystem == "OCSP":
+                        # Stand-alone PKI OCSP OCSP Signing CSR (Step 1)
+                        self.confirm_data_exists(
+                            "pki_external_signing_csr_path")
+                        self.confirm_missing_file(
+                            "pki_external_signing_csr_path")
+                else:
+                    # Stand-alone PKI External CA Certificate Chain (Step 2)
+                    self.confirm_data_exists("pki_external_ca_cert_chain_path")
+                    self.confirm_file_exists("pki_external_ca_cert_chain_path")
+                    # Stand-alone PKI External CA Certificate (Step 2)
+                    self.confirm_data_exists("pki_external_ca_cert_path")
+                    self.confirm_file_exists("pki_external_ca_cert_path")
+                    # Stand-alone PKI Admin Certificate (Step 2)
+                    self.confirm_data_exists("pki_external_admin_cert_path")
+                    self.confirm_file_exists("pki_external_admin_cert_path")
+                    # Stand-alone PKI Audit Signing Certificate (Step 2)
+                    self.confirm_data_exists(
+                        "pki_external_audit_signing_cert_path")
+                    self.confirm_file_exists(
+                        "pki_external_audit_signing_cert_path")
+                    # Stand-alone PKI SSL Server Certificate (Step 2)
+                    self.confirm_data_exists("pki_external_sslserver_cert_path")
+                    self.confirm_file_exists("pki_external_sslserver_cert_path")
+                    # Stand-alone PKI Subsystem Certificate (Step 2)
+                    self.confirm_data_exists("pki_external_subsystem_cert_path")
+                    self.confirm_file_exists("pki_external_subsystem_cert_path")
+                    # Stand-alone PKI KRA Certificates
+                    if self.subsystem == "KRA":
+                        # Stand-alone PKI KRA Storage Certificate (Step 2)
+                        self.confirm_data_exists(
+                            "pki_external_storage_cert_path")
+                        self.confirm_file_exists(
+                            "pki_external_storage_cert_path")
+                        # Stand-alone PKI KRA Transport Certificate (Step 2)
+                        self.confirm_data_exists(
+                            "pki_external_transport_cert_path")
+                        self.confirm_file_exists(
+                            "pki_external_transport_cert_path")
+                    # Stand-alone PKI OCSP Certificates
+                    if self.subsystem == "OCSP":
+                        # Stand-alone PKI OCSP OCSP Signing Certificate (Step 2)
+                        self.confirm_data_exists(
+                            "pki_external_signing_cert_path")
+                        self.confirm_file_exists(
+                            "pki_external_signing_cert_path")
+        return
+
+    def populate_non_default_ports(self):
+        if (self.mdict['pki_http_port'] !=
+                str(config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_HTTP_PORT)):
+            ports.append(self.mdict['pki_http_port'])
+        if (self.mdict['pki_https_port'] !=
+                str(config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_HTTPS_PORT)):
+            ports.append(self.mdict['pki_https_port'])
+        if (self.mdict['pki_tomcat_server_port'] !=
+                str(config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_SERVER_PORT)):
+            ports.append(self.mdict['pki_tomcat_server_port'])
+        if (self.mdict['pki_ajp_port'] !=
+                str(config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_AJP_PORT)):
+            ports.append(self.mdict['pki_ajp_port'])
+        return
+
+    def verify_selinux_ports(self):
+        # Determine which ports still need to be labelled, and if any are
+        # incorrectly labelled
+        if len(ports) == 0:
+            return
+
+        if not bool(selinux.is_selinux_enabled()):
+            config.pki_log.error(
+                log.PKIHELPER_SELINUX_DISABLED,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            return
+
+        portrecs = seobject.portRecords().get_all()
+        portlist = ports[:]
+        for port in portlist:
+            context = ""
+            for i in portrecs:
+                if (portrecs[i][0] == "unreserved_port_t" or
+                        portrecs[i][0] == "reserved_port_t" or
+                        i[2] != "tcp"):
+                    continue
+                if i[0] <= int(port) <= i[1]:
+                    context = portrecs[i][0]
+                    break
+            if context == "":
+                # port has no current context
+                # leave it in list of ports to set
+                continue
+            elif context == config.PKI_PORT_SELINUX_CONTEXT:
+                # port is already set correctly
+                # remove from list of ports to set
+                ports.remove(port)
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_INVALID_SELINUX_CONTEXT_FOR_PORT,
+                    port, context,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKIHELPER_INVALID_SELINUX_CONTEXT_FOR_PORT %
+                    (port, context))
+        return
+
+    def verify_command_matches_configuration_file(self):
+        # Silently verify that the command-line parameters match the values
+        # that are present in the corresponding configuration file
+        if self.mdict['pki_deployment_executable'] == 'pkidestroy':
+            if self.mdict['pki_deployed_instance_name'] != \
+               self.mdict['pki_instance_name']:
+                config.pki_log.error(
+                    log.PKIHELPER_COMMAND_LINE_PARAMETER_MISMATCH_2,
+                    self.mdict['pki_deployed_instance_name'],
+                    self.mdict['pki_instance_name'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % (
+                        self.mdict['pki_deployed_instance_name'],
+                        self.mdict['pki_instance_name']))
+        return
+
+# PKI Deployment XML File Class
+# class xml_file:
+#    def remove_filter_section_from_web_xml(self,
+#                                           web_xml_source,
+#                                           web_xml_target):
+#        config.pki_log.info(log.PKIHELPER_REMOVE_FILTER_SECTION_1,
+#            self.mdict['pki_target_subsystem_web_xml'],
+#            extra=config.PKI_INDENTATION_LEVEL_2)
+#        begin_filters_section = False
+#        begin_servlet_section = False
+#        FILE = open(web_xml_target, "w")
+#        for line in fileinput.FileInput(web_xml_source):
+#            if not begin_filters_section:
+#                # Read and write lines until first "<filter>" tag
+#                if line.count("<filter>") >= 1:
+#                    # Mark filters section
+#                    begin_filters_section = True
+#                else:
+#                    FILE.write(line)
+#            elif not begin_servlet_section:
+#                # Skip lines until first "<servlet>" tag
+#                if line.count("<servlet>") >= 1:
+#                    # Mark servlets section and write out the opening tag
+#                    begin_servlet_section = True
+#                    FILE.write(line)
+#                else:
+#                    continue
+#            else:
+#                # Read and write lines all lines after "<servlet>" tag
+#                FILE.write(line)
+#        FILE.close()
+
+
+class Instance:
+    """PKI Deployment Instance Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+
+    def apache_instance_subsystems(self):
+        rv = 0
+        try:
+            # count number of PKI subsystems present
+            # within the specified Apache instance
+            for subsystem in config.PKI_APACHE_SUBSYSTEMS:
+                path = self.mdict['pki_instance_path'] + "/" + subsystem.lower()
+                if os.path.exists(path) and os.path.isdir(path):
+                    rv += 1
+            config.pki_log.debug(log.PKIHELPER_APACHE_INSTANCE_SUBSYSTEMS_2,
+                                 self.mdict['pki_instance_path'],
+                                 rv, extra=config.PKI_INDENTATION_LEVEL_2)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+        return rv
+
+    def apache_instances(self):
+        rv = 0
+        try:
+            # Since ALL directories under the top-level PKI 'apache' registry
+            # directory SHOULD represent PKI Apache instances, and there
+            # shouldn't be any stray files or symbolic links at this level,
+            # simply count the number of PKI 'apache' instances (directories)
+            # present within the PKI 'apache' registry directory
+            for instance in\
+                    os.listdir(self.mdict['pki_instance_type_registry_path']):
+                if os.path.isdir(
+                        os.path.join(
+                            self.mdict['pki_instance_type_registry_path'],
+                            instance)) and not\
+                   os.path.islink(
+                       os.path.join(
+                           self.mdict['pki_instance_type_registry_path'],
+                           instance)):
+                    rv += 1
+            config.pki_log.debug(log.PKIHELPER_APACHE_INSTANCES_2,
+                                 self.mdict['pki_instance_type_registry_path'],
+                                 rv,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+        return rv
+
+    def pki_instance_subsystems(self):
+        rv = 0
+        try:
+            # Since ALL directories within the top-level PKI infrastructure
+            # SHOULD represent PKI instances, look for all possible
+            # PKI instances within the top-level PKI infrastructure
+            for instance in os.listdir(self.mdict['pki_path']):
+                if os.path.isdir(os.path.join(self.mdict['pki_path'], instance))\
+                   and not\
+                   os.path.islink(os.path.join(self.mdict['pki_path'], instance)):
+                    instance_dir = os.path.join(self.mdict['pki_path'], instance)
+                    # Since ANY directory within this PKI instance COULD
+                    # be a PKI subsystem, look for all possible
+                    # PKI subsystems within this PKI instance
+                    for name in os.listdir(instance_dir):
+                        if os.path.isdir(os.path.join(instance_dir, name)) and\
+                           not os.path.islink(os.path.join(instance_dir, name)):
+                            if name.upper() in config.PKI_SUBSYSTEMS:
+                                rv += 1
+            config.pki_log.debug(log.PKIHELPER_PKI_INSTANCE_SUBSYSTEMS_2,
+                                 self.mdict['pki_instance_path'], rv,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+        return rv
+
+    def tomcat_instance_subsystems(self):
+        # Return list of PKI subsystems in the specified tomcat instance
+        rv = []
+        try:
+            for subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
+                path = self.mdict['pki_instance_path'] + "/" + subsystem.lower()
+                if os.path.exists(path) and os.path.isdir(path):
+                    rv.append(subsystem)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+        return rv
+
+    def tomcat_instances(self):
+        rv = 0
+        try:
+            # Since ALL directories under the top-level PKI 'tomcat' registry
+            # directory SHOULD represent PKI Tomcat instances, and there
+            # shouldn't be any stray files or symbolic links at this level,
+            # simply count the number of PKI 'tomcat' instances (directories)
+            # present within the PKI 'tomcat' registry directory
+            for instance in os.listdir(
+                    self.mdict['pki_instance_type_registry_path']):
+                if os.path.isdir(
+                    os.path.join(
+                        self.mdict['pki_instance_type_registry_path'],
+                        instance)) and not\
+                   os.path.islink(
+                       os.path.join(
+                           self.mdict['pki_instance_type_registry_path'],
+                           instance)):
+                    rv += 1
+            config.pki_log.debug(log.PKIHELPER_TOMCAT_INSTANCES_2,
+                                 self.mdict['pki_instance_type_registry_path'],
+                                 rv,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+        return rv
+
+    def verify_subsystem_exists(self):
+        try:
+            if not os.path.exists(self.mdict['pki_subsystem_path']):
+                config.pki_log.error(log.PKI_SUBSYSTEM_DOES_NOT_EXIST_2,
+                                     self.mdict['pki_subsystem'],
+                                     self.mdict['pki_instance_name'],
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_SUBSYSTEM_DOES_NOT_EXIST_2 % (
+                        self.mdict['pki_subsystem'],
+                        self.mdict['pki_instance_name']))
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+
+    def verify_subsystem_does_not_exist(self):
+        try:
+            if os.path.exists(self.mdict['pki_subsystem_path']):
+                config.pki_log.error(log.PKI_SUBSYSTEM_ALREADY_EXISTS_2,
+                                     self.mdict['pki_subsystem'],
+                                     self.mdict['pki_instance_name'],
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_SUBSYSTEM_DOES_NOT_EXIST_2 % (
+                        self.mdict['pki_subsystem'],
+                        self.mdict['pki_instance_name']))
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+
+    def get_instance_status(self):
+        connection = pki.client.PKIConnection(
+            protocol='https',
+            hostname=self.mdict['pki_hostname'],
+            port=self.mdict['pki_https_port'],
+            subsystem=self.mdict['pki_subsystem_type'],
+            accept='application/xml')
+
+        # catching all exceptions because we do not want to break if underlying
+        # requests or urllib3 use a different exception.
+        # If the connection fails, we will time out in any case
+        # pylint: disable-msg=W0703
+        try:
+            client = pki.system.SystemStatusClient(connection)
+            response = client.get_status()
+            config.pki_log.debug(response, extra=config.PKI_INDENTATION_LEVEL_3)
+
+            root = ET.fromstring(response)
+            status = root.findtext("Status")
+            return status
+        except Exception as exc:
+            config.pki_log.debug(
+                "No connection - server may still be down",
+                extra=config.PKI_INDENTATION_LEVEL_3)
+            config.pki_log.debug(
+                "No connection - exception thrown: " + str(exc),
+                extra=config.PKI_INDENTATION_LEVEL_3)
+            return None
+
+    def wait_for_startup(self, timeout):
+        start_time = datetime.today()
+        status = None
+        while status != "running":
+            status = self.get_instance_status()
+            time.sleep(1)
+            stop_time = datetime.today()
+            if (stop_time - start_time).total_seconds() >= timeout:
+                break
+        return status
+
+
+class Directory:
+    """PKI Deployment Directory Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+        self.identity = deployer.identity
+        self.manifest_db = deployer.manifest_db
+
+    def create(self, name, uid=None, gid=None,
+               perms=config.PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS,
+               acls=None, critical_failure=True):
+        try:
+            if not os.path.exists(name):
+                # mkdir -p <name>
+                config.pki_log.info(log.PKIHELPER_MKDIR_1, name,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                os.makedirs(name)
+                # chmod <perms> <name>
+                config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chmod(name, perms)
+                # chown <uid>:<gid> <name>
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
+                                     uid, gid, name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chown(name, uid, gid)
+                # Store record in installation manifest
+                record = manifest.Record()
+                record.name = name
+                record.type = manifest.RECORD_TYPE_DIRECTORY
+                record.user = self.mdict['pki_user']
+                record.group = self.mdict['pki_group']
+                record.uid = uid
+                record.gid = gid
+                record.permissions = perms
+                record.acls = acls
+                self.manifest_db.append(record)
+            elif not os.path.isdir(name):
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(
+                        log.PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1 %
+                        name)
+        except OSError as exc:
+            if exc.errno == errno.EEXIST:
+                pass
+            else:
+                config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise
+        return
+
+    def modify(self, name, uid=None, gid=None,
+               perms=config.PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS,
+               acls=None, silent=False, critical_failure=True):
+        try:
+            if os.path.exists(name):
+                if not os.path.isdir(name):
+                    config.pki_log.error(
+                        log.PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1,
+                        name, extra=config.PKI_INDENTATION_LEVEL_2)
+                    if critical_failure:
+                        raise Exception(
+                            log.PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1 %
+                            name)
+                # Always re-process each directory whether it needs it or not
+                if not silent:
+                    config.pki_log.info(log.PKIHELPER_MODIFY_DIR_1, name,
+                                        extra=config.PKI_INDENTATION_LEVEL_2)
+                # chmod <perms> <name>
+                if not silent:
+                    config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
+                                         extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chmod(name, perms)
+                # chown <uid>:<gid> <name>
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                if not silent:
+                    config.pki_log.debug(log.PKIHELPER_CHOWN_3,
+                                         uid, gid, name,
+                                         extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chown(name, uid, gid)
+                # Store record in installation manifest
+                if not silent:
+                    record = manifest.Record()
+                    record.name = name
+                    record.type = manifest.RECORD_TYPE_DIRECTORY
+                    record.user = self.mdict['pki_user']
+                    record.group = self.mdict['pki_group']
+                    record.uid = uid
+                    record.gid = gid
+                    record.permissions = perms
+                    record.acls = acls
+                    self.manifest_db.append(record)
+            else:
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(
+                        log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % name)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def delete(self, name, recursive_flag=True, critical_failure=True):
+        try:
+            if not os.path.exists(name) or not os.path.isdir(name):
+                # Simply issue a warning and continue
+                config.pki_log.warning(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+            else:
+                if recursive_flag:
+                    # rm -rf <name>
+                    config.pki_log.info(log.PKIHELPER_RM_RF_1, name,
+                                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    shutil.rmtree(name)
+                else:
+                    # rmdir <name>
+                    config.pki_log.info(log.PKIHELPER_RMDIR_1, name,
+                                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    os.rmdir(name)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def exists(self, name):
+        try:
+            if not os.path.exists(name) or not os.path.isdir(name):
+                return False
+            else:
+                return True
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+
+    def is_empty(self, name):
+        try:
+            if not os.listdir(name):
+                config.pki_log.debug(log.PKIHELPER_DIRECTORY_IS_EMPTY_1,
+                                     name, extra=config.PKI_INDENTATION_LEVEL_2)
+                return True
+            else:
+                config.pki_log.debug(log.PKIHELPER_DIRECTORY_IS_NOT_EMPTY_1,
+                                     name, extra=config.PKI_INDENTATION_LEVEL_2)
+                return False
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+
+    def set_mode(
+            self, name, uid=None, gid=None,
+            dir_perms=config.PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS,
+            file_perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
+            symlink_perms=config.PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS,
+            dir_acls=None, file_acls=None, symlink_acls=None,
+            recursive_flag=True, critical_failure=True):
+        try:
+            if not os.path.exists(name) or not os.path.isdir(name):
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % name)
+            else:
+                config.pki_log.info(
+                    log.PKIHELPER_SET_MODE_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                if recursive_flag:
+                    for root, dirs, files in os.walk(name):
+                        for name in files:
+                            entity = os.path.join(root, name)
+                            if not os.path.islink(entity):
+                                temp_file = entity
+                                config.pki_log.debug(
+                                    log.PKIHELPER_IS_A_FILE_1, temp_file,
+                                    extra=config.PKI_INDENTATION_LEVEL_3)
+                                # chmod <file_perms> <name>
+                                config.pki_log.debug(
+                                    log.PKIHELPER_CHMOD_2,
+                                    file_perms, temp_file,
+                                    extra=config.PKI_INDENTATION_LEVEL_3)
+                                os.chmod(temp_file, file_perms)
+                                # chown <uid>:<gid> <name>
+                                config.pki_log.debug(
+                                    log.PKIHELPER_CHOWN_3,
+                                    uid, gid, temp_file,
+                                    extra=config.PKI_INDENTATION_LEVEL_3)
+                                os.chown(temp_file, uid, gid)
+                                # Store record in installation manifest
+                                record = manifest.Record()
+                                record.name = name
+                                record.type = manifest.RECORD_TYPE_FILE
+                                record.user = self.mdict['pki_user']
+                                record.group = self.mdict['pki_group']
+                                record.uid = uid
+                                record.gid = gid
+                                record.permissions = file_perms
+                                record.acls = file_acls
+                                self.manifest_db.append(record)
+                            else:
+                                symlink = entity
+                                config.pki_log.debug(
+                                    log.PKIHELPER_IS_A_SYMLINK_1, symlink,
+                                    extra=config.PKI_INDENTATION_LEVEL_3)
+                                # REMINDER:  Due to POSIX compliance, 'lchmod'
+                                #            is NEVER implemented on Linux
+                                #            systems since 'chmod' CANNOT be
+                                #            run directly against symbolic
+                                #            links!
+                                # chown -h <uid>:<gid> <symlink>
+                                config.pki_log.debug(
+                                    log.PKIHELPER_CHOWN_H_3,
+                                    uid, gid, symlink,
+                                    extra=config.PKI_INDENTATION_LEVEL_3)
+                                os.lchown(symlink, uid, gid)
+                                # Store record in installation manifest
+                                record = manifest.Record()
+                                record.name = name
+                                record.type = manifest.RECORD_TYPE_SYMLINK
+                                record.user = self.mdict['pki_user']
+                                record.group = self.mdict['pki_group']
+                                record.uid = uid
+                                record.gid = gid
+                                record.permissions = symlink_perms
+                                record.acls = symlink_acls
+                                self.manifest_db.append(record)
+                        for name in dirs:
+                            temp_dir = os.path.join(root, name)
+                            config.pki_log.debug(
+                                log.PKIHELPER_IS_A_DIRECTORY_1, temp_dir,
+                                extra=config.PKI_INDENTATION_LEVEL_3)
+                            # chmod <dir_perms> <name>
+                            config.pki_log.debug(
+                                log.PKIHELPER_CHMOD_2,
+                                dir_perms, temp_dir,
+                                extra=config.PKI_INDENTATION_LEVEL_3)
+                            os.chmod(temp_dir, dir_perms)
+                            # chown <uid>:<gid> <name>
+                            config.pki_log.debug(
+                                log.PKIHELPER_CHOWN_3,
+                                uid, gid, temp_dir,
+                                extra=config.PKI_INDENTATION_LEVEL_3)
+                            os.chown(temp_dir, uid, gid)
+                            # Store record in installation manifest
+                            record = manifest.Record()
+                            record.name = name
+                            record.type = manifest.RECORD_TYPE_DIRECTORY
+                            record.user = self.mdict['pki_user']
+                            record.group = self.mdict['pki_group']
+                            record.uid = uid
+                            record.gid = gid
+                            record.permissions = dir_perms
+                            record.acls = dir_acls
+                            self.manifest_db.append(record)
+                else:
+                    config.pki_log.debug(
+                        log.PKIHELPER_IS_A_DIRECTORY_1, name,
+                        extra=config.PKI_INDENTATION_LEVEL_3)
+                    # chmod <dir_perms> <name>
+                    config.pki_log.debug(log.PKIHELPER_CHMOD_2,
+                                         dir_perms, name,
+                                         extra=config.PKI_INDENTATION_LEVEL_3)
+                    os.chmod(name, dir_perms)
+                    # chown <uid>:<gid> <name>
+                    config.pki_log.debug(log.PKIHELPER_CHOWN_3,
+                                         uid, gid, name,
+                                         extra=config.PKI_INDENTATION_LEVEL_3)
+                    os.chown(name, uid, gid)
+                    # Store record in installation manifest
+                    record = manifest.Record()
+                    record.name = name
+                    record.type = manifest.RECORD_TYPE_DIRECTORY
+                    record.user = self.mdict['pki_user']
+                    record.group = self.mdict['pki_group']
+                    record.uid = uid
+                    record.gid = gid
+                    record.permissions = dir_perms
+                    record.acls = dir_acls
+                    self.manifest_db.append(record)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+
+    def copy(self, old_name, new_name, uid=None, gid=None,
+             dir_perms=config.PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS,
+             file_perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
+             symlink_perms=config.PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS,
+             dir_acls=None, file_acls=None, symlink_acls=None,
+             recursive_flag=True, overwrite_flag=False, critical_failure=True):
+        try:
+            if not os.path.exists(old_name) or not os.path.isdir(old_name):
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, old_name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % old_name)
+            else:
+                if os.path.exists(new_name):
+                    if not overwrite_flag:
+                        config.pki_log.error(
+                            log.PKI_DIRECTORY_ALREADY_EXISTS_1, new_name,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKI_DIRECTORY_ALREADY_EXISTS_1 % new_name)
+                if recursive_flag:
+                    # cp -rp <old_name> <new_name>
+                    config.pki_log.info(log.PKIHELPER_CP_RP_2,
+                                        old_name, new_name,
+                                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    # Due to a limitation in the 'shutil.copytree()'
+                    # implementation which requires that
+                    # 'The destination directory must not already exist.',
+                    # an OSError exception is always thrown due to the
+                    # implementation's unchecked call to 'os.makedirs(dst)'.
+                    # Consequently, a 'patched' local copy of this routine has
+                    # been included in this file with the appropriate fix.
+                    pki_copytree(old_name, new_name)
+                else:
+                    # cp -p <old_name> <new_name>
+                    config.pki_log.info(log.PKIHELPER_CP_P_2,
+                                        old_name, new_name,
+                                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    shutil.copy2(old_name, new_name)
+                # set ownerships, permissions, and acls
+                # of newly created top-level directory
+                self.modify(new_name, uid, gid, dir_perms, dir_acls,
+                            True, critical_failure)
+                # set ownerships, permissions, and acls
+                # of contents of newly created top-level directory
+                self.set_mode(new_name, uid, gid,
+                              dir_perms, file_perms, symlink_perms,
+                              dir_acls, file_acls, symlink_acls,
+                              recursive_flag, critical_failure)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except shutil.Error as exc:
+            config.pki_log.error(log.PKI_SHUTIL_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+
+class File:
+    """PKI Deployment File Class (also used for executables)"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+        self.slots = deployer.slots
+        self.identity = deployer.identity
+        self.manifest_db = deployer.manifest_db
+
+    def create(self, name, uid=None, gid=None,
+               perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
+               acls=None, critical_failure=True):
+        try:
+            if not os.path.exists(name):
+                # touch <name>
+                config.pki_log.info(log.PKIHELPER_TOUCH_1, name,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                open(name, "w").close()
+                # chmod <perms> <name>
+                config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chmod(name, perms)
+                # chown <uid>:<gid> <name>
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
+                                     uid, gid, name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chown(name, uid, gid)
+                # Store record in installation manifest
+                record = manifest.Record()
+                record.name = name
+                record.type = manifest.RECORD_TYPE_FILE
+                record.user = self.mdict['pki_user']
+                record.group = self.mdict['pki_group']
+                record.uid = uid
+                record.gid = gid
+                record.permissions = perms
+                record.acls = acls
+                self.manifest_db.append(record)
+            elif not os.path.isfile(name):
+                config.pki_log.error(
+                    log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(
+                        log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 % name)
+        except OSError as exc:
+            if exc.errno == errno.EEXIST:
+                pass
+            else:
+                config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise
+        return
+
+    def modify(self, name, uid=None, gid=None,
+               perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
+               acls=None, silent=False, critical_failure=True):
+        try:
+            if os.path.exists(name):
+                if not os.path.isfile(name):
+                    config.pki_log.error(
+                        log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1,
+                        name, extra=config.PKI_INDENTATION_LEVEL_2)
+                    if critical_failure:
+                        raise Exception(
+                            log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 % name)
+                # Always re-process each file whether it needs it or not
+                if not silent:
+                    config.pki_log.info(log.PKIHELPER_MODIFY_FILE_1, name,
+                                        extra=config.PKI_INDENTATION_LEVEL_2)
+                # chmod <perms> <name>
+                if not silent:
+                    config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
+                                         extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chmod(name, perms)
+                # chown <uid>:<gid> <name>
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                if not silent:
+                    config.pki_log.debug(log.PKIHELPER_CHOWN_3,
+                                         uid, gid, name,
+                                         extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chown(name, uid, gid)
+                # Store record in installation manifest
+                if not silent:
+                    record = manifest.Record()
+                    record.name = name
+                    record.type = manifest.RECORD_TYPE_FILE
+                    record.user = self.mdict['pki_user']
+                    record.group = self.mdict['pki_group']
+                    record.uid = uid
+                    record.gid = gid
+                    record.permissions = perms
+                    record.acls = acls
+                    self.manifest_db.append(record)
+            else:
+                config.pki_log.error(
+                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % name)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def delete(self, name, critical_failure=True):
+        try:
+            if not os.path.exists(name) or not os.path.isfile(name):
+                # Simply issue a warning and continue
+                config.pki_log.warning(
+                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+            else:
+                # rm -f <name>
+                config.pki_log.info(log.PKIHELPER_RM_F_1, name,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                os.remove(name)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def exists(self, name):
+        try:
+            if not os.path.exists(name) or not os.path.isfile(name):
+                return False
+            else:
+                return True
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+
+    def copy(self, old_name, new_name, uid=None, gid=None,
+             perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS, acls=None,
+             overwrite_flag=False, critical_failure=True):
+        try:
+            if not os.path.exists(old_name) or not os.path.isfile(old_name):
+                config.pki_log.error(
+                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, old_name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % old_name)
+            else:
+                if os.path.exists(new_name):
+                    if not overwrite_flag:
+                        config.pki_log.error(
+                            log.PKI_FILE_ALREADY_EXISTS_1, new_name,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKI_FILE_ALREADY_EXISTS_1 % new_name)
+                # cp -p <old_name> <new_name>
+                config.pki_log.info(log.PKIHELPER_CP_P_2,
+                                    old_name, new_name,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                shutil.copy2(old_name, new_name)
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                # chmod <perms> <new_name>
+                config.pki_log.debug(log.PKIHELPER_CHMOD_2,
+                                     perms, new_name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chmod(new_name, perms)
+                # chown <uid>:<gid> <new_name>
+                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
+                                     uid, gid, new_name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chown(new_name, uid, gid)
+                # Store record in installation manifest
+                record = manifest.Record()
+                record.name = new_name
+                record.type = manifest.RECORD_TYPE_FILE
+                record.user = self.mdict['pki_user']
+                record.group = self.mdict['pki_group']
+                record.uid = uid
+                record.gid = gid
+                record.permissions = perms
+                record.acls = acls
+                self.manifest_db.append(record)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except shutil.Error as exc:
+            config.pki_log.error(log.PKI_SHUTIL_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def apply_slot_substitution(
+            self, name, uid=None, gid=None,
+            perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
+            acls=None, critical_failure=True):
+        try:
+            if not os.path.exists(name) or not os.path.isfile(name):
+                config.pki_log.error(
+                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % name)
+            # applying in-place slot substitutions on <name>
+            config.pki_log.info(log.PKIHELPER_APPLY_SLOT_SUBSTITUTION_1,
+                                name,
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+            for line in fileinput.FileInput(name, inplace=1):
+                for slot in self.slots:
+                    if slot != '__name__' and self.slots[slot] in line:
+                        config.pki_log.debug(
+                            log.PKIHELPER_SLOT_SUBSTITUTION_2,
+                            self.slots[slot], self.mdict[slot],
+                            extra=config.PKI_INDENTATION_LEVEL_3)
+                        line = line.replace(self.slots[slot], self.mdict[slot])
+                sys.stdout.write(line)
+            if uid is None:
+                uid = self.identity.get_uid()
+            if gid is None:
+                gid = self.identity.get_gid()
+            # chmod <perms> <name>
+            config.pki_log.debug(log.PKIHELPER_CHMOD_2,
+                                 perms, name,
+                                 extra=config.PKI_INDENTATION_LEVEL_3)
+            os.chmod(name, perms)
+            # chown <uid>:<gid> <name>
+            config.pki_log.debug(log.PKIHELPER_CHOWN_3,
+                                 uid, gid, name,
+                                 extra=config.PKI_INDENTATION_LEVEL_3)
+            os.chown(name, uid, gid)
+            # Store record in installation manifest
+            record = manifest.Record()
+            record.name = name
+            record.type = manifest.RECORD_TYPE_FILE
+            record.user = self.mdict['pki_user']
+            record.group = self.mdict['pki_group']
+            record.uid = uid
+            record.gid = gid
+            record.permissions = perms
+            record.acls = acls
+            self.manifest_db.append(record)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except shutil.Error as exc:
+            config.pki_log.error(log.PKI_SHUTIL_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def copy_with_slot_substitution(
+            self, old_name, new_name, uid=None, gid=None,
+            perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
+            acls=None, overwrite_flag=False,
+            critical_failure=True):
+        try:
+            if not os.path.exists(old_name) or not os.path.isfile(old_name):
+                config.pki_log.error(
+                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, old_name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % old_name)
+            else:
+                if os.path.exists(new_name):
+                    if not overwrite_flag:
+                        config.pki_log.error(
+                            log.PKI_FILE_ALREADY_EXISTS_1, new_name,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKI_FILE_ALREADY_EXISTS_1 % new_name)
+                # copy <old_name> to <new_name> with slot substitutions
+                config.pki_log.info(log.PKIHELPER_COPY_WITH_SLOT_SUBSTITUTION_2,
+                                    old_name, new_name,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                with open(new_name, "w") as FILE:
+                    for line in fileinput.FileInput(old_name):
+                        for slot in self.slots:
+                            if slot != '__name__' and self.slots[slot] in line:
+                                config.pki_log.debug(
+                                    log.PKIHELPER_SLOT_SUBSTITUTION_2,
+                                    self.slots[slot], self.mdict[slot],
+                                    extra=config.PKI_INDENTATION_LEVEL_3)
+                                line = line.replace(
+                                    self.slots[slot],
+                                    self.mdict[slot])
+                        FILE.write(line)
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                # chmod <perms> <new_name>
+                config.pki_log.debug(log.PKIHELPER_CHMOD_2,
+                                     perms, new_name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chmod(new_name, perms)
+                # chown <uid>:<gid> <new_name>
+                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
+                                     uid, gid, new_name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chown(new_name, uid, gid)
+                # Store record in installation manifest
+                record = manifest.Record()
+                record.name = new_name
+                record.type = manifest.RECORD_TYPE_FILE
+                record.user = self.mdict['pki_user']
+                record.group = self.mdict['pki_group']
+                record.uid = uid
+                record.gid = gid
+                record.permissions = perms
+                record.acls = acls
+                self.manifest_db.append(record)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except shutil.Error as exc:
+            config.pki_log.error(log.PKI_SHUTIL_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def generate_noise_file(
+            self, name, random_bytes, uid=None, gid=None,
+            perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
+            acls=None, critical_failure=True):
+        try:
+            if not os.path.exists(name):
+                # generating noise file called <name> and
+                # filling it with <random_bytes> random bytes
+                config.pki_log.info(
+                    log.PKIHELPER_NOISE_FILE_2, name, random_bytes,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                open(name, "w").close()
+                with open(name, "w") as FILE:
+                    noise = ''.join(random.choice(string.ascii_letters +
+                                    string.digits) for x in range(random_bytes))
+                    FILE.write(noise)
+                # chmod <perms> <name>
+                config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chmod(name, perms)
+                # chown <uid>:<gid> <name>
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
+                                     uid, gid, name,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.chown(name, uid, gid)
+                # Store record in installation manifest
+                record = manifest.Record()
+                record.name = name
+                record.type = manifest.RECORD_TYPE_FILE
+                record.user = self.mdict['pki_user']
+                record.group = self.mdict['pki_group']
+                record.uid = uid
+                record.gid = gid
+                record.permissions = perms
+                record.acls = acls
+                self.manifest_db.append(record)
+            elif not os.path.isfile(name):
+                config.pki_log.error(
+                    log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(
+                        log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 % name)
+        except OSError as exc:
+            if exc.errno == errno.EEXIST:
+                pass
+            else:
+                config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise
+        return
+
+
+class Symlink:
+    """PKI Deployment Symbolic Link Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+        self.identity = deployer.identity
+        self.manifest_db = deployer.manifest_db
+
+    def create(self, name, link, uid=None, gid=None,
+               acls=None, allow_dangling_symlink=False, critical_failure=True):
+        try:
+            if not os.path.exists(link):
+                if not os.path.exists(name):
+                    config.pki_log.warning(
+                        log.PKIHELPER_DANGLING_SYMLINK_2, link, name,
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    if not allow_dangling_symlink:
+                        raise Exception(
+                            "Dangling symlink " + link + " not allowed")
+                # ln -s <name> <link>
+                config.pki_log.info(log.PKIHELPER_LINK_S_2, name, link,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                os.symlink(name, link)
+                # REMINDER:  Due to POSIX compliance, 'lchmod' is NEVER
+                #            implemented on Linux systems since 'chmod'
+                #            CANNOT be run directly against symbolic links!
+                # chown -h <uid>:<gid> <link>
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                config.pki_log.debug(log.PKIHELPER_CHOWN_H_3,
+                                     uid, gid, link,
+                                     extra=config.PKI_INDENTATION_LEVEL_3)
+                os.lchown(link, uid, gid)
+                # Store record in installation manifest
+                record = manifest.Record()
+                record.name = link
+                record.type = manifest.RECORD_TYPE_SYMLINK
+                record.user = self.mdict['pki_user']
+                record.group = self.mdict['pki_group']
+                record.uid = uid
+                record.gid = gid
+                record.permissions = \
+                    config.PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS
+                record.acls = acls
+                self.manifest_db.append(record)
+            elif not os.path.islink(link):
+                config.pki_log.error(
+                    log.PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1, link,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(
+                        log.PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1 % link)
+        except OSError as exc:
+            if exc.errno == errno.EEXIST:
+                pass
+            else:
+                config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise
+        return
+
+    def modify(self, link, uid=None, gid=None,
+               acls=None, silent=False, critical_failure=True):
+        try:
+            if os.path.exists(link):
+                if not os.path.islink(link):
+                    config.pki_log.error(
+                        log.PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1,
+                        link, extra=config.PKI_INDENTATION_LEVEL_2)
+                    if critical_failure:
+                        raise Exception(
+                            log.PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1 %
+                            link)
+                # Always re-process each link whether it needs it or not
+                if not silent:
+                    config.pki_log.info(log.PKIHELPER_MODIFY_SYMLINK_1, link,
+                                        extra=config.PKI_INDENTATION_LEVEL_2)
+                # REMINDER:  Due to POSIX compliance, 'lchmod' is NEVER
+                #            implemented on Linux systems since 'chmod'
+                #            CANNOT be run directly against symbolic links!
+                # chown -h <uid>:<gid> <link>
+                if uid is None:
+                    uid = self.identity.get_uid()
+                if gid is None:
+                    gid = self.identity.get_gid()
+                if not silent:
+                    config.pki_log.debug(log.PKIHELPER_CHOWN_H_3,
+                                         uid, gid, link,
+                                         extra=config.PKI_INDENTATION_LEVEL_3)
+                os.lchown(link, uid, gid)
+                # Store record in installation manifest
+                if not silent:
+                    record = manifest.Record()
+                    record.name = link
+                    record.type = manifest.RECORD_TYPE_SYMLINK
+                    record.user = self.mdict['pki_user']
+                    record.group = self.mdict['pki_group']
+                    record.uid = uid
+                    record.gid = gid
+                    record.permissions = \
+                        config.PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS
+                    record.acls = acls
+                    self.manifest_db.append(record)
+            else:
+                config.pki_log.error(
+                    log.PKI_SYMLINK_MISSING_OR_NOT_A_SYMLINK_1, link,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(
+                        log.PKI_SYMLINK_MISSING_OR_NOT_A_SYMLINK_1 % link)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def delete(self, link, critical_failure=True):
+        try:
+            if not os.path.exists(link) or not os.path.islink(link):
+                # Simply issue a warning and continue
+                config.pki_log.warning(
+                    log.PKI_SYMLINK_MISSING_OR_NOT_A_SYMLINK_1, link,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+            else:
+                # rm -f <link>
+                config.pki_log.info(log.PKIHELPER_RM_F_1, link,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                os.remove(link)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def exists(self, name):
+        try:
+            if not os.path.exists(name) or not os.path.islink(name):
+                return False
+            else:
+                return True
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+
+
+class War:
+    """PKI Deployment War File Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+
+    def explode(self, name, path, critical_failure=True):
+        try:
+            if os.path.exists(name) and os.path.isfile(name):
+                if not zipfile.is_zipfile(name):
+                    config.pki_log.error(
+                        log.PKI_FILE_NOT_A_WAR_FILE_1,
+                        name, extra=config.PKI_INDENTATION_LEVEL_2)
+                    if critical_failure:
+                        raise Exception(log.PKI_FILE_NOT_A_WAR_FILE_1 % name)
+                if not os.path.exists(path) or not os.path.isdir(path):
+                    config.pki_log.error(
+                        log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1,
+                        path, extra=config.PKI_INDENTATION_LEVEL_2)
+                    if critical_failure:
+                        raise Exception(
+                            log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1,
+                            path)
+                # jar -xf <name> -C <path>
+                config.pki_log.info(log.PKIHELPER_JAR_XF_C_2, name, path,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                # Open war file
+                war = zipfile.ZipFile(name, 'r')
+                # Extract contents of war file to path
+                war.extractall(path)
+            else:
+                config.pki_log.error(
+                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except zipfile.BadZipfile as exc:
+            config.pki_log.error(log.PKI_BADZIPFILE_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except zipfile.LargeZipFile as exc:
+            config.pki_log.error(log.PKI_LARGEZIPFILE_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+
+class Password:
+    """PKI Deployment Password Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+
+    def create_password_conf(self, path, pin, pin_sans_token=False,
+                             overwrite_flag=False, critical_failure=True):
+        try:
+            if os.path.exists(path):
+                if overwrite_flag:
+                    config.pki_log.info(
+                        log.PKIHELPER_PASSWORD_CONF_1, path,
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    # overwrite the existing 'password.conf' file
+                    with open(path, "w") as fd:
+                        if pin_sans_token:
+                            fd.write(str(pin))
+                        elif self.mdict['pki_subsystem'] in \
+                                config.PKI_APACHE_SUBSYSTEMS:
+                            fd.write(self.mdict['pki_self_signed_token'] +
+                                     ":" + str(pin))
+                        else:
+                            fd.write(self.mdict['pki_self_signed_token'] +
+                                     "=" + str(pin))
+            else:
+                config.pki_log.info(log.PKIHELPER_PASSWORD_CONF_1, path,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                # create a new 'password.conf' file
+                with open(path, "w") as fd:
+                    if pin_sans_token:
+                        fd.write(str(pin))
+                    elif self.mdict['pki_subsystem'] in\
+                            config.PKI_APACHE_SUBSYSTEMS:
+                        fd.write(self.mdict['pki_self_signed_token'] +
+                                 ":" + str(pin))
+                    else:
+                        fd.write(self.mdict['pki_self_signed_token'] +
+                                 "=" + str(pin))
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def create_client_pkcs12_password_conf(self, path, overwrite_flag=False,
+                                           critical_failure=True):
+        try:
+            if os.path.exists(path):
+                if overwrite_flag:
+                    config.pki_log.info(
+                        log.PKIHELPER_PASSWORD_CONF_1, path,
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    # overwrite the existing 'pkcs12_password.conf' file
+                    with open(path, "w") as fd:
+                        fd.write(self.mdict['pki_client_pkcs12_password'])
+            else:
+                config.pki_log.info(log.PKIHELPER_PASSWORD_CONF_1, path,
+                                    extra=config.PKI_INDENTATION_LEVEL_2)
+                # create a new 'pkcs12_password.conf' file
+                with open(path, "w") as fd:
+                    fd.write(self.mdict['pki_client_pkcs12_password'])
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def get_password(self, path, token_name, critical_failure=True):
+        token_pwd = None
+        if os.path.exists(path) and os.path.isfile(path) and\
+           os.access(path, os.R_OK):
+            tokens = PKIConfigParser.read_simple_configuration_file(path)
+            hardware_token = "hardware-" + token_name
+            if hardware_token in tokens:
+                token_name = hardware_token
+                token_pwd = tokens[hardware_token]
+            elif token_name in tokens:
+                token_pwd = tokens[token_name]
+
+        if token_pwd is None or token_pwd == '':
+            # TODO prompt for this password
+            config.pki_log.error(log.PKIHELPER_PASSWORD_NOT_FOUND_1,
+                                 token_name,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise Exception(log.PKIHELPER_PASSWORD_NOT_FOUND_1 % token_name)
+            else:
+                return
+        return token_pwd
+
+
+class Certutil:
+    """PKI Deployment NSS 'certutil' Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+
+    def create_security_databases(self, path, pki_cert_database,
+                                  pki_key_database, pki_secmod_database,
+                                  password_file=None, prefix=None,
+                                  critical_failure=True):
+        try:
+            # Compose this "certutil" command
+            command = ["certutil", "-N"]
+            #   Provide a path to the NSS security databases
+            if path:
+                command.extend(["-d", path])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_PATH,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PATH)
+            if password_file is not None:
+                command.extend(["-f", password_file])
+            if prefix is not None:
+                command.extend(["-P", prefix])
+            if not os.path.exists(path):
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, path,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % path)
+            if os.path.exists(pki_cert_database) or\
+               os.path.exists(pki_key_database) or\
+               os.path.exists(pki_secmod_database):
+                # Simply notify user that the security databases exist
+                config.pki_log.info(
+                    log.PKI_SECURITY_DATABASES_ALREADY_EXIST_3,
+                    pki_cert_database,
+                    pki_key_database,
+                    pki_secmod_database,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+            else:
+                if password_file is not None:
+                    if not os.path.exists(password_file) or\
+                       not os.path.isfile(password_file):
+                        config.pki_log.error(
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                            password_file,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise Exception(
+                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
+                            password_file)
+                # Display this "certutil" command
+                config.pki_log.info(
+                    log.PKIHELPER_CREATE_SECURITY_DATABASES_1,
+                    ' '.join(command),
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                # Execute this "certutil" command
+                subprocess.check_call(command)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def verify_certificate_exists(self, path, pki_cert_database,
+                                  pki_key_database, pki_secmod_database,
+                                  token, nickname, password_file=None,
+                                  silent=True, critical_failure=True):
+        try:
+            # Compose this "certutil" command
+            command = ["certutil", "-L"]
+            #   Provide a path to the NSS security databases
+            if path:
+                command.extend(["-d", path])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_PATH,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PATH)
+            #   Specify the 'token'
+            if token:
+                command.extend(["-h", token])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_TOKEN,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_TOKEN)
+            #   Specify the nickname of this self-signed certificate
+            if nickname:
+                command.extend(["-n", nickname])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_NICKNAME,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NICKNAME)
+            #   OPTIONALLY specify a password file
+            if password_file is not None:
+                command.extend(["-f", password_file])
+            if not os.path.exists(path):
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, path,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % path)
+            if not os.path.exists(pki_cert_database) or\
+               not os.path.exists(pki_key_database) or\
+               not os.path.exists(pki_secmod_database):
+                # NSS security databases MUST exist!
+                config.pki_log.error(
+                    log.PKI_SECURITY_DATABASES_DO_NOT_EXIST_3,
+                    pki_cert_database,
+                    pki_key_database,
+                    pki_secmod_database,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_SECURITY_DATABASES_DO_NOT_EXIST_3 % (
+                        pki_cert_database,
+                        pki_key_database,
+                        pki_secmod_database))
+            if password_file is not None:
+                if not os.path.exists(password_file) or\
+                   not os.path.isfile(password_file):
+                    config.pki_log.error(
+                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                        password_file,
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise Exception(
+                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % password_file)
+            # Display this "certutil" command
+            config.pki_log.info(
+                log.PKIHELPER_CERTUTIL_SELF_SIGNED_CERTIFICATE_1,
+                ' '.join(command), extra=config.PKI_INDENTATION_LEVEL_2)
+            # Execute this "certutil" command
+            if silent:
+                # By default, execute this command silently
+                with open(os.devnull, "w") as fnull:
+                    subprocess.check_call(command, stdout=fnull, stderr=fnull)
+            else:
+                subprocess.check_call(command)
+        except subprocess.CalledProcessError:
+            return False
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return True
+
+    def generate_self_signed_certificate(self, path, pki_cert_database,
+                                         pki_key_database, pki_secmod_database,
+                                         token, nickname,
+                                         subject, serial_number,
+                                         validity_period, issuer_name,
+                                         trustargs, noise_file,
+                                         password_file=None,
+                                         critical_failure=True):
+        try:
+            # Compose this "certutil" command
+            command = ["certutil", "-S"]
+            #   Provide a path to the NSS security databases
+            if path:
+                command.extend(["-d", path])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_PATH,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PATH)
+            #   Specify the 'token'
+            if token:
+                command.extend(["-h", token])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_TOKEN,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_TOKEN)
+            #   Specify the nickname of this self-signed certificate
+            if nickname:
+                command.extend(["-n", nickname])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_NICKNAME,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NICKNAME)
+            #   Specify the subject name (RFC1485)
+            if subject:
+                command.extend(["-s", subject])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_SUBJECT,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_SUBJECT)
+            #   Specify the serial number
+            if serial_number is not None:
+                command.extend(["-m", str(serial_number)])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_SERIAL_NUMBER,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_SERIAL_NUMBER)
+            #   Specify the months valid
+            if validity_period is not None:
+                command.extend(["-v", str(validity_period)])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_VALIDITY_PERIOD,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_VALIDITY_PERIOD)
+            #   Specify the nickname of the issuer certificate
+            if issuer_name:
+                command.extend(["-c", issuer_name])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_ISSUER_NAME,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_ISSUER_NAME)
+            #   Specify the certificate trust attributes
+            if trustargs:
+                command.extend(["-t", trustargs])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_TRUSTARGS,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_TRUSTARGS)
+            #   Specify a noise file to be used for key generation
+            if noise_file:
+                command.extend(["-z", noise_file])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_NOISE_FILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NOISE_FILE)
+            #   OPTIONALLY specify a password file
+            if password_file is not None:
+                command.extend(["-f", password_file])
+            #   ALWAYS self-sign this certificate
+            command.append("-x")
+            # Display this "certutil" command
+            config.pki_log.info(
+                log.PKIHELPER_CERTUTIL_SELF_SIGNED_CERTIFICATE_1,
+                ' '.join(command), extra=config.PKI_INDENTATION_LEVEL_2)
+            if not os.path.exists(path):
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, path,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % path)
+            if not os.path.exists(pki_cert_database) or\
+               not os.path.exists(pki_key_database) or\
+               not os.path.exists(pki_secmod_database):
+                # NSS security databases MUST exist!
+                config.pki_log.error(
+                    log.PKI_SECURITY_DATABASES_DO_NOT_EXIST_3,
+                    pki_cert_database,
+                    pki_key_database,
+                    pki_secmod_database,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_SECURITY_DATABASES_DO_NOT_EXIST_3 % (
+                        pki_cert_database,
+                        pki_key_database,
+                        pki_secmod_database))
+            if not os.path.exists(noise_file):
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1,
+                    noise_file,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % noise_file)
+            if password_file is not None:
+                if not os.path.exists(password_file) or\
+                   not os.path.isfile(password_file):
+                    config.pki_log.error(
+                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                        password_file,
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise Exception(
+                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % password_file)
+            # Execute this "certutil" command
+            #
+            #     NOTE:  ALWAYS mask the command-line output of this command
+            #
+            with open(os.devnull, "w") as fnull:
+                subprocess.check_call(command, stdout=fnull, stderr=fnull)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def import_cert(self, nickname, trust, input_file, password_file,
+                    path=None, token=None, critical_failure=True):
+        try:
+            command = ["certutil", "-A"]
+            if path:
+                command.extend(["-d", path])
+
+            if token:
+                command.extend(["-h", token])
+
+            if nickname:
+                command.extend(["-n", nickname])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_NICKNAME,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NICKNAME)
+
+            if trust:
+                command.extend(["-t", trust])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_TRUSTARGS,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_TRUSTARGS)
+
+            if input_file:
+                command.extend(["-i", input_file])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_INPUT_FILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_INPUT_FILE)
+
+            if password_file:
+                command.extend(["-f", password_file])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE)
+
+            config.pki_log.info(
+                ' '.join(command),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            subprocess.check_call(command)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def generate_certificate_request(self, subject, key_size,
+                                     password_file, noise_file,
+                                     output_file=None, path=None,
+                                     ascii_format=None, token=None,
+                                     critical_failure=True):
+        try:
+            command = ["certutil", "-R"]
+            if path:
+                command.extend(["-d", path])
+            else:
+                command.extend(["-d", "."])
+
+            if token:
+                command.extend(["-h", token])
+
+            if subject:
+                command.extend(["-s", subject])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_SUBJECT,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_SUBJECT)
+
+            if key_size:
+                command.extend(["-g", str(key_size)])
+
+            if noise_file:
+                command.extend(["-z", noise_file])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_NOISE_FILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NOISE_FILE)
+
+            if password_file:
+                command.extend(["-f", password_file])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE)
+
+            if output_file:
+                command.extend(["-o", output_file])
+
+            # set acsii output
+            if ascii_format:
+                command.append("-a")
+
+            # Display this "certutil" command
+            config.pki_log.info(
+                log.PKIHELPER_CERTUTIL_GENERATE_CSR_1, ' '.join(command),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            if not os.path.exists(noise_file):
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1,
+                    noise_file,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % noise_file)
+            if not os.path.exists(password_file) or\
+               not os.path.isfile(password_file):
+                config.pki_log.error(
+                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                    password_file,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(
+                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % password_file)
+            # Execute this "certutil" command
+            with open(os.devnull, "w") as fnull:
+                subprocess.check_call(command, stdout=fnull, stderr=fnull)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+
+class PK12util:
+    """PKI Deployment pk12util class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+
+    def create_file(self, out_file, nickname, out_pwfile,
+                    db_pwfile, path=None, critical_failure=True):
+        try:
+            command = ["pk12util"]
+            if path:
+                command.extend(["-d", path])
+            if out_file:
+                command.extend(["-o", out_file])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_PK12UTIL_MISSING_OUTFILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_PK12UTIL_MISSING_OUTFILE)
+            if nickname:
+                command.extend(["-n", nickname])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_PK12UTIL_MISSING_NICKNAME,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_PK12UTIL_MISSING_NICKNAME)
+            if out_pwfile:
+                command.extend(["-w", out_pwfile])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_PK12UTIL_MISSING_PWFILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_PK12UTIL_MISSING_PWFILE)
+            if db_pwfile:
+                command.extend(["-k", db_pwfile])
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_PK12UTIL_MISSING_DBPWFILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                raise Exception(log.PKIHELPER_PK12UTIL_MISSING_DBPWFILE)
+
+            config.pki_log.info(
+                ' '.join(command),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            with open(os.devnull, "w") as fnull:
+                subprocess.check_call(command, stdout=fnull, stderr=fnull)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+
+class KRAConnector:
+    """PKI Deployment KRA Connector Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+        self.password = deployer.password
+
+    def deregister(self, critical_failure=False):
+        krahost = None
+        kraport = None
+        try:
+            # this is applicable to KRAs only
+            if self.mdict['pki_subsystem_type'] != "kra":
+                return
+
+            config.pki_log.info(
+                log.PKIHELPER_KRACONNECTOR_UPDATE_CONTACT,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+
+            cs_cfg = PKIConfigParser.read_simple_configuration_file(
+                self.mdict['pki_target_cs_cfg'])
+            krahost = cs_cfg.get('service.machineName')
+            kraport = cs_cfg.get('pkicreate.secure_port')
+            cahost = cs_cfg.get('cloning.ca.hostname')
+            caport = cs_cfg.get('cloning.ca.httpsport')
+            if cahost is None or\
+               caport is None:
+                config.pki_log.warning(
+                    log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                config.pki_log.error(
+                    log.PKIHELPER_UNDEFINED_CA_HOST_PORT,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(log.PKIHELPER_UNDEFINED_CA_HOST_PORT)
+                else:
+                    return
+
+            # retrieve subsystem nickname
+            subsystemnick = cs_cfg.get('kra.cert.subsystem.nickname')
+            if subsystemnick is None:
+                config.pki_log.warning(
+                    log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                config.pki_log.error(
+                    log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME)
+                else:
+                    return
+
+            # retrieve name of token based upon type (hardware/software)
+            if ':' in subsystemnick:
+                token_name = subsystemnick.split(':')[0]
+            else:
+                token_name = "internal"
+
+            token_pwd = self.password.get_password(
+                self.mdict['pki_shared_password_conf'],
+                token_name,
+                critical_failure)
+
+            if token_pwd is None or token_pwd == '':
+                config.pki_log.warning(
+                    log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                config.pki_log.error(
+                    log.PKIHELPER_UNDEFINED_TOKEN_PASSWD_1,
+                    token_name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_TOKEN_PASSWD_1 % token_name)
+                else:
+                    return
+
+            self.execute_using_sslget(
+                caport, cahost, subsystemnick,
+                token_pwd, krahost, kraport)
+
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.warning(
+                log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE_2,
+                str(krahost),
+                str(kraport),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def execute_using_pki(
+            self, caport, cahost, subsystemnick,
+            token_pwd, krahost, kraport, critical_failure=False):
+        command = ["/bin/pki",
+                   "-p", str(caport),
+                   "-h", cahost,
+                   "-n", subsystemnick,
+                   "-P", "https",
+                   "-d", self.mdict['pki_database_path'],
+                   "-c", token_pwd,
+                   "ca-kraconnector-del", krahost, str(kraport)]
+
+        output = subprocess.check_output(command,
+                                         stderr=subprocess.STDOUT,
+                                         shell=True)
+
+        error = re.findall("ClientResponseFailure:(.*?)", output)
+        if error:
+            config.pki_log.warning(
+                log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE_2,
+                str(krahost),
+                str(kraport),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(
+                log.PKI_SUBPROCESS_ERROR_1, output,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+        if critical_failure:
+            raise Exception(log.PKI_SUBPROCESS_ERROR_1 % output)
+
+    def execute_using_sslget(
+            self, caport, cahost, subsystemnick,
+            token_pwd, krahost, kraport):
+        update_url = "/ca/rest/admin/kraconnector/remove"
+
+        params = "host=" + str(krahost) + \
+                 "&port=" + str(kraport)
+
+        command = ["/usr/bin/sslget",
+                   "-n", subsystemnick,
+                   "-p", token_pwd,
+                   "-d", self.mdict['pki_database_path'],
+                   "-e", params,
+                   "-v",
+                   "-r", update_url, cahost + ":" + str(caport)]
+
+        # update KRA connector
+        # Execute this "sslget" command
+        # Note that sslget will return non-zero value for HTTP code != 200
+        # and this will raise an exception
+        subprocess.check_output(command, stderr=subprocess.STDOUT)
+
+
+class TPSConnector:
+    """PKI Deployment TPS Connector Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+        self.password = deployer.password
+
+    def deregister(self, critical_failure=False):
+        tkshost = None
+        tksport = None
+        try:
+            # this is applicable to TPSs only
+            if self.mdict['pki_subsystem_type'] != "tps":
+                return
+
+            config.pki_log.info(
+                log.PKIHELPER_TPSCONNECTOR_UPDATE_CONTACT,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+
+            cs_cfg = PKIConfigParser.read_simple_configuration_file(
+                self.mdict['pki_target_cs_cfg'])
+            tpshost = cs_cfg.get('service.machineName')
+            tpsport = cs_cfg.get('pkicreate.secure_port')
+            tkshostport = cs_cfg.get('conn.tks1.hostport')
+            if tkshostport is None:
+                config.pki_log.warning(
+                    log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                config.pki_log.error(
+                    log.PKIHELPER_UNDEFINED_TKS_HOST_PORT,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(log.PKIHELPER_UNDEFINED_TKS_HOST_PORT)
+                else:
+                    return
+
+            #retrieve tks host and port
+            if ':' in tkshostport:
+                tkshost = tkshostport.split(':')[0]
+                tksport = tkshostport.split(':')[1]
+            else:
+                tkshost = tkshostport
+                tksport = '443'
+
+            # retrieve subsystem nickname
+            subsystemnick = cs_cfg.get('tps.cert.subsystem.nickname')
+            if subsystemnick is None:
+                config.pki_log.warning(
+                    log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                config.pki_log.error(
+                    log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME)
+                else:
+                    return
+
+            # retrieve name of token based upon type (hardware/software)
+            if ':' in subsystemnick:
+                token_name = subsystemnick.split(':')[0]
+            else:
+                token_name = "internal"
+
+            token_pwd = self.password.get_password(
+                self.mdict['pki_shared_password_conf'],
+                token_name,
+                critical_failure)
+
+            if token_pwd is None or token_pwd == '':
+                config.pki_log.warning(
+                    log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                config.pki_log.error(
+                    log.PKIHELPER_UNDEFINED_TOKEN_PASSWD_1,
+                    token_name,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(
+                        log.PKIHELPER_UNDEFINED_TOKEN_PASSWD_1 % token_name)
+                else:
+                    return
+
+            self.execute_using_pki(
+                tkshost, tksport, subsystemnick,
+                token_pwd, tpshost, tpsport)
+
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.warning(
+                log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE_2,
+                str(tkshost),
+                str(tksport),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def execute_using_pki(
+            self, tkshost, tksport, subsystemnick,
+            token_pwd, tpshost, tpsport, critical_failure=False):
+        command = ["/bin/pki",
+                   "-p", str(tksport),
+                   "-h", tkshost,
+                   "-n", subsystemnick,
+                   "-P", "https",
+                   "-d", self.mdict['pki_database_path'],
+                   "-c", token_pwd,
+                   "-t", "tks",
+                   "tks-tpsconnector-del",
+                   "--host", tpshost,
+                   "--port", str(tpsport)]
+
+        output = subprocess.check_output(command,
+                                         stderr=subprocess.STDOUT,
+                                         shell=False)
+
+        error = re.findall("ClientResponseFailure:(.*?)", output)
+        if error:
+            config.pki_log.warning(
+                log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE_2,
+                str(tpshost),
+                str(tpsport),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(
+                log.PKI_SUBPROCESS_ERROR_1, output,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+        if critical_failure:
+            raise Exception(log.PKI_SUBPROCESS_ERROR_1 % output)
+
+
+class SecurityDomain:
+    """PKI Deployment Security Domain Class"""
+
+    def __init__(self, deployer):
+        self.mdict = deployer.mdict
+        self.password = deployer.password
+
+    def deregister(self, install_token, critical_failure=False):
+        # process this PKI subsystem instance's 'CS.cfg'
+        cs_cfg = PKIConfigParser.read_simple_configuration_file(
+            self.mdict['pki_target_cs_cfg'])
+
+        # assign key name/value pairs
+        machinename = cs_cfg.get('service.machineName')
+        sport = cs_cfg.get('service.securityDomainPort')
+        ncsport = cs_cfg.get('service.non_clientauth_securePort', '')
+        sechost = cs_cfg.get('securitydomain.host')
+        seceeport = cs_cfg.get('securitydomain.httpseeport')
+        secagentport = cs_cfg.get('securitydomain.httpsagentport')
+        secadminport = cs_cfg.get('securitydomain.httpsadminport')
+        secname = cs_cfg.get('securitydomain.name', 'unknown')
+        adminsport = cs_cfg.get('pkicreate.admin_secure_port', '')
+        typeval = cs_cfg.get('cs.type', '')
+        agentsport = cs_cfg.get('pkicreate.agent_secure_port', '')
+
+        # fix ports for proxy settings
+        proxy_secure_port = cs_cfg.get('proxy.securePort', '')
+        if proxy_secure_port != '':
+            adminsport = proxy_secure_port
+            agentsport = proxy_secure_port
+            sport = proxy_secure_port
+            ncsport = proxy_secure_port
+
+        # NOTE:  Don't check for the existence of 'httpport', as this will
+        #        be undefined for a Security Domain that has been migrated!
+        if sechost is None or\
+           seceeport is None or\
+           secagentport is None or\
+           secadminport is None:
+            config.pki_log.warning(
+                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2,
+                typeval,
+                secname,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(
+                log.PKIHELPER_SECURITY_DOMAIN_UNDEFINED,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise Exception(log.PKIHELPER_SECURITY_DOMAIN_UNDEFINED)
+            else:
+                return
+
+        config.pki_log.info(log.PKIHELPER_SECURITY_DOMAIN_CONTACT_1,
+                            secname,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+        listval = typeval.lower() + "List"
+        update_url = "/ca/agent/ca/updateDomainXML"
+
+        params = "name=" + "\"" + self.mdict['pki_instance_path'] + "\"" + \
+                 "&type=" + str(typeval) + \
+                 "&list=" + str(listval) + \
+                 "&host=" + str(machinename) + \
+                 "&sport=" + str(sport) + \
+                 "&ncsport=" + str(ncsport) + \
+                 "&adminsport=" + str(adminsport) + \
+                 "&agentsport=" + str(agentsport) + \
+                 "&operation=remove"
+
+        if install_token:
+            try:
+                # first try install token-based servlet
+                params += "&sessionID=" + str(install_token)
+                admin_update_url = "/ca/admin/ca/updateDomainXML"
+                command = ["/usr/bin/sslget",
+                           "-p", str(123456),
+                           "-d", self.mdict['pki_database_path'],
+                           "-e", params,
+                           "-v",
+                           "-r", admin_update_url,
+                           sechost + ":" + str(secadminport)]
+                output = subprocess.check_output(
+                    command,
+                    stderr=subprocess.STDOUT)
+            except subprocess.CalledProcessError:
+                config.pki_log.warning(
+                    log.PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1,
+                    secname,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                output = self.update_domain_using_agent_port(
+                    typeval, secname, params, update_url, sechost, secagentport,
+                    critical_failure)
+        else:
+            output = self.update_domain_using_agent_port(
+                typeval, secname, params, update_url, sechost, secagentport,
+                critical_failure)
+
+        if not output:
+            if critical_failure:
+                raise Exception("Cannot update domain using agent port")
+            else:
+                return
+
+        config.pki_log.debug(log.PKIHELPER_SSLGET_OUTPUT_1,
+                             output,
+                             extra=config.PKI_INDENTATION_LEVEL_2)
+        # Search the output for Status
+        status = re.findall('<Status>(.*?)</Status>', output)
+        if not status:
+            config.pki_log.warning(
+                log.PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1,
+                secname,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise Exception(
+                    log.PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1 % secname)
+        elif status[0] != "0":
+            error = re.findall('<Error>(.*?)</Error>', output)
+            if not error:
+                error = ""
+            config.pki_log.warning(
+                log.PKIHELPER_SECURITY_DOMAIN_UNREGISTERED_2,
+                typeval,
+                secname,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(
+                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_3,
+                typeval,
+                secname,
+                error,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise Exception(log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_3
+                                %
+                                (typeval, secname, error))
+        else:
+            config.pki_log.info(
+                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_SUCCESS_2,
+                typeval,
+                secname,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+
+    def update_domain_using_agent_port(
+            self, typeval, secname, params,
+            update_url, sechost, secagentport, critical_failure=False):
+        cs_cfg = PKIConfigParser.read_simple_configuration_file(
+            self.mdict['pki_target_cs_cfg'])
+        # retrieve subsystem nickname
+        subsystemnick_param = typeval.lower() + ".cert.subsystem.nickname"
+        subsystemnick = cs_cfg.get(subsystemnick_param)
+        if subsystemnick is None:
+            config.pki_log.warning(
+                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2,
+                typeval,
+                secname,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(
+                log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise Exception(log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME)
+            else:
+                return
+
+        # retrieve name of token based upon type (hardware/software)
+        if ':' in subsystemnick:
+            token_name = subsystemnick.split(':')[0]
+        else:
+            token_name = "internal"
+
+        token_pwd = self.password.get_password(
+            self.mdict['pki_shared_password_conf'],
+            token_name,
+            critical_failure)
+
+        if token_pwd is None or token_pwd == '':
+            config.pki_log.warning(
+                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2,
+                typeval,
+                secname,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise Exception(
+                    log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2 %
+                    (typeval, secname))
+            else:
+                return
+
+        command = ["/usr/bin/sslget",
+                   "-n", subsystemnick,
+                   "-p", token_pwd,
+                   "-d", self.mdict['pki_database_path'],
+                   "-e", params,
+                   "-v",
+                   "-r", update_url, sechost + ":" + str(secagentport)]
+        try:
+            output = subprocess.check_output(command,
+                                             stderr=subprocess.STDOUT)
+            return output
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.warning(
+                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2,
+                typeval,
+                secname,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.warning(
+                log.PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1,
+                secname,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+
+        return None
+
+    def get_installation_token(self, secuser, secpass, critical_failure=True):
+        if not secuser or not secpass:
+            return None
+
+        # process this PKI subsystem instance's 'CS.cfg'
+        cs_cfg = PKIConfigParser.read_simple_configuration_file(
+            self.mdict['pki_target_cs_cfg'])
+
+        # assign key name/value pairs
+        machinename = cs_cfg.get('service.machineName')
+        cstype = cs_cfg.get('cs.type', '')
+        sechost = cs_cfg.get('securitydomain.host')
+        secadminport = cs_cfg.get('securitydomain.httpsadminport')
+        #secselect = cs_cfg.get('securitydomain.select') - Selected
+        # security domain
+
+        command = ["/bin/pki",
+                   "-p", str(secadminport),
+                   "-h", sechost,
+                   "-P", "https",
+                   "-u", secuser,
+                   "-w", secpass,
+                   "-d", self.mdict['pki_database_path'],
+                   "securitydomain-get-install-token",
+                   "--hostname", machinename,
+                   "--subsystem", cstype]
+        try:
+            output = subprocess.check_output(
+                command,
+                stderr=subprocess.STDOUT,
+                shell=True)
+
+            token_list = re.findall("Install token: \"(.*)\"", output)
+            if not token_list:
+                config.pki_log.error(
+                    log.PKIHELPER_SECURITY_DOMAIN_GET_TOKEN_FAILURE_2,
+                    str(sechost),
+                    str(secadminport),
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                config.pki_log.error(
+                    log.PKI_SUBPROCESS_ERROR_1, output,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                if critical_failure:
+                    raise Exception(
+                        log.PKIHELPER_SECURITY_DOMAIN_GET_TOKEN_FAILURE_2 %
+                        (str(sechost), str(secadminport)))
+            else:
+                token = token_list[0]
+                return token
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(
+                log.PKIHELPER_SECURITY_DOMAIN_GET_TOKEN_FAILURE_2,
+                str(sechost),
+                str(secadminport),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return None
+
+
+class Systemd(object):
+    """PKI Deployment Execution Management Class"""
+
+    def __init__(self, deployer):
+        """PKI Deployment execution management __init__ method.
+
+        Args:
+          deployer (dictionary):  PKI Deployment name/value parameters
+
+        Attributes:
+
+        Returns:
+
+        Raises:
+
+        Examples:
+
+        """
+        self.mdict = deployer.mdict
+
+    def daemon_reload(self, critical_failure=True):
+        """PKI Deployment execution management lifecycle function.
+
+        Executes a 'systemd daemon-reload' system command.
+
+        Args:
+          critical_failure (boolean, optional):  Raise exception on failures;
+                                                 defaults to 'True'.
+
+        Attributes:
+
+        Returns:
+
+        Raises:
+          subprocess.CalledProcessError:  If 'critical_failure' is 'True'.
+
+        Examples:
+
+        """
+        try:
+            # Un-defined command on Debian systems
+            if pki.system.SYSTEM_TYPE == "debian":
+                return
+            # Compose this "systemd" execution management lifecycle command
+            command = ["systemctl", "daemon-reload"]
+            # Display this "systemd" execution management lifecycle command
+            config.pki_log.info(
+                log.PKIHELPER_SYSTEMD_COMMAND_1, ' '.join(command),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            # Execute this "systemd" execution management lifecycle command
+            subprocess.check_call(command)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def start(self, critical_failure=True, reload_daemon=True):
+        """PKI Deployment execution management 'start' method.
+
+           Executes a 'systemd start <service>' system command, or
+           an '/etc/init.d/pki-tomcatd start <instance>' system command.
+           on Debian systems.
+
+        Args:
+          critical_failure (boolean, optional):  Raise exception on failures;
+                                                 defaults to 'True'.
+          reload_daemon (boolean, optional):     Perform a reload of the
+                                                 'systemd' daemon prior to
+                                                 starting;
+                                                 defaults to 'True'.
+
+        Attributes:
+
+        Returns:
+
+        Raises:
+          subprocess.CalledProcessError:  If 'critical_failure' is 'True'.
+
+        Examples:
+
+        """
+        try:
+            service = None
+            # Execute the "systemd daemon-reload" management lifecycle command
+            if reload_daemon:
+                self.daemon_reload(critical_failure)
+            # Compose this "systemd" execution management command
+            if self.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
+                service = "pki-apached" + "@" +\
+                          self.mdict['pki_instance_name'] + "." +\
+                          "service"
+            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+                service = "pki-tomcatd" + "@" +\
+                          self.mdict['pki_instance_name'] + "." +\
+                          "service"
+
+            if pki.system.SYSTEM_TYPE == "debian":
+                command = ["/etc/init.d/pki-tomcatd", "start",
+                           self.mdict['pki_instance_name']]
+            else:
+                command = ["systemctl", "start", service]
+
+            # Display this "systemd" execution managment command
+            config.pki_log.info(
+                log.PKIHELPER_SYSTEMD_COMMAND_1, ' '.join(command),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            # Execute this "systemd" execution management command
+            subprocess.check_call(command)
+        except subprocess.CalledProcessError as exc:
+            if pki.system.SYSTEM_TYPE == "debian":
+                if exc.returncode == 6:
+                    return
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def stop(self, critical_failure=True):
+        """PKI Deployment execution management 'stop' method.
+
+        Executes a 'systemd stop <service>' system command, or
+        an '/etc/init.d/pki-tomcatd stop <instance>' system command
+        on Debian systems.
+
+        Args:
+          critical_failure (boolean, optional):  Raise exception on failures;
+                                                 defaults to 'True'.
+
+        Attributes:
+
+        Returns:
+
+        Raises:
+          subprocess.CalledProcessError:  If 'critical_failure' is 'True'.
+
+        Examples:
+
+        """
+        try:
+            service = None
+            # Compose this "systemd" execution management command
+            if self.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
+                service = "pki-apached" + "@" +\
+                          self.mdict['pki_instance_name'] + "." +\
+                          "service"
+            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+                service = "pki-tomcatd" + "@" +\
+                          self.mdict['pki_instance_name'] + "." +\
+                          "service"
+
+            if pki.system.SYSTEM_TYPE == "debian":
+                command = ["/etc/init.d/pki-tomcatd", "stop",
+                           self.mdict['pki_instance_name']]
+            else:
+                command = ["systemctl", "stop", service]
+
+            # Display this "systemd" execution managment command
+            config.pki_log.info(
+                log.PKIHELPER_SYSTEMD_COMMAND_1, ' '.join(command),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            # Execute this "systemd" execution management command
+            subprocess.check_call(command)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+    def restart(self, critical_failure=True, reload_daemon=True):
+        """PKI Deployment execution management 'restart' method.
+
+        Executes a 'systemd restart <service>' system command, or
+        an '/etc/init.d/pki-tomcatd restart <instance>' system command
+        on Debian systems.
+
+        Args:
+          critical_failure (boolean, optional):  Raise exception on failures;
+                                                 defaults to 'True'.
+          reload_daemon (boolean, optional):     Perform a reload of the
+                                                 'systemd' daemon prior to
+                                                 restarting;
+                                                 defaults to 'True'.
+
+        Attributes:
+
+        Returns:
+
+        Raises:
+          subprocess.CalledProcessError:  If 'critical_failure' is 'True'.
+
+        Examples:
+
+        """
+        try:
+            service = None
+            # Compose this "systemd" execution management command
+            # Execute the "systemd daemon-reload" management lifecycle command
+            if reload_daemon:
+                self.daemon_reload(critical_failure)
+            if self.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
+                service = "pki-apached" + "@" +\
+                          self.mdict['pki_instance_name'] + "." +\
+                          "service"
+            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+                service = "pki-tomcatd" + "@" +\
+                          self.mdict['pki_instance_name'] + "." +\
+                          "service"
+
+            if pki.system.SYSTEM_TYPE == "debian":
+                command = ["/etc/init.d/pki-tomcatd", "restart",
+                           self.mdict['pki_instance_name']]
+            else:
+                command = ["systemctl", "restart", service]
+
+            # Display this "systemd" execution managment command
+            config.pki_log.info(
+                log.PKIHELPER_SYSTEMD_COMMAND_1, ' '.join(command),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            # Execute this "systemd" execution management command
+            subprocess.check_call(command)
+        except subprocess.CalledProcessError as exc:
+            if pki.system.SYSTEM_TYPE == "debian":
+                if exc.returncode == 6:
+                    return
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure:
+                raise
+        return
+
+
+class ConfigClient:
+    """PKI Deployment Configuration Client"""
+
+    def __init__(self, deployer):
+        self.deployer = deployer
+        self.mdict = deployer.mdict
+        # set useful 'boolean' object variables for this class
+        self.clone = config.str2bool(self.mdict['pki_clone'])
+        self.external = config.str2bool(self.mdict['pki_external'])
+        self.external_step_two = config.str2bool(
+            self.mdict['pki_external_step_two'])
+        self.standalone = config.str2bool(self.mdict['pki_standalone'])
+        self.subordinate = config.str2bool(self.mdict['pki_subordinate'])
+        # set useful 'string' object variables for this class
+        self.subsystem = self.mdict['pki_subsystem']
+
+    def configure_pki_data(self, data):
+        config.pki_log.info(
+            log.PKI_CONFIG_CONFIGURING_PKI_DATA,
+            extra=config.PKI_INDENTATION_LEVEL_2)
+
+        connection = pki.client.PKIConnection(
+            protocol='https',
+            hostname=self.mdict['pki_hostname'],
+            port=self.mdict['pki_https_port'],
+            subsystem=self.mdict['pki_subsystem_type'])
+
+        try:
+            client = pki.system.SystemConfigClient(connection)
+            response = client.configure(data)
+
+            config.pki_log.debug(
+                log.PKI_CONFIG_RESPONSE_STATUS + " " + str(response['status']),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            try:
+                certs = response['systemCerts']
+            except KeyError:
+                # no system certs created
+                config.pki_log.debug(
+                    "No new system certificates generated.",
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                certs = []
+
+            if not isinstance(certs, types.ListType):
+                certs = [certs]
+            for cdata in certs:
+                if (self.subsystem == "CA" and self.external and
+                        not self.external_step_two):
+                    # External CA (Step 1)
+                    if cdata['tag'].lower() == "signing":
+                        # Save 'External CA Signing Certificate' CSR (Step 1)
+                        self.save_system_csr(
+                            cdata['request'],
+                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE,
+                            self.mdict['pki_external_csr_path'])
+                        return
+                elif self.standalone and not self.external_step_two:
+                    # Stand-alone PKI (Step 1)
+                    if cdata['tag'].lower() == "audit_signing":
+                        # Save Stand-alone PKI 'Audit Signing Certificate' CSR
+                        # (Step 1)
+                        self.save_system_csr(
+                            cdata['request'],
+                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_AUDIT_SIGNING_1,
+                            self.mdict['pki_external_audit_signing_csr_path'],
+                            self.subsystem)
+                    elif cdata['tag'].lower() == "signing":
+                        # Save Stand-alone PKI OCSP 'OCSP Signing Certificate'
+                        # CSR (Step 1)
+                        self.save_system_csr(
+                            cdata['request'],
+                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_OCSP_SIGNING,
+                            self.mdict['pki_external_signing_csr_path'])
+                    elif cdata['tag'].lower() == "sslserver":
+                        # Save Stand-alone PKI 'SSL Server Certificate' CSR
+                        # (Step 1)
+                        self.save_system_csr(
+                            cdata['request'],
+                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SSLSERVER_1,
+                            self.mdict['pki_external_sslserver_csr_path'],
+                            self.subsystem)
+                    elif cdata['tag'].lower() == "storage":
+                        # Save Stand-alone PKI KRA 'Storage Certificate' CSR
+                        # (Step 1)
+                        self.save_system_csr(
+                            cdata['request'],
+                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_STORAGE,
+                            self.mdict['pki_external_storage_csr_path'])
+                    elif cdata['tag'].lower() == "subsystem":
+                        # Save Stand-alone PKI 'Subsystem Certificate' CSR
+                        # (Step 1)
+                        self.save_system_csr(
+                            cdata['request'],
+                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SUBSYSTEM_1,
+                            self.mdict['pki_external_subsystem_csr_path'],
+                            self.subsystem)
+                    elif cdata['tag'].lower() == "transport":
+                        # Save Stand-alone PKI KRA 'Transport Certificate' CSR
+                        # (Step 1)
+                        self.save_system_csr(
+                            cdata['request'],
+                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_TRANSPORT,
+                            self.mdict['pki_external_transport_csr_path'])
+                else:
+                    config.pki_log.debug(
+                        log.PKI_CONFIG_CDATA_TAG + " " + cdata['tag'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    config.pki_log.debug(
+                        log.PKI_CONFIG_CDATA_CERT + "\n" + cdata['cert'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    config.pki_log.debug(
+                        log.PKI_CONFIG_CDATA_REQUEST + "\n" + cdata['request'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+
+            # Cloned PKI subsystems do not return an Admin Certificate
+            if not self.clone:
+                if self.standalone:
+                    if not self.external_step_two:
+                        # NOTE:  Do nothing for Stand-alone PKI (Step 1)
+                        #        as this has already been addressed
+                        #        in 'set_admin_parameters()'
+                        pass
+                    else:
+                        admin_cert = response['adminCert']['cert']
+                        self.process_admin_cert(admin_cert)
+                elif not config.str2bool(self.mdict['pki_import_admin_cert']):
+                    admin_cert = response['adminCert']['cert']
+                    self.process_admin_cert(admin_cert)
+
+        except Exception, e:
+            if hasattr(e, 'response'):
+                root = ET.fromstring(e.response.text)
+                if root.tag == 'PKIException':
+                    message = root.findall('.//Message')[0].text
+                    if message is not None:
+                        config.pki_log.error(
+                            log.PKI_CONFIG_JAVA_CONFIGURATION_EXCEPTION + " "
+                            + message,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        raise
+            config.pki_log.error(
+                log.PKI_CONFIG_JAVA_CONFIGURATION_EXCEPTION + " " + str(e),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+        return
+
+    def process_admin_cert(self, admin_cert):
+        config.pki_log.debug(
+            log.PKI_CONFIG_RESPONSE_ADMIN_CERT + "\n" + admin_cert,
+            extra=config.PKI_INDENTATION_LEVEL_2)
+
+        # Store the Administration Certificate in a file
+        admin_cert_file = self.mdict['pki_client_admin_cert']
+        admin_cert_bin_file = admin_cert_file + ".der"
+        self.save_admin_cert(log.PKI_CONFIG_ADMIN_CERT_SAVE_1,
+                             admin_cert, admin_cert_file,
+                             self.mdict['pki_subsystem_name'])
+
+        # convert the cert file to binary
+        command = ["AtoB", admin_cert_file, admin_cert_bin_file]
+        config.pki_log.info(
+            ' '.join(command),
+            extra=config.PKI_INDENTATION_LEVEL_2)
+        try:
+            subprocess.check_call(command)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+
+        os.chmod(admin_cert_file,
+                 config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS)
+
+        os.chmod(admin_cert_bin_file,
+                 config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS)
+
+        # Import the Administration Certificate
+        # into the client NSS security database
+        self.deployer.certutil.import_cert(
+            re.sub("&#39;", "'", self.mdict['pki_admin_nickname']),
+            "u,u,u",
+            admin_cert_bin_file,
+            self.mdict['pki_client_password_conf'],
+            self.mdict['pki_client_database_dir'],
+            None,
+            True)
+
+        # create directory for p12 file if it does not exist
+        self.deployer.directory.create(os.path.dirname(
+            self.mdict['pki_client_admin_cert_p12']))
+
+        # Export the Administration Certificate from the
+        # client NSS security database into a PKCS #12 file
+        self.deployer.pk12util.create_file(
+            self.mdict['pki_client_admin_cert_p12'],
+            re.sub("&#39;", "'", self.mdict['pki_admin_nickname']),
+            self.mdict['pki_client_pkcs12_password_conf'],
+            self.mdict['pki_client_password_conf'],
+            self.mdict['pki_client_database_dir'])
+
+        os.chmod(
+            self.mdict['pki_client_admin_cert_p12'],
+            config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
+
+    def construct_pki_configuration_data(self):
+        config.pki_log.info(log.PKI_CONFIG_CONSTRUCTING_PKI_DATA,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+
+        data = pki.system.ConfigurationRequest()
+
+        # Miscellaneous Configuration Information
+        data.pin = self.mdict['pki_one_time_pin']
+        data.subsystemName = self.mdict['pki_subsystem_name']
+        data.standAlone = self.standalone
+        data.stepTwo = self.external_step_two
+
+        # Cloning parameters
+        if self.mdict['pki_instance_type'] == "Tomcat":
+            if self.clone:
+                self.set_cloning_parameters(data)
+            else:
+                data.isClone = "false"
+
+        # Hierarchy
+        self.set_hierarchy_parameters(data)
+
+        # Security Domain
+        if ((self.subsystem != "CA" or self.clone or self.subordinate) and
+                not self.standalone):
+            # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone, or
+            # Subordinate CA
+            self.set_existing_security_domain(data)
+        else:
+            # PKI CA, External CA, or Stand-alone PKI
+            self.set_new_security_domain(data)
+
+        # database
+        if self.subsystem != "RA":
+            self.set_database_parameters(data)
+
+        # backup
+        if self.mdict['pki_instance_type'] == "Tomcat":
+            self.set_backup_parameters(data)
+
+        # admin user
+        if not self.clone:
+            self.set_admin_parameters(data)
+
+        # Issuing CA Information
+        self.set_issuing_ca_parameters(data)
+
+        # Create system certs
+        self.set_system_certs(data)
+
+        # TPS parameters
+        if self.subsystem == "TPS":
+            self.set_tps_parameters(data)
+
+        return data
+
+    def save_admin_csr(self):
+        config.pki_log.info(
+            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_ADMIN_1 + " '" +
+            self.mdict['pki_external_admin_csr_path'] + "'", self.subsystem,
+            extra=config.PKI_INDENTATION_LEVEL_2)
+        self.deployer.directory.create(
+            os.path.dirname(self.mdict['pki_external_admin_csr_path']))
+        with open(self.mdict['pki_external_admin_csr_path'], "w") as f:
+            f.write("-----BEGIN CERTIFICATE REQUEST-----\n")
+        admin_certreq = None
+        with open(os.path.join(
+                  self.mdict['pki_client_database_dir'],
+                  "admin_pkcs10.bin.asc"), "r") as f:
+            admin_certreq = f.read()
+        with open(self.mdict['pki_external_admin_csr_path'], "a") as f:
+            f.write(admin_certreq)
+            f.write("-----END CERTIFICATE REQUEST-----")
+        # Read in and print Admin certificate request
+        with open(self.mdict['pki_external_admin_csr_path'], "r") as f:
+            admin_certreq = f.read()
+        config.pki_log.info(
+            log.PKI_CONFIG_CDATA_REQUEST + "\n" + admin_certreq,
+            extra=config.PKI_INDENTATION_LEVEL_2)
+
+    def save_admin_cert(self, message, input_data, output_file, subsystem_name):
+        config.pki_log.debug(message + " '" + output_file + "'", subsystem_name,
+                             extra=config.PKI_INDENTATION_LEVEL_2)
+        with open(output_file, "w") as f:
+            f.write(input_data)
+
+    def save_system_csr(self, csr, message, path, subsystem=None):
+        if subsystem is not None:
+            config.pki_log.info(message + " '" + path + "'", subsystem,
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+        else:
+            config.pki_log.info(message + " '" + path + "'",
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+        self.deployer.directory.create(os.path.dirname(path))
+        with open(path, "w") as f:
+            f.write(csr)
+        # Print this certificate request
+        config.pki_log.info(log.PKI_CONFIG_CDATA_REQUEST + "\n" + csr,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+
+    def load_system_cert(self, cert, message, path, subsystem=None):
+        if subsystem is not None:
+            config.pki_log.info(message + " '" + path + "'", subsystem,
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+        else:
+            config.pki_log.info(message + " '" + path + "'",
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+        with open(path, "r") as f:
+            cert.cert = f.read()
+
+    def load_system_cert_chain(self, cert, message, path):
+        config.pki_log.info(message + " '" + path + "'",
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+        with open(path, "r") as f:
+            cert.certChain = f.read()
+
+    def set_system_certs(self, data):
+        systemCerts = []
+
+        # Create 'CA Signing Certificate'
+        if not self.clone:
+            if self.subsystem == "CA" or self.standalone:
+                cert1 = None
+                if self.subsystem == "CA":
+                    # PKI CA, Subordinate CA, or External CA
+                    cert1 = self.create_system_cert("ca_signing")
+                    cert1.signingAlgorithm = \
+                        self.mdict['pki_ca_signing_signing_algorithm']
+                if self.external_step_two:
+                    # External CA (Step 2) or Stand-alone PKI (Step 2)
+                    if not self.subsystem == "CA":
+                        # Stand-alone PKI (Step 2)
+                        cert1 = pki.system.SystemCertData()
+                        cert1.tag = self.mdict['pki_ca_signing_tag']
+                    # Load the External CA or Stand-alone PKI
+                    # 'External CA Signing Certificate' (Step 2)
+                    self.load_system_cert(
+                        cert1,
+                        log.PKI_CONFIG_EXTERNAL_CA_LOAD,
+                        self.mdict['pki_external_ca_cert_path'])
+                    # Load the External CA or Stand-alone PKI
+                    # 'External CA Signing Certificate Chain' (Step 2)
+                    self.load_system_cert_chain(
+                        cert1,
+                        log.PKI_CONFIG_EXTERNAL_CA_CHAIN_LOAD,
+                        self.mdict['pki_external_ca_cert_chain_path'])
+                    systemCerts.append(cert1)
+                elif self.subsystem == "CA":
+                    # PKI CA or Subordinate CA
+                    systemCerts.append(cert1)
+
+        # Create 'OCSP Signing Certificate'
+        if not self.clone:
+            if (self.subsystem == "OCSP" and
+                    self.standalone and
+                    self.external_step_two):
+                # Stand-alone PKI OCSP (Step 2)
+                cert2 = self.create_system_cert("ocsp_signing")
+                # Load the Stand-alone PKI OCSP 'OCSP Signing Certificate'
+                # (Step 2)
+                self.load_system_cert(
+                    cert2,
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_OCSP_SIGNING,
+                    self.mdict['pki_external_signing_cert_path'])
+                cert2.signingAlgorithm = \
+                    self.mdict['pki_ocsp_signing_signing_algorithm']
+                systemCerts.append(cert2)
+            elif self.subsystem == "CA" or self.subsystem == "OCSP":
+                # External CA, Subordinate CA, PKI CA, or PKI OCSP
+                cert2 = self.create_system_cert("ocsp_signing")
+                cert2.signingAlgorithm = \
+                    self.mdict['pki_ocsp_signing_signing_algorithm']
+                systemCerts.append(cert2)
+
+        # Create 'SSL Server Certificate'
+        # all subsystems
+
+        # create new sslserver cert only if this is a new instance
+        system_list = self.deployer.instance.tomcat_instance_subsystems()
+        if self.standalone and self.external_step_two:
+            # Stand-alone PKI (Step 2)
+            cert3 = self.create_system_cert("ssl_server")
+            # Load the Stand-alone PKI 'SSL Server Certificate' (Step 2)
+            self.load_system_cert(
+                cert3,
+                log.PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SSLSERVER_1,
+                self.mdict['pki_external_sslserver_cert_path'],
+                self.subsystem)
+            systemCerts.append(cert3)
+        elif len(system_list) >= 2:
+            # Existing PKI Instance
+            data.generateServerCert = "false"
+            for subsystem in system_list:
+                dst = self.mdict['pki_instance_path'] + '/conf/' + \
+                    subsystem.lower() + '/CS.cfg'
+                if subsystem != self.subsystem and os.path.exists(dst):
+                    cert3 = self.retrieve_existing_server_cert(dst)
+                    systemCerts.append(cert3)
+                    break
+        else:
+            # PKI CA, PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone,
+            # Subordinate CA, or External CA
+            cert3 = self.create_system_cert("ssl_server")
+            systemCerts.append(cert3)
+
+        # Create 'Subsystem Certificate'
+        if not self.clone:
+            if self.standalone and self.external_step_two:
+                data.generateSubsystemCert = "true"
+                # Stand-alone PKI (Step 2)
+                cert4 = self.create_system_cert("subsystem")
+                # Load the Stand-alone PKI 'Subsystem Certificate' (Step 2)
+                self.load_system_cert(
+                    cert4,
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SUBSYSTEM_1,
+                    self.mdict['pki_external_subsystem_cert_path'],
+                    self.subsystem)
+                systemCerts.append(cert4)
+            elif len(system_list) >= 2:
+                # Existing PKI Instance
+                data.generateSubsystemCert = "false"
+                for subsystem in system_list:
+                    dst = self.mdict['pki_instance_path'] + '/conf/' + \
+                        subsystem.lower() + '/CS.cfg'
+                    if subsystem != self.subsystem and os.path.exists(dst):
+                        cert4 = self.retrieve_existing_subsystem_cert(dst)
+                        systemCerts.append(cert4)
+                        break
+            else:
+                # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+                # Subordinate CA, or External CA
+                data.generateSubsystemCert = "true"
+                cert4 = self.create_system_cert("subsystem")
+                systemCerts.append(cert4)
+
+        # Create 'Audit Signing Certificate'
+        if not self.clone:
+            if self.standalone and self.external_step_two:
+                # Stand-alone PKI (Step 2)
+                cert5 = self.create_system_cert("audit_signing")
+                # Load the Stand-alone PKI 'Audit Signing Certificate' (Step 2)
+                self.load_system_cert(
+                    cert5,
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_AUDIT_SIGNING_1,
+                    self.mdict['pki_external_audit_signing_cert_path'],
+                    self.subsystem)
+                cert5.signingAlgorithm = \
+                    self.mdict['pki_audit_signing_signing_algorithm']
+                systemCerts.append(cert5)
+            elif self.subsystem != "RA":
+                cert5 = self.create_system_cert("audit_signing")
+                cert5.signingAlgorithm = \
+                    self.mdict['pki_audit_signing_signing_algorithm']
+                systemCerts.append(cert5)
+
+        # Create 'DRM Transport Certificate' and 'DRM Storage Certificate'
+        if not self.clone:
+            if (self.subsystem == "KRA" and
+                    self.standalone and
+                    self.external_step_two):
+                # Stand-alone PKI KRA Transport Certificate (Step 2)
+                cert6 = self.create_system_cert("transport")
+                # Load the Stand-alone PKI KRA 'Transport Certificate' (Step 2)
+                self.load_system_cert(
+                    cert6,
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_TRANSPORT,
+                    self.mdict['pki_external_transport_cert_path'])
+                systemCerts.append(cert6)
+                # Stand-alone PKI KRA Storage Certificate (Step 2)
+                cert7 = self.create_system_cert("storage")
+                # Load the Stand-alone PKI KRA 'Storage Certificate' (Step 2)
+                self.load_system_cert(
+                    cert7,
+                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_STORAGE,
+                    self.mdict['pki_external_storage_cert_path'])
+                systemCerts.append(cert7)
+            elif self.subsystem == "KRA":
+                # PKI KRA Transport Certificate
+                cert6 = self.create_system_cert("transport")
+                systemCerts.append(cert6)
+                # PKI KRA Storage Certificate
+                cert7 = self.create_system_cert("storage")
+                systemCerts.append(cert7)
+
+        data.systemCerts = systemCerts
+
+    def set_cloning_parameters(self, data):
+        data.isClone = "true"
+        data.cloneUri = self.mdict['pki_clone_uri']
+        data.p12File = self.mdict['pki_clone_pkcs12_path']
+        data.p12Password = self.mdict['pki_clone_pkcs12_password']
+        if config.str2bool(self.mdict['pki_clone_replicate_schema']):
+            data.replicateSchema = "true"
+        else:
+            data.replicateSchema = "false"
+        data.replicationSecurity = \
+            self.mdict['pki_clone_replication_security']
+        if self.mdict['pki_clone_replication_master_port']:
+            data.masterReplicationPort = \
+                self.mdict['pki_clone_replication_master_port']
+        if self.mdict['pki_clone_replication_clone_port']:
+            data.cloneReplicationPort = \
+                self.mdict['pki_clone_replication_clone_port']
+        data.setupReplication = self.mdict['pki_clone_setup_replication']
+
+    def set_hierarchy_parameters(self, data):
+        if self.subsystem == "CA":
+            if self.clone:
+                # Cloned CA
+                data.hierarchy = "root"
+            elif self.external:
+                # External CA
+                data.hierarchy = "join"
+            elif self.subordinate:
+                # Subordinate CA
+                data.hierarchy = "join"
+            else:
+                # PKI CA
+                data.hierarchy = "root"
+
+    def set_existing_security_domain(self, data):
+        data.securityDomainType = "existingdomain"
+        data.securityDomainUri = self.mdict['pki_security_domain_uri']
+        data.securityDomainUser = self.mdict['pki_security_domain_user']
+        data.securityDomainPassword = self.mdict['pki_security_domain_password']
+
+    def set_new_security_domain(self, data):
+        data.securityDomainType = "newdomain"
+        data.securityDomainName = self.mdict['pki_security_domain_name']
+
+    def set_database_parameters(self, data):
+        data.dsHost = self.mdict['pki_ds_hostname']
+        data.dsPort = self.mdict['pki_ds_ldap_port']
+        data.baseDN = self.mdict['pki_ds_base_dn']
+        data.bindDN = self.mdict['pki_ds_bind_dn']
+        data.database = self.mdict['pki_ds_database']
+        data.bindpwd = self.mdict['pki_ds_password']
+        if config.str2bool(self.mdict['pki_ds_create_new_db']):
+            data.createNewDB = "true"
+        else:
+            data.createNewDB = "false"
+        if config.str2bool(self.mdict['pki_ds_remove_data']):
+            data.removeData = "true"
+        else:
+            data.removeData = "false"
+        if config.str2bool(self.mdict['pki_ds_secure_connection']):
+            data.secureConn = "true"
+        else:
+            data.secureConn = "false"
+        if config.str2bool(self.mdict['pki_share_db']):
+            data.sharedDB = "true"
+            data.sharedDBUserDN = self.mdict['pki_share_dbuser_dn']
+        else:
+            data.sharedDB = "false"
+
+    def set_backup_parameters(self, data):
+        if config.str2bool(self.mdict['pki_backup_keys']):
+            data.backupKeys = "true"
+            data.backupFile = self.mdict['pki_backup_keys_p12']
+            data.backupPassword = self.mdict['pki_backup_password']
+        else:
+            data.backupKeys = "false"
+
+    def set_admin_parameters(self, data):
+        data.adminEmail = self.mdict['pki_admin_email']
+        data.adminName = self.mdict['pki_admin_name']
+        data.adminPassword = self.mdict['pki_admin_password']
+        data.adminProfileID = self.mdict['pki_admin_profile_id']
+        data.adminUID = self.mdict['pki_admin_uid']
+        data.adminSubjectDN = self.mdict['pki_admin_subject_dn']
+        if self.standalone:
+            if not self.external_step_two:
+                # IMPORTANT:  ALWAYS set 'pki_import_admin_cert' FALSE for
+                #             Stand-alone PKI (Step 1)
+                self.mdict['pki_import_admin_cert'] = "False"
+            else:
+                # IMPORTANT:  ALWAYS set 'pki_import_admin_cert' TRUE for
+                #             Stand-alone PKI (Step 2)
+                self.mdict['pki_import_admin_cert'] = "True"
+        if config.str2bool(self.mdict['pki_import_admin_cert']):
+            data.importAdminCert = "true"
+            if self.standalone:
+                # Stand-alone PKI (Step 2)
+                #
+                # Copy the Stand-alone PKI 'Admin Certificate'
+                # (that was previously generated via an external CA) into
+                # 'ca_admin.cert' under the specified 'pki_client_dir'
+                # stripping the certificate HEADER/FOOTER prior to saving it.
+                imported_admin_cert = ""
+                with open(self.mdict['pki_external_admin_cert_path'], "r") as f:
+                    for line in f:
+                        if line.startswith("-----BEGIN CERTIFICATE-----"):
+                            continue
+                        elif line.startswith("-----END CERTIFICATE-----"):
+                            continue
+                        else:
+                            imported_admin_cert += line
+                with open(self.mdict['pki_admin_cert_file'], "w") as f:
+                    f.write(imported_admin_cert)
+            # read config from file
+            with open(self.mdict['pki_admin_cert_file'], "r") as f:
+                b64 = f.read().replace('\n', '')
+            data.adminCert = b64
+        else:
+            data.importAdminCert = "false"
+            data.adminSubjectDN = self.mdict['pki_admin_subject_dn']
+            if self.mdict['pki_admin_cert_request_type'] == "pkcs10":
+                data.adminCertRequestType = "pkcs10"
+
+                noise_file = os.path.join(
+                    self.mdict['pki_client_database_dir'], "noise")
+
+                output_file = os.path.join(
+                    self.mdict['pki_client_database_dir'], "admin_pkcs10.bin")
+
+                self.deployer.file.generate_noise_file(
+                    noise_file, int(self.mdict['pki_admin_keysize']))
+
+                self.deployer.certutil.generate_certificate_request(
+                    self.mdict['pki_admin_subject_dn'],
+                    self.mdict['pki_admin_keysize'],
+                    self.mdict['pki_client_password_conf'],
+                    noise_file,
+                    output_file,
+                    self.mdict['pki_client_database_dir'],
+                    None, None, True)
+
+                # convert output to ascii
+                command = ["BtoA", output_file, output_file + ".asc"]
+                config.pki_log.info(
+                    ' '.join(command),
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                try:
+                    subprocess.check_call(command)
+                except subprocess.CalledProcessError as exc:
+                    config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                         extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise
+
+                if self.standalone and not self.external_step_two:
+                    # For convenience and consistency, save a copy of
+                    # the Stand-alone PKI 'Admin Certificate' CSR to the
+                    # specified "pki_external_admin_csr_path" location
+                    # (Step 1)
+                    self.save_admin_csr()
+                    # IMPORTANT:  ALWAYS save the client database for
+                    #             Stand-alone PKI (Step 1)
+                    self.mdict['pki_client_database_purge'] = "False"
+
+                with open(output_file + ".asc", "r") as f:
+                    b64 = f.read().replace('\n', '')
+
+                data.adminCertRequest = b64
+            else:
+                print "log.PKI_CONFIG_PKCS10_SUPPORT_ONLY"
+                raise Exception(log.PKI_CONFIG_PKCS10_SUPPORT_ONLY)
+
+    def set_issuing_ca_parameters(self, data):
+        if (self.subsystem != "CA" or
+                self.clone or
+                self.subordinate or
+                self.external):
+            # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone,
+            # Subordinate CA, External CA, or Stand-alone PKI
+            data.issuingCA = self.mdict['pki_issuing_ca']
+
+    def set_tps_parameters(self, data):
+        data.caUri = self.mdict['pki_ca_uri']
+        data.tksUri = self.mdict['pki_tks_uri']
+        data.enableServerSideKeyGen = \
+            self.mdict['pki_enable_server_side_keygen']
+        if config.str2bool(self.mdict['pki_enable_server_side_keygen']):
+            data.kraUri = self.mdict['pki_kra_uri']
+        data.authdbHost = self.mdict['pki_authdb_hostname']
+        data.authdbPort = self.mdict['pki_authdb_port']
+        data.authdbBaseDN = self.mdict['pki_authdb_basedn']
+        data.authdbSecureConn = self.mdict['pki_authdb_secure_conn']
+        data.importSharedSecret = self.mdict['pki_import_shared_secret']
+
+    def create_system_cert(self, tag):
+        cert = pki.system.SystemCertData()
+        cert.tag = self.mdict["pki_%s_tag" % tag]
+        cert.keyAlgorithm = self.mdict["pki_%s_key_algorithm" % tag]
+        cert.keySize = self.mdict["pki_%s_key_size" % tag]
+        cert.keyType = self.mdict["pki_%s_key_type" % tag]
+        cert.nickname = self.mdict["pki_%s_nickname" % tag]
+        cert.subjectDN = self.mdict["pki_%s_subject_dn" % tag]
+        cert.token = self.mdict["pki_%s_token" % tag]
+        return cert
+
+    def retrieve_existing_server_cert(self, cfg_file):
+        cs_cfg = PKIConfigParser.read_simple_configuration_file(cfg_file)
+        cstype = cs_cfg.get('cs.type').lower()
+        cert = pki.system.SystemCertData()
+        cert.tag = self.mdict["pki_ssl_server_tag"]
+        cert.keyAlgorithm = self.mdict["pki_ssl_server_key_algorithm"]
+        cert.keySize = self.mdict["pki_ssl_server_key_size"]
+        cert.keyType = self.mdict["pki_ssl_server_key_type"]
+        cert.nickname = cs_cfg.get(cstype + ".sslserver.nickname")
+        cert.cert = cs_cfg.get(cstype + ".sslserver.cert")
+        cert.request = cs_cfg.get(cstype + ".sslserver.certreq")
+        cert.subjectDN = self.mdict["pki_ssl_server_subject_dn"]
+        cert.token = cs_cfg.get(cstype + ".sslserver.tokenname")
+        return cert
+
+    def retrieve_existing_subsystem_cert(self, cfg_file):
+        cs_cfg = PKIConfigParser.read_simple_configuration_file(cfg_file)
+        cstype = cs_cfg.get('cs.type').lower()
+        cert = pki.system.SystemCertData()
+        cert.tag = self.mdict["pki_subsystem_tag"]
+        cert.keyAlgorithm = cs_cfg.get("cloning.subsystem.keyalgorithm")
+        cert.keySize = self.mdict["pki_subsystem_key_size"]
+        cert.keyType = cs_cfg.get("cloning.subsystem.keytype")
+        cert.nickname = cs_cfg.get(cstype + ".subsystem.nickname")
+        cert.cert = cs_cfg.get(cstype + ".subsystem.cert")
+        cert.request = cs_cfg.get(cstype + ".subsystem.certreq")
+        cert.subjectDN = cs_cfg.get("cloning.subsystem.dn")
+        cert.token = cs_cfg.get(cstype + ".subsystem.tokenname")
+        return cert
+
+
+class PKIDeployer:
+    """Holds the global dictionaries and the utility objects"""
+
+    def __init__(self, pki_mdict, slots_dict=None):
+        # Global dictionary variables
+        self.mdict = pki_mdict
+        self.slots = slots_dict
+        self.manifest_db = []
+
+        # Utility objects
+        self.identity = Identity(self)
+        self.namespace = Namespace(self)
+        self.configuration_file = ConfigurationFile(self)
+        self.instance = Instance(self)
+        self.directory = Directory(self)
+        self.file = File(self)
+        self.symlink = Symlink(self)
+        self.war = War(self)
+        self.password = Password(self)
+        self.certutil = Certutil(self)
+        self.pk12util = PK12util(self)
+        self.kra_connector = KRAConnector(self)
+        self.security_domain = SecurityDomain(self)
+        self.systemd = Systemd(self)
+        self.tps_connector = TPSConnector(self)
+        self.config_client = ConfigClient(self)
+
+
diff --git a/base/admin/python/pki/admin/deployment/pkilogging.py b/base/admin/python/pki/admin/deployment/pkilogging.py
new file mode 100644
index 0000000..14c11cf
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/pkilogging.py
@@ -0,0 +1,78 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# System Imports
+import logging
+import os
+import pprint
+
+sensitive_parameters = []
+
+# Initialize 'pretty print' for objects
+pp = pprint.PrettyPrinter(indent=4)
+
+
+def log_format(given_dict):
+    new_dict = {}
+
+    # mask sensitive data
+    for key in given_dict:
+        if key in sensitive_parameters:
+            value = 'XXXXXXXX'
+        else:
+            value = given_dict[key]
+        new_dict[key] = value
+
+    return pp.pformat(new_dict)
+
+
+# PKI Deployment Logging Functions
+def enable_pki_logger(log_dir, log_name, log_level, console_log_level, name):
+    if not os.path.isdir(log_dir):
+        try:
+            os.makedirs(log_dir)
+        except OSError:
+            return OSError
+
+    # Configure logger
+    logger = logging.getLogger(name)
+    logger.setLevel(log_level)
+
+    # Configure console handler
+    console = logging.StreamHandler()
+    console.setLevel(console_log_level)
+    console_format = logging.Formatter('%(name)-12s: ' +
+                                       '%(levelname)-8s ' +
+                                       '%(indent)s%(message)s')
+    console.setFormatter(console_format)
+    logger.addHandler(console)
+
+    # Configure file handler
+    log_file = logging.FileHandler(log_dir + "/" + log_name, 'w')
+    log_file.setLevel(log_level)
+    file_format = logging.Formatter('%(asctime)s %(name)-12s: ' +
+                                    '%(levelname)-8s ' +
+                                    '%(indent)s%(message)s',
+                                    '%Y-%m-%d %H:%M:%S')
+    log_file.setFormatter(file_format)
+    logger.addHandler(log_file)
+
+    return logger
diff --git a/base/admin/python/pki/admin/deployment/pkimanifest.py b/base/admin/python/pki/admin/deployment/pkimanifest.py
new file mode 100644
index 0000000..593fb20
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/pkimanifest.py
@@ -0,0 +1,104 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# System Imports
+import csv
+
+# PKI Deployment Imports
+from . import pkiconfig as config
+from . import pkimessages as log
+
+
+# PKI Deployment Manifest Constants
+RECORD_TYPE_DIRECTORY = "directory"
+RECORD_TYPE_FILE = "file"
+RECORD_TYPE_SYMLINK = "symlink"
+
+
+# PKI Deployment Manifest Record Class
+class Record(object):
+    __slots__ = "name", \
+                "type", \
+                "user", \
+                "group", \
+                "uid", \
+                "gid", \
+                "permissions", \
+                "acls",
+
+    def __init__(self):
+        self.name = None
+        self.type = None
+        self.user = None
+        self.group = None
+        self.uid = None
+        self.gid = None
+        self.permissions = None
+        self.acls = None
+
+    def items(self):
+        """dict style items"""
+        return [
+            (field_name, getattr(self, field_name))
+            for field_name in self.__slots__]
+
+    def __iter__(self):
+        """iterate over fields tuple/list style"""
+        for field_name in self.__slots__:
+            yield getattr(self, field_name)
+
+    def __getitem__(self, index):
+        """tuple/list style getitem"""
+        return getattr(self, self.__slots__[index])
+
+
+# PKI Deployment Manifest File Class
+class File:
+
+    def __init__(self, database):
+        self.filename = None
+        self.database = database
+
+    def register(self, name):
+        self.filename = name
+
+    def write(self):
+        try:
+            with open(self.filename, "w") as fd:
+                c = csv.writer(fd)
+                for record in self.database:
+                    c.writerow(tuple(record))
+        except IOError as exc:
+            config.pki_log.error(log.PKI_IOERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_1)
+            raise
+
+    def read(self):
+        try:
+            with open(self.filename, "r") as fd:
+                cr = csv.reader(fd)
+                for row in cr:
+                    print tuple(row)
+        except IOError as exc:
+            config.pki_log.error(log.PKI_IOERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_1)
+            raise
+
diff --git a/base/admin/python/pki/admin/deployment/pkimessages.py b/base/admin/python/pki/admin/deployment/pkimessages.py
new file mode 100644
index 0000000..405118a
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/pkimessages.py
@@ -0,0 +1,421 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# PKI Deployment Engine Messages
+PKI_DICTIONARY_DEFAULT = '''
+=====================================================
+    DISPLAY CONTENTS OF PKI DEFAULT DICTIONARY
+=====================================================
+'''
+PKI_DICTIONARY_MASTER = '''
+=====================================================
+    DISPLAY CONTENTS OF PKI MASTER DICTIONARY
+=====================================================
+'''
+PKI_DICTIONARY_SLOTS = '''
+=====================================================
+    DISPLAY CONTENTS OF PKI SLOTS DICTIONARY
+=====================================================
+'''
+PKI_DICTIONARY_SUBSYSTEM = '''
+=====================================================
+    DISPLAY CONTENTS OF PKI SUBSYSTEM DICTIONARY
+=====================================================
+'''
+PKI_DICTIONARY_WEB_SERVER = '''
+=====================================================
+    DISPLAY CONTENTS OF PKI WEB SERVER DICTIONARY
+=====================================================
+'''
+# NEVER print out 'sensitive' data dictionary!!!
+
+
+# PKI Deployment Log Messages
+PKI_VERBOSITY = '''
+VERBOSITY FLAGS    CONSOLE MESSAGE LEVEL       LOG MESSAGE LEVEL
+=======================================================================
+  NONE             error|warning               error|warning|info|debug
+  -v               error|warning|info          error|warning|info|debug
+  -vv              error|warning|info|debug    error|warning|info|debug
+
+'''
+
+
+# PKI Deployment Error Messages
+PKI_BADZIPFILE_ERROR_1 = "zipfile.BadZipFile:  %s!"
+PKI_CONFIGURATION_RESTART_1 = '''
+    After configuration, the server can be operated by the command:
+        %s
+'''
+PKI_CONFIGURATION_STANDALONE_1 = '''
+      Please obtain the necessary certificates for this stand-alone %s,
+      and re-run the configuration for step two.
+'''
+PKI_CONFIGURATION_URL_1 = \
+    "    Please start the configuration by accessing:\n    %s"
+PKI_CONFIGURATION_WIZARD_RESTART_1 = \
+    "After configuration, the server can be operated by the command:\n%s"
+PKI_CONFIGURATION_WIZARD_URL_1 = "Configuration Wizard listening on\n%s"
+PKI_DIRECTORY_ALREADY_EXISTS_1 = "Directory '%s' already exists!"
+PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1 = \
+    "Directory '%s' already exists BUT it is NOT a directory!"
+PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 = \
+    "Directory '%s' is either missing or is NOT a directory!"
+PKI_DNS_DOMAIN_NOT_SET = \
+    "A valid DNS domain name MUST be established to use PKI services!"
+PKI_FILE_ALREADY_EXISTS_1 = "File '%s' already exists!"
+PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 = \
+    "File '%s' already exists BUT it is NOT a file!"
+PKI_FILE_MISSING_OR_NOT_A_FILE_1 = \
+    "File '%s' is either missing or is NOT a regular file!"
+PKI_FILE_NOT_A_WAR_FILE_1 = "File '%s' is NOT a war file!"
+PKI_INSTANCE_DOES_NOT_EXIST_1 = "PKI instance '%s' does NOT exist!"
+PKI_SECURITY_DATABASES_ALREADY_EXIST_3 = \
+    "Security databases '%s', '%s', and/or '%s' already exist!"
+PKI_SECURITY_DATABASES_DO_NOT_EXIST_3 = \
+    "Security databases '%s', '%s', and/or '%s' do NOT exist!"
+PKI_SUBSYSTEM_NOT_INSTALLED_1 = "Package pki-%s is NOT installed!"
+PKI_SUBSYSTEM_ALREADY_EXISTS_2 = \
+    "PKI subsystem '%s' for instance '%s' already exists!"
+PKI_SUBSYSTEM_DOES_NOT_EXIST_2 = \
+    "PKI subsystem '%s' for instance '%s' does NOT exist!"
+PKI_EXTERNAL_UNSUPPORTED_1 = \
+    "PKI '%s' subsystems do NOT support the 'pki_external' parameter!"
+PKI_EXTERNAL_STEP_TWO_UNSUPPORTED_1 = \
+    "PKI '%s' subsystems do NOT support the 'pki_external_step_two' parameter!"
+PKI_STANDALONE_UNSUPPORTED_1 = \
+    "PKI '%s' subsystems do NOT support the 'pki_standalone' parameter!"
+PKI_SUBORDINATE_UNSUPPORTED_1 = \
+    "PKI '%s' subsystems do NOT support the 'pki_subordinate' parameter!"
+
+PKI_IOERROR_1 = "IOError:  %s!"
+PKI_KEYERROR_1 = "KeyError:  %s!"
+PKI_LARGEZIPFILE_ERROR_1 = "zipfile.LargeZipFile:  %s!"
+PKI_MANIFEST_MESSAGE_1 = "generating manifest file called '%s'"
+PKI_OSERROR_1 = "OSError:  %s!"
+PKI_SHUTIL_ERROR_1 = "shutil.Error:  %s!"
+PKI_SUBPROCESS_ERROR_1 = "subprocess.CalledProcessError:  %s!"
+PKI_SYMLINK_ALREADY_EXISTS_1 = "Symlink '%s' already exists!"
+PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1 = \
+    "Symlink '%s' already exists BUT it is NOT a symlink!"
+PKI_SYMLINK_MISSING_OR_NOT_A_SYMLINK_1 = \
+    "Symlink '%s' is either missing or is NOT a symbolic link!"
+PKI_UNABLE_TO_PARSE_1 = "'Could not parse:  '%s'"
+PKI_UNABLE_TO_CREATE_LOG_DIRECTORY_1 = "Could not create log directory '%s'!"
+
+
+# PKI Deployment 'pkispawn' and 'pkidestroy' Messages
+PKIDESTROY_BEGIN_MESSAGE_2 = \
+    "BEGIN destroying subsystem '%s' of instance '%s' . . ."
+PKIDESTROY_END_MESSAGE_2 = "END destroying subsystem '%s' of instance '%s'"
+PKIDESTROY_EPILOG = '''
+REMINDER:
+
+    The default PKI instance path will be calculated and placed in front
+    of the mandatory '-i <instance>' parameter, and the values that reside
+    in deployment configuration file that was most recently used
+    by this instance's 'pkispawn' (or 'pkispawn -u') command will be
+    utilized by 'pkidestroy' to remove this instance.
+
+    Finally, if an optional '-p <prefix>' is defined, this value WILL be
+    prepended to the default PKI instance path which is placed in front
+    of the specified '-i <instance>' parameter.
+''' + PKI_VERBOSITY
+PKISPAWN_BEGIN_MESSAGE_2 = \
+    "BEGIN spawning subsystem '%s' of instance '%s' . . ."
+PKISPAWN_END_MESSAGE_2 = \
+    "END spawning subsystem '%s' of instance '%s'"
+PKISPAWN_EPILOG = """
+REMINDER:
+
+    If two or more Apache or Tomcat PKI 'instances' are specified via
+    separate configuration files, remember that the following parameters
+    MUST differ between PKI 'instances':
+
+        Apache:  'pki_instance_name', 'pki_http_port', and 'pki_https_port'
+        Tomcat:  'pki_instance_name', 'pki_http_port', 'pki_https_port',
+                 'pki_ajp_port', and 'pki_tomcat_server_port'
+
+    Finally, if an optional '-p <prefix>' is defined, this value WILL NOT
+    be prepended in front of the mandatory '-f <configuration_file>'.
+""" + PKI_VERBOSITY
+
+
+# PKI Deployment "Helper" Messages
+PKIHELPER_APACHE_INSTANCE_SUBSYSTEMS_2 = \
+    "instance '%s' contains '%d' Apache PKI subsystems"
+PKIHELPER_APACHE_INSTANCES_2 = \
+    "PKI Apache registry '%s' contains '%d' Apache PKI instances"
+PKIHELPER_APPLY_SLOT_SUBSTITUTION_1 = \
+    "applying in-place slot substitutions on '%s'"
+PKIHELPER_CERTUTIL_GENERATE_CSR_1 = "executing '%s'"
+PKIHELPER_CERTUTIL_MISSING_INPUT_FILE = \
+    "certutil: Missing '-i input-file' option!"
+PKIHELPER_CERTUTIL_MISSING_ISSUER_NAME = \
+    "certutil:  Missing '-c issuer-name' option!"
+PKIHELPER_CERTUTIL_MISSING_NICKNAME = \
+    "certutil:  Missing '-n nickname' option!"
+PKIHELPER_CERTUTIL_MISSING_NOISE_FILE = \
+    "certutil:  Missing '-z noise-file' option!"
+PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE = \
+    "certutil:  Missing '-f password-file' option!"
+PKIHELPER_CERTUTIL_MISSING_PATH = "certutil:  Missing '-d path' option!"
+PKIHELPER_CERTUTIL_MISSING_SERIAL_NUMBER = \
+    "certutil:  Missing '-m serial-number' option!"
+PKIHELPER_CERTUTIL_MISSING_SUBJECT = "certutil:  Missing '-s subject' option!"
+PKIHELPER_CERTUTIL_MISSING_TOKEN = "certutil:  Missing '-h token' option!"
+PKIHELPER_CERTUTIL_MISSING_TRUSTARGS = \
+    "certutil:  Missing '-t trustargs' option!"
+PKIHELPER_CERTUTIL_MISSING_VALIDITY_PERIOD = \
+    "certutil:  Missing '-v months-valid' option!"
+PKIHELPER_CERTUTIL_SELF_SIGNED_CERTIFICATE_1 = "executing '%s'"
+PKIHELPER_CHMOD_2 = "chmod %o %s"
+PKIHELPER_CHOWN_3 = "chown %s:%s %s"
+PKIHELPER_CHOWN_H_3 = "chown -h %s:%s %s"
+PKIHELPER_COMMAND_LINE_PARAMETER_MISMATCH_2 = \
+    "the command-line parameter '%s' DOES NOT match the "\
+    "configuration file value '%s'!"
+PKIHELPER_COPY_WITH_SLOT_SUBSTITUTION_2 = \
+    "copying '%s' --> '%s' with slot substitution"
+PKIHELPER_CP_P_2 = "cp -p %s %s"
+PKIHELPER_CP_RP_2 = "cp -rp %s %s"
+PKIHELPER_CREATE_SECURITY_DATABASES_1 = "executing '%s'"
+PKIHELPER_DANGLING_SYMLINK_2 = "Dangling symlink '%s'-->'%s'"
+PKIHELPER_DICTIONARY_MASTER_MISSING_KEY_1 = \
+    "KeyError:  Master dictionary is missing the key called '%s'!"
+PKIHELPER_DICTIONARY_INTERPOLATION_1 = \
+    "Deployment file could not be parsed correctly.  This might be because of "\
+    "unescaped '%%' characters.  You must escape '%%' characters in deployment"\
+    " files (example - 'setting=foo%%%%bar')."
+PKIHELPER_DICTIONARY_INTERPOLATION_2 = "Interpolation error (%s)"
+PKIHELPER_DIRECTORY_IS_EMPTY_1 = "directory '%s' is empty"
+PKIHELPER_DIRECTORY_IS_NOT_EMPTY_1 = "directory '%s' is NOT empty"
+PKIHELPER_GID_2 = "GID of '%s' is %s"
+PKIHELPER_GROUP_1 = "retrieving GID for '%s' . . ."
+PKIHELPER_GROUP_ADD_2 = "adding GID '%s' for group '%s' . . ."
+PKIHELPER_GROUP_ADD_DEFAULT_2 = "adding default GID '%s' for group '%s' . . ."
+PKIHELPER_GROUP_ADD_GID_KEYERROR_1 = "KeyError:  pki_gid %s"
+PKIHELPER_GROUP_ADD_KEYERROR_1 = "KeyError:  pki_group %s"
+PKIHELPER_INVALID_SELINUX_CONTEXT_FOR_PORT = \
+    "port %s has invalid selinux context %s"
+PKIHELPER_IS_A_DIRECTORY_1 = "'%s' is a directory"
+PKIHELPER_IS_A_FILE_1 = "'%s' is a file"
+PKIHELPER_IS_A_SYMLINK_1 = "'%s' is a symlink"
+PKIHELPER_JAR_XF_C_2 = "jar -xf %s -C %s"
+PKIHELPER_KRACONNECTOR_UPDATE_CONTACT = \
+    "contacting the CA to update the KRA connector"
+PKIHELPER_KRACONNECTOR_UPDATE_FAILURE = "Failed to update KRA connector on CA"
+PKIHELPER_KRACONNECTOR_UPDATE_FAILURE_2 = \
+    "Failed to update KRA connector for %s:%s"
+PKIHELPER_LINK_S_2 = "ln -s %s %s"
+PKIHELPER_MKDIR_1 = "mkdir -p %s"
+PKIHELPER_MODIFY_DIR_1 = "modifying '%s'"
+PKIHELPER_MODIFY_FILE_1 = "modifying '%s'"
+PKIHELPER_MODIFY_SYMLINK_1 = "modifying '%s'"
+PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_CA = \
+    "cloned CAs and external CAs MUST be MUTUALLY EXCLUSIVE in '%s'"
+PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_SUB_CA = \
+    "cloned CAs, external CAs, and subordinate CAs MUST ALL be MUTUALLY "\
+    "EXCLUSIVE in '%s'"
+PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_STANDALONE_PKI = \
+    "cloned PKIs and stand-alone PKIs MUST be MUTUALLY EXCLUSIVE in '%s'"
+PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_SUB_CA = \
+    "cloned CAs and subordinate CAs MUST be MUTUALLY EXCLUSIVE in '%s'"
+PKIHELPER_MUTUALLY_EXCLUSIVE_EXTERNAL_SUB_CA = \
+    "external CAs and subordinate CAs MUST be MUTUALLY EXCLUSIVE in '%s'"
+PKIHELPER_NAMESPACE_COLLISION_2 = \
+    "PKI instance '%s' would produce a namespace collision with '%s'!"
+PKIHELPER_NAMESPACE_RESERVED_NAME_2 = \
+    "PKI instance '%s' is already a reserved name under '%s'!"
+PKIHELPER_NOISE_FILE_2 = \
+    "generating noise file called '%s' and filling it with '%d' random bytes"
+PKIHELPER_PASSWORD_CONF_1 = "generating '%s'"
+PKIHELPER_PASSWORD_NOT_FOUND_1 = "no password found for '%s'!"
+PKIHELPER_PK12UTIL_MISSING_DBPWFILE = \
+    "pk12util missing -k db-password-file option!"
+PKIHELPER_PK12UTIL_MISSING_NICKNAME = \
+    "pk12util missing -n nickname option!"
+PKIHELPER_PK12UTIL_MISSING_OUTFILE = \
+    "pk12util missing -o output-file option!"
+PKIHELPER_PK12UTIL_MISSING_PWFILE = \
+    "pk12util missing -w pw-file option!"
+
+PKIHELPER_PKI_INSTANCE_SUBSYSTEMS_2 = \
+    "instance '%s' contains '%d' PKI subsystems"
+PKIHELPER_REMOVE_FILTER_SECTION_1 = "removing filter section from '%s'"
+PKIHELPER_RM_F_1 = "rm -f %s"
+PKIHELPER_RM_RF_1 = "rm -rf %s"
+PKIHELPER_RMDIR_1 = "rmdir %s"
+PKIHELPER_SECURITY_DOMAIN_CONTACT_1 = \
+    "contacting the security domain master to update security domain '%s'"
+PKIHELPER_SECURITY_DOMAIN_GET_TOKEN_FAILURE_2 = \
+    "Failed to get installation token from security domain '%s:%s'"
+PKIHELPER_SECURITY_DOMAIN_UNDEFINED = \
+    "No security domain defined.\n"\
+    "If this is an unconfigured instance, then that is OK.\n"\
+    "Otherwise, manually delete the entry from the security domain master."
+PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1 = \
+    "security domain '%s' may be offline or unreachable!"
+PKIHELPER_SECURITY_DOMAIN_UNREGISTERED_2 = \
+    "this '%s' entry may not be registered with security domain '%s'!"
+PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2 = \
+    "this '%s' entry will NOT be deleted from security domain '%s'!"
+PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_3 = \
+    "updateDomainXML FAILED to delete this '%s' entry from "\
+    "security domain '%s': '%s'"
+PKIHELPER_SECURITY_DOMAIN_UPDATE_SUCCESS_2 = \
+    "updateDomainXML SUCCESSFULLY deleted this '%s' entry from "\
+    "security domain '%s'"
+PKIHELPER_SELINUX_DISABLED = "Selinux is disabled.  Not checking port contexts"
+PKIHELPER_SET_MODE_1 = "setting ownerships, permissions, and acls on '%s'"
+PKIHELPER_SLOT_SUBSTITUTION_2 = "slot substitution: '%s' ==> '%s'"
+PKIHELPER_SSLGET_OUTPUT_1 = '''
+    Dump of 'sslget' output:
+    =====================================================
+    %s
+    =====================================================
+'''
+PKIHELPER_SYSTEMD_COMMAND_1 = "executing '%s'"
+PKIHELPER_TOMCAT_INSTANCE_SUBSYSTEMS_2 = \
+    "instance '%s' contains '%d' Tomcat PKI subsystems"
+PKIHELPER_TOMCAT_INSTANCES_2 = \
+    "PKI Tomcat registry '%s' contains '%d' Tomcat PKI instances"
+PKIHELPER_TOUCH_1 = "touch %s"
+PKIHELPER_TPSCONNECTOR_UPDATE_CONTACT = \
+    "contacting the TKS to update the TPS connector"
+PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE = "Failed to update TPS connector on TKS"
+PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE_2 = \
+    "Failed to update TPS connector for %s:%s"
+PKIHELPER_UID_2 = "UID of '%s' is %s"
+PKIHELPER_UNDEFINED_CA_HOST_PORT = "CA Host or Port is undefined"
+PKIHELPER_UNDEFINED_CLIENT_DATABASE_PASSWORD_2 = \
+    "Either a value for '%s' MUST be defined in '%s', or "\
+    "the randomly generated client pin MUST be used"
+PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 = \
+    "A value for '%s' MUST be defined in '%s'"
+PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME = "subsystem nickname not defined"
+PKIHELPER_UNDEFINED_TKS_HOST_PORT = "TKS Host or Port is undefined"
+PKIHELPER_UNDEFINED_TOKEN_PASSWD_1 = "Password for token '%s' not defined"
+PKIHELPER_USER_1 = "retrieving UID for '%s' . . ."
+PKIHELPER_USER_ADD_2 = "adding UID '%s' for user '%s' . . ."
+PKIHELPER_USER_ADD_DEFAULT_2 = "adding default UID '%s' for user '%s' . . ."
+PKIHELPER_USER_ADD_KEYERROR_1 = "KeyError:  pki_user %s"
+PKIHELPER_USER_ADD_UID_KEYERROR_1 = "KeyError:  pki_uid %s"
+
+PKI_CONFIG_ADMIN_CERT_SAVE_1 = "saving %s Admin Certificate to file:"
+PKI_CONFIG_ADMIN_CERT_ATOB_1 = "converting %s Admin Certificate to binary:"
+PKI_CONFIG_CDATA_TAG = "tag:"
+PKI_CONFIG_CDATA_CERT = "cert:"
+PKI_CONFIG_CDATA_REQUEST = "request:"
+PKI_CONFIG_CONFIGURING_PKI_DATA = "configuring PKI configuration data."
+PKI_CONFIG_CONSTRUCTING_PKI_DATA = "constructing PKI configuration data."
+PKI_CONFIG_PKCS10_SUPPORT_ONLY = \
+    "only the 'pkcs10' certificate request type is currently supported"
+PKI_CONFIG_EXTERNAL_CA_LOAD = \
+    "loading external CA signing certificate from file:"
+PKI_CONFIG_EXTERNAL_CA_CHAIN_LOAD = \
+    "loading external CA signing certificate chain from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_STORAGE = \
+    "loading external CA signed KRA Storage certificate from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_TRANSPORT = \
+    "loading external CA signed KRA Transport certificate from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_OCSP_SIGNING = \
+    "loading external CA signed OCSP Signing certificate from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SSLSERVER_1 = \
+    "loading external CA signed %s SSL Server certificate from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SUBSYSTEM_1 = \
+    "loading external CA signed %s Subsystem certificate from file:"
+PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_AUDIT_SIGNING_1 = \
+    "loading external CA signed %s Audit Signing certificate from file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE = "saving CA Signing CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_STORAGE = "saving KRA Storage CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_TRANSPORT = "saving KRA Transport CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_OCSP_SIGNING = "saving OCSP Signing CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_ADMIN_1 = "saving %s Admin CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_AUDIT_SIGNING_1 = \
+    "saving %s Audit Signing CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SSLSERVER_1 = \
+    "saving %s SSL Server CSR to file:"
+PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SUBSYSTEM_1 = \
+    "saving %s Subsystem CSR to file:"
+PKI_CONFIG_JAVA_CONFIGURATION_EXCEPTION = \
+    "Exception from Java Configuration Servlet:"
+PKI_CONFIG_RESPONSE_ADMIN_CERT = "adminCert:"
+PKI_CONFIG_RESPONSE_STATUS = "status:"
+PKI_CONFIG_NOT_YET_IMPLEMENTED_1 = " %s NOT YET IMPLEMENTED"
+PKI_CHECK_STATUS_MESSAGE = '''
+      To check the status of the subsystem:
+            systemctl status pki-tomcatd@%s.service
+'''
+PKI_ACCESS_URL = "      The URL for the subsystem is: \n"\
+                 "            https://%s:%s/%s"
+PKI_INSTANCE_RESTART_MESSAGE = \
+    "      To restart the subsystem: \n"\
+    "            systemctl restart pki-tomcatd@%s.service"
+
+
+PKI_SPAWN_INFORMATION_HEADER = '''
+    ==========================================================================
+                                INSTALLATION SUMMARY\n\
+    ==========================================================================
+'''
+
+PKI_SPAWN_INFORMATION_FOOTER = '''
+    ==========================================================================
+'''
+
+
+# PKI Deployment "Scriptlet" Messages
+ADMIN_DOMAIN_DESTROY_1 = "depopulating '%s'"
+ADMIN_DOMAIN_SPAWN_1 = "populating '%s'"
+CONFIGURATION_DESTROY_1 = "unconfiguring '%s'"
+CONFIGURATION_SPAWN_1 = "configuring '%s'"
+FINALIZATION_DESTROY_1 = "finalizing '%s'"
+FINALIZATION_SPAWN_1 = "finalizing '%s'"
+INITIALIZATION_DESTROY_1 = "initializing '%s'"
+INITIALIZATION_SPAWN_1 = "initializing '%s'"
+INSTANCE_DESTROY_1 = "depopulating '%s'"
+INSTANCE_SPAWN_1 = "populating '%s'"
+RESIDUAL_DESTROY_1 = "depopulating '%s'"
+RESIDUAL_SPAWN_1 = "populating '%s'"
+SECURITY_DATABASES_DESTROY_1 = "removing '%s'"
+SECURITY_DATABASES_SPAWN_1 = "generating '%s'"
+SELINUX_DESTROY_1 = "depopulating '%s'"
+SELINUX_SPAWN_1 = "populating '%s'"
+SELINUX_DISABLED_DESTROY_1 = "selinux disabled. skipping unlabelling '%s'"
+SELINUX_DISABLED_SPAWN_1 = "selinux disabled. skipping labelling '%s'"
+SLOT_ASSIGNMENT_DESTROY_1 = "unassigning slots for '%s'"
+SLOT_ASSIGNMENT_SPAWN_1 = "assigning slots for '%s'"
+SUBSYSTEM_DESTROY_1 = "depopulating '%s'"
+SUBSYSTEM_SPAWN_1 = "populating '%s'"
+WEBAPP_DEPLOYMENT_DESTROY_1 = "removing '%s'"
+WEBAPP_DEPLOYMENT_SPAWN_1 = "deploying '%s'"
+SKIP_ADMIN_DOMAIN_SPAWN_1 = "skip populating '%s'"
+SKIP_CONFIGURATION_SPAWN_1 = "skip configuring '%s'"
+SKIP_FINALIZATION_SPAWN_1 = "skip finalizing '%s'"
+SKIP_INITIALIZATION_SPAWN_1 = "skip initializing '%s'"
+SKIP_INSTANCE_SPAWN_1 = "skip populating '%s'"
+SKIP_RESIDUAL_SPAWN_1 = "skip populating '%s'"
+SKIP_SECURITY_DATABASES_SPAWN_1 = "skip generating '%s'"
+SKIP_SELINUX_SPAWN_1 = "skip populating '%s'"
+SKIP_SLOT_ASSIGNMENT_SPAWN_1 = "skip assigning slots for '%s'"
+SKIP_SUBSYSTEM_SPAWN_1 = "skip populating '%s'"
+SKIP_WEBAPP_DEPLOYMENT_SPAWN_1 = "skip deploying '%s'"
diff --git a/base/admin/python/pki/admin/deployment/pkiparser.py b/base/admin/python/pki/admin/deployment/pkiparser.py
new file mode 100644
index 0000000..1d201ce
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/pkiparser.py
@@ -0,0 +1,1273 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# System Imports
+import ConfigParser
+import argparse
+import getpass
+import ldap
+import logging
+import os
+import random
+import requests
+import string
+import subprocess
+import xml.etree.ElementTree as ET
+from urlparse import urlparse
+
+# PKI Imports
+import pki
+import pki.upgrade
+import pki.account
+import pki.client
+import pki.system
+from . import pkiconfig as config
+from . import pkimessages as log
+from . import pkilogging
+
+
+class PKIConfigParser:
+
+    COMMENT_CHAR = '#'
+    OPTION_CHAR = '='
+
+    def __init__(self, description, epilog):
+        self.pki_config = None
+
+        #Read and process command-line options
+        self.arg_parser = argparse.ArgumentParser(
+            description=description,
+            add_help=False,
+            formatter_class=argparse.RawDescriptionHelpFormatter,
+            epilog=epilog)
+
+        # Establish 'Mandatory' command-line options
+        self.mandatory = self.arg_parser.add_argument_group(
+            'mandatory arguments')
+
+        # Establish 'Optional' command-line options
+        self.optional = self.arg_parser.add_argument_group('optional arguments')
+        self.optional.add_argument(
+            '-s',
+            dest='pki_subsystem', action='store',
+            nargs=1, choices=config.PKI_SUBSYSTEMS,
+            metavar='<subsystem>',
+            help='where <subsystem> is '
+            'CA, KRA, OCSP, RA, TKS, or TPS')
+        self.optional.add_argument(
+            '-h', '--help',
+            dest='help', action='help',
+            help='show this help message and exit')
+        self.optional.add_argument(
+            '-v',
+            dest='pki_verbosity', action='count',
+            help='display verbose information (details below)')
+
+        # Establish 'Test' command-line options
+        test = self.arg_parser.add_argument_group('test arguments')
+        test.add_argument(
+            '-p',
+            dest='pki_root_prefix', action='store',
+            nargs=1, metavar='<prefix>',
+            help='directory prefix to specify local directory '
+            '[TEST ONLY]')
+        self.indent = 0
+        self.ds_connection = None
+        self.sd_connection = None
+        self.authdb_connection = None
+
+        # Master and Slot dictionaries
+        self.mdict = dict()
+        self.slots_dict = dict()
+
+    # PKI Deployment Helper Functions
+    def process_command_line_arguments(self):
+
+        # Parse command-line options
+        args = self.arg_parser.parse_args()
+
+        # Process 'Mandatory' command-line options
+
+        # Process 'Optional' command-line options
+        #    '-v'
+        if args.pki_verbosity == 1:
+            config.pki_console_log_level = logging.INFO
+        elif args.pki_verbosity >= 2:
+            config.pki_console_log_level = logging.DEBUG
+        else:
+            # Set default log levels
+            config.pki_console_log_level = logging.WARNING
+
+        # Debug log is always at DEBUG level
+        config.pki_log_level = logging.DEBUG
+
+        # Process 'Test' command-line options
+        #    '-p'
+        if args.pki_root_prefix is None:
+            config.pki_root_prefix = ""
+        else:
+            config.pki_root_prefix = str(args.pki_root_prefix).strip('[\']')
+
+        return args
+
+    def validate(self):
+
+        # Validate command-line options
+        if len(config.pki_root_prefix) > 0:
+            if not os.path.exists(config.pki_root_prefix) or \
+                    not os.path.isdir(config.pki_root_prefix):
+                print "ERROR:  " + \
+                      log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % \
+                      config.pki_root_prefix
+                print
+                self.arg_parser.print_help()
+                self.arg_parser.exit(-1)
+
+        # always default that configuration file exists
+        if not os.path.exists(config.default_deployment_cfg) or \
+                not os.path.isfile(config.default_deployment_cfg):
+            print "ERROR:  " + \
+                  log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % \
+                  config.default_deployment_cfg
+            print
+            self.arg_parser.print_help()
+            self.arg_parser.exit(-1)
+
+        if config.user_deployment_cfg:
+            # verify user configuration file exists
+            if not os.path.exists(config.user_deployment_cfg) or \
+                    not os.path.isfile(config.user_deployment_cfg):
+                print "ERROR:  " + \
+                      log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % \
+                      config.user_deployment_cfg
+                print
+                self.arg_parser.print_help()
+                self.arg_parser.exit(-1)
+
+    def init_config(self):
+
+        # RESTEasy
+        resteasy_lib = subprocess.check_output(
+            '. /etc/pki/pki.conf && echo $RESTEASY_LIB',
+            shell=True)
+        # workaround for pylint error E1103
+        resteasy_lib = str(resteasy_lib).strip()
+
+        # JNI jar location
+        jni_jar_dir = subprocess.check_output(
+            '. /usr/share/pki/etc/pki.conf && echo $JNI_JAR_DIR',
+            shell=True)
+        # workaround for pylint error E1103
+        jni_jar_dir = str(jni_jar_dir).strip()
+
+        if config.pki_subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
+            default_instance_name = 'pki-tomcat'
+            default_http_port = '8080'
+            default_https_port = '8443'
+        else:
+            default_instance_name = 'pki-apache'
+            default_http_port = '80'
+            default_https_port = '443'
+
+        application_version = str(pki.upgrade.Version(
+            pki.implementation_version()))
+
+        self.pki_config = ConfigParser.SafeConfigParser({
+            'application_version': application_version,
+            'pki_instance_name': default_instance_name,
+            'pki_http_port': default_http_port,
+            'pki_https_port': default_https_port,
+            'pki_dns_domainname': config.pki_dns_domainname,
+            'pki_subsystem': config.pki_subsystem,
+            'pki_subsystem_type': config.pki_subsystem.lower(),
+            'pki_root_prefix': config.pki_root_prefix,
+            'resteasy_lib': resteasy_lib,
+            'jni_jar_dir': jni_jar_dir,
+            'home_dir': os.path.expanduser("~"),
+            'pki_hostname': config.pki_hostname})
+
+        # Make keys case-sensitive!
+        self.pki_config.optionxform = str
+
+        config.user_config = ConfigParser.SafeConfigParser()
+        config.user_config.optionxform = str
+
+        with open(config.default_deployment_cfg) as f:
+            self.pki_config.readfp(f)
+
+        self.flatten_master_dict()
+
+    # The following code is based heavily upon
+    # "http://www.decalage.info/en/python/configparser"
+    @staticmethod
+    def read_simple_configuration_file(filename):
+        values = {}
+        with open(filename) as f:
+            for line in f:
+                # First, remove comments:
+                if PKIConfigParser.COMMENT_CHAR in line:
+                    # split on comment char, keep only the part before
+                    line, _ = line.split(PKIConfigParser.COMMENT_CHAR, 1)
+                # Second, find lines with an name=value:
+                if PKIConfigParser.OPTION_CHAR in line:
+                    # split on name char:
+                    name, value = line.split(PKIConfigParser.OPTION_CHAR, 1)
+                    # strip spaces:
+                    name = name.strip()
+                    value = value.strip()
+                    # store in dictionary:
+                    values[name] = value
+        return values
+
+    def set_property(self, section, key, value):
+        if section != "DEFAULT" and not self.pki_config.has_section(section):
+            self.pki_config.add_section(section)
+        self.pki_config.set(section, key, value)
+        self.flatten_master_dict()
+
+        if section != "DEFAULT" and not config.user_config.has_section(section):
+            config.user_config.add_section(section)
+        config.user_config.set(section, key, value)
+
+    def print_text(self, message):
+        print ' ' * self.indent + message
+
+    def read_text(
+            self, message,
+            section=None, key=None, default=None,
+            options=None, sign=':', allow_empty=True, case_sensitive=True):
+
+        if default is None and key is not None:
+            default = self.mdict[key]
+        if default:
+            message = message + ' [' + default + ']'
+        message = ' ' * self.indent + message + sign + ' '
+
+        done = False
+        while not done:
+            value = raw_input(message)
+            value = value.strip()
+
+            if len(value) == 0:  # empty value
+                if allow_empty:
+                    value = default
+                    done = True
+                    break
+
+            else:  # non-empty value
+                if options is not None:
+                    for v in options:
+                        if case_sensitive:
+                            if v == value:
+                                done = True
+                                break
+                        else:
+                            if v.lower() == value.lower():
+                                done = True
+                                break
+                else:
+                    done = True
+                    break
+
+        value = value.replace("%", "%%")
+        if section:
+            self.set_property(section, key, value)
+
+        return value
+
+    def read_password(
+            self, message, section=None, key=None,
+            verifyMessage=None):
+        message = ' ' * self.indent + message + ': '
+        if verifyMessage is not None:
+            verifyMessage = ' ' * self.indent + verifyMessage + ': '
+
+        while True:
+            password = ''
+            while len(password) == 0:
+                password = getpass.getpass(prompt=message)
+
+            if verifyMessage is not None:
+                verification = ''
+                while len(verification) == 0:
+                    verification = getpass.getpass(prompt=verifyMessage)
+
+                if password != verification:
+                    self.print_text('Passwords do not match.')
+                    continue
+
+            break
+
+        password = password.replace("%", "%%")
+        if section:
+            self.set_property(section, key, password)
+
+        return password
+
+    def read_pki_configuration_file(self):
+        """Read configuration file sections into dictionaries"""
+        rv = 0
+        try:
+            if config.user_deployment_cfg:
+                # We don't allow interpolation in password settings, which
+                # means that we need to deal with escaping '%' characters
+                # that might be present.
+                no_interpolation = (
+                    'pki_admin_password', 'pki_backup_password',
+                    'pki_client_database_password',
+                    'pki_client_pkcs12_password',
+                    'pki_ds_password', 'pki_security_domain_password')
+
+                print 'Loading deployment configuration from ' + \
+                      config.user_deployment_cfg + '.'
+                self.pki_config.read([config.user_deployment_cfg])
+                config.user_config.read([config.user_deployment_cfg])
+
+                # Look through each section and see if any password settings
+                # are present.  If so, escape any '%' characters.
+                sections = self.pki_config.sections()
+                if sections:
+                    sections.append('DEFAULT')
+                    for section in sections:
+                        for key in no_interpolation:
+                            try:
+                                val = self.pki_config.get(
+                                    section, key, raw=True)
+                                if val:
+                                    self.pki_config.set(
+                                        section, key, val.replace("%", "%%"))
+                            except ConfigParser.NoOptionError:
+                                continue
+
+                sections = config.user_config.sections()
+                if sections:
+                    sections.append('DEFAULT')
+                    for section in sections:
+                        for key in no_interpolation:
+                            try:
+                                val = config.user_config.get(
+                                    section, key, raw=True)
+                                if val:
+                                    config.user_config.set(
+                                        section, key, val.replace("%", "%%"))
+                            except ConfigParser.NoOptionError:
+                                continue
+        except ConfigParser.ParsingError, err:
+            print err
+            rv = err
+        return rv
+
+    def flatten_master_dict(self):
+        self.mdict.update(__name__="PKI Master Dictionary")
+
+        default_dict = dict(self.pki_config.items('DEFAULT'))
+        default_dict[0] = None
+        self.mdict.update(default_dict)
+
+        web_server_dict = None
+        if config.pki_subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
+            if self.pki_config.has_section('Tomcat'):
+                web_server_dict = dict(self.pki_config.items('Tomcat'))
+        else:
+            if self.pki_config.has_section('Apache'):
+                web_server_dict = dict(self.pki_config.items('Apache'))
+
+        if web_server_dict:
+            web_server_dict[0] = None
+            self.mdict.update(web_server_dict)
+
+        if self.pki_config.has_section(config.pki_subsystem):
+            subsystem_dict = dict(self.pki_config.items(config.pki_subsystem))
+            subsystem_dict[0] = None
+            self.mdict.update(subsystem_dict)
+
+    def ds_connect(self):
+
+        hostname = self.mdict['pki_ds_hostname']
+
+        if config.str2bool(self.mdict['pki_ds_secure_connection']):
+            protocol = 'ldaps'
+            port = self.mdict['pki_ds_ldaps_port']
+        else:
+            protocol = 'ldap'
+            port = self.mdict['pki_ds_ldap_port']
+
+        self.ds_connection = ldap.initialize(
+            protocol + '://' + hostname + ':' + port)
+
+    def ds_bind(self):
+        self.ds_connection.simple_bind_s(
+            self.mdict['pki_ds_bind_dn'],
+            self.mdict['pki_ds_password'])
+
+    def ds_search(self, key=None):
+        if key is None:
+            key = ''
+        self.ds_connection.search_s(key, ldap.SCOPE_BASE)
+
+    def ds_close(self):
+        self.ds_connection.unbind_s()
+
+    def ds_verify_configuration(self):
+
+        try:
+            self.ds_connect()
+            self.ds_bind()
+            self.ds_search()
+        except:
+            raise
+        finally:
+            self.ds_close()
+
+    def ds_base_dn_exists(self):
+        base_dn_exists = True
+        try:
+            self.ds_connect()
+            self.ds_bind()
+            self.ds_search()
+            try:
+                results = self.ds_search(self.mdict['pki_ds_base_dn'])
+
+                if results is None or len(results) == 0:
+                    base_dn_exists = False
+
+            except ldap.NO_SUCH_OBJECT:
+                base_dn_exists = False
+        except:
+            raise
+        finally:
+            self.ds_close()
+        return base_dn_exists
+
+    def sd_connect(self):
+        self.sd_connection = pki.client.PKIConnection(
+            protocol='https',
+            hostname=self.mdict['pki_security_domain_hostname'],
+            port=self.mdict['pki_security_domain_https_port'],
+            subsystem='ca')
+
+    def sd_get_info(self):
+        sd = pki.system.SecurityDomainClient(self.sd_connection)
+        try:
+            info = sd.get_security_domain_info()
+        except requests.exceptions.HTTPError as e:
+            config.pki_log.info(
+                "unable to access security domain through REST interface.  " +
+                "Trying old interface. " + str(e),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            info = sd.get_old_security_domain_info()
+        return info
+
+    def sd_authenticate(self):
+        self.sd_connection.authenticate(
+            self.mdict['pki_security_domain_user'],
+            self.mdict['pki_security_domain_password'])
+
+        account = pki.account.AccountClient(self.sd_connection)
+        try:
+            account.login()
+            account.logout()
+        except requests.exceptions.HTTPError as e:
+            code = e.response.status_code
+            if code == 404 or code == 501:
+                config.pki_log.warning(
+                    "unable to validate security domain user/password " +
+                    "through REST interface. Interface not available",
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+            else:
+                raise
+
+    def authdb_connect(self):
+
+        hostname = self.mdict['pki_authdb_hostname']
+        port = self.mdict['pki_authdb_port']
+
+        if config.str2bool(self.mdict['pki_authdb_secure_conn']):
+            protocol = 'ldaps'
+        else:
+            protocol = 'ldap'
+
+        self.authdb_connection = ldap.initialize(
+            protocol + '://' + hostname + ':' + port)
+        self.authdb_connection.search_s('', ldap.SCOPE_BASE)
+
+    def authdb_base_dn_exists(self):
+        try:
+            results = self.authdb_connection.search_s(
+                self.mdict['pki_authdb_basedn'],
+                ldap.SCOPE_BASE)
+
+            if results is None or len(results) == 0:
+                return False
+
+            return True
+
+        except ldap.NO_SUCH_OBJECT:
+            return False
+
+    def get_server_status(self, system_type, system_uri):
+        parse = urlparse(self.mdict[system_uri])
+        conn = pki.client.PKIConnection(
+            protocol=parse.scheme,
+            hostname=parse.hostname,
+            port=str(parse.port),
+            subsystem=system_type)
+        client = pki.system.SystemStatusClient(conn)
+        response = client.get_status()
+        root = ET.fromstring(response)
+        return root.findtext("Status")
+
+    def compose_pki_master_dictionary(self):
+        """
+        Create a single master PKI dictionary from the
+        sectional dictionaries
+        """
+        try:
+            # 'pkispawn'/'pkidestroy' name/value pairs
+            self.mdict['pki_deployment_executable'] = \
+                config.pki_deployment_executable
+            self.mdict['pki_install_time'] = config.pki_install_time
+            self.mdict['pki_timestamp'] = config.pki_timestamp
+            self.mdict['pki_certificate_timestamp'] = \
+                config.pki_certificate_timestamp
+            self.mdict['pki_architecture'] = config.pki_architecture
+            self.mdict['pki_default_deployment_cfg'] = \
+                config.default_deployment_cfg
+            self.mdict['pki_user_deployment_cfg'] = config.user_deployment_cfg
+            self.mdict['pki_deployed_instance_name'] = \
+                config.pki_deployed_instance_name
+            # Generate random 'pin's for use as security database passwords
+            # and add these to the "sensitive" key value pairs read in from
+            # the configuration file
+            pin_low = 100000000000
+            pin_high = 999999999999
+            self.mdict['pki_pin'] = \
+                random.randint(pin_low, pin_high)
+            self.mdict['pki_client_pin'] = \
+                random.randint(pin_low, pin_high)
+
+            self.flatten_master_dict()
+
+            pkilogging.sensitive_parameters = \
+                self.mdict['sensitive_parameters'].split()
+
+            # Always create "false" values for these missing "boolean" keys
+            if not 'pki_enable_access_log' in self.mdict or\
+               not len(self.mdict['pki_enable_access_log']):
+                self.mdict['pki_enable_access_log'] = "false"
+            if not 'pki_external' in self.mdict or\
+               not len(self.mdict['pki_external']):
+                self.mdict['pki_external'] = "false"
+            if not 'pki_external_step_two' in self.mdict or\
+               not len(self.mdict['pki_external_step_two']):
+                self.mdict['pki_external_step_two'] = "false"
+            if not 'pki_standalone' in self.mdict or\
+               not len(self.mdict['pki_standalone']):
+                self.mdict['pki_standalone'] = "false"
+            if not 'pki_subordinate' in self.mdict or\
+               not len(self.mdict['pki_subordinate']):
+                self.mdict['pki_subordinate'] = "false"
+
+            # PKI Target (slot substitution) name/value pairs
+            self.mdict['pki_target_cs_cfg'] = \
+                os.path.join(
+                    self.mdict['pki_subsystem_configuration_path'],
+                    "CS.cfg")
+            self.mdict['pki_target_registry'] = \
+                os.path.join(self.mdict['pki_instance_registry_path'],
+                             self.mdict['pki_instance_name'])
+            if config.str2bool(self.mdict['pki_external_step_two']) or\
+               config.str2bool(self.mdict['pki_skip_installation']):
+                # For CA (External CA Step 2) and Stand-alone PKI (Step 2),
+                # use the 'pki_one_time_pin' established during the setup
+                # of (Step 1)
+                #
+                # Similarly, if the only code being processed is for
+                # configuration, re-use the 'pki_one_time_pin' generated
+                # during the installation phase
+                #
+                if os.path.exists(self.mdict['pki_target_cs_cfg'])\
+                   and\
+                   os.path.isfile(self.mdict['pki_target_cs_cfg']):
+                    cs_cfg = self.read_simple_configuration_file(
+                        self.mdict['pki_target_cs_cfg'])
+                    self.mdict['pki_one_time_pin'] = \
+                        cs_cfg.get('preop.pin')
+                else:
+                    config.pki_log.error(
+                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                        self.mdict['pki_target_cs_cfg'],
+                        extra=config.PKI_INDENTATION_LEVEL_2)
+                    raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1)
+            else:
+                # Generate a one-time pin to be used prior to configuration
+                # and add this to the "sensitive" key value pairs read in from
+                # the configuration file
+                self.mdict['pki_one_time_pin'] = \
+                    ''.join(random.choice(string.ascii_letters + string.digits)
+                    for x in range(20))
+            if self.mdict['pki_subsystem'] in\
+               config.PKI_TOMCAT_SUBSYSTEMS:
+                self.mdict['pki_target_catalina_properties'] = \
+                    os.path.join(
+                        self.mdict['pki_instance_configuration_path'],
+                        "catalina.properties")
+                self.mdict['pki_target_servercertnick_conf'] = \
+                    os.path.join(
+                        self.mdict['pki_instance_configuration_path'],
+                        "serverCertNick.conf")
+                self.mdict['pki_target_server_xml'] = \
+                    os.path.join(
+                        self.mdict['pki_instance_configuration_path'],
+                        "server.xml")
+                self.mdict['pki_target_context_xml'] = \
+                    os.path.join(
+                        self.mdict['pki_instance_configuration_path'],
+                        "context.xml")
+                self.mdict['pki_target_tomcat_conf_instance_id'] = \
+                    self.mdict['pki_root_prefix'] + \
+                    "/etc/sysconfig/" + \
+                    self.mdict['pki_instance_name']
+                self.mdict['pki_target_tomcat_conf'] = \
+                    os.path.join(
+                        self.mdict['pki_instance_configuration_path'],
+                        "tomcat.conf")
+                # in-place slot substitution name/value pairs
+                self.mdict['pki_target_velocity_properties'] = \
+                    os.path.join(
+                        self.mdict['pki_tomcat_webapps_subsystem_path'],
+                        "WEB-INF",
+                        "velocity.properties")
+                self.mdict['pki_target_subsystem_web_xml'] = \
+                    os.path.join(
+                        self.mdict['pki_tomcat_webapps_subsystem_path'],
+                        "WEB-INF",
+                        "web.xml")
+                self.mdict['pki_target_subsystem_web_xml_orig'] = \
+                    os.path.join(
+                        self.mdict['pki_tomcat_webapps_subsystem_path'],
+                        "WEB-INF",
+                        "web.xml.orig")
+                # subystem-specific slot substitution name/value pairs
+                if self.mdict['pki_subsystem'] == "CA":
+                    self.mdict['pki_target_flatfile_txt'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "flatfile.txt")
+                    self.mdict['pki_target_proxy_conf'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "proxy.conf")
+                    self.mdict['pki_target_registry_cfg'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "registry.cfg")
+                    # '*.profile'
+                    self.mdict['pki_target_admincert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "adminCert.profile")
+                    self.mdict['pki_target_caauditsigningcert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "caAuditSigningCert.profile")
+                    self.mdict['pki_target_cacert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "caCert.profile")
+                    self.mdict['pki_target_caocspcert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "caOCSPCert.profile")
+                    self.mdict['pki_target_servercert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "serverCert.profile")
+                    self.mdict['pki_target_subsystemcert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "subsystemCert.profile")
+                    # in-place slot substitution name/value pairs
+                    self.mdict['pki_target_profileselect_template'] = \
+                        os.path.join(
+                            self.mdict['pki_tomcat_webapps_subsystem_path'],
+                            "ee",
+                            self.mdict['pki_subsystem'].lower(),
+                            "ProfileSelect.template")
+                elif self.mdict['pki_subsystem'] == "KRA":
+                    # '*.profile'
+                    self.mdict['pki_target_servercert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "serverCert.profile")
+                    self.mdict['pki_target_storagecert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "storageCert.profile")
+                    self.mdict['pki_target_subsystemcert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "subsystemCert.profile")
+                    self.mdict['pki_target_transportcert_profile'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "transportCert.profile")
+                elif self.mdict['pki_subsystem'] == "TPS":
+                    self.mdict['pki_target_registry_cfg'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "registry.cfg")
+                    self.mdict['pki_target_phone_home_xml'] = \
+                        os.path.join(
+                            self.mdict['pki_subsystem_configuration_path'],
+                            "phoneHome.xml")
+
+            # Slot assignment name/value pairs
+            #     NOTE:  Master key == Slots key; Master value ==> Slots value
+            self.mdict['PKI_INSTANCE_NAME_SLOT'] = \
+                self.mdict['pki_instance_name']
+            self.mdict['PKI_INSTANCE_INITSCRIPT_SLOT'] = \
+                os.path.join(self.mdict['pki_instance_path'],
+                             self.mdict['pki_instance_name'])
+            self.mdict['PKI_REGISTRY_FILE_SLOT'] = \
+                os.path.join(self.mdict['pki_subsystem_registry_path'],
+                             self.mdict['pki_instance_name'])
+            if self.mdict['pki_subsystem'] in\
+               config.PKI_APACHE_SUBSYSTEMS:
+                self.mdict['FORTITUDE_APACHE_SLOT'] = None
+                self.mdict['FORTITUDE_AUTH_MODULES_SLOT'] = None
+                self.mdict['FORTITUDE_DIR_SLOT'] = None
+                self.mdict['FORTITUDE_LIB_DIR_SLOT'] = None
+                self.mdict['FORTITUDE_MODULE_SLOT'] = None
+                self.mdict['FORTITUDE_NSS_MODULES_SLOT'] = None
+                self.mdict['HTTPD_CONF_SLOT'] = None
+                self.mdict['LIB_PREFIX_SLOT'] = None
+                self.mdict['NON_CLIENTAUTH_SECURE_PORT_SLOT'] = None
+                self.mdict['NSS_CONF_SLOT'] = None
+                self.mdict['OBJ_EXT_SLOT'] = None
+                self.mdict['PKI_LOCKDIR_SLOT'] = \
+                    os.path.join("/var/lock/pki",
+                                 "apache")
+                self.mdict['PKI_PIDDIR_SLOT'] = \
+                    os.path.join("/var/run/pki",
+                                 "apache")
+                self.mdict['PKI_WEB_SERVER_TYPE_SLOT'] = "apache"
+                self.mdict['PORT_SLOT'] = None
+                self.mdict['PROCESS_ID_SLOT'] = None
+                self.mdict['REQUIRE_CFG_PL_SLOT'] = None
+                self.mdict['SECURE_PORT_SLOT'] = None
+                self.mdict['SECURITY_LIBRARIES_SLOT'] = None
+                self.mdict['PKI_HOSTNAME_SLOT'] = None
+                self.mdict['SERVER_ROOT_SLOT'] = None
+                self.mdict['SYSTEM_LIBRARIES_SLOT'] = None
+                self.mdict['SYSTEM_USER_LIBRARIES_SLOT'] = None
+                self.mdict['TMP_DIR_SLOT'] = None
+            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+                self.mdict['INSTALL_TIME_SLOT'] = \
+                    self.mdict['pki_install_time']
+                self.mdict['PKI_ADMIN_SECURE_PORT_SLOT'] = \
+                    self.mdict['pki_https_port']
+                self.mdict['PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME_SLOT'] = \
+                    "Unused"
+                self.mdict['PKI_ADMIN_SECURE_PORT_SERVER_COMMENT_SLOT'] = ""
+                self.mdict['PKI_AGENT_CLIENTAUTH_SLOT'] = "want"
+                self.mdict['PKI_AGENT_SECURE_PORT_SLOT'] = \
+                    self.mdict['pki_https_port']
+                self.mdict['PKI_AJP_PORT_SLOT'] = \
+                    self.mdict['pki_ajp_port']
+                self.mdict['PKI_AJP_REDIRECT_PORT_SLOT'] = \
+                    self.mdict['pki_https_port']
+                self.mdict['PKI_CA_HOSTNAME_SLOT'] = \
+                    self.mdict['pki_ca_hostname']
+                self.mdict['PKI_CA_PORT_SLOT'] = \
+                    self.mdict['pki_ca_port']
+                self.mdict['PKI_CERT_DB_PASSWORD_SLOT'] = \
+                    self.mdict['pki_pin']
+                self.mdict['PKI_CFG_PATH_NAME_SLOT'] = \
+                    self.mdict['pki_target_cs_cfg']
+                self.mdict['PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT_SLOT'] = \
+                    "-->"
+                self.mdict['PKI_CLOSE_SEPARATE_PORTS_WEB_COMMENT_SLOT'] = \
+                    "-->"
+                self.mdict['PKI_EE_SECURE_CLIENT_AUTH_PORT_SLOT'] = \
+                    self.mdict['pki_https_port']
+                self.mdict\
+                    ['PKI_EE_SECURE_CLIENT_AUTH_PORT_CONNECTOR_NAME_SLOT'] = \
+                    "Unused"
+                self.mdict\
+                    ['PKI_EE_SECURE_CLIENT_AUTH_PORT_SERVER_COMMENT_SLOT'] = \
+                    ""
+                self.mdict['PKI_EE_SECURE_CLIENT_AUTH_PORT_UI_SLOT'] = \
+                    self.mdict['pki_https_port']
+                self.mdict['PKI_EE_SECURE_PORT_SLOT'] = \
+                    self.mdict['pki_https_port']
+                self.mdict['PKI_EE_SECURE_PORT_CONNECTOR_NAME_SLOT'] = \
+                    "Unused"
+                self.mdict['PKI_EE_SECURE_PORT_SERVER_COMMENT_SLOT'] = \
+                    ""
+                self.mdict['PKI_GROUP_SLOT'] = \
+                    self.mdict['pki_group']
+                self.mdict['PKI_INSTANCE_PATH_SLOT'] = \
+                    self.mdict['pki_instance_path']
+                self.mdict['PKI_INSTANCE_ROOT_SLOT'] = \
+                    self.mdict['pki_path']
+                self.mdict['PKI_LOCKDIR_SLOT'] = \
+                    os.path.join("/var/lock/pki",
+                                 "tomcat")
+                self.mdict['PKI_HOSTNAME_SLOT'] = \
+                    self.mdict['pki_hostname']
+                self.mdict['PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT_SLOT'] = \
+                    "<!--"
+                self.mdict['PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT_SLOT'] = \
+                    "<!--"
+                self.mdict['PKI_PIDDIR_SLOT'] = \
+                    os.path.join("/var/run/pki", "tomcat")
+                if config.str2bool(self.mdict['pki_enable_proxy']):
+                    self.mdict['PKI_CLOSE_AJP_PORT_COMMENT_SLOT'] = \
+                        ""
+                    self.mdict['PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT'] = \
+                        ""
+                    self.mdict['PKI_PROXY_SECURE_PORT_SLOT'] = \
+                        self.mdict['pki_proxy_https_port']
+                    self.mdict['PKI_PROXY_UNSECURE_PORT_SLOT'] = \
+                        self.mdict['pki_proxy_http_port']
+                    self.mdict['PKI_OPEN_AJP_PORT_COMMENT_SLOT'] = \
+                        ""
+                    self.mdict['PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT'] = \
+                        ""
+                else:
+                    self.mdict['PKI_CLOSE_AJP_PORT_COMMENT_SLOT'] = \
+                        "-->"
+                    self.mdict['PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT'] = \
+                        "-->"
+                    self.mdict['PKI_PROXY_SECURE_PORT_SLOT'] = ""
+                    self.mdict['PKI_PROXY_UNSECURE_PORT_SLOT'] = ""
+                    self.mdict['PKI_OPEN_AJP_PORT_COMMENT_SLOT'] = \
+                        "<!--"
+                    self.mdict['PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT'] = \
+                        "<!--"
+                if config.str2bool(self.mdict['pki_standalone']):
+                    # Stand-alone PKI
+                    self.mdict['PKI_CLOSE_STANDALONE_COMMENT_SLOT'] = \
+                        ""
+                    self.mdict['PKI_OPEN_STANDALONE_COMMENT_SLOT'] = \
+                        ""
+                    self.mdict['PKI_STANDALONE_SLOT'] = "true"
+                else:
+                    self.mdict['PKI_CLOSE_STANDALONE_COMMENT_SLOT'] = \
+                        "-->"
+                    self.mdict['PKI_OPEN_STANDALONE_COMMENT_SLOT'] = \
+                        "<!--"
+                    self.mdict['PKI_STANDALONE_SLOT'] = "false"
+                if config.str2bool(self.mdict['pki_enable_access_log']):
+                    self.mdict['PKI_CLOSE_TOMCAT_ACCESS_LOG_COMMENT_SLOT'] = \
+                        ""
+                    self.mdict['PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT_SLOT'] = \
+                        ""
+                else:
+                    self.mdict['PKI_CLOSE_TOMCAT_ACCESS_LOG_COMMENT_SLOT'] = \
+                        "-->"
+                    self.mdict['PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT_SLOT'] = \
+                        "<!--"
+                self.mdict['PKI_TMPDIR_SLOT'] = \
+                    self.mdict['pki_tomcat_tmpdir_path']
+                self.mdict['PKI_RESTEASY_LIB_SLOT'] = \
+                    self.mdict['resteasy_lib']
+                self.mdict['PKI_RANDOM_NUMBER_SLOT'] = \
+                    self.mdict['pki_one_time_pin']
+                self.mdict['PKI_SECURE_PORT_SLOT'] = \
+                    self.mdict['pki_https_port']
+                self.mdict['PKI_SECURE_PORT_CONNECTOR_NAME_SLOT'] = \
+                    "Secure"
+                self.mdict['PKI_SECURE_PORT_SERVER_COMMENT_SLOT'] = \
+                    "<!-- " + \
+                    "Shared Ports:  Agent, EE, and Admin Secure Port Connector " + \
+                    "-->"
+                self.mdict['PKI_SECURITY_MANAGER_SLOT'] = \
+                    self.mdict['pki_security_manager']
+                self.mdict['PKI_SERVER_XML_CONF_SLOT'] = \
+                    self.mdict['pki_target_server_xml']
+                self.mdict['PKI_SSL_SERVER_NICKNAME_SLOT'] = \
+                    self.mdict['pki_ssl_server_nickname']
+                self.mdict['PKI_SUBSYSTEM_TYPE_SLOT'] = \
+                    self.mdict['pki_subsystem'].lower()
+                self.mdict['PKI_SYSTEMD_SERVICENAME_SLOT'] = \
+                    "pki-tomcatd" + "@" + \
+                    self.mdict['pki_instance_name'] + ".service"
+                self.mdict['PKI_UNSECURE_PORT_SLOT'] = \
+                    self.mdict['pki_http_port']
+                self.mdict['PKI_UNSECURE_PORT_CONNECTOR_NAME_SLOT'] = \
+                    "Unsecure"
+                self.mdict['PKI_UNSECURE_PORT_SERVER_COMMENT_SLOT'] = \
+                    "<!-- Shared Ports:  Unsecure Port Connector -->"
+                self.mdict['PKI_USER_SLOT'] = \
+                    self.mdict['pki_user']
+                self.mdict['PKI_WEB_SERVER_TYPE_SLOT'] = \
+                    "tomcat"
+                self.mdict['PKI_WEBAPPS_NAME_SLOT'] = \
+                    "webapps"
+                self.mdict['TOMCAT_CFG_SLOT'] = \
+                    self.mdict['pki_target_tomcat_conf']
+                self.mdict['TOMCAT_INSTANCE_COMMON_LIB_SLOT'] = \
+                    os.path.join(
+                        self.mdict['pki_tomcat_common_lib_path'],
+                        "*.jar")
+                self.mdict['TOMCAT_LOG_DIR_SLOT'] = \
+                    self.mdict['pki_instance_log_path']
+                self.mdict['TOMCAT_PIDFILE_SLOT'] = \
+                    "/var/run/pki/tomcat/" + self.mdict['pki_instance_name'] + \
+                    ".pid"
+                self.mdict['TOMCAT_SERVER_PORT_SLOT'] = \
+                    self.mdict['pki_tomcat_server_port']
+                self.mdict['TOMCAT_SSL2_CIPHERS_SLOT'] = \
+                    "-SSL2_RC4_128_WITH_MD5," + \
+                    "-SSL2_RC4_128_EXPORT40_WITH_MD5," + \
+                    "-SSL2_RC2_128_CBC_WITH_MD5," + \
+                    "-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5," + \
+                    "-SSL2_DES_64_CBC_WITH_MD5," + \
+                    "-SSL2_DES_192_EDE3_CBC_WITH_MD5"
+                self.mdict['TOMCAT_SSL3_CIPHERS_SLOT'] = \
+                    "-SSL3_FORTEZZA_DMS_WITH_NULL_SHA," + \
+                    "-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA," + \
+                    "+SSL3_RSA_WITH_RC4_128_SHA," + \
+                    "-SSL3_RSA_EXPORT_WITH_RC4_40_MD5," + \
+                    "+SSL3_RSA_WITH_3DES_EDE_CBC_SHA," + \
+                    "-SSL3_RSA_WITH_DES_CBC_SHA," + \
+                    "-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5," + \
+                    "-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA," + \
+                    "-SSL_RSA_FIPS_WITH_DES_CBC_SHA," + \
+                    "+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA," + \
+                    "-SSL3_RSA_WITH_NULL_MD5," + \
+                    "-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA," + \
+                    "-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA," + \
+                    "+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
+                self.mdict['TOMCAT_SSL_OPTIONS_SLOT'] = \
+                    "ssl2=true," + \
+                    "ssl3=true," + \
+                    "tls=true"
+                self.mdict['TOMCAT_TLS_CIPHERS_SLOT'] = \
+                    "-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA," + \
+                    "-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA," + \
+                    "+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA," + \
+                    "+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA," + \
+                    "+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA," + \
+                    "-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA," + \
+                    "+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA," + \
+                    "+TLS_RSA_WITH_3DES_EDE_CBC_SHA," + \
+                    "+TLS_RSA_WITH_AES_128_CBC_SHA," + \
+                    "+TLS_RSA_WITH_AES_256_CBC_SHA," + \
+                    "+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA," + \
+                    "+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA," + \
+                    "-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA," + \
+                    "-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA," + \
+                    "-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA," + \
+                    "+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA," + \
+                    "+TLS_DHE_DSS_WITH_AES_128_CBC_SHA," + \
+                    "+TLS_DHE_DSS_WITH_AES_256_CBC_SHA," + \
+                    "+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA," + \
+                    "+TLS_DHE_RSA_WITH_AES_128_CBC_SHA," + \
+                    "+TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
+
+                # tps parameters
+                self.mdict['TOKENDB_HOST_SLOT'] = \
+                    self.mdict['pki_ds_hostname']
+
+                if config.str2bool(self.mdict['pki_ds_secure_connection']):
+                    self.mdict['TOKENDB_PORT_SLOT'] = \
+                        self.mdict['pki_ds_ldaps_port']
+                else:
+                    self.mdict['TOKENDB_PORT_SLOT'] = \
+                        self.mdict['pki_ds_ldap_port']
+
+                self.mdict['TOKENDB_ROOT_SLOT'] = \
+                    self.mdict['pki_ds_base_dn']
+
+                self.mdict['TPS_DIR_SLOT'] = \
+                    self.mdict['pki_source_subsystem_path']
+
+                if self.mdict['pki_subsystem'] == "CA":
+                    self.mdict['PKI_ENABLE_RANDOM_SERIAL_NUMBERS'] = \
+                        self.mdict['pki_random_serial_numbers_enable'].lower()
+            # Shared Apache/Tomcat NSS security database name/value pairs
+            self.mdict['pki_shared_pfile'] = \
+                os.path.join(
+                    self.mdict['pki_instance_configuration_path'],
+                    "pfile")
+            self.mdict['pki_shared_password_conf'] = \
+                os.path.join(
+                    self.mdict['pki_instance_configuration_path'],
+                    "password.conf")
+            self.mdict['pki_cert_database'] = \
+                os.path.join(self.mdict['pki_database_path'],
+                             "cert8.db")
+            self.mdict['pki_key_database'] = \
+                os.path.join(self.mdict['pki_database_path'],
+                             "key3.db")
+            self.mdict['pki_secmod_database'] = \
+                os.path.join(self.mdict['pki_database_path'],
+                             "secmod.db")
+            self.mdict['pki_self_signed_token'] = "internal"
+            self.mdict['pki_self_signed_nickname'] = \
+                self.mdict['pki_ssl_server_nickname']
+            self.mdict['pki_self_signed_subject'] = \
+                "cn=" + self.mdict['pki_hostname'] + "," + \
+                "o=" + self.mdict['pki_certificate_timestamp']
+            self.mdict['pki_self_signed_serial_number'] = 0
+            self.mdict['pki_self_signed_validity_period'] = 12
+            self.mdict['pki_self_signed_issuer_name'] = \
+                "cn=" + self.mdict['pki_hostname'] + "," + \
+                "o=" + self.mdict['pki_certificate_timestamp']
+            self.mdict['pki_self_signed_trustargs'] = "CTu,CTu,CTu"
+            self.mdict['pki_self_signed_noise_file'] = \
+                os.path.join(
+                    self.mdict['pki_subsystem_configuration_path'],
+                    "noise")
+            self.mdict['pki_self_signed_noise_bytes'] = 1024
+            # Shared Apache/Tomcat NSS security database convenience
+            # symbolic links
+            self.mdict['pki_subsystem_configuration_password_conf_link'] = \
+                os.path.join(
+                    self.mdict['pki_subsystem_configuration_path'],
+                    "password.conf")
+
+            if not len(self.mdict['pki_client_database_password']):
+                # use randomly generated client 'pin'
+                self.mdict['pki_client_database_password'] = \
+                    str(self.mdict['pki_client_pin'])
+
+            # Configuration scriptlet
+            # 'Security Domain' Configuration name/value pairs
+            # 'Subsystem Name'  Configuration name/value pairs
+            # 'Token'           Configuration name/value pairs
+            #
+            #     Apache - [RA]
+            #     Tomcat - [CA], [KRA], [OCSP], [TKS], [TPS]
+            #            - [CA Clone], [KRA Clone], [OCSP Clone], [TKS Clone],
+            #              [TPS Clone]
+            #            - [External CA]
+            #            - [Subordinate CA]
+            #
+            #     The following variables are defined below:
+            #
+            #         self.mdict['pki_security_domain_type']
+            #         self.mdict['pki_security_domain_uri']
+            #
+            #     The following variables are established via the specified PKI
+            #     deployment configuration file and are NOT redefined below:
+            #
+            #         self.mdict['pki_clone_pkcs12_password']
+            #         self.mdict['pki_security_domain_password']
+            #         self.mdict['pki_token_password']
+            #         self.mdict['pki_clone_pkcs12_path']
+            #         self.mdict['pki_clone_uri']
+            #         self.mdict['pki_security_domain_https_port']
+            #         self.mdict['pki_token_name']
+            #
+            #     The following variables are established via the specified PKI
+            #     deployment configuration file and potentially overridden
+            #     below:
+            #
+            #         self.mdict['pki_security_domain_user']
+            #         self.mdict['pki_issuing_ca']
+            #
+
+            # if security domain user is not defined
+            if not len(self.mdict['pki_security_domain_user']):
+
+                # use the CA admin uid if it's defined
+                if self.pki_config.has_option('CA', 'pki_admin_uid') and\
+                        len(self.pki_config.get('CA', 'pki_admin_uid')) > 0:
+                    self.mdict['pki_security_domain_user'] = \
+                        self.pki_config.get('CA', 'pki_admin_uid')
+
+                # or use the Default admin uid if it's defined
+                elif self.pki_config.has_option('DEFAULT', 'pki_admin_uid') and\
+                        len(self.pki_config.get('DEFAULT', 'pki_admin_uid')) > 0:
+                    self.mdict['pki_security_domain_user'] = \
+                        self.pki_config.get('DEFAULT', 'pki_admin_uid')
+
+                # otherwise use the default CA admin uid
+                else:
+                    self.mdict['pki_security_domain_user'] = "caadmin"
+
+            if not config.str2bool(self.mdict['pki_skip_configuration']) and\
+                    (config.str2bool(self.mdict['pki_standalone'])):
+                # Stand-alone PKI
+                self.mdict['pki_security_domain_type'] = "new"
+                self.mdict['pki_issuing_ca'] = "External CA"
+            elif config.pki_subsystem != "CA" or\
+                    config.str2bool(self.mdict['pki_clone']) or\
+                    config.str2bool(self.mdict['pki_subordinate']):
+                # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+                # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone, or
+                # Subordinate CA
+                self.mdict['pki_security_domain_type'] = "existing"
+                self.mdict['pki_security_domain_uri'] = \
+                    "https" + "://" + \
+                    self.mdict['pki_security_domain_hostname'] + ":" + \
+                    self.mdict['pki_security_domain_https_port']
+
+            elif config.str2bool(self.mdict['pki_external']):
+                # External CA
+                self.mdict['pki_security_domain_type'] = "new"
+                self.mdict['pki_issuing_ca'] = "External CA"
+            else:
+                # PKI CA
+                self.mdict['pki_security_domain_type'] = "new"
+
+            # 'External CA' Configuration name/value pairs
+            #
+            #     Tomcat - [External CA]
+            #
+            #     The following variables are established via the specified PKI
+            #     deployment configuration file and are NOT redefined below:
+            #
+            #        self.mdict['pki_external_ca_cert_chain_path']
+            #        self.mdict['pki_external_ca_cert_path']
+            #        self.mdict['pki_external_csr_path']
+            #        self.mdict['pki_external_step_two']
+            #
+
+            # 'Backup' Configuration name/value pairs
+            #
+            #     Apache - [RA]
+            #     Tomcat - [CA], [KRA], [OCSP], [TKS], [TPS]
+            #            - [External CA]
+            #            - [Subordinate CA]
+            #
+            #     The following variables are established via the specified PKI
+            #     deployment configuration file and are NOT redefined below:
+            #
+            #        self.mdict['pki_backup_password']
+            #        self.mdict['pki_backup_keys']
+            #
+            if config.str2bool(self.mdict['pki_backup_keys']):
+                # NOTE:  ALWAYS store the PKCS #12 backup keys file
+                #        in with the NSS "server" security databases
+                self.mdict['pki_backup_keys_p12'] = \
+                    self.mdict['pki_database_path'] + "/" + \
+                    self.mdict['pki_subsystem'].lower() + "_" + \
+                    "backup" + "_" + "keys" + "." + "p12"
+
+            self.mdict['pki_admin_profile_id'] = "caAdminCert"
+
+            if not 'pki_import_admin_cert' in self.mdict:
+                self.mdict['pki_import_admin_cert'] = 'false'
+            elif not config.str2bool(self.mdict['pki_skip_configuration']) and \
+                    (config.str2bool(self.mdict['pki_standalone'])):
+                # Stand-alone PKI
+                self.mdict['pki_import_admin_cert'] = 'false'
+
+            if config.str2bool(self.mdict['pki_standalone']):
+                self.mdict['pki_ca_signing_tag'] = "external_signing"
+            else:
+                self.mdict['pki_ca_signing_tag'] = "signing"
+            if self.mdict['pki_subsystem'] == "CA":
+                self.mdict['pki_ocsp_signing_tag'] = "ocsp_signing"
+            elif self.mdict['pki_subsystem'] == "OCSP":
+                self.mdict['pki_ocsp_signing_tag'] = "signing"
+            self.mdict['pki_ssl_server_tag'] = "sslserver"
+            self.mdict['pki_subsystem_tag'] = "subsystem"
+            self.mdict['pki_audit_signing_tag'] = "audit_signing"
+            self.mdict['pki_transport_tag'] = "transport"
+            self.mdict['pki_storage_tag'] = "storage"
+
+            # Finalization name/value pairs
+            self.mdict['pki_default_deployment_cfg_replica'] = \
+                os.path.join(self.mdict['pki_subsystem_registry_path'],
+                             config.DEFAULT_DEPLOYMENT_CONFIGURATION)
+            self.mdict['pki_user_deployment_cfg_replica'] = \
+                os.path.join(self.mdict['pki_subsystem_registry_path'],
+                             config.USER_DEPLOYMENT_CONFIGURATION)
+            self.mdict['pki_user_deployment_cfg_spawn_archive'] = \
+                self.mdict['pki_subsystem_archive_log_path'] + "/" + \
+                "spawn" + "_" + \
+                config.USER_DEPLOYMENT_CONFIGURATION + "." + \
+                self.mdict['pki_timestamp']
+            self.mdict['pki_manifest'] = \
+                self.mdict['pki_subsystem_registry_path'] + "/" + \
+                "manifest"
+            self.mdict['pki_manifest_spawn_archive'] = \
+                self.mdict['pki_subsystem_archive_log_path'] + "/" + \
+                "spawn" + "_" + "manifest" + "." + \
+                self.mdict['pki_timestamp']
+            # Construct the configuration URL containing the one-time pin
+            # and add this to the "sensitive" key value pairs read in from
+            # the configuration file
+            #
+            # NOTE:  This is the one and only parameter containing a sensitive
+            #        parameter that may be stored in a log file and displayed
+            #        to the screen.
+            #
+            self.mdict['pki_configuration_url'] = \
+                "https://{}:{}/{}/{}?pin={}".format(
+                    self.mdict['pki_hostname'],
+                    self.mdict['pki_https_port'],
+                    self.mdict['pki_subsystem'].lower(),
+                    "admin/console/config/login",
+                    self.mdict['pki_one_time_pin'])
+            # Compose this "systemd" execution management command
+            if self.mdict['pki_subsystem'] in\
+               config.PKI_APACHE_SUBSYSTEMS:
+                self.mdict['pki_registry_initscript_command'] = \
+                    "systemctl" + " " + \
+                    "restart" + " " + \
+                    "pki-apached" + "@" + \
+                    self.mdict['pki_instance_name'] + "." + "service"
+            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+                self.mdict['pki_registry_initscript_command'] = \
+                    "systemctl" + " " + \
+                    "restart" + " " + \
+                    "pki-tomcatd" + "@" + \
+                    self.mdict['pki_instance_name'] + "." + "service"
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+        except KeyError as err:
+            config.pki_log.error(log.PKIHELPER_DICTIONARY_MASTER_MISSING_KEY_1,
+                                 err, extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+        except ConfigParser.InterpolationSyntaxError as err:
+            config.pki_log.error(log.PKIHELPER_DICTIONARY_INTERPOLATION_1,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            config.pki_log.error(log.PKIHELPER_DICTIONARY_INTERPOLATION_2, err,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            raise
+        return
+
+    def compose_pki_slots_dictionary(self):
+        """Read the slots configuration file to create
+           the appropriate PKI slots dictionary"""
+        rv = 0
+        try:
+            parser = ConfigParser.ConfigParser()
+            # Make keys case-sensitive!
+            parser.optionxform = str
+            parser.read(config.PKI_DEPLOYMENT_SLOTS_CONFIGURATION_FILE)
+            # Slots configuration file name/value pairs
+            if config.pki_subsystem in config.PKI_APACHE_SUBSYSTEMS:
+                self.slots_dict = dict(parser.items('Apache'))
+            elif config.pki_subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
+                self.slots_dict = dict(parser.items('Tomcat'))
+        except ConfigParser.ParsingError, err:
+            rv = err
+        return rv
diff --git a/base/admin/python/pki/admin/deployment/pkiscriptlet.py b/base/admin/python/pki/admin/deployment/pkiscriptlet.py
new file mode 100644
index 0000000..2bf4d07
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/pkiscriptlet.py
@@ -0,0 +1,42 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# System Imports
+import abc
+
+
+# PKI Deployment Abstract Base PKI Scriptlet
+class AbstractBasePkiScriptlet(object):
+    __metaclass__ = abc.ABCMeta
+
+    # pylint: disable-msg=W0613
+    @abc.abstractmethod
+    def spawn(self, deployer):
+        """Retrieve data from the specified PKI dictionary and
+           use it to install a new PKI instance."""
+        return
+
+    # pylint: disable-msg=W0613
+    @abc.abstractmethod
+    def destroy(self, deployer):
+        """Retrieve data from the specified PKI dictionary and
+           use it to destroy an existing PKI instance."""
+        return
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/__init__.py b/base/admin/python/pki/admin/deployment/scriptlets/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/configuration.py b/base/admin/python/pki/admin/deployment/scriptlets/configuration.py
new file mode 100644
index 0000000..78ec9ba
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/configuration.py
@@ -0,0 +1,149 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+import json
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from .. import pkimessages as log
+from .. import pkiscriptlet
+import pki.system
+import pki.encoder
+
+
+# PKI Deployment Configuration Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+
+    def spawn(self, deployer):
+
+        # ALWAYS establish the following Tomcat instance symbolic link since
+        # this link is required by both automatic pkispawn instance
+        # configuration as well as manual browser GUI instance configuration
+        deployer.symlink.create(deployer.mdict['pki_systemd_service'],
+                                deployer.mdict['pki_systemd_service_link'])
+
+        if config.str2bool(deployer.mdict['pki_skip_configuration']):
+            config.pki_log.info(log.SKIP_CONFIGURATION_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+        config.pki_log.info(log.CONFIGURATION_SPAWN_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+
+        # Place "slightly" less restrictive permissions on
+        # the top-level client directory ONLY
+        deployer.directory.create(
+            deployer.mdict['pki_client_subsystem_dir'],
+            uid=0, gid=0,
+            perms=config.PKI_DEPLOYMENT_DEFAULT_CLIENT_DIR_PERMISSIONS)
+        # Since 'certutil' does NOT strip the 'token=' portion of
+        # the 'token=password' entries, create a client password file
+        # which ONLY contains the 'password' for the purposes of
+        # allowing 'certutil' to generate the security databases
+        deployer.password.create_password_conf(
+            deployer.mdict['pki_client_password_conf'],
+            deployer.mdict['pki_client_database_password'], pin_sans_token=True)
+        deployer.file.modify(
+            deployer.mdict['pki_client_password_conf'],
+            uid=0, gid=0)
+        # Similarly, create a simple password file containing the
+        # PKCS #12 password used when exporting the "Admin Certificate"
+        # into a PKCS #12 file
+        deployer.password.create_client_pkcs12_password_conf(
+            deployer.mdict['pki_client_pkcs12_password_conf'])
+        deployer.file.modify(deployer.mdict['pki_client_pkcs12_password_conf'])
+        deployer.directory.create(
+            deployer.mdict['pki_client_database_dir'],
+            uid=0, gid=0)
+        deployer.certutil.create_security_databases(
+            deployer.mdict['pki_client_database_dir'],
+            deployer.mdict['pki_client_cert_database'],
+            deployer.mdict['pki_client_key_database'],
+            deployer.mdict['pki_client_secmod_database'],
+            password_file=deployer.mdict['pki_client_password_conf'])
+
+        # Start/Restart this Apache/Tomcat PKI Process
+        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
+            apache_instance_subsystems = \
+                deployer.instance.apache_instance_subsystems()
+            if apache_instance_subsystems == 1:
+                deployer.systemd.start()
+            elif apache_instance_subsystems > 1:
+                deployer.systemd.restart()
+        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+            # Optionally prepare to enable a java debugger
+            # (e. g. - 'eclipse'):
+            if config.str2bool(deployer.mdict['pki_enable_java_debugger']):
+                config.prepare_for_an_external_java_debugger(
+                    deployer.mdict['pki_target_tomcat_conf_instance_id'])
+            tomcat_instance_subsystems = \
+                len(deployer.instance.tomcat_instance_subsystems())
+            if tomcat_instance_subsystems == 1:
+                deployer.systemd.start()
+            elif tomcat_instance_subsystems > 1:
+                deployer.systemd.restart()
+
+        # wait for startup
+        status = deployer.instance.wait_for_startup(60)
+        if status is None:
+            config.pki_log.error(
+                "server failed to restart",
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            raise Exception("server failed to restart")
+
+        # Optionally wait for debugger to attach (e. g. - 'eclipse'):
+        if config.str2bool(deployer.mdict['pki_enable_java_debugger']):
+            config.wait_to_attach_an_external_java_debugger()
+
+        # Construct PKI Subsystem Configuration Data
+        data = None
+        if deployer.mdict['pki_instance_type'] == "Apache":
+            if deployer.mdict['pki_subsystem'] == "RA":
+                config.pki_log.info(
+                    log.PKI_CONFIG_NOT_YET_IMPLEMENTED_1,
+                    deployer.mdict['pki_subsystem'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                return self.rv
+        elif deployer.mdict['pki_instance_type'] == "Tomcat":
+            # CA, KRA, OCSP, TKS, or TPS
+            data = deployer.config_client.construct_pki_configuration_data()
+
+        # Configure the subsystem
+        deployer.config_client.configure_pki_data(
+            json.dumps(data, cls=pki.encoder.CustomTypeEncoder))
+
+        return self.rv
+
+    def destroy(self, deployer):
+
+        config.pki_log.info(log.CONFIGURATION_DESTROY_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS and\
+           deployer.instance.apache_instance_subsystems() == 1:
+            if deployer.directory.exists(deployer.mdict['pki_client_dir']):
+                deployer.directory.delete(deployer.mdict['pki_client_dir'])
+            deployer.symlink.delete(deployer.mdict['pki_systemd_service_link'])
+        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
+                and len(deployer.instance.tomcat_instance_subsystems()) == 1:
+            if deployer.directory.exists(deployer.mdict['pki_client_dir']):
+                deployer.directory.delete(deployer.mdict['pki_client_dir'])
+            deployer.symlink.delete(deployer.mdict['pki_systemd_service_link'])
+        return self.rv
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/finalization.py b/base/admin/python/pki/admin/deployment/scriptlets/finalization.py
new file mode 100644
index 0000000..d3756b7
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/finalization.py
@@ -0,0 +1,102 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from .. import pkimanifest as manifest
+from .. import pkimessages as log
+from .. import pkiscriptlet
+
+
+# PKI Deployment Finalization Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+
+    def spawn(self, deployer):
+
+        # ALWAYS finalize execution of scriptlets
+        config.pki_log.info(log.FINALIZATION_SPAWN_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        # For debugging/auditing purposes, save a timestamped copy of
+        # this configuration file in the subsystem archive
+        deployer.file.copy(
+            deployer.mdict['pki_user_deployment_cfg_replica'],
+            deployer.mdict['pki_user_deployment_cfg_spawn_archive'])
+        # Save a copy of the installation manifest file
+        config.pki_log.info(
+            log.PKI_MANIFEST_MESSAGE_1, deployer.mdict['pki_manifest'],
+            extra=config.PKI_INDENTATION_LEVEL_2)
+        # for record in manifest.database:
+        #     print tuple(record)
+        manifest_file = manifest.File(deployer.manifest_db)
+        manifest_file.register(deployer.mdict['pki_manifest'])
+        manifest_file.write()
+        deployer.file.modify(deployer.mdict['pki_manifest'], silent=True)
+
+        # Also, for debugging/auditing purposes, save a timestamped copy of
+        # this installation manifest file
+        deployer.file.copy(
+            deployer.mdict['pki_manifest'],
+            deployer.mdict['pki_manifest_spawn_archive'])
+        # Optionally, programmatically 'restart' the configured PKI instance
+        if config.str2bool(deployer.mdict['pki_restart_configured_instance']):
+            deployer.systemd.restart()
+        # Optionally, 'purge' the entire temporary client infrastructure
+        # including the client NSS security databases and password files
+        #
+        #     WARNING:  If the PKCS #12 file containing the Admin Cert was
+        #               placed under this infrastructure, it may accidentally
+        #               be deleted!
+        #
+        if config.str2bool(deployer.mdict['pki_client_database_purge']):
+            if deployer.directory.exists(
+                    deployer.mdict['pki_client_subsystem_dir']):
+                deployer.directory.delete(
+                    deployer.mdict['pki_client_subsystem_dir'])
+        # If instance has not been configured, print the
+        # configuration URL to the log
+        if config.str2bool(deployer.mdict['pki_skip_configuration']):
+            deployer.configuration_file.log_configuration_url()
+        # Log final process messages
+        config.pki_log.info(log.PKISPAWN_END_MESSAGE_2,
+                            deployer.mdict['pki_subsystem'],
+                            deployer.mdict['pki_instance_name'],
+                            extra=config.PKI_INDENTATION_LEVEL_0)
+        deployer.file.modify(deployer.mdict['pki_spawn_log'], silent=True)
+        return self.rv
+
+    def destroy(self, deployer):
+
+        config.pki_log.info(log.FINALIZATION_DESTROY_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        deployer.file.modify(deployer.mdict['pki_destroy_log'], silent=True)
+        # Start this Apache/Tomcat PKI Process
+        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS and\
+           deployer.instance.apache_instance_subsystems() >= 1:
+            deployer.systemd.start()
+        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
+                and len(deployer.instance.tomcat_instance_subsystems()) >= 1:
+            deployer.systemd.start()
+        config.pki_log.info(log.PKIDESTROY_END_MESSAGE_2,
+                            deployer.mdict['pki_subsystem'],
+                            deployer.mdict['pki_instance_name'],
+                            extra=config.PKI_INDENTATION_LEVEL_0)
+        return self.rv
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/infrastructure_layout.py b/base/admin/python/pki/admin/deployment/scriptlets/infrastructure_layout.py
new file mode 100644
index 0000000..60ce601
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/infrastructure_layout.py
@@ -0,0 +1,121 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from .. import pkimessages as log
+from .. import pkiscriptlet
+
+
+# PKI Deployment Top-Level Infrastructure Layout Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+
+    def spawn(self, deployer):
+
+        if config.str2bool(deployer.mdict['pki_skip_installation']):
+            config.pki_log.info(log.SKIP_ADMIN_DOMAIN_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+        config.pki_log.info(log.ADMIN_DOMAIN_SPAWN_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        # NOTE:  It was determined that since the "pkidestroy" command
+        #        relies upon a symbolic link to a replica of the original
+        #        deployment configuration file used by the
+        #        "pkispawn" command of an instance, it is necessary to
+        #        create any required instance and subsystem directories
+        #        in this top-level "infrastructure_layout" scriptlet
+        #        (rather than the "instance_layout" and "subsystem_layout"
+        #        scriptlets) so that a copy of this configuration file can
+        #        be saved, and the required symbolic link can be created.
+        #
+        # establish the top-level infrastructure, instance, and subsystem
+        # registry directories for storage of a copy of the original
+        # deployment configuration file used to spawn this instance,
+        # and save a copy of this file
+        deployer.directory.create(deployer.mdict['pki_registry_path'])
+        deployer.directory.create(
+            deployer.mdict['pki_instance_type_registry_path'])
+        deployer.directory.create(deployer.mdict['pki_instance_registry_path'])
+        deployer.directory.create(deployer.mdict['pki_subsystem_registry_path'])
+        deployer.file.copy(
+            deployer.mdict['pki_default_deployment_cfg'],
+            deployer.mdict['pki_default_deployment_cfg_replica'])
+
+        print "Storing deployment configuration into " + \
+              deployer.mdict['pki_user_deployment_cfg_replica'] + "."
+
+        # Archive the user deployment configuration excluding the sensitive
+        # parameters
+        sensitive_parameters = deployer.mdict['sensitive_parameters'].split()
+        sections = config.user_config.sections()
+        for s in sections:
+            for k in sensitive_parameters:
+                config.user_config.set(s, k, 'XXXXXXXX')
+        with open(deployer.mdict['pki_user_deployment_cfg_replica'], 'w') as f:
+            config.user_config.write(f)
+
+        # establish top-level infrastructure, instance, and subsystem
+        # base directories and create the "registry" symbolic link that
+        # the "pkidestroy" executable relies upon
+        deployer.directory.create(deployer.mdict['pki_path'])
+        deployer.directory.create(deployer.mdict['pki_instance_path'])
+        deployer.directory.create(deployer.mdict['pki_subsystem_path'])
+        deployer.symlink.create(
+            deployer.mdict['pki_instance_registry_path'],
+            deployer.mdict['pki_subsystem_registry_link'])
+        #
+        # NOTE:  If "infrastructure_layout" scriptlet execution has been
+        #        successfully executed to this point, the "pkidestroy" command
+        #        may always be utilized to remove the entire infrastructure.
+        #
+        # no need to establish top-level infrastructure logs
+        # since it now stores 'pkispawn'/'pkidestroy' logs
+        # and will already exist
+        # deployer.directory.create(deployer.mdict['pki_log_path'])
+        # establish top-level infrastructure configuration
+        if deployer.mdict['pki_configuration_path'] != \
+           config.PKI_DEPLOYMENT_CONFIGURATION_ROOT:
+            deployer.directory.create(deployer.mdict['pki_configuration_path'])
+        return self.rv
+
+    def destroy(self, deployer):
+
+        config.pki_log.info(log.ADMIN_DOMAIN_DESTROY_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        # remove top-level infrastructure base
+        if deployer.mdict['pki_subsystem'] in config.PKI_SUBSYSTEMS and\
+           deployer.instance.pki_instance_subsystems() == 0:
+            # remove top-level infrastructure base
+            deployer.directory.delete(deployer.mdict['pki_path'])
+            # do NOT remove top-level infrastructure logs
+            # since it now stores 'pkispawn'/'pkidestroy' logs
+            # deployer.directory.delete(deployer.mdict['pki_log_path'])
+            # remove top-level infrastructure configuration
+            if deployer.directory.is_empty(
+                    deployer.mdict['pki_configuration_path']) and \
+                deployer.mdict['pki_configuration_path'] != \
+                    config.PKI_DEPLOYMENT_CONFIGURATION_ROOT:
+                deployer.directory.delete(
+                    deployer.mdict['pki_configuration_path'])
+            # remove top-level infrastructure registry
+            deployer.directory.delete(deployer.mdict['pki_registry_path'])
+        return self.rv
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/initialization.py b/base/admin/python/pki/admin/deployment/scriptlets/initialization.py
new file mode 100644
index 0000000..a555a89
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/initialization.py
@@ -0,0 +1,118 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from .. import pkimessages as log
+from .. import pkiscriptlet
+
+
+# PKI Deployment Initialization Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+
+    def spawn(self, deployer):
+
+        # begin official logging
+        config.pki_log.info(log.PKISPAWN_BEGIN_MESSAGE_2,
+                            deployer.mdict['pki_subsystem'],
+                            deployer.mdict['pki_instance_name'],
+                            extra=config.PKI_INDENTATION_LEVEL_0)
+        # ALWAYS initialize 'uid' and 'gid'
+        deployer.identity.add_uid_and_gid(deployer.mdict['pki_user'],
+                                          deployer.mdict['pki_group'])
+        # ALWAYS establish 'uid' and 'gid'
+        deployer.identity.set_uid(deployer.mdict['pki_user'])
+        deployer.identity.set_gid(deployer.mdict['pki_group'])
+        if config.str2bool(deployer.mdict['pki_skip_installation']):
+            config.pki_log.info(log.SKIP_INITIALIZATION_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+        else:
+            config.pki_log.info(log.INITIALIZATION_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            if (deployer.mdict['pki_subsystem'] == "CA" or
+                config.str2bool(deployer.mdict['pki_standalone'])) and\
+               config.str2bool(deployer.mdict['pki_external_step_two']):
+                # verify that this External CA (Step 2), or Stand-alone PKI
+                # (Step 2) currently EXISTS for this "instance"
+                deployer.instance.verify_subsystem_exists()
+                deployer.mdict['pki_skip_installation'] = "True"
+            else:
+                # verify that this type of "subsystem" does NOT yet
+                # exist for this "instance"
+                deployer.instance.verify_subsystem_does_not_exist()
+                # detect and avoid any namespace collisions
+                deployer.namespace.collision_detection()
+        # verify existence of SENSITIVE configuration file data
+        deployer.configuration_file.verify_sensitive_data()
+        # verify existence of MUTUALLY EXCLUSIVE configuration file data
+        deployer.configuration_file.verify_mutually_exclusive_data()
+        # verify existence of PREDEFINED configuration file data
+        deployer.configuration_file.verify_predefined_configuration_file_data()
+        # verify selinux context of selected ports
+        deployer.configuration_file.populate_non_default_ports()
+        deployer.configuration_file.verify_selinux_ports()
+        return self.rv
+
+    def destroy(self, deployer):
+
+        # begin official logging
+        config.pki_log.info(log.PKIDESTROY_BEGIN_MESSAGE_2,
+                            deployer.mdict['pki_subsystem'],
+                            deployer.mdict['pki_instance_name'],
+                            extra=config.PKI_INDENTATION_LEVEL_0)
+        config.pki_log.info(log.INITIALIZATION_DESTROY_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        # verify that this type of "subsystem" currently EXISTS
+        # for this "instance"
+        deployer.instance.verify_subsystem_exists()
+        # verify that the command-line parameters match the values
+        # that are present in the corresponding configuration file
+        deployer.configuration_file.verify_command_matches_configuration_file()
+        # establish 'uid' and 'gid'
+        deployer.identity.set_uid(deployer.mdict['pki_user'])
+        deployer.identity.set_gid(deployer.mdict['pki_group'])
+        # get ports to remove selinux context
+        deployer.configuration_file.populate_non_default_ports()
+
+        # get deinstallation token
+        token = deployer.security_domain.get_installation_token(
+            config.pki_secdomain_user, config.pki_secdomain_pass)
+
+        # remove kra connector from CA if this is a KRA
+        deployer.kra_connector.deregister()
+
+        # remove tps connector from TKS if this is a TPS
+        deployer.tps_connector.deregister()
+
+        # de-register instance from its Security Domain
+        #
+        #     NOTE:  Since the security domain of an instance must be up
+        #            and running in order to be de-registered, this step
+        #            must be done PRIOR to instance shutdown because this
+        #            instance's security domain may be a part of a
+        #            tightly-coupled shared instance.
+        #
+        deployer.security_domain.deregister(token)
+        # ALWAYS Stop this Apache/Tomcat PKI Process
+        deployer.systemd.stop()
+        return self.rv
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/instance_layout.py b/base/admin/python/pki/admin/deployment/scriptlets/instance_layout.py
new file mode 100644
index 0000000..b5ec19e
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/instance_layout.py
@@ -0,0 +1,331 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# System Imports
+import os
+
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from .. import pkimessages as log
+from .. import pkiscriptlet
+
+
+# PKI Deployment Instance Layout Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+
+    def spawn(self, deployer):
+
+        if config.str2bool(deployer.mdict['pki_skip_installation']):
+            config.pki_log.info(log.SKIP_INSTANCE_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+
+        config.pki_log.info(log.INSTANCE_SPAWN_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+
+        # if this is the first subsystem
+        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
+                and len(deployer.instance.tomcat_instance_subsystems()) == 1:
+
+            # establish instance logs
+            deployer.directory.create(deployer.mdict['pki_instance_log_path'])
+
+            # establish Tomcat instance configuration
+            deployer.directory.copy(
+                deployer.mdict['pki_source_server_path'],
+                deployer.mdict['pki_instance_configuration_path'])
+
+            # establish Tomcat instance base
+            deployer.directory.create(deployer.mdict['pki_tomcat_common_path'])
+            deployer.directory.create(
+                deployer.mdict['pki_tomcat_common_lib_path'])
+            # establish Tomcat instance library
+            deployer.directory.create(deployer.mdict['pki_instance_lib'])
+            for name in os.listdir(deployer.mdict['pki_tomcat_lib_path']):
+                deployer.symlink.create(
+                    os.path.join(
+                        deployer.mdict['pki_tomcat_lib_path'],
+                        name),
+                    os.path.join(
+                        deployer.mdict['pki_instance_lib'],
+                        name))
+            deployer.symlink.create(
+                deployer.mdict['pki_instance_conf_log4j_properties'],
+                deployer.mdict['pki_instance_lib_log4j_properties'])
+            deployer.directory.create(deployer.mdict['pki_tomcat_tmpdir_path'])
+
+            # Copy /usr/share/pki/server/webapps to <instance>/webapps
+            deployer.directory.copy(
+                os.path.join(
+                    config.PKI_DEPLOYMENT_SOURCE_ROOT,
+                    "server",
+                    "webapps"),
+                deployer.mdict['pki_tomcat_webapps_path'])
+
+            # If desired and available,
+            # copy selected server theme
+            # to <instance>/webapps/pki
+            if config.str2bool(deployer.mdict['pki_theme_enable']) and\
+                    os.path.exists(deployer.mdict['pki_theme_server_dir']):
+                deployer.directory.copy(
+                    deployer.mdict['pki_theme_server_dir'],
+                    os.path.join(
+                        deployer.mdict['pki_tomcat_webapps_path'],
+                        "pki"),
+                    overwrite_flag=True)
+
+            deployer.directory.create(deployer.mdict['pki_tomcat_work_path'])
+            deployer.directory.create(
+                deployer.mdict['pki_tomcat_work_catalina_path'])
+            deployer.directory.create(
+                deployer.mdict['pki_tomcat_work_catalina_host_path'])
+            deployer.directory.create(
+                deployer.mdict['pki_tomcat_work_catalina_host_run_path'])
+            deployer.directory.create(
+                deployer.mdict['pki_tomcat_work_catalina_host_subsystem_path'])
+            # establish Tomcat instance logs
+            # establish Tomcat instance registry
+            # establish Tomcat instance convenience symbolic links
+            deployer.symlink.create(
+                deployer.mdict['pki_tomcat_bin_path'],
+                deployer.mdict['pki_tomcat_bin_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_tomcat_systemd'],
+                deployer.mdict['pki_instance_systemd_link'],
+                uid=0, gid=0)
+            # establish Tomcat instance common lib jar symbolic links
+            deployer.symlink.create(
+                deployer.mdict['pki_apache_commons_collections_jar'],
+                deployer.mdict['pki_apache_commons_collections_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_apache_commons_io_jar'],
+                deployer.mdict['pki_apache_commons_io_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_apache_commons_lang_jar'],
+                deployer.mdict['pki_apache_commons_lang_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_apache_commons_logging_jar'],
+                deployer.mdict['pki_apache_commons_logging_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_commons_codec_jar'],
+                deployer.mdict['pki_commons_codec_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_httpclient_jar'],
+                deployer.mdict['pki_httpclient_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_httpcore_jar'],
+                deployer.mdict['pki_httpcore_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_javassist_jar'],
+                deployer.mdict['pki_javassist_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_jss_jar'],
+                deployer.mdict['pki_jss_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_ldapjdk_jar'],
+                deployer.mdict['pki_ldapjdk_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_tomcat_jar'],
+                deployer.mdict['pki_tomcat_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_scannotation_jar'],
+                deployer.mdict['pki_scannotation_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_tomcatjss_jar'],
+                deployer.mdict['pki_tomcatjss_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_velocity_jar'],
+                deployer.mdict['pki_velocity_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_xerces_j2_jar'],
+                deployer.mdict['pki_xerces_j2_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_xml_commons_apis_jar'],
+                deployer.mdict['pki_xml_commons_apis_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_xml_commons_resolver_jar'],
+                deployer.mdict['pki_xml_commons_resolver_jar_link'])
+
+            # Jackson
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_annotations_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-annotations.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_core_asl_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-core-asl.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_core_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-core.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_databind_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-databind.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_jaxrs_base_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-jaxrs-base.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_jaxrs_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-jaxrs.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_jaxrs_json_provider_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-jaxrs-json-provider.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_mapper_asl_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-mapper-asl.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_module_jaxb_annotations_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-module-jaxb-annotations.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_mrbean_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-mrbean.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_smile_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-smile.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_jackson_xc_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jackson-xc.jar'))
+
+            # RESTEasy
+            deployer.symlink.create(
+                deployer.mdict['pki_resteasy_atom_provider_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'resteasy-atom-provider.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_resteasy_client_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'resteasy-client.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_resteasy_jaxb_provider_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'resteasy-jaxb-provider.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_resteasy_jaxrs_api_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'jaxrs-api.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_resteasy_jaxrs_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'resteasy-jaxrs.jar'))
+            deployer.symlink.create(
+                deployer.mdict['pki_resteasy_jackson_provider_jar'],
+                os.path.join(
+                    deployer.mdict['pki_tomcat_common_lib_path'],
+                    'resteasy-jackson-provider.jar'))
+
+            # establish shared NSS security databases for this instance
+            deployer.directory.create(deployer.mdict['pki_database_path'])
+            # establish instance convenience symbolic links
+            deployer.symlink.create(
+                deployer.mdict['pki_database_path'],
+                deployer.mdict['pki_instance_database_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_instance_configuration_path'],
+                deployer.mdict['pki_instance_conf_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_instance_log_path'],
+                deployer.mdict['pki_instance_logs_link'])
+
+        if deployer.mdict['pki_subsystem'] == 'TKS':
+            deployer.symlink.create(
+                deployer.mdict['pki_symkey_jar'],
+                deployer.mdict['pki_symkey_jar_link'])
+
+        return self.rv
+
+    def destroy(self, deployer):
+
+        config.pki_log.info(log.INSTANCE_DESTROY_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+
+        if deployer.mdict['pki_subsystem'] == 'TKS':
+            deployer.symlink.delete(deployer.mdict['pki_symkey_jar_link'])
+
+        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS and\
+           deployer.instance.apache_instance_subsystems() == 0:
+            # remove Apache instance base
+            deployer.directory.delete(deployer.mdict['pki_instance_path'])
+            # remove Apache instance logs
+            # remove shared NSS security database path for this instance
+            deployer.directory.delete(deployer.mdict['pki_database_path'])
+            # remove Apache instance configuration
+            deployer.directory.delete(
+                deployer.mdict['pki_instance_configuration_path'])
+            # remove Apache instance registry
+            deployer.directory.delete(
+                deployer.mdict['pki_instance_registry_path'])
+            # remove Apache PKI registry (if empty)
+            if deployer.instance.apache_instances() == 0:
+                deployer.directory.delete(
+                    deployer.mdict['pki_instance_type_registry_path'])
+
+        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
+                and len(deployer.instance.tomcat_instance_subsystems()) == 0:
+            # remove Tomcat instance base
+            deployer.directory.delete(deployer.mdict['pki_instance_path'])
+            # remove Tomcat instance logs
+            deployer.directory.delete(deployer.mdict['pki_instance_log_path'])
+            # remove shared NSS security database path for this instance
+            deployer.directory.delete(deployer.mdict['pki_database_path'])
+            # remove Tomcat instance configuration
+            deployer.directory.delete(
+                deployer.mdict['pki_instance_configuration_path'])
+            # remove PKI 'tomcat.conf' instance file
+            deployer.file.delete(
+                deployer.mdict['pki_target_tomcat_conf_instance_id'])
+            # remove Tomcat instance registry
+            deployer.directory.delete(
+                deployer.mdict['pki_instance_registry_path'])
+            # remove Tomcat PKI registry (if empty)
+            if deployer.instance.tomcat_instances() == 0:
+                deployer.directory.delete(
+                    deployer.mdict['pki_instance_type_registry_path'])
+
+        return self.rv
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/security_databases.py b/base/admin/python/pki/admin/deployment/scriptlets/security_databases.py
new file mode 100644
index 0000000..dc175cd
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/security_databases.py
@@ -0,0 +1,118 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from .. import pkimessages as log
+from .. import pkiscriptlet
+
+
+# PKI Deployment Security Databases Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+
+    def spawn(self, deployer):
+
+        if config.str2bool(deployer.mdict['pki_skip_installation']):
+            config.pki_log.info(log.SKIP_SECURITY_DATABASES_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+        config.pki_log.info(log.SECURITY_DATABASES_SPAWN_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        deployer.password.create_password_conf(
+            deployer.mdict['pki_shared_password_conf'],
+            deployer.mdict['pki_pin'])
+        # Since 'certutil' does NOT strip the 'token=' portion of
+        # the 'token=password' entries, create a temporary server 'pfile'
+        # which ONLY contains the 'password' for the purposes of
+        # allowing 'certutil' to generate the security databases
+        deployer.password.create_password_conf(
+            deployer.mdict['pki_shared_pfile'],
+            deployer.mdict['pki_pin'], pin_sans_token=True)
+        deployer.file.modify(deployer.mdict['pki_shared_password_conf'])
+        deployer.certutil.create_security_databases(
+            deployer.mdict['pki_database_path'],
+            deployer.mdict['pki_cert_database'],
+            deployer.mdict['pki_key_database'],
+            deployer.mdict['pki_secmod_database'],
+            password_file=deployer.mdict['pki_shared_pfile'])
+        deployer.file.modify(
+            deployer.mdict['pki_cert_database'],
+            perms=config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
+        deployer.file.modify(
+            deployer.mdict['pki_key_database'],
+            perms=config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
+        deployer.file.modify(
+            deployer.mdict['pki_secmod_database'],
+            perms=config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
+
+        if len(deployer.instance.tomcat_instance_subsystems()) < 2:
+            # only create a self signed cert for a new instance
+            rv = deployer.certutil.verify_certificate_exists(
+                deployer.mdict['pki_database_path'],
+                deployer.mdict['pki_cert_database'],
+                deployer.mdict['pki_key_database'],
+                deployer.mdict['pki_secmod_database'],
+                deployer.mdict['pki_self_signed_token'],
+                deployer.mdict['pki_self_signed_nickname'],
+                password_file=deployer.mdict['pki_shared_pfile'])
+            if not rv:
+                deployer.file.generate_noise_file(
+                    deployer.mdict['pki_self_signed_noise_file'],
+                    deployer.mdict['pki_self_signed_noise_bytes'])
+                deployer.certutil.generate_self_signed_certificate(
+                    deployer.mdict['pki_database_path'],
+                    deployer.mdict['pki_cert_database'],
+                    deployer.mdict['pki_key_database'],
+                    deployer.mdict['pki_secmod_database'],
+                    deployer.mdict['pki_self_signed_token'],
+                    deployer.mdict['pki_self_signed_nickname'],
+                    deployer.mdict['pki_self_signed_subject'],
+                    deployer.mdict['pki_self_signed_serial_number'],
+                    deployer.mdict['pki_self_signed_validity_period'],
+                    deployer.mdict['pki_self_signed_issuer_name'],
+                    deployer.mdict['pki_self_signed_trustargs'],
+                    deployer.mdict['pki_self_signed_noise_file'],
+                    password_file=deployer.mdict['pki_shared_pfile'])
+                # Delete the temporary 'noise' file
+                deployer.file.delete(
+                    deployer.mdict['pki_self_signed_noise_file'])
+            # Delete the temporary 'pfile'
+            deployer.file.delete(deployer.mdict['pki_shared_pfile'])
+        return self.rv
+
+    def destroy(self, deployer):
+
+        config.pki_log.info(log.SECURITY_DATABASES_DESTROY_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS \
+                and deployer.instance.apache_instance_subsystems() == 0:
+            deployer.file.delete(deployer.mdict['pki_cert_database'])
+            deployer.file.delete(deployer.mdict['pki_key_database'])
+            deployer.file.delete(deployer.mdict['pki_secmod_database'])
+            deployer.file.delete(deployer.mdict['pki_shared_password_conf'])
+        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
+                and len(deployer.instance.tomcat_instance_subsystems()) == 0:
+            deployer.file.delete(deployer.mdict['pki_cert_database'])
+            deployer.file.delete(deployer.mdict['pki_key_database'])
+            deployer.file.delete(deployer.mdict['pki_secmod_database'])
+            deployer.file.delete(deployer.mdict['pki_shared_password_conf'])
+        return self.rv
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/selinux_setup.py b/base/admin/python/pki/admin/deployment/scriptlets/selinux_setup.py
new file mode 100644
index 0000000..daf4142
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/selinux_setup.py
@@ -0,0 +1,241 @@
+#!/usr/bin/python -t
+# Authors:
+#     Ade Lee <alee@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+import selinux
+import time
+if selinux.is_selinux_enabled():
+    import seobject
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from ..pkiconfig import pki_selinux_config_ports as ports
+from .. import pkimessages as log
+from .. import pkiscriptlet
+
+
+# PKI Deployment Selinux Setup Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+    suffix = "(/.*)?"
+
+    def restore_context(self, mdict):
+        selinux.restorecon(mdict['pki_instance_path'], True)
+        selinux.restorecon(config.PKI_DEPLOYMENT_LOG_ROOT, True)
+        selinux.restorecon(mdict['pki_instance_log_path'], True)
+        selinux.restorecon(mdict['pki_instance_configuration_path'], True)
+
+    def spawn(self, deployer):
+
+        if config.str2bool(deployer.mdict['pki_skip_installation']):
+            config.pki_log.info(log.SKIP_SELINUX_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+
+        if not bool(selinux.is_selinux_enabled()):
+            config.pki_log.info(log.SELINUX_DISABLED_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+
+        config.pki_log.info(log.SELINUX_SPAWN_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        # A maximum of 10 tries to create the SELinux contexts
+        counter = 0
+        max_tries = 10
+        while True:
+            try:
+                # check first if any transactions are required
+                if len(ports) == 0 and deployer.mdict['pki_instance_name'] == \
+                        config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME:
+                    self.restore_context(deployer.mdict)
+                    return self.rv
+
+                # add SELinux contexts when adding the first subsystem
+                if deployer.mdict['pki_subsystem'] in \
+                        config.PKI_APACHE_SUBSYSTEMS and \
+                        deployer.instance.apache_instance_subsystems() == 1 \
+                        or deployer.mdict['pki_subsystem'] in \
+                        config.PKI_TOMCAT_SUBSYSTEMS and \
+                        len(deployer.instance.tomcat_instance_subsystems()) == 1:
+
+                    trans = seobject.semanageRecords("targeted")
+                    trans.start()
+                    if deployer.mdict['pki_instance_name'] != \
+                            config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME:
+
+                        fcon = seobject.fcontextRecords()
+
+                        config.pki_log.info(
+                            "adding selinux fcontext \"%s\"",
+                            deployer.mdict['pki_instance_path'] + self.suffix,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        fcon.add(
+                            deployer.mdict['pki_instance_path'] + self.suffix,
+                            config.PKI_INSTANCE_SELINUX_CONTEXT, "", "s0", "")
+
+                        config.pki_log.info(
+                            "adding selinux fcontext \"%s\"",
+                            deployer.mdict['pki_instance_log_path'] +
+                            self.suffix,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        fcon.add(
+                            deployer.mdict['pki_instance_log_path'] +
+                            self.suffix,
+                            config.PKI_LOG_SELINUX_CONTEXT, "", "s0", "")
+
+                        config.pki_log.info(
+                            "adding selinux fcontext \"%s\"",
+                            deployer.mdict['pki_instance_configuration_path'] +
+                            self.suffix,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        fcon.add(
+                            deployer.mdict['pki_instance_configuration_path'] +
+                            self.suffix,
+                            config.PKI_CFG_SELINUX_CONTEXT, "", "s0", "")
+
+                        config.pki_log.info(
+                            "adding selinux fcontext \"%s\"",
+                            deployer.mdict['pki_database_path'] + self.suffix,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        fcon.add(
+                            deployer.mdict['pki_database_path'] + self.suffix,
+                            config.PKI_CERTDB_SELINUX_CONTEXT, "", "s0", "")
+
+                        port_records = seobject.portRecords()
+                        for port in ports:
+                            config.pki_log.info(
+                                "adding selinux port %s", port,
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            port_records.add(
+                                port, "tcp", "s0",
+                                config.PKI_PORT_SELINUX_CONTEXT)
+
+                    trans.finish()
+
+                    self.restore_context(deployer.mdict)
+                break
+            except ValueError as e:
+                error_message = str(e)
+                config.pki_log.debug(error_message)
+                if error_message.strip() == \
+                        "Could not start semanage transaction":
+                    counter += 1
+                    if counter >= max_tries:
+                        raise
+                    time.sleep(5)
+                    config.pki_log.debug(
+                        "Retrying to setup the selinux context ...")
+                else:
+                    raise
+
+        return self.rv
+
+    def destroy(self, deployer):
+
+        if not bool(selinux.is_selinux_enabled()):
+            config.pki_log.info(log.SELINUX_DISABLED_DESTROY_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+        config.pki_log.info(log.SELINUX_DESTROY_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+
+        # check first if any transactions are required
+        if (len(ports) == 0 and deployer.mdict['pki_instance_name'] ==
+                config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME):
+            return self.rv
+        # A maximum of 10 tries to delete the SELinux contexts
+        counter = 1
+        max_tries = 10
+        while True:
+            try:
+                # remove SELinux contexts when removing the last subsystem
+                if (deployer.mdict['pki_subsystem'] in
+                        config.PKI_APACHE_SUBSYSTEMS and
+                        deployer.instance.apache_instance_subsystems() == 0 or
+                        deployer.mdict['pki_subsystem'] in
+                        config.PKI_TOMCAT_SUBSYSTEMS and
+                        len(deployer.instance.tomcat_instance_subsystems()) == 0):
+
+                    trans = seobject.semanageRecords("targeted")
+                    trans.start()
+
+                    if deployer.mdict['pki_instance_name'] != \
+                            config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME:
+
+                        fcon = seobject.fcontextRecords()
+
+                        config.pki_log.info(
+                            "deleting selinux fcontext \"%s\"",
+                            deployer.mdict['pki_instance_path'] + self.suffix,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        fcon.delete(
+                            deployer.mdict['pki_instance_path'] +
+                            self.suffix, "")
+
+                        config.pki_log.info(
+                            "deleting selinux fcontext \"%s\"",
+                            deployer.mdict['pki_instance_log_path'] +
+                            self.suffix,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        fcon.delete(
+                            deployer.mdict['pki_instance_log_path'] +
+                            self.suffix, "")
+
+                        config.pki_log.info(
+                            "deleting selinux fcontext \"%s\"",
+                            deployer.mdict['pki_instance_configuration_path'] +
+                            self.suffix,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        fcon.delete(
+                            deployer.mdict['pki_instance_configuration_path'] +
+                            self.suffix, "")
+
+                        config.pki_log.info(
+                            "deleting selinux fcontext \"%s\"",
+                            deployer.mdict['pki_database_path'] + self.suffix,
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        fcon.delete(
+                            deployer.mdict['pki_database_path'] +
+                            self.suffix, "")
+
+                        port_records = seobject.portRecords()
+                        for port in ports:
+                            config.pki_log.info(
+                                "deleting selinux port %s", port,
+                                extra=config.PKI_INDENTATION_LEVEL_2)
+                            port_records.delete(port, "tcp")
+
+                    trans.finish()
+                break
+            except ValueError as e:
+                error_message = str(e)
+                config.pki_log.debug(error_message)
+                if error_message.strip() == \
+                        "Could not start semanage transaction":
+                    counter += 1
+                    if counter >= max_tries:
+                        raise
+                    time.sleep(5)
+                    config.pki_log.debug(
+                        "Retrying to remove selinux context ...")
+                else:
+                    raise
+
+        return self.rv
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/slot_substitution.py b/base/admin/python/pki/admin/deployment/scriptlets/slot_substitution.py
new file mode 100644
index 0000000..f86ae49
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/slot_substitution.py
@@ -0,0 +1,113 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from .. import pkimessages as log
+from .. import pkiscriptlet
+
+
+# PKI Deployment Slot Substitution Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+
+    def spawn(self, deployer):
+
+        if config.str2bool(deployer.mdict['pki_skip_installation']):
+            config.pki_log.info(log.SKIP_SLOT_ASSIGNMENT_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+        config.pki_log.info(log.SLOT_ASSIGNMENT_SPAWN_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        deployer.file.copy_with_slot_substitution(
+            deployer.mdict['pki_source_cs_cfg'],
+            deployer.mdict['pki_target_cs_cfg'])
+        deployer.file.copy_with_slot_substitution(
+            deployer.mdict['pki_source_registry'],
+            deployer.mdict['pki_target_registry'],
+            overwrite_flag=True)
+        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+            deployer.file.copy_with_slot_substitution(
+                deployer.mdict['pki_source_catalina_properties'],
+                deployer.mdict['pki_target_catalina_properties'],
+                overwrite_flag=True)
+            deployer.file.copy_with_slot_substitution(
+                deployer.mdict['pki_source_servercertnick_conf'],
+                deployer.mdict['pki_target_servercertnick_conf'],
+                overwrite_flag=True)
+            deployer.file.copy_with_slot_substitution(
+                deployer.mdict['pki_source_server_xml'],
+                deployer.mdict['pki_target_server_xml'],
+                overwrite_flag=True)
+            deployer.file.copy_with_slot_substitution(
+                deployer.mdict['pki_source_context_xml'],
+                deployer.mdict['pki_target_context_xml'],
+                overwrite_flag=True)
+            deployer.file.copy_with_slot_substitution(
+                deployer.mdict['pki_source_tomcat_conf'],
+                deployer.mdict['pki_target_tomcat_conf_instance_id'],
+                uid=0, gid=0, overwrite_flag=True)
+            deployer.file.copy_with_slot_substitution(
+                deployer.mdict['pki_source_tomcat_conf'],
+                deployer.mdict['pki_target_tomcat_conf'],
+                overwrite_flag=True)
+
+            # Configure web.xml and velocity.properties for each subsystem.
+            # For TPS this is not necessary since the files are no longer
+            # copied to the target location in the instance directory.
+            if deployer.mdict['pki_subsystem'] != "TPS":
+                deployer.file.apply_slot_substitution(
+                    deployer.mdict['pki_target_velocity_properties'])
+                deployer.file.apply_slot_substitution(
+                    deployer.mdict['pki_target_subsystem_web_xml'])
+
+            # Strip "<filter>" section from subsystem "web.xml"
+            # This is ONLY necessary because XML comments cannot be "nested"!
+            # deployer.file.copy(deployer.mdict['pki_target_subsystem_web_xml'],
+            #               deployer.mdict['pki_target_subsystem_web_xml_orig'])
+            # deployer.file.delete(
+            #   deployer.mdict['pki_target_subsystem_web_xml'])
+            # util.xml_file.remove_filter_section_from_web_xml(
+            #    deployer.mdict['pki_target_subsystem_web_xml_orig'],
+            #    deployer.mdict['pki_target_subsystem_web_xml'])
+            # deployer.file.delete(
+            #   deployer.mdict['pki_target_subsystem_web_xml_orig'])
+            if deployer.mdict['pki_subsystem'] == "CA":
+                deployer.file.copy_with_slot_substitution(
+                    deployer.mdict['pki_source_proxy_conf'],
+                    deployer.mdict['pki_target_proxy_conf'])
+                deployer.file.apply_slot_substitution(
+                    deployer.mdict['pki_target_profileselect_template'])
+            elif deployer.mdict['pki_subsystem'] == "TPS":
+                deployer.file.copy_with_slot_substitution(
+                    deployer.mdict['pki_source_registry_cfg'],
+                    deployer.mdict['pki_target_registry_cfg'])
+                deployer.file.copy_with_slot_substitution(
+                    deployer.mdict['pki_source_phone_home_xml'],
+                    deployer.mdict['pki_target_phone_home_xml'])
+        return self.rv
+
+    def destroy(self, deployer):
+        config.pki_log.info(log.SLOT_ASSIGNMENT_DESTROY_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        config.pki_log.info("NOTHING NEEDS TO BE IMPLEMENTED",
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+        return self.rv
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/subsystem_layout.py b/base/admin/python/pki/admin/deployment/scriptlets/subsystem_layout.py
new file mode 100644
index 0000000..432fba9
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/subsystem_layout.py
@@ -0,0 +1,153 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from .. import pkimessages as log
+from .. import pkiscriptlet
+
+
+# PKI Deployment Subsystem Layout Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+
+    def spawn(self, deployer):
+
+        if config.str2bool(deployer.mdict['pki_skip_installation']):
+            config.pki_log.info(log.SKIP_SUBSYSTEM_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+            return self.rv
+        config.pki_log.info(log.SUBSYSTEM_SPAWN_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        # establish instance-based subsystem logs
+        deployer.directory.create(deployer.mdict['pki_subsystem_log_path'])
+        deployer.directory.create(
+            deployer.mdict['pki_subsystem_archive_log_path'])
+        if deployer.mdict['pki_subsystem'] in \
+                config.PKI_SIGNED_AUDIT_SUBSYSTEMS:
+            deployer.directory.create(
+                deployer.mdict['pki_subsystem_signed_audit_log_path'])
+        # establish instance-based subsystem configuration
+        deployer.directory.create(
+            deployer.mdict['pki_subsystem_configuration_path'])
+        # deployer.directory.copy(
+        #   deployer.mdict['pki_source_conf_path'],
+        #   deployer.mdict['pki_subsystem_configuration_path'])
+        # establish instance-based Apache/Tomcat specific subsystems
+        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+            # establish instance-based Tomcat PKI subsystem base
+            if deployer.mdict['pki_subsystem'] == "CA":
+                deployer.directory.copy(
+                    deployer.mdict['pki_source_emails'],
+                    deployer.mdict['pki_subsystem_emails_path'])
+                deployer.directory.copy(
+                    deployer.mdict['pki_source_profiles'],
+                    deployer.mdict['pki_subsystem_profiles_path'])
+            # establish instance-based Tomcat PKI subsystem logs
+            # establish instance-based Tomcat PKI subsystem configuration
+            if deployer.mdict['pki_subsystem'] == "CA":
+                deployer.file.copy(
+                    deployer.mdict['pki_source_flatfile_txt'],
+                    deployer.mdict['pki_target_flatfile_txt'])
+                deployer.file.copy(
+                    deployer.mdict['pki_source_registry_cfg'],
+                    deployer.mdict['pki_target_registry_cfg'])
+                # '*.profile'
+                deployer.file.copy(
+                    deployer.mdict['pki_source_admincert_profile'],
+                    deployer.mdict['pki_target_admincert_profile'])
+                deployer.file.copy(
+                    deployer.mdict['pki_source_caauditsigningcert_profile'],
+                    deployer.mdict['pki_target_caauditsigningcert_profile'])
+                deployer.file.copy(
+                    deployer.mdict['pki_source_cacert_profile'],
+                    deployer.mdict['pki_target_cacert_profile'])
+                deployer.file.copy(
+                    deployer.mdict['pki_source_caocspcert_profile'],
+                    deployer.mdict['pki_target_caocspcert_profile'])
+                deployer.file.copy(
+                    deployer.mdict['pki_source_servercert_profile'],
+                    deployer.mdict['pki_target_servercert_profile'])
+                deployer.file.copy(
+                    deployer.mdict['pki_source_subsystemcert_profile'],
+                    deployer.mdict['pki_target_subsystemcert_profile'])
+            elif deployer.mdict['pki_subsystem'] == "KRA":
+                # '*.profile'
+                deployer.file.copy(
+                    deployer.mdict['pki_source_servercert_profile'],
+                    deployer.mdict['pki_target_servercert_profile'])
+                deployer.file.copy(
+                    deployer.mdict['pki_source_storagecert_profile'],
+                    deployer.mdict['pki_target_storagecert_profile'])
+                deployer.file.copy(
+                    deployer.mdict['pki_source_subsystemcert_profile'],
+                    deployer.mdict['pki_target_subsystemcert_profile'])
+                deployer.file.copy(
+                    deployer.mdict['pki_source_transportcert_profile'],
+                    deployer.mdict['pki_target_transportcert_profile'])
+            # establish instance-based Tomcat PKI subsystem registry
+            # establish instance-based Tomcat PKI subsystem convenience
+            # symbolic links
+            deployer.symlink.create(
+                deployer.mdict['pki_tomcat_webapps_path'],
+                deployer.mdict['pki_subsystem_tomcat_webapps_link'])
+        # establish instance-based subsystem convenience symbolic links
+        deployer.symlink.create(
+            deployer.mdict['pki_instance_database_link'],
+            deployer.mdict['pki_subsystem_database_link'])
+        deployer.symlink.create(
+            deployer.mdict['pki_subsystem_configuration_path'],
+            deployer.mdict['pki_subsystem_conf_link'])
+        deployer.symlink.create(
+            deployer.mdict['pki_subsystem_log_path'],
+            deployer.mdict['pki_subsystem_logs_link'])
+        deployer.symlink.create(
+            deployer.mdict['pki_instance_registry_path'],
+            deployer.mdict['pki_subsystem_registry_link'])
+        return self.rv
+
+    def destroy(self, deployer):
+
+        config.pki_log.info(log.SUBSYSTEM_DESTROY_1, __name__,
+                            extra=config.PKI_INDENTATION_LEVEL_1)
+        # remove instance-based subsystem base
+        if deployer.mdict['pki_subsystem'] == "CA":
+            deployer.directory.delete(
+                deployer.mdict['pki_subsystem_emails_path'])
+            deployer.directory.delete(
+                deployer.mdict['pki_subsystem_profiles_path'])
+        deployer.directory.delete(deployer.mdict['pki_subsystem_path'])
+        # remove instance-based subsystem logs
+        if deployer.mdict['pki_subsystem'] in \
+                config.PKI_SIGNED_AUDIT_SUBSYSTEMS:
+            deployer.directory.delete(
+                deployer.mdict['pki_subsystem_signed_audit_log_path'])
+        deployer.directory.delete(
+            deployer.mdict['pki_subsystem_archive_log_path'])
+        deployer.directory.delete(
+            deployer.mdict['pki_subsystem_log_path'])
+        # remove instance-based subsystem configuration
+        deployer.directory.delete(
+            deployer.mdict['pki_subsystem_configuration_path'])
+        # remove instance-based subsystem registry
+        deployer.directory.delete(
+            deployer.mdict['pki_subsystem_registry_path'])
+        return self.rv
diff --git a/base/admin/python/pki/admin/deployment/scriptlets/webapp_deployment.py b/base/admin/python/pki/admin/deployment/scriptlets/webapp_deployment.py
new file mode 100644
index 0000000..962de72
--- /dev/null
+++ b/base/admin/python/pki/admin/deployment/scriptlets/webapp_deployment.py
@@ -0,0 +1,177 @@
+#!/usr/bin/python -t
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2012 Red Hat, Inc.
+# All rights reserved.
+#
+
+# System Imports
+import os
+
+# PKI Deployment Imports
+from .. import pkiconfig as config
+from .. import pkimessages as log
+from .. import pkiscriptlet
+
+
+# PKI Web Application Deployment Scriptlet
+class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
+    rv = 0
+
+    def spawn(self, deployer):
+
+        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+            if config.str2bool(deployer.mdict['pki_skip_installation']):
+                config.pki_log.info(log.SKIP_WEBAPP_DEPLOYMENT_SPAWN_1,
+                                    __name__,
+                                    extra=config.PKI_INDENTATION_LEVEL_1)
+                return self.rv
+
+            config.pki_log.info(log.WEBAPP_DEPLOYMENT_SPAWN_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+
+            # For TPS, deploy web application directly from /usr/share/pki.
+            if deployer.mdict['pki_subsystem'] == "TPS":
+                deployer.file.copy(
+                    os.path.join(
+                        config.PKI_DEPLOYMENT_SOURCE_ROOT,
+                        "tps",
+                        "conf",
+                        "Catalina",
+                        "localhost",
+                        "tps.xml"),
+                    os.path.join(
+                        deployer.mdict['pki_instance_configuration_path'],
+                        "Catalina",
+                        "localhost",
+                        "tps.xml"))
+                return self.rv
+
+            # For other subsystems, deploy web application into Tomcat instance.
+            deployer.directory.create(
+                deployer.mdict['pki_tomcat_webapps_subsystem_path'])
+
+            # Copy /usr/share/pki/<subsystem>/webapps/<subsystem>
+            # to <instance>/webapps/<subsystem>
+            deployer.directory.copy(
+                os.path.join(
+                    config.PKI_DEPLOYMENT_SOURCE_ROOT,
+                    deployer.mdict['pki_subsystem'].lower(),
+                    "webapps",
+                    deployer.mdict['pki_subsystem'].lower()),
+                deployer.mdict['pki_tomcat_webapps_subsystem_path'],
+                overwrite_flag=True)
+
+            # Copy /usr/share/pki/server/webapps/pki/admin
+            # to <instance>/webapps/<subsystem>/admin
+            # TODO: common templates should be deployed in common webapp
+            deployer.directory.copy(
+                os.path.join(
+                    config.PKI_DEPLOYMENT_SOURCE_ROOT,
+                    "server",
+                    "webapps",
+                    "pki",
+                    "admin"),
+                os.path.join(
+                    deployer.mdict['pki_tomcat_webapps_subsystem_path'],
+                    "admin"),
+                overwrite_flag=True)
+
+            deployer.directory.create(
+                deployer.mdict['pki_tomcat_webapps_subsystem_webinf_classes_path'])
+            deployer.directory.create(
+                deployer.mdict['pki_tomcat_webapps_subsystem_webinf_lib_path'])
+            # establish Tomcat webapps subsystem WEB-INF lib symbolic links
+            deployer.symlink.create(
+                deployer.mdict['pki_certsrv_jar'],
+                deployer.mdict['pki_certsrv_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_cmsbundle'],
+                deployer.mdict['pki_cmsbundle_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_cmscore'],
+                deployer.mdict['pki_cmscore_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_cms'],
+                deployer.mdict['pki_cms_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_cmsutil'],
+                deployer.mdict['pki_cmsutil_jar_link'])
+            deployer.symlink.create(
+                deployer.mdict['pki_nsutil'],
+                deployer.mdict['pki_nsutil_jar_link'])
+            if deployer.mdict['pki_subsystem'] == "CA":
+                deployer.symlink.create(
+                    deployer.mdict['pki_ca_jar'],
+                    deployer.mdict['pki_ca_jar_link'])
+            elif deployer.mdict['pki_subsystem'] == "KRA":
+                deployer.symlink.create(
+                    deployer.mdict['pki_kra_jar'],
+                    deployer.mdict['pki_kra_jar_link'])
+            elif deployer.mdict['pki_subsystem'] == "OCSP":
+                deployer.symlink.create(
+                    deployer.mdict['pki_ocsp_jar'],
+                    deployer.mdict['pki_ocsp_jar_link'])
+            elif deployer.mdict['pki_subsystem'] == "TKS":
+                deployer.symlink.create(
+                    deployer.mdict['pki_tks_jar'],
+                    deployer.mdict['pki_tks_jar_link'])
+
+            # set ownerships, permissions, and acls
+            deployer.directory.set_mode(
+                deployer.mdict['pki_tomcat_webapps_subsystem_path'])
+
+            # Copy web application context file
+            # from /usr/share/pki/<subsystem>/conf/Catalina/localhost/
+            # <subsystem>.xml
+            # to <instance>/conf/Catalina/localhost/<subsystem>.xml
+            deployer.file.copy(
+                os.path.join(
+                    config.PKI_DEPLOYMENT_SOURCE_ROOT,
+                    deployer.mdict['pki_subsystem'].lower(),
+                    "conf",
+                    "Catalina",
+                    "localhost",
+                    deployer.mdict['pki_subsystem'].lower() + ".xml"),
+                os.path.join(
+                    deployer.mdict['pki_instance_configuration_path'],
+                    "Catalina",
+                    "localhost",
+                    deployer.mdict['pki_subsystem'].lower() + ".xml"))
+
+        return self.rv
+
+    def destroy(self, deployer):
+        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
+            config.pki_log.info(log.WEBAPP_DEPLOYMENT_DESTROY_1, __name__,
+                                extra=config.PKI_INDENTATION_LEVEL_1)
+
+            # Delete <instance>/conf/Catalina/localhost/<subsystem>.xml
+            deployer.file.delete(
+                os.path.join(
+                    deployer.mdict['pki_instance_configuration_path'],
+                    "Catalina",
+                    "localhost",
+                    deployer.mdict['pki_subsystem'].lower() + ".xml"))
+
+            # For subsystems other than TPS, delete
+            # <instance>/webapps/<subsystem>.
+            if deployer.mdict['pki_subsystem'] != "TPS":
+                deployer.directory.delete(
+                    deployer.mdict['pki_tomcat_webapps_subsystem_path'])
+
+        return self.rv
diff --git a/base/admin/sbin/pkidestroy b/base/admin/sbin/pkidestroy
new file mode 100755
index 0000000..b52e588
--- /dev/null
+++ b/base/admin/sbin/pkidestroy
@@ -0,0 +1,278 @@
+#!/usr/bin/python -tu
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2011 Red Hat, Inc.
+# All rights reserved.
+#
+
+# System Imports
+import sys
+import signal
+
+if not hasattr(sys, "hexversion") or sys.hexversion < 0x020700f0:
+    print "Python version %s.%s.%s is too old." % sys.version_info[:3]
+    print "Please upgrade to at least Python 2.7.0."
+    sys.exit(1)
+try:
+    import os
+    import socket
+    import struct
+    import subprocess
+    import time
+    from time import strftime as date
+    from pki.admin.deployment import pkiconfig as config
+    from pki.admin.deployment.pkiparser import PKIConfigParser
+    from pki.admin.deployment import pkilogging
+    from pki.admin.deployment import pkimessages as log
+    import pki.admin.deployment.pkihelper as util
+except ImportError:
+    print >> sys.stderr, """\
+There was a problem importing one of the required Python modules. The
+error was:
+
+    %s
+""" % sys.exc_value
+    sys.exit(1)
+
+
+#Handle the Keyboard Interrupt
+# pylint: disable-msg=W0613
+def interrupt_handler(event, frame):
+    print
+    print '\nUninstallation canceled.'
+    sys.exit(1)
+
+
+# PKI Deployment Functions
+def main(argv):
+    """main entry point"""
+
+    config.pki_deployment_executable = os.path.basename(argv[0])
+
+    # Only run this program as "root".
+    if not os.geteuid() == 0:
+        sys.exit("'%s' must be run as root!" % argv[0])
+
+    # Set the umask
+    os.umask(config.PKI_DEPLOYMENT_DEFAULT_UMASK)
+
+    # Set installation time
+    ticks = time.time()
+    config.pki_install_time = time.asctime(time.localtime(ticks))
+
+    # Generate a timestamp
+    config.pki_timestamp = date('%Y%m%d%H%M%S', time.localtime(ticks))
+    config.pki_certificate_timestamp =\
+        date('%Y-%m-%d %H:%M:%S', time.localtime(ticks))
+
+    # Obtain the architecture bit-size
+    config.pki_architecture = struct.calcsize("P") * 8
+
+    # Retrieve hostname
+    config.pki_hostname = socket.getfqdn()
+
+    # Retrieve DNS domainname
+    config.pki_dns_domainname = None
+    try:
+        dnsdomainname = subprocess.check_output(
+            "dnsdomainname",
+            shell=True)
+        # workaround for pylint error E1103
+        config.pki_dns_domainname = str(dnsdomainname).rstrip('\n')
+        if not len(config.pki_dns_domainname):
+            print log.PKI_DNS_DOMAIN_NOT_SET
+            sys.exit(1)
+    except subprocess.CalledProcessError as exc:
+        print log.PKI_SUBPROCESS_ERROR_1 % exc
+        sys.exit(1)
+
+    # Read and process command-line arguments.
+    parser = PKIConfigParser(
+        'PKI Instance Removal',
+        log.PKIDESTROY_EPILOG)
+
+    parser.optional.add_argument(
+        '-i',
+        dest='pki_deployed_instance_name',
+        action='store',
+        nargs=1, metavar='<instance>',
+        help='FORMAT:  ${pki_instance_name}')
+
+    parser.optional.add_argument(
+        '-u',
+        dest='pki_secdomain_user',
+        action='store',
+        nargs=1, metavar='<security domain user>',
+        help='security domain user')
+    
+    parser.optional.add_argument(
+        '-W',
+        dest='pki_secdomain_pass_file',
+        action='store',
+        nargs=1, metavar='<security domain password file>',
+        help='security domain password file path')
+
+    args = parser.process_command_line_arguments()
+
+    interactive = False
+
+    while True:
+
+        # -s <subsystem>
+        if args.pki_subsystem is None:
+            interactive = True
+            config.pki_subsystem = parser.read_text(
+                'Subsystem (CA/KRA/OCSP/TKS/TPS)',
+                options=['CA', 'KRA', 'OCSP', 'TKS', 'TPS'],
+                default='CA', case_sensitive=False).upper()
+        else:
+            config.pki_subsystem = str(args.pki_subsystem).strip('[\']')
+
+        # -i <instance name>
+        if args.pki_deployed_instance_name is None:
+            interactive = True
+            config.pki_deployed_instance_name = \
+                parser.read_text('Instance', default='pki-tomcat')
+        else:
+            config.pki_deployed_instance_name = \
+                str(args.pki_deployed_instance_name).strip('[\']')
+
+        if interactive:
+            print
+            parser.indent = 0
+
+            begin = parser.read_text(
+                'Begin uninstallation (Yes/No/Quit)',
+                options=['Yes', 'Y', 'No', 'N', 'Quit', 'Q'],
+                sign='?', allow_empty=False, case_sensitive=False).lower()
+
+            print
+
+            if begin == 'q' or begin == 'quit':
+                print "Uninstallation canceled."
+                sys.exit(0)
+
+            elif begin == 'y' or begin == 'yes':
+                break
+
+        else:
+            break
+
+    #    '-u'
+    if args.pki_secdomain_user:
+        config.pki_secdomain_user = str(args.pki_secdomain_user).strip('[\']')
+
+    #    '-W' password file
+    if args.pki_secdomain_pass_file:
+        with open(str(args.pki_secdomain_pass_file).strip('[\']'), 'r') as \
+                pwd_file:
+            config.pki_secdomain_pass = pwd_file.readline().strip('\n')
+
+    # verify that previously deployed instance exists
+    deployed_pki_instance_path = \
+        config.pki_root_prefix + config.PKI_DEPLOYMENT_BASE_ROOT + "/" + \
+        config.pki_deployed_instance_name
+    if not os.path.exists(deployed_pki_instance_path):
+        print "ERROR:  " + log.PKI_INSTANCE_DOES_NOT_EXIST_1 %\
+              deployed_pki_instance_path
+        print
+        parser.arg_parser.exit(-1)
+
+    # verify that previously deployed subsystem for this instance exists
+    deployed_pki_subsystem_path = \
+        deployed_pki_instance_path + "/" + config.pki_subsystem.lower()
+    if not os.path.exists(deployed_pki_subsystem_path):
+        print "ERROR:  " + log.PKI_SUBSYSTEM_DOES_NOT_EXIST_2 %\
+              (config.pki_subsystem, deployed_pki_instance_path)
+        print
+        parser.arg_parser.exit(-1)
+
+    config.default_deployment_cfg = \
+        config.PKI_DEPLOYMENT_DEFAULT_CONFIGURATION_FILE
+
+    # establish complete path to previously deployed configuration file
+    config.user_deployment_cfg =\
+        deployed_pki_subsystem_path + "/" +\
+        "registry" + "/" +\
+        config.pki_subsystem.lower() + "/" +\
+        config.USER_DEPLOYMENT_CONFIGURATION
+
+    parser.validate()
+    parser.init_config()
+
+    # Enable 'pkidestroy' logging.
+    config.pki_log_dir = \
+        config.pki_root_prefix + config.PKI_DEPLOYMENT_LOG_ROOT
+    config.pki_log_name = "pki" + "-" +\
+                          config.pki_subsystem.lower() +\
+                          "-" + "destroy" + "." +\
+                          config.pki_timestamp + "." + "log"
+    rv = pkilogging.enable_pki_logger(config.pki_log_dir,
+                                      config.pki_log_name,
+                                      config.pki_log_level,
+                                      config.pki_console_log_level,
+                                      "pkidestroy")
+    if rv != OSError:
+        config.pki_log = rv
+    else:
+        print log.PKI_UNABLE_TO_CREATE_LOG_DIRECTORY_1 % config.pki_log_dir
+        sys.exit(1)
+
+    # Read the specified PKI configuration file.
+    rv = parser.read_pki_configuration_file()
+    if rv != 0:
+        config.pki_log.error(log.PKI_UNABLE_TO_PARSE_1, rv,
+                             extra=config.PKI_INDENTATION_LEVEL_0)
+        sys.exit(1)
+
+    # Combine the various sectional dictionaries into a PKI master dictionary
+    parser.compose_pki_master_dictionary()
+    parser.mdict['pki_destroy_log'] = \
+        config.pki_log_dir + "/" + config.pki_log_name
+    config.pki_log.debug(log.PKI_DICTIONARY_MASTER,
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+    config.pki_log.debug(pkilogging.log_format(parser.mdict),
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+
+    print "Uninstalling " + config.pki_subsystem + " from " + \
+          deployed_pki_instance_path + "."
+
+    # Process the various "scriptlets" to remove the specified PKI subsystem.
+    pki_subsystem_scriptlets = parser.mdict['destroy_scriplets'].split()
+    deployer = util.PKIDeployer(parser.mdict)
+    rv = 0
+    for pki_scriptlet in pki_subsystem_scriptlets:
+        scriptlet = __import__("pki.admin.deployment.scriptlets." +
+                               pki_scriptlet,
+                               fromlist=[pki_scriptlet])
+        instance = scriptlet.PkiScriptlet()
+        rv = instance.destroy(deployer)
+        if rv != 0:
+            sys.exit(1)
+    config.pki_log.debug(log.PKI_DICTIONARY_MASTER,
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+    config.pki_log.debug(pkilogging.log_format(parser.mdict),
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+
+    print
+    print "Uninstallation complete."
+
+
+# PKI Deployment Entry Point
+if __name__ == "__main__":
+    signal.signal(signal.SIGINT, interrupt_handler)
+    main(sys.argv)
diff --git a/base/admin/sbin/pkispawn b/base/admin/sbin/pkispawn
new file mode 100755
index 0000000..a873b8b
--- /dev/null
+++ b/base/admin/sbin/pkispawn
@@ -0,0 +1,586 @@
+#!/usr/bin/python -tu
+# Authors:
+#     Matthew Harmsen <mharmsen@redhat.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Copyright (C) 2011 Red Hat, Inc.
+# All rights reserved.
+#
+
+# System Imports
+import sys
+import signal
+
+if not hasattr(sys, "hexversion") or sys.hexversion < 0x020700f0:
+    print "Python version %s.%s.%s is too old." % sys.version_info[:3]
+    print "Please upgrade to at least Python 2.7.0."
+    sys.exit(1)
+try:
+    import ldap
+    import os
+    import requests
+    import socket
+    import struct
+    import subprocess
+    import time
+    import traceback
+    from time import strftime as date
+    from pki.admin.deployment import pkiconfig as config
+    from pki.admin.deployment.pkiparser import PKIConfigParser
+    from pki.admin.deployment import pkilogging
+    from pki.admin.deployment import pkimessages as log
+    import pki.admin.deployment.pkihelper as util
+except ImportError:
+    print >> sys.stderr, """\
+There was a problem importing one of the required Python modules. The
+error was:
+
+    %s
+""" % sys.exc_value
+    sys.exit(1)
+
+
+# Handle the Keyboard Interrupt
+# pylint: disable-msg=W0613
+def interrupt_handler(event, frame):
+    print
+    print '\nInstallation canceled.'
+    sys.exit(1)
+
+
+# PKI Deployment Functions
+def main(argv):
+    """main entry point"""
+
+    config.pki_deployment_executable = os.path.basename(argv[0])
+
+    # Only run this program as "root".
+    if not os.geteuid() == 0:
+        sys.exit("'%s' must be run as root!" % argv[0])
+
+    # Set the umask
+    os.umask(config.PKI_DEPLOYMENT_DEFAULT_UMASK)
+
+    # Set installation time
+    ticks = time.time()
+    config.pki_install_time = time.asctime(time.localtime(ticks))
+
+    # Generate a timestamp
+    config.pki_timestamp = date('%Y%m%d%H%M%S', time.localtime(ticks))
+    config.pki_certificate_timestamp = \
+        date('%Y-%m-%d %H:%M:%S', time.localtime(ticks))
+
+    # Obtain the architecture bit-size
+    config.pki_architecture = struct.calcsize("P") * 8
+
+    # Retrieve hostname
+    config.pki_hostname = socket.getfqdn()
+
+    # Retrieve DNS domainname
+    try:
+        dnsdomainname = subprocess.check_output(
+            "dnsdomainname", shell=True)
+        # workaround for pylint error E1103
+        config.pki_dns_domainname = str(dnsdomainname).rstrip('\n')
+        if not len(config.pki_dns_domainname):
+            print log.PKI_DNS_DOMAIN_NOT_SET
+            sys.exit(1)
+    except subprocess.CalledProcessError as exc:
+        print log.PKI_SUBPROCESS_ERROR_1 % exc
+        sys.exit(1)
+
+    # Read and process command-line arguments.
+    parser = PKIConfigParser(
+        'PKI Instance Installation and Configuration',
+        log.PKISPAWN_EPILOG)
+
+    parser.optional.add_argument(
+        '-f',
+        dest='user_deployment_cfg', action='store',
+        nargs=1, metavar='<file>',
+        help='configuration filename '
+        '(MUST specify complete path)')
+
+    args = parser.process_command_line_arguments()
+
+    config.default_deployment_cfg = \
+        config.PKI_DEPLOYMENT_DEFAULT_CONFIGURATION_FILE
+
+    # -f <user deployment config>
+    if args.user_deployment_cfg is not None:
+        config.user_deployment_cfg = str(args.user_deployment_cfg).strip('[\']')
+
+    parser.validate()
+    interactive = False
+
+    while True:
+
+        # -s <subsystem>
+        if args.pki_subsystem is None:
+            interactive = True
+            parser.indent = 0
+
+            config.pki_subsystem = parser.read_text(
+                'Subsystem (CA/KRA/OCSP/TKS/TPS)',
+                options=['CA', 'KRA', 'OCSP', 'TKS', 'TPS'],
+                default='CA', case_sensitive=False).upper()
+            print
+        else:
+            config.pki_subsystem = str(args.pki_subsystem).strip('[\']')
+
+        parser.init_config()
+
+        if config.user_deployment_cfg is None:
+            interactive = True
+            parser.indent = 2
+
+            print "Tomcat:"
+            parser.read_text('Instance', 'DEFAULT', 'pki_instance_name')
+            parser.read_text('HTTP port', config.pki_subsystem, 'pki_http_port')
+            parser.read_text('Secure HTTP port', config.pki_subsystem,
+                             'pki_https_port')
+            parser.read_text('AJP port', config.pki_subsystem, 'pki_ajp_port')
+            parser.read_text('Management port', config.pki_subsystem,
+                             'pki_tomcat_server_port')
+            print
+
+            print "Administrator:"
+            parser.read_text('Username', config.pki_subsystem, 'pki_admin_uid')
+
+            admin_password = parser.read_password(
+                'Password', config.pki_subsystem, 'pki_admin_password',
+                verifyMessage='Verify password')
+
+            parser.set_property(config.pki_subsystem, 'pki_backup_password',
+                                admin_password)
+            parser.set_property(config.pki_subsystem,
+                                'pki_client_database_password',
+                                admin_password)
+            parser.set_property(config.pki_subsystem,
+                                'pki_client_pkcs12_password',
+                                admin_password)
+
+            if parser.mdict['pki_import_admin_cert'] == 'True':
+                import_cert = 'Y'
+            else:
+                import_cert = 'N'
+
+            import_cert = parser.read_text(
+                'Import certificate (Yes/No)',
+                default=import_cert, options=['Yes', 'Y', 'No', 'N'],
+                sign='?', case_sensitive=False).lower()
+
+            if import_cert == 'y' or import_cert == 'yes':
+                parser.set_property(config.pki_subsystem,
+                                    'pki_import_admin_cert',
+                                    'True')
+                parser.read_text('Import certificate from',
+                                 config.pki_subsystem,
+                                 'pki_admin_cert_file')
+            else:
+                parser.set_property(config.pki_subsystem,
+                                    'pki_import_admin_cert',
+                                    'False')
+
+            parser.read_text('Export certificate to',
+                             config.pki_subsystem,
+                             'pki_client_admin_cert')
+            print
+
+            print "Directory Server:"
+            while True:
+                parser.read_text('Hostname',
+                                 config.pki_subsystem,
+                                 'pki_ds_hostname')
+                parser.read_text('Port',
+                                 config.pki_subsystem,
+                                 'pki_ds_ldap_port')
+                parser.read_text('Bind DN',
+                                 config.pki_subsystem,
+                                 'pki_ds_bind_dn')
+                parser.read_password('Password',
+                                     config.pki_subsystem,
+                                     'pki_ds_password')
+
+                try:
+                    parser.ds_verify_configuration()
+
+                except ldap.LDAPError as e:
+                    parser.print_text('ERROR: ' + e.message['desc'])
+                    continue
+
+                parser.read_text('Base DN',
+                                 config.pki_subsystem,
+                                 'pki_ds_base_dn')
+                try:
+                    if not parser.ds_base_dn_exists():
+                        break
+
+                except ldap.LDAPError as e:
+                    parser.print_text('ERROR: ' + e.message['desc'])
+                    continue
+
+                remove = parser.read_text(
+                    'Base DN already exists. Overwrite (Yes/No/Quit)',
+                    options=['Yes', 'Y', 'No', 'N', 'Quit', 'Q'],
+                    sign='?', allow_empty=False, case_sensitive=False).lower()
+
+                if remove == 'q' or remove == 'quit':
+                    print "Installation canceled."
+                    sys.exit(0)
+
+                if remove == 'y' or remove == 'yes':
+                    break
+
+            print
+
+            print "Security Domain:"
+
+            if config.pki_subsystem == "CA":
+                parser.read_text('Name',
+                                 config.pki_subsystem,
+                                 'pki_security_domain_name')
+
+            else:
+                while True:
+                    parser.read_text('Hostname',
+                                     config.pki_subsystem,
+                                     'pki_security_domain_hostname')
+
+                    parser.read_text('Secure HTTP port',
+                                     config.pki_subsystem,
+                                     'pki_security_domain_https_port')
+
+                    try:
+                        parser.sd_connect()
+                        info = parser.sd_get_info()
+                        parser.print_text('Name: ' + info.name)
+                        parser.set_property(config.pki_subsystem,
+                                            'pki_security_domain_name',
+                                            info.name)
+                        break
+                    except requests.exceptions.ConnectionError as e:
+                        parser.print_text('ERROR: ' + str(e))
+
+                while True:
+                    parser.read_text('Username',
+                                     config.pki_subsystem,
+                                     'pki_security_domain_user')
+                    parser.read_password('Password',
+                                         config.pki_subsystem,
+                                         'pki_security_domain_password')
+
+                    try:
+                        parser.sd_authenticate()
+                        break
+                    except requests.exceptions.HTTPError as e:
+                        parser.print_text('ERROR: ' + str(e))
+
+            print
+
+            if config.pki_subsystem == "TPS":
+                print "External Servers:"
+
+                while True:
+                    parser.read_text('CA URL',
+                                     config.pki_subsystem,
+                                     'pki_ca_uri')
+                    try:
+                        status = parser.get_server_status('ca', 'pki_ca_uri')
+                        if status == 'running':
+                            break
+                        parser.print_text('ERROR: CA is not running')
+                    except requests.exceptions.ConnectionError as e:
+                        parser.print_text('ERROR: ' + str(e))
+
+                while True:
+                    parser.read_text('TKS URL',
+                                     config.pki_subsystem,
+                                     'pki_tks_uri')
+                    try:
+                        status = parser.get_server_status('tks', 'pki_tks_uri')
+                        if status == 'running':
+                            break
+                        parser.print_text('ERROR: TKS is not running')
+                    except requests.exceptions.ConnectionError as e:
+                        parser.print_text('ERROR: ' + str(e))
+
+                while True:
+                    keygen = parser.read_text(
+                        'Enable server side key generation (Yes/No)',
+                        options=['Yes', 'Y', 'No', 'N'], default='N',
+                        sign='?', case_sensitive=False).lower()
+
+                    if keygen == 'y' or keygen == 'yes':
+                        parser.set_property(config.pki_subsystem,
+                                            'pki_enable_server_side_keygen',
+                                            'True')
+ 
+                        parser.read_text('KRA URL',
+                                         config.pki_subsystem,
+                                         'pki_kra_uri')
+                        try:
+                            status = parser.get_server_status(
+                                'kra', 'pki_kra_uri')
+                            if status == 'running':
+                                break
+                            parser.print_text('ERROR: KRA is not running')
+                        except requests.exceptions.ConnectionError as e:
+                            parser.print_text('ERROR: ' + str(e))
+                    else:
+                        parser.set_property(config.pki_subsystem,
+                                            'pki_enable_server_side_keygen',
+                                            'False')
+                        break
+
+                print
+
+                print "Authentication Database:"
+
+                while True:
+                    parser.read_text('Hostname',
+                                     config.pki_subsystem,
+                                     'pki_authdb_hostname')
+                    parser.read_text('Port',
+                                     config.pki_subsystem,
+                                     'pki_authdb_port')
+                    basedn = parser.read_text('Base DN', allow_empty=False)
+                    parser.set_property(config.pki_subsystem,
+                                        'pki_authdb_basedn',
+                                        basedn)
+
+                    try:
+                        parser.authdb_connect()
+                        if parser.authdb_base_dn_exists():
+                            break
+                        else:
+                            parser.print_text('ERROR: base DN does not exist')
+
+                    except ldap.LDAPError as e:
+                        parser.print_text('ERROR: ' + e.message['desc'])
+
+                print
+
+        if interactive:
+            parser.indent = 0
+
+            begin = parser.read_text(
+                'Begin installation (Yes/No/Quit)',
+                options=['Yes', 'Y', 'No', 'N', 'Quit', 'Q'],
+                sign='?', allow_empty=False, case_sensitive=False).lower()
+            print
+
+            if begin == 'q' or begin == 'quit':
+                print "Installation canceled."
+                sys.exit(0)
+
+            if begin == 'y' or begin == 'yes':
+                break
+
+        else:
+            break
+
+    if not os.path.exists(config.PKI_DEPLOYMENT_SOURCE_ROOT +
+                          "/" + config.pki_subsystem.lower()):
+        print "ERROR:  " + log.PKI_SUBSYSTEM_NOT_INSTALLED_1 % \
+            config.pki_subsystem.lower()
+        sys.exit(1)
+
+    # Enable 'pkispawn' logging.
+    config.pki_log_dir = config.pki_root_prefix + config.PKI_DEPLOYMENT_LOG_ROOT
+    config.pki_log_name = "pki" + "-" + \
+                          config.pki_subsystem.lower() + \
+                          "-" + "spawn" + "." + \
+                          config.pki_timestamp + "." + "log"
+    rv = pkilogging.enable_pki_logger(config.pki_log_dir,
+                                      config.pki_log_name,
+                                      config.pki_log_level,
+                                      config.pki_console_log_level,
+                                      "pkispawn")
+    if rv != OSError:
+        config.pki_log = rv
+    else:
+        print log.PKI_UNABLE_TO_CREATE_LOG_DIRECTORY_1 % config.pki_log_dir
+        sys.exit(1)
+
+    # Read the specified PKI configuration file.
+    rv = parser.read_pki_configuration_file()
+    if rv != 0:
+        config.pki_log.error(log.PKI_UNABLE_TO_PARSE_1, rv,
+                             extra=config.PKI_INDENTATION_LEVEL_0)
+        sys.exit(1)
+
+    # Read in the PKI slots configuration file.
+    parser.compose_pki_slots_dictionary()
+    config.pki_log.debug(log.PKI_DICTIONARY_SLOTS,
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+    config.pki_log.debug(pkilogging.log_format(parser.slots_dict),
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+
+    # Combine the various sectional dictionaries into a PKI master dictionary
+    parser.compose_pki_master_dictionary()
+
+    parser.mdict['pki_spawn_log'] = \
+        config.pki_log_dir + "/" + config.pki_log_name
+    config.pki_log.debug(log.PKI_DICTIONARY_MASTER,
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+    config.pki_log.debug(pkilogging.log_format(parser.mdict),
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+
+    if not interactive and \
+            not config.str2bool(parser.mdict['pki_skip_configuration']):
+        try:
+            # Verify existence of Directory Server Password
+            if not 'pki_ds_password' in parser.mdict or\
+               not len(parser.mdict['pki_ds_password']):
+                config.pki_log.error(
+                    log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                    "pki_ds_password",
+                    parser.mdict['pki_user_deployment_cfg'],
+                    extra=config.PKI_INDENTATION_LEVEL_0)
+                sys.exit(1)
+
+            parser.ds_verify_configuration()
+
+            if parser.ds_base_dn_exists() and\
+                    not config.str2bool(parser.mdict['pki_ds_remove_data']):
+                print 'ERROR:  Base DN already exists.'
+                sys.exit(1)
+
+        except ldap.LDAPError as e:
+            print 'ERROR:  Unable to access directory server: ' + \
+                  e.message['desc']
+            sys.exit(1)
+
+        if ((config.pki_subsystem == "KRA" or
+             config.pki_subsystem == "OCSP") and
+            not config.str2bool(parser.mdict['pki_standalone'])) or\
+           config.pki_subsystem == "TKS" or\
+           config.pki_subsystem == "TPS" or\
+           config.str2bool(parser.mdict['pki_clone']) or\
+           (config.pki_subsystem == "CA" and
+            config.str2bool(parser.mdict['pki_subordinate'])):
+            try:
+                # Verify existence of Security Domain Password
+                if not 'pki_security_domain_password' in parser.mdict or\
+                   not len(parser.mdict['pki_security_domain_password']):
+                    config.pki_log.error(
+                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
+                        "pki_security_domain_password",
+                        parser.mdict['pki_user_deployment_cfg'],
+                        extra=config.PKI_INDENTATION_LEVEL_0)
+                    sys.exit(1)
+
+                parser.sd_connect()
+                info = parser.sd_get_info()
+                parser.set_property(config.pki_subsystem,
+                                    'pki_security_domain_name',
+                                    info.name)
+                parser.sd_authenticate()
+
+            except requests.exceptions.ConnectionError as e:
+                print('ERROR:  Unable to access security domain: ' + str(e))
+                sys.exit(1)
+
+            except requests.exceptions.HTTPError as e:
+                print('ERROR:  Unable to access security domain: ' + str(e))
+                sys.exit(1)
+
+    print "Installing " + config.pki_subsystem + " into " + \
+          parser.mdict['pki_instance_path'] + "."
+
+    # Process the various "scriptlets" to create the specified PKI subsystem.
+    pki_subsystem_scriptlets = parser.mdict['spawn_scriplets'].split()
+    deployer = util.PKIDeployer(parser.mdict, parser.slots_dict)
+    rv = 0
+    for pki_scriptlet in pki_subsystem_scriptlets:
+        scriptlet = __import__("pki.admin.deployment.scriptlets." +
+                               pki_scriptlet,
+                               fromlist=[pki_scriptlet])
+        instance = scriptlet.PkiScriptlet()
+        try:
+            rv = instance.spawn(deployer)
+        # pylint: disable-msg=W0703
+        except Exception:
+            log_error_details()
+            print
+            print "Installation failed."
+            print
+            sys.exit(1)
+        if rv != 0:
+            print "Nothing here!!!"
+            print "Installation failed."
+            sys.exit(1)
+    config.pki_log.debug(log.PKI_DICTIONARY_MASTER,
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+    config.pki_log.debug(pkilogging.log_format(parser.mdict),
+                         extra=config.PKI_INDENTATION_LEVEL_0)
+
+    print_install_information(parser.mdict)
+
+
+def print_install_information(mdict):
+
+    skip_configuration = config.str2bool(mdict['pki_skip_configuration'])
+    print log.PKI_SPAWN_INFORMATION_HEADER
+    if skip_configuration:
+        print log.PKI_CONFIGURATION_URL_1 % mdict['pki_configuration_url']
+        print log.PKI_CONFIGURATION_RESTART_1 % \
+            mdict['pki_registry_initscript_command']
+    else:
+        print "      Administrator's username:             %s" % \
+              mdict['pki_admin_uid']
+        if os.path.isfile(mdict['pki_client_admin_cert_p12']):
+            print "      Administrator's PKCS #12 file:\n            %s" % \
+                  mdict['pki_client_admin_cert_p12']
+        if not config.str2bool(mdict['pki_client_database_purge']):
+            print
+            print "      Administrator's certificate nickname:\n            %s"\
+                  % mdict['pki_admin_nickname']
+            print "      Administrator's certificate database:\n            %s"\
+                  % mdict['pki_client_database_dir']
+        print log.PKI_CHECK_STATUS_MESSAGE % mdict['pki_instance_name']
+        print log.PKI_INSTANCE_RESTART_MESSAGE % mdict['pki_instance_name']
+        if (((config.pki_subsystem == "KRA" or
+              config.pki_subsystem == "OCSP") and
+            config.str2bool(mdict['pki_standalone'])) and
+            not config.str2bool(mdict['pki_external_step_two'])):
+            # Stand-alone PKI KRA/OCSP (External CA Step 1)
+            print log.PKI_CONFIGURATION_STANDALONE_1 % config.pki_subsystem
+        else:
+            print log.PKI_ACCESS_URL % (mdict['pki_hostname'],
+                                        mdict['pki_https_port'],
+                                        config.pki_subsystem.lower())
+    print log.PKI_SPAWN_INFORMATION_FOOTER
+
+
+def log_error_details():
+
+    e_type, e_value, e_stacktrace = sys.exc_info()
+    config.pki_log.debug(
+        "Error Type: " + e_type.__name__, extra=config.PKI_INDENTATION_LEVEL_2)
+    config.pki_log.debug(
+        "Error Message: " + str(e_value), extra=config.PKI_INDENTATION_LEVEL_2)
+    stacktrace_list = traceback.format_list(traceback.extract_tb(e_stacktrace))
+    e_stacktrace = ""
+    for l in stacktrace_list:
+        e_stacktrace += l
+    config.pki_log.debug(e_stacktrace, extra=config.PKI_INDENTATION_LEVEL_2)
+    sys.exc_clear()
+
+# PKI Deployment Entry Point
+if __name__ == "__main__":
+    signal.signal(signal.SIGINT, interrupt_handler)
+    main(sys.argv)
diff --git a/base/server/CMakeLists.txt b/base/server/CMakeLists.txt
index 01a194a..79436ca 100644
--- a/base/server/CMakeLists.txt
+++ b/base/server/CMakeLists.txt
@@ -111,13 +111,6 @@ install(
         WORLD_EXECUTE WORLD_READ
 )
 
-install(
-    DIRECTORY
-        config
-    DESTINATION
-        ${DATA_INSTALL_DIR}/deployment
-)
-
 # install server files
 install(
     DIRECTORY
@@ -128,14 +121,6 @@ install(
         "lib/*" EXCLUDE
 )
 
-# install server configuration files
-install(
-    DIRECTORY
-        etc/
-    DESTINATION
-        ${SYSCONF_INSTALL_DIR}/pki
-)
-
 # install empty directories
 install(CODE "file(MAKE_DIRECTORY \$ENV{DESTDIR}${VAR_INSTALL_DIR}/lock/pki)")
 install(CODE "file(MAKE_DIRECTORY \$ENV{DESTDIR}${VAR_INSTALL_DIR}/run/pki)")
diff --git a/base/server/config/pkislots.cfg b/base/server/config/pkislots.cfg
deleted file mode 100644
index ce1ac78..0000000
--- a/base/server/config/pkislots.cfg
+++ /dev/null
@@ -1,104 +0,0 @@
-[Apache]
-FORTITUDE_APACHE_SLOT=[FORTITUDE_APACHE]
-FORTITUDE_AUTH_MODULES_SLOT=[FORTITUDE_AUTH_MODULES]
-FORTITUDE_DIR_SLOT=[FORTITUDE_DIR]
-FORTITUDE_LIB_DIR_SLOT=[FORTITUDE_LIB_DIR]
-FORTITUDE_MODULE_SLOT=[FORTITUDE_MODULE]
-FORTITUDE_NSS_MODULES_SLOT=[FORTITUDE_NSS_MODULES]
-HTTPD_CONF_SLOT=[HTTPD_CONF]
-LIB_PREFIX_SLOT=[LIB_PREFIX]
-NON_CLIENTAUTH_SECURE_PORT_SLOT=[NON_CLIENTAUTH_SECURE_PORT]
-NSS_CONF_SLOT=[NSS_CONF]
-OBJ_EXT_SLOT=[OBJ_EXT]
-PKI_INSTANCE_NAME_SLOT=[PKI_INSTANCE_NAME]
-PKI_INSTANCE_INITSCRIPT_SLOT=[PKI_INSTANCE_INITSCRIPT]
-PKI_LOCKDIR_SLOT=[PKI_LOCKDIR]
-PKI_PIDDIR_SLOT=[PKI_PIDDIR]
-PKI_REGISTRY_FILE_SLOT=[PKI_REGISTRY_FILE]
-PKI_WEB_SERVER_TYPE_SLOT=[PKI_WEB_SERVER_TYPE]
-PORT_SLOT=[PORT]
-PROCESS_ID_SLOT=[PROCESS_ID]
-REQUIRE_CFG_PL_SLOT=[REQUIRE_CFG_PL]
-SECURE_PORT_SLOT=[SECURE_PORT]
-SECURITY_LIBRARIES_SLOT=[SECURITY_LIBRARIES]
-PKI_HOSTNAME_SLOT=[PKI_HOSTNAME]
-SERVER_ROOT_SLOT=[SERVER_ROOT]
-SYSTEM_LIBRARIES_SLOT=[SYSTEM_LIBRARIES]
-SYSTEM_USER_LIBRARIES_SLOT=[SYSTEM_USER_LIBRARIES]
-TMP_DIR_SLOT=[TMP_DIR]
-[Tomcat]
-application_version=[APPLICATION_VERSION]
-INSTALL_TIME_SLOT=[INSTALL_TIME]
-PKI_ADMIN_SECURE_PORT_SLOT=[PKI_ADMIN_SECURE_PORT]
-PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME_SLOT=[PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME]
-PKI_ADMIN_SECURE_PORT_SERVER_COMMENT_SLOT=[PKI_ADMIN_SECURE_PORT_SERVER_COMMENT]
-PKI_AGENT_CLIENTAUTH_SLOT=[PKI_AGENT_CLIENTAUTH]
-PKI_AGENT_SECURE_PORT_SLOT=[PKI_AGENT_SECURE_PORT]
-PKI_AJP_PORT_SLOT=[PKI_AJP_PORT]
-PKI_AJP_REDIRECT_PORT_SLOT=[PKI_AJP_REDIRECT_PORT]
-PKI_CA_HOSTNAME_SLOT=[PKI_CA_HOSTNAME]
-PKI_CA_PORT_SLOT=[PKI_CA_PORT]
-PKI_CERT_DB_PASSWORD_SLOT=[PKI_CERT_DB_PASSWORD]
-PKI_CFG_PATH_NAME_SLOT=[PKI_CFG_PATH_NAME]
-PKI_CLOSE_AJP_PORT_COMMENT_SLOT=[PKI_CLOSE_AJP_PORT_COMMENT]
-PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT=[PKI_CLOSE_ENABLE_PROXY_COMMENT]
-PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT_SLOT=[PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT]
-PKI_CLOSE_SEPARATE_PORTS_WEB_COMMENT_SLOT=[PKI_CLOSE_SEPARATE_PORTS_WEB_COMMENT]
-PKI_CLOSE_STANDALONE_COMMENT_SLOT=[PKI_CLOSE_STANDALONE_COMMENT]
-PKI_CLOSE_TOMCAT_ACCESS_LOG_COMMENT_SLOT=[PKI_CLOSE_TOMCAT_ACCESS_LOG_COMMENT]
-PKI_EE_SECURE_CLIENT_AUTH_PORT_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT]
-PKI_EE_SECURE_CLIENT_AUTH_PORT_CONNECTOR_NAME_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT_CONNECTOR_NAME]
-PKI_EE_SECURE_CLIENT_AUTH_PORT_SERVER_COMMENT_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT_SERVER_COMMENT]
-PKI_EE_SECURE_CLIENT_AUTH_PORT_UI_SLOT=[PKI_EE_SECURE_CLIENT_AUTH_PORT_UI]
-PKI_EE_SECURE_PORT_SLOT=[PKI_EE_SECURE_PORT]
-PKI_EE_SECURE_PORT_CONNECTOR_NAME_SLOT=[PKI_EE_SECURE_PORT_CONNECTOR_NAME]
-PKI_EE_SECURE_PORT_SERVER_COMMENT_SLOT=[PKI_EE_SECURE_PORT_SERVER_COMMENT]
-PKI_ENABLE_RANDOM_SERIAL_NUMBERS=[PKI_ENABLE_RANDOM_SERIAL_NUMBERS]
-PKI_GROUP_SLOT=[PKI_GROUP]
-PKI_INSTANCE_NAME_SLOT=[PKI_INSTANCE_NAME]
-PKI_INSTANCE_INITSCRIPT_SLOT=[PKI_INSTANCE_INITSCRIPT]
-PKI_INSTANCE_PATH_SLOT=[PKI_INSTANCE_PATH]
-PKI_INSTANCE_ROOT_SLOT=[PKI_INSTANCE_ROOT]
-PKI_LOCKDIR_SLOT=[PKI_LOCKDIR]
-PKI_HOSTNAME_SLOT=[PKI_HOSTNAME]
-PKI_OPEN_AJP_PORT_COMMENT_SLOT=[PKI_OPEN_AJP_PORT_COMMENT]
-PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT=[PKI_OPEN_ENABLE_PROXY_COMMENT]
-PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT_SLOT=[PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT]
-PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT_SLOT=[PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT]
-PKI_OPEN_STANDALONE_COMMENT_SLOT=[PKI_OPEN_STANDALONE_COMMENT]
-PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT_SLOT=[PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT]
-PKI_PIDDIR_SLOT=[PKI_PIDDIR]
-PKI_PROXY_SECURE_PORT_SLOT=[PKI_PROXY_SECURE_PORT]
-PKI_PROXY_UNSECURE_PORT_SLOT=[PKI_PROXY_UNSECURE_PORT]
-PKI_RANDOM_NUMBER_SLOT=[PKI_RANDOM_NUMBER]
-PKI_REGISTRY_FILE_SLOT=[PKI_REGISTRY_FILE]
-PKI_RESTEASY_LIB_SLOT=[PKI_RESTEASY_LIB]
-PKI_SECURE_PORT_SLOT=[PKI_SECURE_PORT]
-PKI_SECURE_PORT_CONNECTOR_NAME_SLOT=[PKI_SECURE_PORT_CONNECTOR_NAME]
-PKI_SECURE_PORT_SERVER_COMMENT_SLOT=[PKI_SECURE_PORT_SERVER_COMMENT]
-PKI_SECURITY_MANAGER_SLOT=[PKI_SECURITY_MANAGER]
-PKI_SERVER_XML_CONF_SLOT=[PKI_SERVER_XML_CONF]
-PKI_SSL_SERVER_NICKNAME_SLOT=[PKI_SSL_SERVER_NICKNAME]
-PKI_STANDALONE_SLOT=[PKI_STANDALONE]
-PKI_SUBSYSTEM_TYPE_SLOT=[PKI_SUBSYSTEM_TYPE]
-PKI_SYSTEMD_SERVICENAME_SLOT=[PKI_SYSTEMD_SERVICENAME]
-PKI_TMPDIR_SLOT=[PKI_TMPDIR]
-PKI_UNSECURE_PORT_SLOT=[PKI_UNSECURE_PORT]
-PKI_UNSECURE_PORT_CONNECTOR_NAME_SLOT=[PKI_UNSECURE_PORT_CONNECTOR_NAME]
-PKI_UNSECURE_PORT_SERVER_COMMENT_SLOT=[PKI_UNSECURE_PORT_SERVER_COMMENT]
-PKI_USER_SLOT=[PKI_USER]
-PKI_WEB_SERVER_TYPE_SLOT=[PKI_WEB_SERVER_TYPE]
-PKI_WEBAPPS_NAME_SLOT=[PKI_WEBAPPS_NAME]
-TOKENDB_HOST_SLOT=[TOKENDB_HOST]
-TOKENDB_PORT_SLOT={TOKENDB_PORT]
-TOKENDB_ROOT_SLOT=[TOKENDB_ROOT]
-TOMCAT_CFG_SLOT=[TOMCAT_CFG]
-TOMCAT_INSTANCE_COMMON_LIB_SLOT=[TOMCAT_INSTANCE_COMMON_LIB]
-TOMCAT_LOG_DIR_SLOT=[TOMCAT_LOG_DIR]
-TOMCAT_PIDFILE_SLOT=[TOMCAT_PIDFILE]
-TOMCAT_SERVER_PORT_SLOT=[TOMCAT_SERVER_PORT]
-TOMCAT_SSL2_CIPHERS_SLOT=[TOMCAT_SSL2_CIPHERS]
-TOMCAT_SSL3_CIPHERS_SLOT=[TOMCAT_SSL3_CIPHERS]
-TOMCAT_SSL_OPTIONS_SLOT=[TOMCAT_SSL_OPTIONS]
-TOMCAT_TLS_CIPHERS_SLOT=[TOMCAT_TLS_CIPHERS]
-TPS_DIR_SLOT=[TPS_DIR]
diff --git a/base/server/config/sample.cfg b/base/server/config/sample.cfg
deleted file mode 100644
index d2334c7..0000000
--- a/base/server/config/sample.cfg
+++ /dev/null
@@ -1,6 +0,0 @@
-[DEFAULT]
-pki_admin_password=
-pki_client_pkcs12_password=
-pki_ds_password=
-##Required for all subsystems that are not root CAs
-#pki_security_domain_password=
diff --git a/base/server/config/sampleCAclone.cfg b/base/server/config/sampleCAclone.cfg
deleted file mode 100644
index 0aef7b2..0000000
--- a/base/server/config/sampleCAclone.cfg
+++ /dev/null
@@ -1,15 +0,0 @@
-[DEFAULT]
-pki_admin_password=
-pki_client_pkcs12_password=
-pki_ds_password=
-pki_security_domain_password=
-pki_security_domain_hostname=
-pki_security_domain_https_port=
-pki_security_domain_user=
-
-[CA]
-pki_clone=True
-pki_clone_pkcs12_password=
-pki_clone_pkcs12_path=
-pki_clone_replicate_schema=
-pki_clone_uri=
\ No newline at end of file
diff --git a/base/server/config/sampleExternalSignedCA-step1.cfg b/base/server/config/sampleExternalSignedCA-step1.cfg
deleted file mode 100644
index 35b3d24..0000000
--- a/base/server/config/sampleExternalSignedCA-step1.cfg
+++ /dev/null
@@ -1,10 +0,0 @@
-[DEFAULT]
-pki_admin_password=
-pki_client_pkcs12_password=
-pki_ds_password=
-pki_security_domain_password=
-
-[CA]
-pki_external=True
-pki_external_csr_path=
-pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/server/config/sampleExternalSignedCA-step2.cfg b/base/server/config/sampleExternalSignedCA-step2.cfg
deleted file mode 100644
index c106d63..0000000
--- a/base/server/config/sampleExternalSignedCA-step2.cfg
+++ /dev/null
@@ -1,12 +0,0 @@
-[DEFAULT]
-pki_admin_password=
-pki_client_pkcs12_password=
-pki_ds_password=
-pki_security_domain_password=
-
-[CA]
-pki_external=True
-pki_external_ca_cert_chain_path=
-pki_external_ca_cert_path=
-pki_external_step_two=True
-pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/server/config/sampleKRA.cfg b/base/server/config/sampleKRA.cfg
deleted file mode 100644
index 8cdfb9f..0000000
--- a/base/server/config/sampleKRA.cfg
+++ /dev/null
@@ -1,12 +0,0 @@
-[DEFAULT]
-pki_admin_password=
-pki_client_pkcs12_password=
-pki_ds_password=
-pki_security_domain_password=
-pki_security_domain_hostname=
-pki_security_domain_https_port=
-pki_security_domain_user=
-pki_issuing_ca_uri=
-
-[KRA]
-pki_import_admin_cert=
\ No newline at end of file
diff --git a/base/server/config/sampleKRAclone.cfg b/base/server/config/sampleKRAclone.cfg
deleted file mode 100644
index 96025cf..0000000
--- a/base/server/config/sampleKRAclone.cfg
+++ /dev/null
@@ -1,16 +0,0 @@
-[DEFAULT]
-pki_admin_password=
-pki_client_pkcs12_password=
-pki_ds_password=
-pki_security_domain_password=
-pki_security_domain_hostname=
-pki_security_domain_https_port=
-pki_security_domain_user=
-
-[KRA]
-pki_clone=True
-pki_clone_pkcs12_password=
-pki_clone_pkcs12_path=
-pki_clone_replicate_schema=
-pki_clone_uri=
-pki_issuing_ca=
\ No newline at end of file
diff --git a/base/server/config/sampleSubordinateCA.cfg b/base/server/config/sampleSubordinateCA.cfg
deleted file mode 100644
index 8b61616..0000000
--- a/base/server/config/sampleSubordinateCA.cfg
+++ /dev/null
@@ -1,13 +0,0 @@
-[DEFAULT]
-pki_admin_password=
-pki_client_pkcs12_password=
-pki_ds_password=
-pki_security_domain_password=
-pki_security_domain_hostname=
-pki_security_domain_https_port=
-pki_security_domain_user=
-
-[CA]
-pki_subordinate=True
-pki_issuing_ca=
-pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/server/etc/default.cfg b/base/server/etc/default.cfg
deleted file mode 100644
index 7ecbf10..0000000
--- a/base/server/etc/default.cfg
+++ /dev/null
@@ -1,619 +0,0 @@
-###############################################################################
-##  Default Configuration:                                                   ##
-##                                                                           ##
-##  Values in this section are common to more than one PKI subsystem, and    ##
-##  contain required information which MAY be overridden by users as         ##
-##  necessary.                                                               ##
-##                                                                           ##
-##  There are also some meta-parameters that determine how the PKI           ##
-##  configuratiion should work.                                              ##
-##                                                                           ##
-###############################################################################
-[DEFAULT]
-
-# The sensitive_parameters contains a list of parameters which may contain
-# sensitive information which must not be displayed to the console nor stored
-# in log files for security reasons.
-sensitive_parameters=
-    pki_admin_password
-    pki_backup_password
-    pki_client_database_password
-    pki_client_pin
-    pki_client_pkcs12_password
-    pki_clone_pkcs12_password
-    pki_ds_password
-    pki_one_time_pin
-    pki_pin
-    pki_security_domain_password
-    pki_token_password
-
-# The spawn_scriplets contains a list of scriplets to be executed by pkispawn.
-spawn_scriplets=
-    initialization
-    infrastructure_layout
-    instance_layout
-    subsystem_layout
-    selinux_setup
-    webapp_deployment
-    slot_substitution
-    security_databases
-    configuration
-    finalization
-
-# The destroy_scriplets contains a list of scriplets to be executed by pkidestroy.
-destroy_scriplets=
-    initialization
-    configuration
-    webapp_deployment
-    subsystem_layout
-    security_databases
-    instance_layout
-    selinux_setup
-    infrastructure_layout
-    finalization
-
-# By default, the following parameters will be set for Tomcat and Apache instances.
-# There is no reason to uncomment these.  They are provided for reference in 
-# case someone wants to override them in their config file.
-#
-# Tomcat instances:
-# pki_instance_name=pki-tomcat
-# pki_https_port=8443
-# pki_http_port=8080
-#
-# Apache instances:
-# pki_instance_name=pki-apache
-# pki_https_port=443
-# pki_http_port=80
-
-pki_admin_cert_file=%(pki_client_dir)s/ca_admin.cert
-pki_admin_cert_request_type=pkcs10
-pki_admin_dualkey=False
-pki_admin_keysize=2048
-pki_admin_password=
-pki_audit_group=pkiaudit
-pki_audit_signing_key_algorithm=SHA256withRSA
-pki_audit_signing_key_size=2048
-pki_audit_signing_key_type=rsa
-pki_audit_signing_signing_algorithm=SHA256withRSA
-pki_audit_signing_token=Internal Key Storage Token
-pki_backup_keys=False
-pki_backup_password=
-pki_ca_hostname=%(pki_security_domain_hostname)s
-pki_ca_port=%(pki_security_domain_https_port)s
-pki_client_admin_cert_p12=%(pki_client_dir)s/%(pki_subsystem_type)s_admin_cert.p12
-pki_client_database_password=
-pki_client_database_purge=True
-pki_client_dir=%(home_dir)s/.dogtag/%(pki_instance_name)s
-pki_client_pkcs12_password=
-pki_ds_bind_dn=cn=Directory Manager
-pki_ds_create_new_db=True
-pki_ds_ldap_port=389
-pki_ds_ldaps_port=636
-pki_ds_password=
-pki_ds_remove_data=True
-pki_ds_secure_connection=False
-pki_group=pkiuser
-pki_issuing_ca_hostname=%(pki_security_domain_hostname)s
-pki_issuing_ca_https_port=%(pki_security_domain_https_port)s
-pki_issuing_ca_uri=https://%(pki_issuing_ca_hostname)s:%(pki_issuing_ca_https_port)s
-pki_issuing_ca=%(pki_issuing_ca_uri)s
-pki_restart_configured_instance=True
-pki_security_domain_hostname=%(pki_hostname)s
-pki_security_domain_https_port=8443
-pki_security_domain_name=%(pki_dns_domainname)s Security Domain
-pki_security_domain_password=
-pki_security_domain_user=caadmin
-pki_skip_configuration=False
-pki_skip_installation=False
-pki_ssl_server_key_algorithm=SHA256withRSA
-pki_ssl_server_key_size=2048
-pki_ssl_server_key_type=rsa
-pki_ssl_server_nickname=Server-Cert cert-%(pki_instance_name)s
-pki_ssl_server_subject_dn=cn=%(pki_hostname)s,o=%(pki_security_domain_name)s
-pki_ssl_server_token=Internal Key Storage Token
-pki_subsystem_key_algorithm=SHA256withRSA
-pki_subsystem_key_size=2048
-pki_subsystem_key_type=rsa
-pki_subsystem_nickname=subsystemCert cert-%(pki_instance_name)s
-pki_subsystem_subject_dn=cn=Subsystem Certificate,o=%(pki_security_domain_name)s
-pki_subsystem_token=Internal Key Storage Token
-pki_theme_enable=True
-pki_theme_server_dir=/usr/share/pki/common-ui
-pki_token_name=internal
-pki_token_password=
-pki_user=pkiuser
-
-# Paths:
-# These are used in the processing of pkispawn and are not supposed
-# to be overwritten by user configuration files.
-#
-pki_client_database_dir=%(pki_client_subsystem_dir)s/alias
-pki_client_subsystem_dir=%(pki_client_dir)s/%(pki_subsystem_type)s
-pki_client_password_conf=%(pki_client_subsystem_dir)s/password.conf
-pki_client_pkcs12_password_conf=%(pki_client_subsystem_dir)s/pkcs12_password.conf
-pki_client_cert_database=%(pki_client_database_dir)s/cert8.db
-pki_client_key_database=%(pki_client_database_dir)s/key3.db
-pki_client_secmod_database=%(pki_client_database_dir)s/secmod.db
-pki_client_admin_cert=%(pki_client_dir)s/%(pki_subsystem_type)s_admin.cert
-pki_source_conf_path=/usr/share/pki/%(pki_subsystem_type)s/conf
-pki_source_setup_path=/usr/share/pki/setup
-pki_source_server_path=/usr/share/pki/server/conf
-pki_source_cs_cfg=/usr/share/pki/%(pki_subsystem_type)s/conf/CS.cfg
-pki_source_registry=/usr/share/pki/setup/pkidaemon_registry
-pki_source_subsystem_path=/usr/share/pki/%(pki_subsystem_type)s
-pki_path=%(pki_root_prefix)s/var/lib/pki
-pki_log_path=%(pki_root_prefix)s/var/log/pki
-pki_configuration_path=%(pki_root_prefix)s/etc/pki
-pki_registry_path=%(pki_root_prefix)s/etc/sysconfig/pki
-pki_instance_path=%(pki_path)s/%(pki_instance_name)s
-pki_instance_log_path=%(pki_log_path)s/%(pki_instance_name)s
-pki_instance_configuration_path=%(pki_configuration_path)s/%(pki_instance_name)s
-pki_database_path=%(pki_instance_configuration_path)s/alias
-pki_instance_database_link=%(pki_instance_path)s/alias
-pki_instance_conf_link=%(pki_instance_path)s/conf
-pki_instance_logs_link=%(pki_instance_path)s/logs
-pki_subsystem_path=%(pki_instance_path)s/%(pki_subsystem_type)s
-pki_subsystem_log_path=%(pki_instance_log_path)s/%(pki_subsystem_type)s
-pki_subsystem_archive_log_path=%(pki_subsystem_log_path)s/archive
-pki_subsystem_configuration_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s
-pki_subsystem_database_link=%(pki_subsystem_path)s/alias
-pki_subsystem_conf_link=%(pki_subsystem_path)s/conf
-pki_subsystem_logs_link=%(pki_subsystem_path)s/logs
-pki_subsystem_registry_link=%(pki_subsystem_path)s/registry
-
- 
-###############################################################################
-##  Apache Configuration:                                                    ##
-##                                                                           ##
-##  Values in this section are common to PKI subsystems that run             ##
-##  as an instance of 'Apache' (RA and TPS subsystems), and contain          ##
-##  required information which MAY be overridden by users as necessary.      ##
-###############################################################################
-[Apache]
-
-# Paths
-# These are used in the processing of pkispawn and are not supposed
-# to be overwritten by user configuration files.
-#
-pki_systemd_service=/lib/systemd/system/pki-apached@.service
-pki_systemd_target=/lib/systemd/system/pki-apached.target
-pki_systemd_target_wants=/etc/systemd/system/pki-apached.target.wants
-pki_systemd_service_link=%(pki_systemd_target_wants)s/pki-apached@%(pki_instance_name)s.service
-pki_cgroup_systemd_service_path=/sys/fs/cgroup/systemd/system/%(pki_systemd_service)s
-pki_cgroup_systemd_service=%(pki_cgroup_systemd_service_path)s/%(pki_instance_name)s
-pki_cgroup_cpu_systemd_service_path=/sys/fs/cgroup/cpu\,cpuacct/system/%(pki_systemd_service)s
-pki_cgroup_cpu_systemd_service=%(pki_cgroup_cpu_systemd_service_path)s/%(pki_systemd_service)s
-pki_instance_type=Apache
-pki_instance_type_registry_path =%(pki_registry_path)s/apache
-pki_instance_registry_path=%(pki_instance_type_registry_path)s/%(pki_instance_name)s
-pki_subsystem_registry_path=%(pki_instance_registry_path)s/%(pki_subsystem_type)s
-
-###############################################################################
-##  Tomcat Configuration:                                                    ##
-##                                                                           ##
-##  Values in this section are common to PKI subsystems that run             ##
-##  as an instance of 'Tomcat' (CA, KRA, OCSP, TKS, and TPS subsystems       ##
-##  including 'Clones', 'Subordinate CAs', and 'External CAs'), and contain  ##
-##  required information which MAY be overridden by users as necessary.      ##
-##                                                                           ##
-##  PKI CLONES:  To specify a 'CA Clone', a 'KRA Clone', an 'OCSP Clone',    ##
-##               a 'TKS Clone', or a 'TPS Clone', change the value of        ##
-##               'pki_clone' from 'False' to 'True'.                         ##
-##                                                                           ##
-##    REMINDER:  PKI CA Clones, Subordinate CAs, and External CAs            ##
-##               are MUTUALLY EXCLUSIVE entities!!!                          ##
-###############################################################################
-[Tomcat]
-pki_ajp_port=8009
-pki_clone=False
-pki_clone_pkcs12_password=
-pki_clone_pkcs12_path=
-pki_clone_replicate_schema=True
-pki_clone_replication_master_port=
-pki_clone_replication_clone_port=
-pki_clone_replication_security=None
-pki_clone_setup_replication=True
-pki_clone_uri=
-pki_enable_access_log=True
-pki_enable_java_debugger=False
-pki_enable_proxy=False
-pki_proxy_http_port=80
-pki_proxy_https_port=443
-pki_security_manager=true
-pki_tomcat_server_port=8005
-
-# Paths
-# These are used in the processing of pkispawn and are not supposed
-# to be overwritten by user configuration files.
-#
-pki_systemd_service=/lib/systemd/system/pki-tomcatd@.service
-pki_systemd_target=/lib/systemd/system/pki-tomcatd.target
-pki_systemd_target_wants=/etc/systemd/system/pki-tomcatd.target.wants
-pki_systemd_service_link=%(pki_systemd_target_wants)s/pki-tomcatd@%(pki_instance_name)s.service
-pki_cgroup_systemd_service_path=/sys/fs/cgroup/systemd/system/%(pki_systemd_service)s
-pki_cgroup_systemd_service=%(pki_cgroup_systemd_service_path)s/%(pki_instance_name)s
-pki_cgroup_cpu_systemd_service_path=/sys/fs/cgroup/cpu\,cpuacct/system/%(pki_systemd_service)s
-pki_cgroup_cpu_systemd_service=%(pki_cgroup_cpu_systemd_service_path)s/%(pki_systemd_service)s
-pki_tomcat_bin_path=/usr/share/tomcat/bin
-pki_tomcat_lib_path=/usr/share/tomcat/lib
-pki_tomcat_systemd=/usr/sbin/tomcat
-pki_source_catalina_properties=%(pki_source_server_path)s/catalina.properties
-pki_source_servercertnick_conf=%(pki_source_server_path)s/serverCertNick.conf
-pki_source_server_xml=%(pki_source_server_path)s/server.xml
-pki_source_context_xml=%(pki_source_server_path)s/context.xml
-pki_source_tomcat_conf=%(pki_source_server_path)s/tomcat.conf
-pki_instance_type=Tomcat
-pki_tomcat_common_path=%(pki_instance_path)s/common
-pki_tomcat_common_lib_path=%(pki_tomcat_common_path)s/lib
-pki_tomcat_tmpdir_path=%(pki_instance_path)s/temp
-pki_tomcat_webapps_path=%(pki_instance_path)s/webapps
-pki_tomcat_work_path=%(pki_instance_path)s/work
-pki_tomcat_work_catalina_path=%(pki_tomcat_work_path)s/Catalina
-pki_tomcat_work_catalina_host_path=%(pki_tomcat_work_catalina_path)s/localhost
-pki_tomcat_work_catalina_host_run_path=%(pki_tomcat_work_catalina_host_path)s/_
-pki_tomcat_work_catalina_host_subsystem_path=%(pki_tomcat_work_catalina_host_path)s/%(pki_subsystem_type)s
-pki_instance_conf_log4j_properties=%(pki_instance_configuration_path)s/log4j.properties
-pki_instance_type_registry_path=%(pki_registry_path)s/tomcat
-pki_instance_registry_path=%(pki_instance_type_registry_path)s/%(pki_instance_name)s
-pki_subsystem_registry_path=%(pki_instance_registry_path)s/%(pki_subsystem_type)s
-pki_tomcat_bin_link=%(pki_instance_path)s/bin
-pki_instance_lib=%(pki_instance_path)s/lib
-pki_instance_lib_log4j_properties=%(pki_instance_lib)s/log4j.properties
-pki_instance_systemd_link=%(pki_instance_path)s/%(pki_instance_name)s
-pki_subsystem_signed_audit_log_path=%(pki_subsystem_log_path)s/signedAudit
-pki_subsystem_tomcat_webapps_link=%(pki_subsystem_path)s/webapps
-pki_tomcat_webapps_subsystem_path=%(pki_tomcat_webapps_path)s/%(pki_subsystem_type)s
-pki_tomcat_webapps_subsystem_webinf_classes_path=%(pki_tomcat_webapps_subsystem_path)s/WEB-INF/classes
-pki_tomcat_webapps_subsystem_webinf_lib_path=%(pki_tomcat_webapps_subsystem_path)s/WEB-INF/lib
-pki_certsrv_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-certsrv.jar
-pki_cmsbundle_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cmsbundle.jar
-pki_cmscore_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cmscore.jar
-pki_cms_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cms.jar
-pki_cmsutil_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-cmsutil.jar
-pki_nsutil_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-nsutil.jar
-
-
-# JAR paths
-# These are used in the processing of pkispawn and are not supposed
-# to be overwritten by user configuration files
-pki_jss_jar=%(jni_jar_dir)s/jss4.jar
-pki_symkey_jar=%(jni_jar_dir)s/symkey.jar
-pki_apache_commons_collections_jar=/usr/share/java/apache-commons-collections.jar
-pki_apache_commons_io_jar=/usr/share/java/apache-commons-io.jar
-pki_apache_commons_lang_jar=/usr/share/java/apache-commons-lang.jar
-pki_apache_commons_logging_jar=/usr/share/java/apache-commons-logging.jar
-pki_commons_codec_jar=/usr/share/java/commons-codec.jar
-pki_httpclient_jar=/usr/share/java/httpcomponents/httpclient.jar
-pki_httpcore_jar=/usr/share/java/httpcomponents/httpcore.jar
-pki_javassist_jar=/usr/share/java/javassist.jar
-pki_ldapjdk_jar=/usr/share/java/ldapjdk.jar
-pki_certsrv_jar=/usr/share/java/pki/pki-certsrv.jar
-pki_cmsbundle=/usr/share/java/pki/pki-cmsbundle.jar
-pki_cmscore=/usr/share/java/pki/pki-cmscore.jar
-pki_cms=/usr/share/java/pki/pki-cms.jar
-pki_cmsutil=/usr/share/java/pki/pki-cmsutil.jar
-pki_nsutil=/usr/share/java/pki/pki-nsutil.jar
-pki_tomcat_jar=/usr/share/java/pki/pki-tomcat.jar
-pki_scannotation_jar=/usr/share/java/scannotation.jar
-pki_tomcatjss_jar=/usr/share/java/tomcatjss.jar
-pki_velocity_jar=/usr/share/java/velocity.jar
-pki_xerces_j2_jar=/usr/share/java/xerces-j2.jar
-pki_xml_commons_apis_jar=/usr/share/java/xml-commons-apis.jar
-pki_xml_commons_resolver_jar=/usr/share/java/xml-commons-resolver.jar
-pki_jss_jar_link=%(pki_tomcat_common_lib_path)s/jss4.jar
-pki_symkey_jar_link=%(pki_tomcat_common_lib_path)s/symkey.jar
-pki_apache_commons_collections_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-collections.jar
-pki_apache_commons_io_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-io.jar
-pki_apache_commons_lang_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-lang.jar
-pki_apache_commons_logging_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-logging.jar
-pki_commons_codec_jar_link=%(pki_tomcat_common_lib_path)s/apache-commons-codec.jar
-pki_httpclient_jar_link=%(pki_tomcat_common_lib_path)s/httpclient.jar
-pki_httpcore_jar_link=%(pki_tomcat_common_lib_path)s/httpcore.jar
-pki_javassist_jar_link=%(pki_tomcat_common_lib_path)s/javassist.jar
-pki_ldapjdk_jar_link=%(pki_tomcat_common_lib_path)s/ldapjdk.jar
-pki_tomcat_jar_link=%(pki_tomcat_common_lib_path)s/pki-tomcat.jar
-pki_scannotation_jar_link=%(pki_tomcat_common_lib_path)s/scannotation.jar
-pki_tomcatjss_jar_link=%(pki_tomcat_common_lib_path)s/tomcatjss.jar
-pki_velocity_jar_link=%(pki_tomcat_common_lib_path)s/velocity.jar
-pki_xerces_j2_jar_link=%(pki_tomcat_common_lib_path)s/xerces-j2.jar
-pki_xml_commons_apis_jar_link=%(pki_tomcat_common_lib_path)s/xml-commons-apis.jar
-pki_xml_commons_resolver_jar_link=%(pki_tomcat_common_lib_path)s/xml-commons-resolver.jar
-pki_ca_jar=/usr/share/java/pki/pki-ca.jar
-pki_ca_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-ca.jar
-pki_kra_jar=/usr/share/java/pki/pki-kra.jar
-pki_kra_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-kra.jar
-pki_ocsp_jar=/usr/share/java/pki/pki-ocsp.jar
-pki_ocsp_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-ocsp.jar
-pki_tks_jar=/usr/share/java/pki/pki-tks.jar
-pki_tks_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-tks.jar
-pki_tps_jar=/usr/share/java/pki/pki-tps.jar
-pki_tps_jar_link=%(pki_tomcat_webapps_subsystem_webinf_lib_path)s/pki-tps.jar
-
-# Jackson
-pki_jackson_annotations_jar=/usr/share/java/jackson-annotations.jar
-pki_jackson_core_asl_jar=/usr/share/java/jackson/jackson-core-asl.jar
-pki_jackson_core_jar=/usr/share/java/jackson-core.jar
-pki_jackson_databind_jar=/usr/share/java/jackson-databind.jar
-pki_jackson_jaxrs_base_jar=/usr/share/java/jackson-jaxrs-providers/jackson-jaxrs-base.jar
-pki_jackson_jaxrs_jar=/usr/share/java/jackson/jackson-jaxrs.jar
-pki_jackson_jaxrs_json_provider_jar=/usr/share/java/jackson-jaxrs-providers/jackson-jaxrs-json-provider.jar
-pki_jackson_mapper_asl_jar=/usr/share/java/jackson/jackson-mapper-asl.jar
-pki_jackson_module_jaxb_annotations_jar=/usr/share/java/jackson-module-jaxb-annotations.jar
-pki_jackson_mrbean_jar=/usr/share/java/jackson/jackson-mrbean.jar
-pki_jackson_smile_jar=/usr/share/java/jackson/jackson-smile.jar
-pki_jackson_xc_jar=/usr/share/java/jackson/jackson-xc.jar
-
-# RESTEasy
-pki_resteasy_atom_provider_jar=%(resteasy_lib)s/resteasy-atom-provider.jar
-pki_resteasy_client_jar=%(resteasy_lib)s/resteasy-client.jar
-pki_resteasy_jaxb_provider_jar=%(resteasy_lib)s/resteasy-jaxb-provider.jar
-pki_resteasy_jaxrs_api_jar=%(resteasy_lib)s/jaxrs-api.jar
-pki_resteasy_jaxrs_jar=%(resteasy_lib)s/resteasy-jaxrs.jar
-pki_resteasy_jackson_provider_jar=%(resteasy_lib)s/resteasy-jackson-provider.jar
-
-
-###############################################################################
-##  CA Configuration:                                                        ##
-##                                                                           ##
-##  Values in this section are common to CA subsystems including 'PKI CAs',  ##
-##  'Cloned CAs', 'Subordinate CAs', and 'External CAs', and contain         ##
-##  required information which MAY be overridden by users as necessary.      ##
-##                                                                           ##
-##     EXTERNAL CAs:  To specify an 'External CA', change the value          ##
-##                    of 'pki_external' from 'False' to 'True'.              ##
-##                                                                           ##
-##  SUBORDINATE CAs:  To specify a 'Subordinate CA', change the value        ##
-##                    of 'pki_subordinate' from 'False' to 'True'.           ##
-##                                                                           ##
-##         REMINDER:  PKI CA Clones, Subordinate CAs, and External CAs       ##
-##                    are MUTUALLY EXCLUSIVE entities!!!                     ##
-###############################################################################
-[CA]
-pki_ca_signing_key_algorithm=SHA256withRSA
-pki_ca_signing_key_size=2048
-pki_ca_signing_key_type=rsa
-pki_ca_signing_nickname=caSigningCert cert-%(pki_instance_name)s CA
-pki_ca_signing_signing_algorithm=SHA256withRSA
-pki_ca_signing_subject_dn=cn=CA Signing Certificate,o=%(pki_security_domain_name)s
-pki_ca_signing_token=Internal Key Storage Token
-pki_external=False
-pki_external_csr_path=%(pki_instance_configuration_path)s/ca_signing.csr
-pki_external_step_two=False
-pki_external_ca_cert_chain_path=%(pki_instance_configuration_path)s/external_ca_chain.cert
-pki_external_ca_cert_path=%(pki_instance_configuration_path)s/external_ca.cert
-pki_import_admin_cert=False
-pki_ocsp_signing_key_algorithm=SHA256withRSA
-pki_ocsp_signing_key_size=2048
-pki_ocsp_signing_key_type=rsa
-pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s CA
-pki_ocsp_signing_signing_algorithm=SHA256withRSA
-pki_ocsp_signing_subject_dn=cn=CA OCSP Signing Certificate,o=%(pki_security_domain_name)s
-pki_ocsp_signing_token=Internal Key Storage Token
-pki_random_serial_numbers_enable=False
-pki_subordinate=False
-pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
-pki_admin_name=%(pki_admin_uid)s
-pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
-pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
-pki_admin_uid=caadmin
-pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s CA
-pki_audit_signing_subject_dn=cn=CA Audit Signing Certificate,o=%(pki_security_domain_name)s
-pki_ds_base_dn=o=%(pki_instance_name)s-CA
-pki_ds_database=%(pki_instance_name)s-CA
-pki_ds_hostname=%(pki_hostname)s
-pki_subsystem_name=CA %(pki_hostname)s %(pki_https_port)s
-pki_share_db=False
-
-# Paths
-# These are used in the processing of pkispawn and are not supposed
-# to be overwritten by user configuration files.
-#
-pki_source_emails=/usr/share/pki/ca/emails
-pki_source_flatfile_txt=%(pki_source_conf_path)s/flatfile.txt
-pki_source_profiles=/usr/share/pki/ca/profiles
-pki_source_proxy_conf=%(pki_source_conf_path)s/proxy.conf
-pki_source_registry_cfg=%(pki_source_conf_path)s/registry.cfg
-pki_source_admincert_profile=%(pki_source_conf_path)s/adminCert.profile
-pki_source_caauditsigningcert_profile=%(pki_source_conf_path)s/caAuditSigningCert.profile
-pki_source_cacert_profile=%(pki_source_conf_path)s/caCert.profile
-pki_source_caocspcert_profile=%(pki_source_conf_path)s/caOCSPCert.profile
-pki_source_servercert_profile=%(pki_source_conf_path)s/serverCert.profile
-pki_source_subsystemcert_profile=%(pki_source_conf_path)s/subsystemCert.profile
-pki_subsystem_emails_path=%(pki_subsystem_path)s/emails
-pki_subsystem_profiles_path=%(pki_subsystem_path)s/profiles
-
-
-
-
-###############################################################################
-##  KRA Configuration:                                                       ##
-##                                                                           ##
-##  Values in this section are common to KRA subsystems                      ##
-##  including 'PKI KRAs', 'Cloned KRAs', and 'Stand-alone KRAs' and contain  ##
-##  required information which MAY be overridden by users as necessary.      ##
-##                                                                           ##
-##      STAND-ALONE KRAs:  To specify a 'Stand-alone KRA', change the value  ##
-##                         of 'pki_standalone' from 'False' to 'True', and   ##
-##                         specify the various 'pki_external' parameters     ##
-##                         as appropriate.                                   ##
-##                                                                           ##
-###############################################################################
-[KRA]
-pki_import_admin_cert=True
-pki_standalone=False
-pki_external_admin_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.csr
-pki_external_audit_signing_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.csr
-pki_external_sslserver_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.csr
-pki_external_storage_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_storage.csr
-pki_external_subsystem_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.csr
-pki_external_transport_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_transport.csr
-pki_external_step_two=False
-pki_external_ca_cert_chain_path=%(pki_instance_configuration_path)s/external_ca_chain.cert
-pki_external_ca_cert_path=%(pki_instance_configuration_path)s/external_ca.cert
-pki_external_admin_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.cert
-pki_external_audit_signing_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.cert
-pki_external_sslserver_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.cert
-pki_external_storage_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_storage.cert
-pki_external_subsystem_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.cert
-pki_external_transport_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_transport.cert
-pki_storage_key_algorithm=SHA256withRSA
-pki_storage_key_size=2048
-pki_storage_key_type=rsa
-pki_storage_nickname=storageCert cert-%(pki_instance_name)s KRA
-pki_storage_signing_algorithm=SHA256withRSA
-pki_storage_subject_dn=cn=DRM Storage Certificate,o=%(pki_security_domain_name)s
-pki_storage_token=Internal Key Storage Token
-pki_transport_key_algorithm=SHA256withRSA
-pki_transport_key_size=2048
-pki_transport_key_type=rsa
-pki_transport_nickname=transportCert cert-%(pki_instance_name)s KRA
-pki_transport_signing_algorithm=SHA256withRSA
-pki_transport_subject_dn=cn=DRM Transport Certificate,o=%(pki_security_domain_name)s
-pki_transport_token=Internal Key Storage Token
-pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
-pki_admin_name=%(pki_admin_uid)s
-pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
-pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
-pki_admin_uid=kraadmin
-pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s KRA
-pki_audit_signing_subject_dn=cn=KRA Audit Signing Certificate,o=%(pki_security_domain_name)s
-pki_ds_base_dn=o=%(pki_instance_name)s-KRA
-pki_ds_database=%(pki_instance_name)s-KRA
-pki_ds_hostname=%(pki_hostname)s
-pki_subsystem_name=KRA %(pki_hostname)s %(pki_https_port)s
-pki_share_db=True
-pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=%(pki_instance_name)s-CA
-
-
-# Paths
-# These are used in the processing of pkispawn and are not supposed
-# to be overwritten by user configuration files.
-#
-pki_source_servercert_profile=%(pki_source_conf_path)s/serverCert.profile
-pki_source_storagecert_profile=%(pki_source_conf_path)s/storageCert.profile
-pki_source_subsystemcert_profile=%(pki_source_conf_path)s/subsystemCert.profile
-pki_source_transportcert_profile=%(pki_source_conf_path)s/transportCert.profile
-
-###############################################################################
-##  OCSP Configuration:                                                      ##
-##                                                                           ##
-##  Values in this section are common to OCSP subsystems                     ##
-##  including 'PKI OCSPs', 'Cloned OCSPs', and 'Stand-alone OCSPs' and       ##
-##  contain required information which MAY be overridden by users as         ##
-##  necessary.                                                               ##
-##                                                                           ##
-##      STAND-ALONE OCSPs:  To specify a 'Stand-alone OCSP', change the      ##
-##                          value of 'pki_standalone' from 'False' to        ##
-##                          'True', and specify the various 'pki_external'   ##
-##                          parameters as appropriate.                       ##
-##                          (NOTE:  Stand-alone OCSP is not yet supported!)  ##
-##                                                                           ##
-###############################################################################
-[OCSP]
-pki_import_admin_cert=True
-pki_standalone=False
-pki_external_admin_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.csr
-pki_external_audit_signing_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.csr
-pki_external_signing_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_signing.csr
-pki_external_sslserver_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.csr
-pki_external_subsystem_csr_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.csr
-pki_external_step_two=False
-pki_external_ca_cert_chain_path=%(pki_instance_configuration_path)s/external_ca_chain.cert
-pki_external_ca_cert_path=%(pki_instance_configuration_path)s/external_ca.cert
-pki_external_admin_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.cert
-pki_external_audit_signing_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.cert
-pki_external_signing_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_signing.cert
-pki_external_sslserver_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.cert
-pki_external_subsystem_cert_path=%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.cert
-pki_ocsp_signing_key_algorithm=SHA256withRSA
-pki_ocsp_signing_key_size=2048
-pki_ocsp_signing_key_type=rsa
-pki_ocsp_signing_nickname=ocspSigningCert cert-%(pki_instance_name)s OCSP
-pki_ocsp_signing_signing_algorithm=SHA256withRSA
-pki_ocsp_signing_subject_dn=cn=OCSP Signing Certificate,o=%(pki_security_domain_name)s
-pki_ocsp_signing_token=Internal Key Storage Token
-pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
-pki_admin_name=%(pki_admin_uid)s
-pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
-pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
-pki_admin_uid=ocspadmin
-pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s OCSP
-pki_audit_signing_subject_dn=cn=OCSP Audit Signing Certificate,o=%(pki_security_domain_name)s
-pki_ds_base_dn=o=%(pki_instance_name)s-OCSP
-pki_ds_database=%(pki_instance_name)s-OCSP
-pki_ds_hostname=%(pki_hostname)s
-pki_subsystem_name=OCSP %(pki_hostname)s %(pki_https_port)s
-pki_share_db=True
-pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=%(pki_instance_name)s-CA
-
-
-###############################################################################
-##  RA Configuration:                                                        ##
-##                                                                           ##
-##  Values in this section are common to PKI RA subsystems, and contain      ##
-##  required information which MAY be overridden by users as necessary.      ##
-###############################################################################
-[RA]
-
-###############################################################################
-##  TKS Configuration:                                                       ##
-##                                                                           ##
-##  Values in this section are common to TKS subsystems                      ##
-##  including 'PKI TKSs' and 'Cloned TKSs', and contain                      ##
-##  required information which MAY be overridden by users as necessary.      ##
-###############################################################################
-[TKS]
-pki_import_admin_cert=True
-pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
-pki_admin_name=%(pki_admin_uid)s
-pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
-pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
-pki_admin_uid=tksadmin
-pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s TKS
-pki_audit_signing_subject_dn=cn=TKS Audit Signing Certificate,o=%(pki_security_domain_name)s
-pki_ds_base_dn=o=%(pki_instance_name)s-TKS
-pki_ds_database=%(pki_instance_name)s-TKS
-pki_ds_hostname=%(pki_hostname)s
-pki_subsystem_name=TKS %(pki_hostname)s %(pki_https_port)s
-pki_share_db=True
-pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=%(pki_instance_name)s-CA
-
-###############################################################################
-##  TPS Configuration:                                                       ##
-##                                                                           ##
-##  Values in this section are common to PKI TPS subsystems, and contain     ##
-##  required information which MAY be overridden by users as necessary.      ##
-###############################################################################
-[TPS]
-pki_import_admin_cert=True
-pki_admin_email=%(pki_admin_name)s@%(pki_dns_domainname)s
-pki_admin_name=%(pki_admin_uid)s
-pki_admin_nickname=PKI Administrator for %(pki_dns_domainname)s
-pki_admin_subject_dn=cn=PKI Administrator,e=%(pki_admin_email)s,o=%(pki_security_domain_name)s
-pki_admin_uid=tpsadmin
-pki_audit_signing_nickname=auditSigningCert cert-%(pki_instance_name)s TPS
-pki_audit_signing_subject_dn=cn=TPS Audit Signing Certificate,o=%(pki_security_domain_name)s
-pki_ds_base_dn=o=%(pki_instance_name)s-TPS
-pki_ds_database=%(pki_instance_name)s-TPS
-pki_ds_hostname=%(pki_hostname)s
-pki_subsystem_name=TPS %(pki_hostname)s %(pki_https_port)s
-pki_authdb_hostname=%(pki_hostname)s
-pki_authdb_port=389
-pki_authdb_secure_conn=False
-pki_ca_uri=https://%(pki_hostname)s:%(pki_https_port)s
-pki_kra_uri=https://%(pki_hostname)s:%(pki_https_port)s
-pki_tks_uri=https://%(pki_hostname)s:%(pki_https_port)s
-pki_enable_server_side_keygen=False
-pki_import_shared_secret=False
-pki_share_db=True
-pki_share_dbuser_dn=uid=pkidbuser,ou=people,o=%(pki_instance_name)s-CA
-pki_source_phone_home_xml=/usr/share/pki/%(pki_subsystem_type)s/conf/phoneHome.xml
-pki_source_registry_cfg=%(pki_source_conf_path)s/registry.cfg
-
-# Paths
-# These are used in the processing of pkispawn and are not supposed
-# to be overwritten by user configuration files.
-#
-pki_subsystem_signed_audit_log_path=%(pki_subsystem_log_path)s/signedAudit
-
diff --git a/base/server/man/man5/pki_default.cfg.5 b/base/server/man/man5/pki_default.cfg.5
deleted file mode 100644
index 040eb1b..0000000
--- a/base/server/man/man5/pki_default.cfg.5
+++ /dev/null
@@ -1,348 +0,0 @@
-.\" First parameter, NAME, should be all caps
-.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
-.\" other parameters are allowed: see man(7), man(1)
-.TH pki_default.cfg 5 "December 13, 2012" "version 1.0" "PKI Default Instance Configuration" Ade Lee
-.\" Please adjust this date whenever revising the man page.
-.\"
-.\" Some roff macros, for reference:
-.\" .nh        disable hyphenation
-.\" .hy        enable hyphenation
-.\" .ad l      left justify
-.\" .ad b      justify to both left and right margins
-.\" .nf        disable filling
-.\" .fi        enable filling
-.\" .br        insert line break
-.\" .sp <n>    insert n+1 empty lines
-.\" for man page specific macros, see man(7)
-.SH NAME
-pki_default.cfg \- Certificate Server instance default config file.
-
-.SH LOCATION
-/etc/pki/default.cfg
-
-.SH DESCRIPTION
-This file contains the default settings for a Certificate Server instance created using \fBpkispawn\fP.  This file should not be edited, as it can be modified when the Certificate Server packages are updated.  Rather, when setting up a Certificate Server instance, a user-provided configuration file can provide overrides to the defaults in /etc/pki/default.cfg.  See \fBpkispawn(8)\fR for details.
-
-.SH SECTIONS
-\fIdefault.cfg\fP is divided into subsystem-based sections ([DEFAULT] for general configuration and subsystem-type sections such as [CA] and [KRA]).  These sections are stacked, so that parameters read in earlier sections can be overwritten by parameters in later sections.  For the Java subsystems (CA, KRA, OCSP, and TKS), the sections read are [DEFAULT], [Tomcat] and the subsystem type section -- [CA], [KRA], [OCSP], and [TKS] -- in that order.  This allows the ability to specify parameters to be shared by all subsystems in [DEFAULT] or [Tomcat], and subsystem-specific upgrades in the other sections.
-.PP
-There are a small number of bootstrap parameters which are passed in the configuration file by \fBpkispawn\fP. Other parameter's values can be interpolated tokens rather than explicit values. For example:
-.PP
-\fBpki_ca_signing_nickname=caSigningCert cert-%(pki_instance_name)s CA\fP
-.PP
-This substitutes the value of pki_instance_name into the parameter value.  It is possible to interpolate any non-password parameter within a section or in [DEFAULT]. Any parameter used in interpolation can \fBONLY\fP be overridden within the same section.  So, for example, pki_instance_name should only be overridden in [DEFAULT]; otherwise, interpolations can fail.
-.TP
-\fBNote:\fP
-Any non-password related parameter values in the configuration file that needs to contain a \fB%\fP character must be properly escaped.  For example, a value of \fBfoo%bar\fP would be specified as \fBfoo%%bar\fP in the configuration file.
-
-.SH GENERAL INSTANCE PARAMETERS
-The parameters described below, as well as the parameters located in the following sections, can be customized as part of a deployment.  This list is not exhaustive.
-.TP
-.B pki_instance_name
-.IP
-Name of the instance. The instance is located at /var/lib/pki/<instance_name>.  For Java subsystems, the default is specified as pki-tomcat.
-.TP
-.B pki_https_port, pki_http_port
-.IP
-Secure and unsecure ports.  Defaults to standard Tomcat ports 8443 and 8080, respectively, for Java subsystems, and 443 and 80 for Apache subsystems.
-.TP
-.B pki_ajp_port, pki_tomcat_server_port
-.IP
-Ports for Tomcat subsystems.  Defaults to standard Tomcat ports of 8009 and 8005, respectively.
-.TP
-.B pki_proxy_http_port, pki_proxy_https_port, pki_enable_proxy
-.IP
-Ports for an Apache proxy server. Certificate Server instances can be run behind an Apache proxy server, which will communicate with the Tomcat instance through the AJP port.  See the Red Hat Certificate System documentation at https://access.redhat.com/knowledge/docs/Red_Hat_Certificate_System/ for details.
-.TP
-.B pki_user, pki_group, pki_audit_group
-.IP
-Specifies the default administrative user, group, and auditor group identities for PKI instances.  The default user and group are both specified as \fBpkiuser\fR, and the default audit group is specified as \fBpkiaudit\fR.
-.TP
-.B pki_token_name, pki_token_password
-.IP
-The token and password where this instance's system certificate and keys are stored.  Defaults to the NSS internal software token.
-
-.SS SYSTEM CERTIFICATE PARAMETERS
-\fBpkispawn\fP sets up a number of system certificates for each subsystem.  The system certificates which are required differ between subsystems.  Each system certificate is denoted by a tag, as noted below.  The different system certificates are:
-.IP
-* signing certificate ("signing").  Used to sign other certificates.  Required for CA.
-.IP
-* OCSP signing certificate ("ocsp_signing" in CA, "signing" in OCSP).  Used to sign CRLs.  Required for OCSP and CA.
-.IP
-* storage certificate ("storage").  Used to encrypt keys for storage in KRA.  Required for KRA only.
-.IP
-* transport certificate ("transport").  Used to encrypt keys in transport to the KRA.  Required for KRA only.
-.IP
-* subsystem certificate ("subsystem").  Used to communicate between subsystems within the security domain.  Issued by the security domain CA.  Required for all subsystems.
-.IP
-* server certificate ("sslserver").  Used for communication with the server.  One server certificate is required for each Certificate Server instance.
-.IP
-* audit signing certificate ("audit_signing").  Used to sign audit logs.  Required for all subsystems except the RA.
-.PP
-Each system certificate can be customized using the parameters below:
-.TP
-.B pki_<tag>_key_type, pki_<type>_keysize, pki_<tag>_key_algorithm
-.IP
-Characteristics of the private key. See the Red Hat Certificate System documentation at https://access.redhat.com/knowledge/docs/Red_Hat_Certificate_System/ for possible options.  The defaults are RSA for the type, 2048 bits for the key size, and SHA256withRSA for the algorithm.
-.TP 
-.B pki_<tag>_signing_algorithm
-.IP
-For signing certificates, the algorithm used for signing.  Defaults to SHA256withRSA.
-.TP
-.B pki_<tag>_token
-.IP
-Location where the certificate and private key are stored.  Defaults to the internal software NSS token database.
-.TP
-.B pki_<tag>_nickname
-.IP
-Nickname for the certificate in the token database.
-.TP
-.B pki_<tag>_subject_dn
-.IP
-Subject DN for the certificate.  The subject DN for the SSL Server certificate must include CN=<hostname>.
-.SS ADMIN USER PARAMETERS
-\fBpkispawn\fP creates a bootstrap administrative user that is a member of all the necessary groups to administer the installed subsystem.  On a security domain CA, the CA administrative user is also a member of the groups required to register a new subsystem on the security domain.  The certificate and keys for this administrative user are stored in a PKCS #12 file in \fBpki_client_dir\fP, and can be imported into a browser to administer the system.
-.TP
-.B pki_admin_name, pki_admin_uid
-.IP
-Name and UID of this administrative user.  Defaults to caadmin for CA, kraadmin for KRA, etc.
-.TP
-.B pki_admin_password
-.IP
-Password for the admin user.  This password is used to log into the pki-console (unless client authentication is enabled), as well as log into the security domain CA.
-.TP
-.B pki_admin_email
-.IP
-Email address for the admin user.
-.TP
-.B pki_admin_dualkey, pki_admin_keysize, pki_admin_keytype
-.IP
-Settings for the administrator certificate and keys.
-.TP
-.B pki_admin_subject_dn
-.IP
-Subject DN for the administrator certificate.  Defaults to \fBcn=PKI Administrator, e=%(pki_admin_email)s, o=%(pki_security_domain_name)s\fP.
-.TP
-.B pki_admin_nickname
-Nickname for the administrator certificate.
-.TP
-.B pki_import_admin_cert
-.IP
-Set to True to import an existing admin certificate for the admin user, rather than generating a new one.  A subsystem-specific administrator will still be created within the subsystem's LDAP tree.  This is useful to allow multiple subsystems within the same instance to be more easily administered from the same browser by using a single certificate.
-
-By default, this is set to False for CA subsystems and true for KRA, OCSP, and TKS subsystems.  In this case, the admin certificate is read from the file ca_admin.cert in \fBpki_client_dir\fP.
-
-Note that cloned subsystems do not create a new administrative user.  The administrative user of the master subsystem is used instead, and the details of this master user are replicated during the install.
-.TP
-.B pki_client_admin_cert_p12
-.IP
-Location for the PKCS #12 file containing the administrative user's certificate and keys.  For a CA, this defaults to \fIca_admin_cert.p12\fP in the \fBpki_client_dir\fP directory.
-.SS BACKUP PARAMETERS
-.TP
-.B pki_backup_keys, pki_backup_password
-.IP
-Set to True to back up the subsystem certificates and keys to a PKCS #12 file.  This file will be located in \fI/var/lib/pki/<instance_name>/alias\fP.  pki_backup_password is the password of the PKCS#12 file.
-  
-.SS CLIENT DIRECTORY PARAMETERS
-.TP
-.B pki_client_dir
-.IP
-This is the location where all client data used during the installation is stored.  At the end of the invocation of \fBpkispawn\fP, the administrative user's certificate and keys are stored in a PKCS #12 file in this location.
-.TP
-.B pki_client_database_dir,  pki_client_database_password
-.IP
-Location where an NSS token database is created in order to generate a key for the administrative user.  Usually, the data in this location is removed at the end of the installation, as the keys and certificates are stored in a PKCS #12 file in \fBpki_client_dir\fP.
-.TP
-.B pki_client_database_purge
-.IP
-Set to True to remove \fBpki_client_database_dir\fP at the end of the installation.  Defaults to True.
-.SS INTERNAL DATABASE PARAMETERS
-\x'-1'\fBpki_ds_hostname, pki_ds_ldap_port, pki_ds_ldaps_port\fR
-.IP
-Hostname and ports for the internal database.  Defaults to localhost, 389, and 636, respectively.
-.PP
-.B pki_ds_bind_dn, pki_ds_password
-.IP
-Credentials to connect to the database during installation.  Directory Manager-level access is required during installation to set up the relevant schema and database.  During the installation, a more restricted Certificate Server user is set up to client authentication connections to the database.  Some additional configuration is required, including setting up the directory server to use SSL.  See the documentation for details. 
-.PP
-.B pki_ds_secure_connection
-.IP
-Sets whether to require connections to the Directory Server using LDAPS.  This requires SSL to be set up on the Directory Server first.  Defaults to false.
-.PP
-.B pki_ds_remove_data
-.IP
-Sets whether to remove any data from the base DN before starting the installation.  Defaults to True.
-.PP
-.B pki_ds_base_dn
-.IP
-The base DN for the internal database.  It is advised that the Certificate Server have its own base DN for its internal database.  If the base DN does not exist, it will be created during the running of \fBpkispawn\fP.  For a cloned subsystem, the base DN for the clone subsystem MUST be the same as for the master subsystem.
-.PP
-.B pki_ds_database
-.IP
-Name of the back-end database.  It is advised that the Certificate Server have its own base DN for its internal database.  If the back-end does not exist, it will be created during the running of \fBpkispawn\fP.
-.SS ISSUING CA PARAMETERS
-\x'-1'\fBpki_issuing_ca_hostname, pki_issuing_ca_https_port, pki_issuing_ca_uri\fR
-.IP
-Hostname and port, or URI of the issuing CA.  Required for installations of subordinate CA and non-CA subsystems.  This should point to the CA that will issue the relevant system certificates for the subsystem.  In a default install, this defaults to the CA subsystem within the same instance.  The URI has the format https://<ca_hostname>:<ca_https_port>.
-
-.SS MISCELLANEOUS PARAMETERS
-\x'-1'\fBpki_restart_configured_instance\fR
-.IP
-Sets whether to restart the instance after configuration is complete.  Defaults to True.
-.PP
-.B pki_skip_configuration
-.IP
-Sets whether to execute the configuration steps when running \fBpkispawn\fP.  If this is true, then the process is analogous to running \fBpkicreate\fP, when the configuration was performed separately from the instance creation.  A configuration URL will be provided.  This URL can be used as a starting point for the browser-based configuration panels.  Defaults to False.
-.PP
-.B pki_skip_installation
-.IP
-Sets whether to skip the installation steps.  With pki_skip_configuration set to False, this is analogous to running pkisilent.  Defaults to False.
-.PP
-.B pki_enable_access_log
-.IP
-Located in the [Tomcat] section, this variable determines whether the instance will enable (True) or disable (False) Tomcat access logging.  Defaults to True.
-.PP
-.B pki_enable_java_debugger
-.IP
-Sets whether to attach a Java debugger such as Eclipse to the instance for troubleshooting.  Defaults to False.
-.PP
-.B pki_security_manager
-.IP
-Enables the Java security manager policies provided by the JDK to be used with the instance.  Defaults to True.
-.PP
-.SS SECURITY DOMAIN PARAMETERS
-The security domain is a component that facilitates communication between subsystems.  The first CA installed hosts this component and is used to register subsequent subsystems with the security domain.  These subsystems can communicate with each other using their subsystem certificate, which is issued by the security domain CA.  For more information about the security domain component, see the Red Hat Certificate System documentation at https://access.redhat.com/knowledge/docs/Red_Hat_Certificate_System/.
-.TP
-.B pki_security_domain_hostname, pki_security_domain_https_port
-.IP
-Location of the security domain.  Required for KRA, OCSP, and TKS subsystems and for CA subsystems joining a security domain.  Defaults to the location of the CA subsystem within the same instance.
-.TP
-.B pki_security_domain_user, pki_security_domain_password
-.IP
-Administrative user of the security domain.  Required for KRA, OCSP, and TKS subsystems, and for CA subsystems joining a security domain.  Defaults to the administrative user for the CA subsystem within the same instance (caadmin).
-.TP
-.B pki_security_domain_name
-.IP
-The name of the security domain. This is required for the security domain CA.
-
-.SS CLONE PARAMETERS
-.TP
-.B pki_clone
-.IP
-Installs a clone, rather than original, subsystem.
-.TP
-.B pki_clone_pkcs12_password, pki_clone_pkcs12_path
-.IP
-Location and password of the PKCS #12 file containing the system certificates for the master subsystem being cloned.  This file should be readable by the user that the Certificate Server is running as (default of pkiuser), and have the correct selinux context (pki_tomcat_cert_t).  This can be achieved by placing the file in \fI/var/lib/pki/<instance_name>/alias\fP.
-.TP
-.B pki_clone_replication_master_port, pki_clone_replication_clone_port
-.IP
-Ports on which replication occurs.  These are the ports on the master and clone databases respectively.  Defaults to the internal database port. 
-.TP
-.B pki_clone_repicate_schema
-.IP
-Replicate schema when the replication agreement is set up and the new instance (consumer) is initialized.  Otherwise, the schema must be installed in the clone as a separate step beforehand.  This does not usually have to be changed.  Defaults to True.
-.TP
-.B pki_clone_replication_security
-.IP
-The type of security used for the replication data.  This can be set to SSL (using LDAPS), TLS, or None.  Defaults to None.  For SSL and TLS, SSL must be set up for the database instances beforehand.
-.TP
-.B pki_clone_uri
-.IP
-A pointer to the subsystem being cloned.  The format is https://<master_hostname>:<master_https_port>.
-
-.SS EXTERNAL CA CERTIFICATE PARAMETERS
-\x'-1'\fBpki_external\fR
-.IP
-Sets whether the new CA will have a signing certificate that will be issued by an external CA.  This is a two step process.  In the first step, a CSR to be presented to the external CA is generated.  In the second step, the issued signing certificate and certificate chain are provided to the \fBpkispawn\fP utility to complete the installation.  Defaults to False.
-.PP
-.B pki_external_csr_path
-.IP
-Required in the first step of the external CA signing process.  The CSR will be printed to the screen and stored in this location.
-.PP
-.B pki_external_step_two
-.IP
-Specifies that this is the second step of the external CA process.  Defaults to False.
-.PP
-.B pki_external_ca_cert_path, pki_external_ca_cert_chain_path
-.IP
-Required for the second step of the external CA signing process.  This is the location of the CA signing cert (as issued by the external CA) and the external CA's certificate chain.
-.SS SUBORDINATE CA CERTIFICATE PARAMETERS
-\x'-1'\fBpki_subordinate\fR
-.IP
-Specifies whether the new CA which will be a subordinate of another CA.  The master CA is specified by \fBpki_issuing_ca\fP.  Defaults to False.
-.SS STANDALONE PKI PARAMETERS
-A stand-alone PKI subsystem is defined as a non-CA PKI subsystem that does not contain a CA as a part of its deployment, and functions as its own security domain.  Currently, only stand-alone DRMs are supported.
-.TP
-.B pki_standalone
-.IP
-Sets whether or not the new PKI subsystem will be stand-alone.  This is a two step process.  In the first step, CSRs for each of this stand-alone PKI subsystem's certificates will be generated so that they may be presented to the external CA.  In the second step, the issued certificates, external CA certificate, and external CA certificate chain are provided to the \fBpkispawn\fP utility to complete the installation.  Defaults to False.
-.PP
-.B pki_external_admin_csr_path
-.IP
-Will be generated by the first step of a stand-alone PKI process.  This is the location of the file containing the administrator's CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.csr'.
-.PP
-.B pki_external_audit_signing_csr_path
-.IP
-Will be generated by the first step of a stand-alone PKI process.  This is the location of the file containing the audit signing CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.csr'.
-.PP
-.B pki_external_sslserver_csr_path
-.IP
-Will be generated by the first step of a stand-alone PKI process.  This is the location of the file containing the SSL server CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.csr'.
-.PP
-.B pki_external_storage_csr_path
-.IP
-[DRM ONLY] Will be generated by the first step of a stand-alone DRM process.  This is the location of the file containing the storage CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/kra_storage.csr'.
-.PP
-.B pki_external_subsystem_csr_path
-.IP
-Will be generated by the first step of a stand-alone PKI process.  This is the location of the file containing the subsystem CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.csr'.
-.PP
-.B pki_external_transport_csr_path
-.IP
-[DRM ONLY] Will be generated by the first step of a stand-alone DRM process.  This is the location of the file containing the transport CSR (which will be presented to the external CA).  Defaults to '%(pki_instance_configuration_path)s/kra_transport.csr'.
-.PP
-.B pki_external_step_two
-.IP
-Specifies that this is the second step of a standalone PKI process.  Defaults to False.
-.PP
-.B pki_external_ca_cert_chain_path
-.IP
-Required for the second step of a stand-alone PKI process.  This is the location of the file containing the external CA signing certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/external_ca.cert'.
-.PP
-.B pki_external_ca_cert_path
-.IP
-Required for the second step of a stand-alone PKI process.  This is the location of the file containing the external CA's certificate chain (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/external_ca_chain.cert'.
-.PP
-.B pki_external_admin_cert_path
-.IP
-Required for the second step of a stand-alone PKI process.  This is the location of the file containing the administrator's certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_admin.cert'.
-.PP
-.B pki_external_audit_signing_cert_path
-.IP
-Required for the second step of a stand-alone PKI process.  This is the location of the file containing the audit signing certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_audit_signing.cert'.
-.PP
-.B pki_external_sslserver_cert_path
-.IP
-Required for the second step of a stand-alone PKI process.  This is the location of the file containing the sslserver certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_sslserver.cert'.
-.PP
-.B pki_external_storage_cert_path
-.IP
-[DRM ONLY] Required for the second step of a stand-alone DRM process.  This is the location of the file containing the storage certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/kra_storage.cert'.
-.PP
-.B pki_external_subsystem_cert_path
-.IP
-Required for the second step of a stand-alone PKI process.  This is the location of the file containing the subsystem certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/%(pki_subsystem_type)s_subsystem.cert'.
-.PP
-.B pki_external_transport_cert_path
-.IP
-[DRM ONLY] Required for the second step of a stand-alone DRM process.  This is the location of the file containing the transport certificate (as issued by the external CA).  Defaults to '%(pki_instance_configuration_path)s/kra_transport.cert'.
-
-.SH AUTHORS
-Ade Lee <alee@redhat.com>.  \fBpkispawn\fP was written by the Dogtag project.
-
-.SH COPYRIGHT
-Copyright (c) 2012 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
-
-.SH SEE ALSO
-.BR pkispawn(8)
diff --git a/base/server/man/man8/pkidestroy.8 b/base/server/man/man8/pkidestroy.8
deleted file mode 100644
index 407a915..0000000
--- a/base/server/man/man8/pkidestroy.8
+++ /dev/null
@@ -1,67 +0,0 @@
-.\" First parameter, NAME, should be all caps
-.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
-.\" other parameters are allowed: see man(7), man(1)
-.TH pkidestroy 8 "December 13, 2012" "version 1.0" "PKI Instance Removal Utility" Ade Lee
-.\" Please adjust this date whenever revising the man page.
-.\"
-.\" Some roff macros, for reference:
-.\" .nh        disable hyphenation
-.\" .hy        enable hyphenation
-.\" .ad l      left justify
-.\" .ad b      justify to both left and right margins
-.\" .nf        disable filling
-.\" .fi        enable filling
-.\" .br        insert line break
-.\" .sp <n>    insert n+1 empty lines
-.\" for man page specific macros, see man(7)
-.SH NAME
-pkidestroy \- Removes a subsystem from an instance of Certificate Server.
-
-.SH SYNOPSIS
-pkidestroy -s <subsystem> -i <instance> [-u <secutiry domain username>] [-W <security domain password file>] [-h] [-v] [-p <prefix>]
-
-.SH DESCRIPTION
-Removes a subsystem from an instance of Certificate Server.  This utility removes any of the Java-based Certificate Server subsystems (CA, KRA, OCSP, and TKS).
-.PP
-.TP
-\fBNote:\fP 
-This utility is only used for Java-based subsystems. The Apache-based Certificate Server subsystems (RA and TPS) are removed using \fBpkiremove\fP.
-.PP
-An instance can contain multiple subsystems, although it may contain at most one of each type of subsystem.  So, for example, an instance could contain CA and KRA subsystems,  but not two CA subsystems.  If \fBpkidestroy\fP is invoked on the last subsystem in the instance, then that instance is removed.  Typically, as subsystems need to contact the CA to update the security domain, the CA instance should be the last instance to be removed.
-
-.SH OPTIONS
-.TP
-.B -s <subsystem>
-Specifies the subsystem to be removed, where <subsystem> is CA, KRA, OCSP, or TKS. If this option is not specified, \fBpkidestroy\fP
-will prompt for its value.
-.TP
-.B -i <instance>
-Specifies the name of the instance from which the subsystem should be removed.  The instance is located at /var/log/pki/<instance>. If this option is not specified, \fBpkidestroy\fP
-will prompt for its value.
-.TP
-.B -u <security domain username> 
-Specifies the username of the security domain of the subsystem. This is an \fBoptional\fP parameter.
-.TP
-.B -W <security domain password file> 
-Specifies the file containing the password of the security domain of the subsystem. This is an \fBoptional\fP parameter. 
-.TP
-.B -h, --help
-Prints additional help information.
-.TP
-.B -v
-Displays verbose information about the installation.  This flag can be provided multiple times to increase verbosity.  See
-.B pkidestroy -h 
-for details.
-
-
-.SH BUGS
-Report bugs to http://bugzilla.redhat.com.
-
-.SH AUTHORS
-Ade Lee <alee@redhat.com>.  \fBpkidestroy\fP was written by the Certificate Server project.
-
-.SH COPYRIGHT
-Copyright (c) 2012 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
-
-.SH SEE ALSO
-.BR pkispawn(8)
diff --git a/base/server/man/man8/pkispawn.8 b/base/server/man/man8/pkispawn.8
deleted file mode 100644
index ebed2cb..0000000
--- a/base/server/man/man8/pkispawn.8
+++ /dev/null
@@ -1,460 +0,0 @@
-.\" First parameter, NAME, should be all caps
-.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
-.\" other parameters are allowed: see man(7), man(1)
-.TH pkispawn 8 "December 13, 2012" "version 1.0" "PKI Instance Creation Utility" Ade Lee
-.\" Please adjust this date whenever revising the man page.
-.\"
-.\" Some roff macros, for reference:
-.\" .nh        disable hyphenation
-.\" .hy        enable hyphenation
-.\" .ad l      left justify
-.\" .ad b      justify to both left and right margins
-.\" .nf        disable filling
-.\" .fi        enable filling
-.\" .br        insert line break
-.\" .sp <n>    insert n+1 empty lines
-.\" for man page specific macros, see man(7)
-.SH NAME
-pkispawn \- Sets up an instance of Certificate Server.
-
-.SH SYNOPSIS
-pkispawn -s <subsystem> -f <config_file> [-h] [-v] [-p <prefix>]
-
-.SH DESCRIPTION
-Sets up an instance of Certificate Server.  This utility creates any of the Java-based Certificate Server subsystems (CA, KRA, OCSP, and TKS). 
-.TP
-\fBNote:\fP 
-A 389 Directory Server instance must be configured and running before this script can be run. Certificate Server requires an internal directory database. The default configuration assumes a Directory Server instance running on the same machine on port 389.  For more information on creating a Directory Server instance, see
-.B setup-ds.pl(8).
-.TP
-\fBNote:\fP 
-This utility creates only Java-based subsystems. The Apache-based Certificate Server subsystems (RA and TPS) are created using \fBpkicreate\fP. 
-.PP
-An instance can contain multiple subsystems, although it may contain at most one of each type of subsystem on a single machine.  So, for example, an instance could contain CA and KRA subsystems,  but not two CA subsystems.  To create an instance with a CA and a KRA, simply run pkispawn twice, with values 
-.I -s CA 
-and 
-.I -s KRA 
-respectively.
-.PP
-The instances are created based on values for configuration parameters in the default configuration (/etc/pki/default.cfg) and the user-provided configuration file.  The user-provided configuration file is read after the default configuration file, so any parameters defined in that file will override parameters in the default configuration file.  In general, most users will store only those parameters which are different from the default configuration in their user-provided configuration file.
-.PP
-This configuration file contains directives that are divided into sections for different subsystem types (such as [DEFAULT], [CA], and [KRA]).  These sections are stacked, so that parameters read in earlier sections can be overwritten by parameters in later sections.  For the Java subsystems (CA, KRA, OCSP and TKS), the sections read are [DEFAULT], [Tomcat] and the subsystem-type section ([CA], [KRA], [OCSP], or [TKS]), in that order.  This allows the ability to specify parameters to be shared by all subsystems in [DEFAULT] or [Tomcat], and system-specific upgrades in the [CA], [KRA], and other sections.
-.TP
-\fBNote:\fP
-Any non-password related parameter values in the configuration file that needs to contain a \fB%\fP character must be properly escaped.  For example, a value of \fBfoo%bar\fP would be specified as \fBfoo%%bar\fP in the configuration file.
-.PP
-At a minimum, the user-defined configuration file must provide some passwords needed for the install.  An example configuration file is provided in the 
-.B EXAMPLES
-section below.  For more information on the default configuration file and the parameters it contains (and can be customized), see
-.B pki_default.cfg(5).
-.PP
-The \fBpkispawn\fP run creates several different installation files that can be referenced later, if need be:
-.IP
-* For Tomcat-based instances, a Tomcat instance is created at \fT/var/lib/pki/<pki_instance_name>\fP, where pki_instance_name is defined in the configuration file.  
-.IP
-* A log file of \fBpkispawn\fP operations is written to \fI/var/log/pki/pki-<subsystem>-spawn.<timestamp>.log\fP.  
-.IP
-* A .p12 (PKCS #12) file containing a certificate for a subsystem administrator is stored in pki_client_dir. 
-.PP
-When the utility is done running, the CA can be accessed by pointing a browser to https://<hostname>:<pki_https_port>/. The agent pages can be accessed by importing the CA certificate and administrator certificate into the browser. 
-.PP
-The Certificate Server instance can also be accessed using the \fBpki\fP command line interface.  See 
-\fBpki(1)\fP. For more extensive documentation on how to use Certificate Server features, see the Red Hat Certificate System Documentation at https://access.redhat.com/knowledge/docs/Red_Hat_Certificate_System/.
-.PP
-Instances created using \fBpkispawn\fP can be removed using \fBpkidestroy\fP.  See
-.BR pkidestroy(8).
-.PP
-\fBpkispawn\fP supersedes and combines the functionality of \fBpkicreate\fP and \fBpkisilent\fP, which were available in earlier releases of Certificate Server.  It is now possible to completely create and configure the Certificate Server subsystem in a single step using \fBpkispawn\fP.
- 
-.PP
-Although \fBpkispawn\fP can be used to install and configure an instance in a single invocation, it can also still be directed to split this work into separate 'installation' and 'configuration' tasks (e. g. - to support an organization's policy where 'installation' and 'configuration' tasks must be fulfilled by separate roles).
-
-.PP
-To run \fBpkispawn\fP for instance installation only, leave the configuration parameter \fBpki_skip_installation\fP set to False (the default), and set the configuration parameter \fBpki_skip_configuration\fP to True. This instance must then be configured using either a \fBpkispawn\fP command line interface (CLI) configuration, or a browser-based (GUI) configuration.
-
-.PP
-To configure an instance using the CLI-based configuration, set the configuration parameter \fBpki_skip_installation\fP to True, leave the configuration parameter \fBpki_skip_configuration\fP to False (the default), and run \fBpkispawn\fP for configuration only.
-
-.PP
-To configure an instance using the GUI-based configuration, launch a browser, input the configuration URL located inside the \fI/var/log/pki/pki-<subsystem>-spawn.<timestamp>.log\fP file, and fill-in the desired/required information for each panel.  The final panel will instruct the user to restart the server.
-
-.TP
-\fBNote:\fP 
-CLI-based configuration and GUI-based configuration go through different code. There is additional code in the CLI-based configuration to support instances that contain more than one subsystem; the GUI-based configuration does not contain this code.  Consequently, GUI-based configuration must not be used to configure a PKI instance which contains more than one subsystem.
-
-.SH OPTIONS
-.TP
-.B -s <subsystem>
-Specifies the subsystem to be installed and configured, where <subsystem> is CA, KRA, OCSP, or TKS.
-.TP
-.B -f <config_file>
-Specifies the path to the user-defined configuration file.  This file contains differences between the default configuration and the custom configuration.
-.TP
-.B -h, --help
-Prints additional help information.
-.TP
-.B -v
-Displays verbose information about the installation.  This flag can be provided multiple times to increase verbosity.  See
-.B pkispawn -h 
-for details.
-
-.SH INTERACTIVE MODE
-.PP
-If no options are specified, pkispawn will provide an interactive menu to collect the parameters needed to install
-the Certificate Server instance.  Note that only the most basic installation options are provided.  This includes root CAs,
-KRAs, OCSPs and TKS, connecting to the LDAP port of a directory server.  More complicated setups such as: cloned subsystems, subordinate or externally signed CAs, subsystems that connect to the directory server using LDAPS, and subsystems that are customized beyond the options described below -  require the use of a configuration file with the
--f option.
-.PP
-The interactive option is most useful for those users getting familiar with Certificate Server.  The parameters collected are
-written to the installation file of the subsystem, which can be found at \fB/etc/sysconfig/pki/tomcat/<instance name>/<subsystem>/deployment.cfg.\fP
-.PP
-The following parameters are queried interactively during the installation process:
-.PP
-\fBSubsystem Type\fP
-.TP
-\fISubsystem (CA/KRA/OCSP/TKS):\fP
-the type of subsystem to be installed. Prompted when the -s option is not specified.  The default value chosen is CA.
-.PP
-\fBInstance Specific Parameters\fP
-.TP
-\fIInstance name:\fP
-the name of the tomcat instance in which the subsystem is to be installed. The default value is pki-tomcat.
-.br
-\fBNote:\fP Only one subsystem of a given type (CA, KRA, OCSP, TKS) can exist within a given instance.
-.TP
-\fIHTTP port:\fP
-the HTTP port of the Tomcat instance. The default value is 8080.
-.TP
-\fISecure HTTP port:\fP
-the HTTPS port of the Tomcat instance. The default value is 8443.
-.TP
-\fIAJP port:\fP
-the AJP port of the Tomcat instance. The default value is 8009.
-.TP
-\fIManagement port:\fP
-the management port of the Tomcat instance. The default value is 8005.
-.PP
-\fBAdministrative User Parameters\f
-.TP
-\fIUsername:\fP
-the username of the administrator of this subsystem. The default value is <ca/kra/tks/ocsp>admin.
-.TP
-\fIPassword:\fP
-password for the administrator user.
-.TP
-\fIImport certificate:\fP
-An optional parameter that can be used to import an already available CA admin certificate into this instance.
-.TP
-\fIExport certificate:\fP
-setup the path where the admin certificate of this <subsystem> should be stored. The default value is /root/.dogtag/pki-tomcat/<ca/kra/tks/ocsp>_admin.cert.
-.PP
-\fBDirectory Server Parameters\f
-.TP
-\fIHostname:\fP
-Hostname of the directory server instance.  The default value is the hostname of the system.
-.TP
-\fIPort:\fP
-Port for the directory server instance. The default value is 389.
-.TP
-\fIBase DN:\fP
-the Base DN to be used for the internal database for this subsystem. The default value is o=pki-tomcat-<subsystem>.
-.TP
-\fIBind DN:\fP
-the bind DN required to connect for the directory server. This user must have sufficient permissions to install the required schema and database.  The default value is cn=Directory Manager.
-.TP
-\fIPassword:\fP
-password for the bind DN.
-.PP
-\fBSecurity Domain Parameters\f
-.TP
-\fIName:\fP
-the name of the security domain. Required only if installing a root CA. Default value: <DNS domain name> Security Domain.
-.TP
-\fIHostname:\fP
-the hostname for the security domain CA. Required only for non-CA subsystems. The default value is the hostname of this system.
-.TP
-\fISecure HTTP port:\fP
-the https port for the security domain. Required only for non-CA subsystems. The default value is 8443.
-.TP
-\fIUsername:\fP
-the username of the security domain administrator of the CA. Required only for non-CA subsystems. The default value is caadmin.
-.TP
-\fIPassword:\fP
-password for the security domain administrator. Required for all subsystems that are not root CAs.
-
-.SH EXAMPLES
-.SS CA using default configuration
-\x'-1'\fBpkispawn -s CA -f myconfig.txt\fR
-.PP
-where \fImyconfig.txt\fP contains the following text:
-.IP
-.nf
-[DEFAULT]
-pki_admin_password=\fIpassword123\fP
-pki_client_pkcs12_password=\fIpassword123\fP
-pki_ds_password=\fIpassword123\fP
-.fi
-.PP
-Prior to running this command, a Directory Server instance should be created and running. This command assumes that the Directory Server instance is using its default configuration:
-.IP
-* Installed on the local machine
-.IP
-* Listening on port 389 
-.IP
-* The user is cn=Directory Manager, with the password specified in pki_ds_password
-
-This invocation of \fBpkispawn\fP creates a Tomcat instance containing a CA running on the local machine with secure port 8443 and unsecure port 8080.  To access this CA, simply point a browser to https://<hostname>:8443.
-.PP
-The instance name (defined by pki_instance_name) is pki-tomcat, and it is located at \fI/var/lib/pki/pki-tomcat\fP.  Logs for the instance are located at \fI/var/log/pki/pki-tomcat\fP, and an installation log is written to \fI/var/log/pki/pki-<subsystem>-spawn.<timestamp>.log\fP.
-.PP
-A PKCS #12 file containing the administrator certificate is created in \fI$HOME/.dogtag/pki-tomcat\fP.  This PKCS #12 file uses the password designated by pki_client_pkcs12_password in the configuration file.
-.PP
-To access the agent pages, first import the CA certificate by accessing the CA End Entity Pages and clicking on the Retrieval Tab.  Be sure to trust the CA certificate.  Then, import the administrator certificate in the PKCS #12 file.
-.SS KRA, OCSP, or TKS using default configuration
-\x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
-.PP
-where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP contains the following text: 
-.IP
-.nf
-[DEFAULT]
-pki_admin_password=\fIpassword123\fP
-pki_client_pkcs12_password=\fIpassword123\fP
-pki_ds_password=\fIpassword123\fP
-pki_security_domain_password=\fIpassword123\fP
-.fi
-.PP
-The \fBpki_security_domain_password\fP is the admin password of the CA installed in the same default instance. This command should be run after a CA is installed.  This installs another subsystem within the same default instance using the certificate generated for the CA administrator for the subsystem's administrator.  This allows a user to access both subsystems on the browser with a single administrator certificate.  To access the new subsystem's functionality, simply point the browser to https://<hostname>:8443 and click the relevant top-level links.
-.SS KRA, OCSP, or TKS connecting to a remote CA
-\x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
-.PP
-where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP contains the following text:
-.IP
-.nf
-[DEFAULT]
-pki_admin_password=\fIpassword123\fP
-pki_client_pkcs12_password=\fIpassword123\fP
-pki_ds_password=\fIpassword123\fP
-pki_security_domain_password=\fIpassword123\fP
-pki_security_domain_hostname=<ca_hostname>
-pki_security_domain_https_port=<ca_port>
-pki_security_domain_user=caadmin
-pki_issuing_ca_uri=https://<ca_hostname>:<ca_port>
-
-[KRA]
-pki_import_admin_cert=False
-.fi
-.PP
-A remote CA is one where the CA resides in another Certificate Server instance, either on the local machine or a remote machine.  In this case, \fImyconfig.txt\fP must specify the connection information for the remote CA and the information about the security domain (the trusted collection of subsystems within an instance).
-.PP
-The subsystem section is [KRA], [OCSP], or [TKS].  This example assumes that the specified CA hosts the security domain.  The CA must be running and accessible.  
-.PP 
-A new administrator certificate is generated for the new subsystem and stored in a PKCS #12 file in \fI$HOME/.dogtag/pki-tomcat\fP.
-.SS Installing a CA clone
-\x'-1'\fBpkispawn -s CA -f myconfig.txt\fR
-.PP 
-where \fImyconfig.txt\fP contains the following text:
-.IP
-.nf
-[DEFAULT]
-pki_admin_password=\fIpassword123\fP
-pki_client_pkcs12_password=\fIpassword123\fP
-pki_ds_password=\fIpassword123\fP
-pki_security_domain_password=\fIpassword123\fP
-pki_security_domain_hostname=<master_ca_hostname>
-pki_security_domain_https_port=<master_ca_https_port>
-pki_security_domain_user=caadmin
-
-[CA]
-pki_clone=True
-pki_clone_pkcs12_password=\fIpassword123\fP
-pki_clone_pkcs12_path=<path_to_pkcs12_file>
-pki_clone_replicate_schema=True
-pki_clone_uri=https://<master_ca_hostname>:<master_ca_https_port>
-.fi
-.PP
-A cloned CA is a CA which uses the same signing, OCSP signing, and audit signing certificates as the master CA, but issues certificates within a different serial number range.  It has its own internal database -- separate from the master CA database -- but using the same base DN, that keeps in sync with the master CA through replication agreements between the databases.  This is very useful for load sharing and disaster recovery. To create a clone, the \fImyconfig.txt\fP uses pki_clone-* parameters in its [CA] section which identify the original CA to use as a master template. Additionally, it connects to the master CA as a remote CA and uses its security domain.
-.PP
-Before the clone can be generated, the Directory Server must be created that is separate from the master CA's Directory Server.  The example assumes that the master CA and cloned CA are on different machines, and that their Directory Servers are on port 389.  In addition, the master's system certs and keys have been stored in a PKCS #12 file that is copied over to the clone subsystem in the location specified in <path_to_pkcs12_file>.  This file is created when the master CA is installed; it can also be generated using \fBPKCS12Export\fP.  The file needs to be readable by the user the Certificate Server runs as (by default, pkiuser) and be given the SELinux context pki_tomcat_cert_t.
-.PP
-.SS Installing a KRA, OCSP, or TKS clone
-\x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
-.PP
-where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP contains the following text:
-.IP
-.nf
-[DEFAULT]
-pki_admin_password=\fIpassword123\fP
-pki_client_pkcs12_password=\fIpassword123\fP
-pki_ds_password=\fIpassword123\fP
-pki_security_domain_password=\fIpassword123\fP
-pki_security_domain_hostname=<master_ca_hostname>
-pki_security_domain_https_port=<master_ca_https_port>
-pki_security_domain_user=caadmin
-
-[KRA]
-pki_clone=True
-pki_clone_pkcs12_password=\fIpassword123\fP
-pki_clone_pkcs12_path=<path_to_pkcs12_file>
-pki_clone_replicate_schema=True
-pki_clone_uri=https://<master_kra_host>:<master_kra_https_port>
-pki_issuing_ca=https://<ca_hostname>:<ca_https_port>
-.fi
-.PP
-As with a CA clone, a KRA, OCSP, or TKS clone uses the same certificates and basic configuration as the original subsystem. The configuration points to the original subsystem to copy its configuration. This example also assumes that the CA is on a remote machine and specifies the CA and security domain information. 
-.PP
-The subsystem section is [KRA], [OCSP], or [TKS].
-.SS Installing a subordinate CA
-\x'-1'\fBpkispawn -s CA -f myconfig.txt\fR
-.PP
-where \fImyconfig.txt\fP contains the following text:
-.IP
-.nf
-[DEFAULT]
-pki_admin_password=\fIpassword123\fP
-pki_client_pkcs12_password=\fIpassword123\fP
-pki_ds_password=\fIpassword123\fP
-pki_security_domain_password=\fIpassword123\fP
-pki_security_domain_hostname=<security_domain_ca_hostname>
-pki_security_domain_https_port=<security_domain_ca_https_port>
-pki_security_domain_user=caadmin
-
-[CA]
-pki_subordinate=True
-pki_issuing_ca=https://<master_ca_hostname>:<master_ca_https_port>
-pki_ca_signing_subject_dn=cn=CA Subordinate Signing ,o=example.com
-.fi
-.PP
-A sub-CA derives its certificate configuration -- such as allowed extensions and validity periods -- from a superior or root CA. Otherwise, the configuration of the CA is independent of the root CA, so it is its own instance rather than a clone. A sub-CA is configured using the pki_subordinate parameter and a pointer to the CA which issues the sub-CA's certificates.
-.PP
-\fBNote:\fP The value of \fBpki_ca_signing_subject_dn\fP of a subordinate CA should be different from the root CA's signing subject DN.
-.SS Installing an externally signed CA
-\x'-1'\fBpkispawn -s CA -f myconfig.txt\fR
-.PP
-This is a two step process.
-.PP
-In the first step, a certificate signing request (CSR) is generated for the signing certificate and \fImyconfig.txt\fP contains the following text:
-.IP
-.nf
-[DEFAULT]
-pki_admin_password=\fIpassword123\fP
-pki_client_pkcs12_password=\fIpassword123\fP
-pki_ds_password=\fIpassword123\fP
-pki_security_domain_password=\fIpassword123\fP
-
-[CA]
-pki_external=True
-pki_external_csr_path=/tmp/ca_signing.csr
-pki_ca_signing_subject_dn=cn=CA Signing,ou=External,o=example.com
-.fi
-.PP
-The CSR is written to pki_external_csr_path.  The pki_ca_signing_subject_dn should be different from the subject DN of the external CA that is signing the request.  The pki_ca_signing_subject_dn parameter can be used to specify the signing certificate's subject DN.
-
-.PP
-The CSR is then submitted to the external CA, and the resulting certificate and certificate chain are saved to files on the system.
-
-.PP
-In the second step, the configuration file has been modified to install the issued certificates. In place of the original CSR, the configuration file now points to the issued CA certificate and certificate chain. There is also a flag to indicate that this completes the installation process (pki_external_step_two). 
-.IP
-.nf
-[DEFAULT]
-pki_admin_password=\fIpassword123\fP
-pki_client_pkcs12_password=\fIpassword123\fP
-pki_ds_password=\fIpassword123\fP
-pki_security_domain_password=\fIpassword123\fP
-
-[CA]
-pki_external=True
-pki_external_ca_cert_chain_path=/tmp/ca_cert_chain.cert
-pki_external_ca_cert_path=/tmp/ca_signing.cert
-pki_external_step_two=True
-pki_ca_signing_subject_dn=cn=CA Signing Certificate,ou=External,o=example.com
-.fi
-.PP
-Then, the \fBpkispawn\fP command is run again:
-.PP
-.B pkispawn -s CA -f myconfig.txt
-
-.SS Execution management of a PKI instance (start, stop, status, etc.)
-.BR
-.PP
-To start all 389 instances (local PKI databases):
-.IP
-.nf
-\fBsystemctl start dirsrv.target\fR
-.fi
-.PP
-To stop all 389 instances (local PKI databases):
-.IP
-.nf
-\fBsystemctl stop dirsrv.target\fR
-.fi
-.PP
-To restart all 389 instances (local PKI databases):
-.IP
-.nf
-\fBsystemctl restart dirsrv.target\fR
-.fi
-.PP
-To obtain the status of all 389 instances (local PKI databases):
-.IP
-.nf
-\fBsystemctl status dirsrv.target\fR
-.fi
-.PP
-To start a PKI instance named <pki_instance_name>:
-.IP
-.nf
-\fBsystemctl start pki-tomcatd@<pki_instance_name>.service\fR
-.fi
-.PP
-To stop a PKI instance named <pki_instance_name>:
-.IP
-.nf
-\fBsystemctl stop pki-tomcatd@<pki_instance_name>.service\fR
-.fi
-.PP
-To restart a PKI instance named <pki_instance_name>:
-.IP
-.nf
-\fBsystemctl restart pki-tomcatd@<pki_instance_name>.service\fR
-.fi
-.PP
-To obtain the status of a PKI instance named <pki_instance_name>:
-.IP
-.nf
-\fBsystemctl status pki-tomcatd@<pki_instance_name>.service\fR
-.fi
-.PP
-To obtain a detailed status of a Tomcat PKI instance named <pki_instance_name>:
-.IP
-.nf
-\fBpkidaemon status tomcat <pki_instance_name>\fR
-.fi
-.PP
-To obtain a detailed status of all Tomcat PKI instances:
-.IP
-.nf
-\fBpkidaemon status tomcat\fR
-.fi
-
-.PP
-To enable a PKI instance named <pki_instance_name> to be started automatically upon system reboot:
-.IP
-.nf
-\x'-1'\fBsystemctl enable pki-tomcatd@<pki_instance_name>.service\fR
-.fi
-
-.SH BUGS
-Report bugs to http://bugzilla.redhat.com.
-
-.SH AUTHORS
-Ade Lee <alee@redhat.com>.  \fBpkispawn\fP was written by the Certificate Server project.
-
-.SH COPYRIGHT
-Copyright (c) 2012 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
-
-.SH SEE ALSO
-.BR pkidestroy(8),
-.BR pki_default.cfg(5),
-.BR pki(1),
-.BR setup-ds.pl(8)
diff --git a/base/server/python/pki/server/deployment/__init__.py b/base/server/python/pki/server/deployment/__init__.py
deleted file mode 100644
index e69de29..0000000
diff --git a/base/server/python/pki/server/deployment/pkiconfig.py b/base/server/python/pki/server/deployment/pkiconfig.py
deleted file mode 100644
index 67edad1..0000000
--- a/base/server/python/pki/server/deployment/pkiconfig.py
+++ /dev/null
@@ -1,181 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# PKI Deployment Constants
-PKI_DEPLOYMENT_DEFAULT_CLIENT_DIR_PERMISSIONS = 00755
-PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS = 00770
-PKI_DEPLOYMENT_DEFAULT_EXE_PERMISSIONS = 00770
-PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS = 00660
-PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS = 00600
-PKI_DEPLOYMENT_DEFAULT_SGID_DIR_PERMISSIONS = 02770
-PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS = 00777
-PKI_DEPLOYMENT_DEFAULT_UMASK = 00002
-
-PKI_DEPLOYMENT_DEFAULT_COMMENT = "'Certificate System'"
-PKI_DEPLOYMENT_DEFAULT_GID = 17
-PKI_DEPLOYMENT_DEFAULT_GROUP = "pkiuser"
-PKI_DEPLOYMENT_DEFAULT_SHELL = "/sbin/nologin"
-PKI_DEPLOYMENT_DEFAULT_UID = 17
-PKI_DEPLOYMENT_DEFAULT_USER = "pkiuser"
-
-PKI_SUBSYSTEMS = ["CA", "KRA", "OCSP", "RA", "TKS", "TPS"]
-PKI_SIGNED_AUDIT_SUBSYSTEMS = ["CA", "KRA", "OCSP", "TKS", "TPS"]
-PKI_APACHE_SUBSYSTEMS = ["RA"]
-PKI_TOMCAT_SUBSYSTEMS = ["CA", "KRA", "OCSP", "TKS", "TPS"]
-PKI_BASE_RESERVED_NAMES = ["alias", "bin", "ca", "common", "conf", "kra",
-                           "lib", "logs", "ocsp", "temp", "tks", "tps",
-                           "webapps", "work"]
-PKI_CONFIGURATION_RESERVED_NAMES = ["CA", "java", "nssdb", "rpm-gpg",
-                                    "rsyslog", "tls"]
-PKI_APACHE_REGISTRY_RESERVED_NAMES = ["ra"]
-PKI_TOMCAT_REGISTRY_RESERVED_NAMES = ["ca", "kra", "ocsp", "tks", "tps"]
-
-PKI_INDENTATION_LEVEL_0 = {'indent': ''}
-PKI_INDENTATION_LEVEL_1 = {'indent': '... '}
-PKI_INDENTATION_LEVEL_2 = {'indent': '....... '}
-PKI_INDENTATION_LEVEL_3 = {'indent': '........... '}
-PKI_INDENTATION_LEVEL_4 = {'indent': '............... '}
-
-PKI_DEPLOYMENT_INTERRUPT_BANNER = "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+"\
-                                  "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-"
-
-PKI_DEPLOYMENT_SOURCE_ROOT = "/usr/share/pki"
-PKI_DEPLOYMENT_BASE_ROOT = "/var/lib/pki"
-# NOTE: Top-level "/etc/pki" is owned by the "filesystem" package!
-PKI_DEPLOYMENT_CONFIGURATION_ROOT = "/etc/pki"
-PKI_DEPLOYMENT_LOG_ROOT = "/var/log/pki"
-# NOTE:  Well-known 'registry root', default 'instance', and default
-#        'configuration file' names MUST be created in order to potentially
-#        obtain an instance-specific configuration file
-#        (presuming one has not been specified during command-line parsing)
-#        because command-line parsing happens prior to reading any
-#        configuration files.  Although the 'registry root' MUST remain fixed,
-#        the default 'instance' name may be overridden by the value specified
-#        in the configuration file (the value in the default configuration file
-#        should always match the 'default' instance name specified below).
-PKI_DEPLOYMENT_DEFAULT_APACHE_INSTANCE_NAME = "pki-apache"
-PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME = "pki-tomcat"
-
-DEFAULT_DEPLOYMENT_CONFIGURATION = "default.cfg"
-USER_DEPLOYMENT_CONFIGURATION = "deployment.cfg"
-
-PKI_DEPLOYMENT_DEFAULT_CONFIGURATION_FILE = \
-    PKI_DEPLOYMENT_CONFIGURATION_ROOT + "/" + DEFAULT_DEPLOYMENT_CONFIGURATION
-PKI_DEPLOYMENT_SLOTS_CONFIGURATION_FILE = \
-    PKI_DEPLOYMENT_SOURCE_ROOT + "/deployment/config/pkislots.cfg"
-
-# subtypes of PKI subsystems
-PKI_DEPLOYMENT_CLONED_PKI_SUBSYSTEM = "Cloned"
-PKI_DEPLOYMENT_EXTERNAL_CA = "External"
-PKI_DEPLOYMENT_SUBORDINATE_CA = "Subordinate"
-
-# default ports (for defined selinux policy)
-PKI_DEPLOYMENT_DEFAULT_TOMCAT_HTTP_PORT = 8080
-PKI_DEPLOYMENT_DEFAULT_TOMCAT_HTTPS_PORT = 8443
-PKI_DEPLOYMENT_DEFAULT_TOMCAT_SERVER_PORT = 8005
-PKI_DEPLOYMENT_DEFAULT_TOMCAT_AJP_PORT = 8009
-
-# PKI Deployment Global Variables
-pki_install_time = None
-pki_timestamp = None
-pki_architecture = None
-pki_hostname = None
-pki_dns_domainname = None
-pki_certificate_timestamp = None
-
-
-# PKI Deployment Command-Line Variables
-pki_deployment_executable = None
-
-# PKI Deployment "Mandatory" Command-Line Variables
-pki_subsystem = None
-#     'pkispawn' ONLY
-default_deployment_cfg = None
-user_deployment_cfg = None
-#     'pkidestroy' ONLY
-pki_deployed_instance_name = None
-pki_secdomain_user = None
-pki_secdomain_pass = None
-
-# PKI Deployment "Test" Command-Line Variables
-pki_root_prefix = None
-
-
-# PKI Deployment Helper Functions
-def str2bool(string):
-    return string.lower() in ("yes", "true", "t", "1")
-
-
-# NOTE:  To utilize the 'preparations_for_an_external_java_debugger(master)'
-#        and 'wait_to_attach_an_external_java_debugger(master)' functions,
-#        change 'pki_enable_java_debugger=False' to
-#        'pki_enable_java_debugger=True' in the appropriate
-#        deployment configuration file.
-def prepare_for_an_external_java_debugger(instance):
-    print
-    print PKI_DEPLOYMENT_INTERRUPT_BANNER
-    print
-    print "The following 'JAVA_OPTS' MUST be edited in"
-    print "'%s':" % instance
-    print
-    print "    JAVA_OPTS=\"-DRESTEASY_LIB=/usr/share/java/resteasy \""
-    print "              \"-Xdebug -Xrunjdwp:transport=dt_socket,\""
-    print "              \"address=8000,server=y,suspend=n \""
-    print "              \"-Djava.awt.headless=true -Xmx128M\""
-    print
-    raw_input("Enable external java debugger 'JAVA_OPTS' "
-              "and press return to continue  . . . ")
-    print
-    print PKI_DEPLOYMENT_INTERRUPT_BANNER
-    print
-    return
-
-
-def wait_to_attach_an_external_java_debugger():
-    print
-    print PKI_DEPLOYMENT_INTERRUPT_BANNER
-    print
-    print "Attach the java debugger to this process on the port specified by"
-    print "the 'address' selected by 'JAVA_OPTS' (e. g. - port 8000) and"
-    print "set any desired breakpoints"
-    print
-    raw_input("Please attach an external java debugger "
-              "and press return to continue  . . . ")
-    print
-    print PKI_DEPLOYMENT_INTERRUPT_BANNER
-    print
-    return
-
-
-# PKI Deployment Logger Variables
-pki_log = None
-pki_log_dir = None
-pki_log_name = None
-pki_log_level = None
-pki_console_log_level = None
-
-# PKI Selinux Constants and parameters
-PKI_INSTANCE_SELINUX_CONTEXT = "pki_tomcat_var_lib_t"
-PKI_LOG_SELINUX_CONTEXT = "pki_tomcat_log_t"
-PKI_CFG_SELINUX_CONTEXT = "pki_tomcat_etc_rw_t"
-PKI_CERTDB_SELINUX_CONTEXT = "pki_tomcat_cert_t"
-PKI_PORT_SELINUX_CONTEXT = "http_port_t"
-pki_selinux_config_ports = []
diff --git a/base/server/python/pki/server/deployment/pkihelper.py b/base/server/python/pki/server/deployment/pkihelper.py
deleted file mode 100644
index 148dab0..0000000
--- a/base/server/python/pki/server/deployment/pkihelper.py
+++ /dev/null
@@ -1,4192 +0,0 @@
-#!/usr/bin/python -t
-
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# System Imports
-import errno
-import sys
-import os
-import fileinput
-import random
-import re
-import shutil
-from shutil import Error, WindowsError
-import string
-import subprocess
-import time
-import types
-from datetime import datetime
-from grp import getgrgid
-from grp import getgrnam
-from pwd import getpwnam
-from pwd import getpwuid
-import xml.etree.ElementTree as ET
-import zipfile
-import selinux
-if selinux.is_selinux_enabled():
-    import seobject
-
-
-# PKI Deployment Imports
-from . import pkiconfig as config
-from .pkiconfig import pki_selinux_config_ports as ports
-from . import pkimanifest as manifest
-from . import pkimessages as log
-from .pkiparser import PKIConfigParser
-import pki.account
-import pki.client
-import pki.system
-
-
-# PKI Deployment Helper Functions
-def pki_copytree(src, dst, symlinks=False, ignore=None):
-    """Recursively copy a directory tree using copy2().
-
-    PATCH:  This code was copied from 'shutil.py' and patched to
-            allow 'The destination directory to already exist.'
-
-    If exception(s) occur, an Error is raised with a list of reasons.
-
-    If the optional symlinks flag is true, symbolic links in the
-    source tree result in symbolic links in the destination tree; if
-    it is false, the contents of the files pointed to by symbolic
-    links are copied.
-
-    The optional ignore argument is a callable. If given, it
-    is called with the `src` parameter, which is the directory
-    being visited by pki_copytree(), and `names` which is the list of
-    `src` contents, as returned by os.listdir():
-
-        callable(src, names) -> ignored_names
-
-    Since pki_copytree() is called recursively, the callable will be
-    called once for each directory that is copied. It returns a
-    list of names relative to the `src` directory that should
-    not be copied.
-
-    *** Consider this example code rather than the ultimate tool.
-
-    """
-    names = os.listdir(src)
-    if ignore is not None:
-        ignored_names = ignore(src, names)
-    else:
-        ignored_names = set()
-
-    # PATCH:  ONLY execute 'os.makedirs(dst)' if the top-level
-    #         destination directory does NOT exist!
-    if not os.path.exists(dst):
-        os.makedirs(dst)
-    errors = []
-    for name in names:
-        if name in ignored_names:
-            continue
-        srcname = os.path.join(src, name)
-        dstname = os.path.join(dst, name)
-        try:
-            if symlinks and os.path.islink(srcname):
-                linkto = os.readlink(srcname)
-                os.symlink(linkto, dstname)
-            elif os.path.isdir(srcname):
-                pki_copytree(srcname, dstname, symlinks, ignore)
-            else:
-                # Will raise a SpecialFileError for unsupported file types
-                shutil.copy2(srcname, dstname)
-        # catch the Error from the recursive pki_copytree so that we can
-        # continue with other files
-        except Error, err:
-            errors.extend(err.args[0])
-        except EnvironmentError, why:
-            errors.append((srcname, dstname, str(why)))
-    try:
-        shutil.copystat(src, dst)
-    except OSError, why:
-        if WindowsError is not None and isinstance(why, WindowsError):
-            # Copying file access times may fail on Windows
-            pass
-        else:
-            errors.extend((src, dst, str(why)))
-    if errors:
-        raise Error(errors)
-
-
-class Identity:
-    """PKI Deployment Identity Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-
-    def __add_gid(self, pki_group):
-        try:
-            # Does the specified 'pki_group' exist?
-            pki_gid = getgrnam(pki_group)[2]
-            # Yes, group 'pki_group' exists!
-            config.pki_log.info(log.PKIHELPER_GROUP_ADD_2, pki_group, pki_gid,
-                                extra=config.PKI_INDENTATION_LEVEL_2)
-        except KeyError as exc:
-            # No, group 'pki_group' does not exist!
-            config.pki_log.debug(log.PKIHELPER_GROUP_ADD_KEYERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            try:
-                # Is the default well-known GID already defined?
-                group = getgrgid(config.PKI_DEPLOYMENT_DEFAULT_GID)[0]
-                # Yes, the default well-known GID exists!
-                config.pki_log.info(log.PKIHELPER_GROUP_ADD_DEFAULT_2,
-                                    group, config.PKI_DEPLOYMENT_DEFAULT_GID,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                # Attempt to create 'pki_group' using a random GID.
-                command = ["/usr/sbin/groupadd", pki_group]
-            except KeyError as exc:
-                # No, the default well-known GID does not exist!
-                config.pki_log.debug(log.PKIHELPER_GROUP_ADD_GID_KEYERROR_1,
-                                     exc, extra=config.PKI_INDENTATION_LEVEL_2)
-                # Is the specified 'pki_group' the default well-known group?
-                if pki_group == config.PKI_DEPLOYMENT_DEFAULT_GROUP:
-                    # Yes, attempt to create the default well-known group
-                    # using the default well-known GID.
-                    command = ["/usr/sbin/groupadd",
-                               "-g", str(config.PKI_DEPLOYMENT_DEFAULT_GID),
-                               "-r", pki_group]
-                else:
-                    # No, attempt to create 'pki_group' using a random GID.
-                    command = ["/usr/sbin/groupadd", pki_group]
-            try:
-                # Execute this "groupadd" command.
-                with open(os.devnull, "w") as fnull:
-                    subprocess.check_call(command, stdout=fnull, stderr=fnull,
-                                          close_fds=True)
-            except subprocess.CalledProcessError as exc:
-                config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise
-            except OSError as exc:
-                config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise
-        return
-
-    def __add_uid(self, pki_user, pki_group):
-        try:
-            # Does the specified 'pki_user' exist?
-            pki_uid = getpwnam(pki_user)[2]
-            # Yes, user 'pki_user' exists!
-            config.pki_log.info(log.PKIHELPER_USER_ADD_2, pki_user, pki_uid,
-                                extra=config.PKI_INDENTATION_LEVEL_2)
-            # NOTE:  For now, never check validity of specified 'pki_group'!
-        except KeyError as exc:
-            # No, user 'pki_user' does not exist!
-            config.pki_log.debug(log.PKIHELPER_USER_ADD_KEYERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            try:
-                # Is the default well-known UID already defined?
-                user = getpwuid(config.PKI_DEPLOYMENT_DEFAULT_UID)[0]
-                # Yes, the default well-known UID exists!
-                config.pki_log.info(log.PKIHELPER_USER_ADD_DEFAULT_2,
-                                    user, config.PKI_DEPLOYMENT_DEFAULT_UID,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                # Attempt to create 'pki_user' using a random UID.
-                command = ["/usr/sbin/useradd",
-                           "-g", pki_group,
-                           "-d", config.PKI_DEPLOYMENT_SOURCE_ROOT,
-                           "-s", config.PKI_DEPLOYMENT_DEFAULT_SHELL,
-                           "-c", config.PKI_DEPLOYMENT_DEFAULT_COMMENT,
-                           pki_user]
-            except KeyError as exc:
-                # No, the default well-known UID does not exist!
-                config.pki_log.debug(log.PKIHELPER_USER_ADD_UID_KEYERROR_1,
-                                     exc, extra=config.PKI_INDENTATION_LEVEL_2)
-                # Is the specified 'pki_user' the default well-known user?
-                if pki_user == config.PKI_DEPLOYMENT_DEFAULT_USER:
-                    # Yes, attempt to create the default well-known user
-                    # using the default well-known UID.
-                    command = ["/usr/sbin/useradd",
-                               "-g", pki_group,
-                               "-d", config.PKI_DEPLOYMENT_SOURCE_ROOT,
-                               "-s", config.PKI_DEPLOYMENT_DEFAULT_SHELL,
-                               "-c", config.PKI_DEPLOYMENT_DEFAULT_COMMENT,
-                               "-u", str(config.PKI_DEPLOYMENT_DEFAULT_UID),
-                               "-r", pki_user]
-                else:
-                    # No, attempt to create 'pki_user' using a random UID.
-                    command = ["/usr/sbin/useradd",
-                               "-g", pki_group,
-                               "-d", config.PKI_DEPLOYMENT_SOURCE_ROOT,
-                               "-s", config.PKI_DEPLOYMENT_DEFAULT_SHELL,
-                               "-c", config.PKI_DEPLOYMENT_DEFAULT_COMMENT,
-                               pki_user]
-            try:
-                # Execute this "useradd" command.
-                with open(os.devnull, "w") as fnull:
-                    subprocess.check_call(command, stdout=fnull, stderr=fnull,
-                                          close_fds=True)
-            except subprocess.CalledProcessError as exc:
-                config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise
-            except OSError as exc:
-                config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise
-        return
-
-    def add_uid_and_gid(self, pki_user, pki_group):
-        self.__add_gid(pki_group)
-        self.__add_uid(pki_user, pki_group)
-        return
-
-    def get_uid(self, critical_failure=True):
-        try:
-            return self.mdict['pki_uid']
-        except KeyError as exc:
-            config.pki_log.error(log.PKI_KEYERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-            return None
-
-    def get_gid(self, critical_failure=True):
-        try:
-            return self.mdict['pki_gid']
-        except KeyError as exc:
-            config.pki_log.error(log.PKI_KEYERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-            return None
-
-    def set_uid(self, name, critical_failure=True):
-        try:
-            config.pki_log.debug(log.PKIHELPER_USER_1, name,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            # id -u <name>
-            pki_uid = getpwnam(name)[2]
-            self.mdict['pki_uid'] = pki_uid
-            config.pki_log.debug(log.PKIHELPER_UID_2, name, pki_uid,
-                                 extra=config.PKI_INDENTATION_LEVEL_3)
-            return pki_uid
-        except KeyError as exc:
-            config.pki_log.error(log.PKI_KEYERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-            return None
-
-    def set_gid(self, name, critical_failure=True):
-        try:
-            config.pki_log.debug(log.PKIHELPER_GROUP_1, name,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            # id -g <name>
-            pki_gid = getgrnam(name)[2]
-            self.mdict['pki_gid'] = pki_gid
-            config.pki_log.debug(log.PKIHELPER_GID_2, name, pki_gid,
-                                 extra=config.PKI_INDENTATION_LEVEL_3)
-            return pki_gid
-        except KeyError as exc:
-            config.pki_log.error(log.PKI_KEYERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-            return None
-
-
-class Namespace:
-    """PKI Deployment Namespace Class"""
-
-    # Silently verify that the selected 'pki_instance_name' will
-    # NOT produce any namespace collisions
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-
-    def collision_detection(self):
-        # Run simple checks for pre-existing namespace collisions
-        if os.path.exists(self.mdict['pki_instance_path']):
-            if os.path.exists(self.mdict['pki_subsystem_path']):
-                # Top-Level PKI base path collision
-                config.pki_log.error(
-                    log.PKIHELPER_NAMESPACE_COLLISION_2,
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_instance_path'],
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKIHELPER_NAMESPACE_COLLISION_2 % (
-                        self.mdict['pki_instance_name'],
-                        self.mdict['pki_instance_path']))
-        else:
-            if os.path.exists(self.mdict['pki_target_tomcat_conf_instance_id']):
-                # Top-Level "/etc/sysconfig" path collision
-                config.pki_log.error(
-                    log.PKIHELPER_NAMESPACE_COLLISION_2,
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_target_tomcat_conf_instance_id'],
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKIHELPER_NAMESPACE_COLLISION_2 % (
-                        self.mdict['pki_instance_name'],
-                        self.mdict['pki_target_tomcat_conf_instance_id']))
-            if os.path.exists(self.mdict['pki_cgroup_systemd_service']):
-                # Systemd cgroup path collision
-                config.pki_log.error(
-                    log.PKIHELPER_NAMESPACE_COLLISION_2,
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_cgroup_systemd_service_path'],
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKIHELPER_NAMESPACE_COLLISION_2 % (
-                        self.mdict['pki_instance_name'],
-                        self.mdict['pki_cgroup_systemd_service_path']))
-            if os.path.exists(self.mdict['pki_cgroup_cpu_systemd_service']):
-                # Systemd cgroup CPU path collision
-                config.pki_log.error(
-                    log.PKIHELPER_NAMESPACE_COLLISION_2,
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_cgroup_cpu_systemd_service_path'],
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKIHELPER_NAMESPACE_COLLISION_2 % (
-                        self.mdict['pki_instance_name'],
-                        self.mdict['pki_cgroup_cpu_systemd_service_path']))
-        if os.path.exists(self.mdict['pki_instance_log_path']) and\
-           os.path.exists(self.mdict['pki_subsystem_log_path']):
-            # Top-Level PKI log path collision
-            config.pki_log.error(
-                log.PKIHELPER_NAMESPACE_COLLISION_2,
-                self.mdict['pki_instance_name'],
-                self.mdict['pki_instance_log_path'],
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            raise Exception(
-                log.PKIHELPER_NAMESPACE_COLLISION_2 % (
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_instance_log_path']))
-        if os.path.exists(self.mdict['pki_instance_configuration_path']) and\
-           os.path.exists(self.mdict['pki_subsystem_configuration_path']):
-            # Top-Level PKI configuration path collision
-            config.pki_log.error(
-                log.PKIHELPER_NAMESPACE_COLLISION_2,
-                self.mdict['pki_instance_name'],
-                self.mdict['pki_instance_configuration_path'],
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            raise Exception(
-                log.PKIHELPER_NAMESPACE_COLLISION_2 % (
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_instance_configuration_path']))
-        if os.path.exists(self.mdict['pki_instance_registry_path']) and\
-           os.path.exists(self.mdict['pki_subsystem_registry_path']):
-            # Top-Level PKI registry path collision
-            config.pki_log.error(
-                log.PKIHELPER_NAMESPACE_COLLISION_2,
-                self.mdict['pki_instance_name'],
-                self.mdict['pki_instance_registry_path'],
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            raise Exception(
-                log.PKIHELPER_NAMESPACE_COLLISION_2 % (
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_instance_registry_path']))
-        # Run simple checks for reserved name namespace collisions
-        if self.mdict['pki_instance_name'] in config.PKI_BASE_RESERVED_NAMES:
-            # Top-Level PKI base path reserved name collision
-            config.pki_log.error(
-                log.PKIHELPER_NAMESPACE_RESERVED_NAME_2,
-                self.mdict['pki_instance_name'],
-                self.mdict['pki_instance_path'],
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            raise Exception(
-                log.PKIHELPER_NAMESPACE_RESERVED_NAME_2 % (
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_instance_path']))
-        # No need to check for reserved name under Top-Level PKI log path
-        if self.mdict['pki_instance_name'] in \
-                config.PKI_CONFIGURATION_RESERVED_NAMES:
-            # Top-Level PKI configuration path reserved name collision
-            config.pki_log.error(
-                log.PKIHELPER_NAMESPACE_RESERVED_NAME_2,
-                self.mdict['pki_instance_name'],
-                self.mdict['pki_instance_configuration_path'],
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            raise Exception(
-                log.PKIHELPER_NAMESPACE_RESERVED_NAME_2 % (
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_instance_configuration_path']))
-        if self.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
-            # Top-Level Apache PKI registry path reserved name collision
-            if self.mdict['pki_instance_name'] in\
-               config.PKI_APACHE_REGISTRY_RESERVED_NAMES:
-                config.pki_log.error(
-                    log.PKIHELPER_NAMESPACE_RESERVED_NAME_2,
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_instance_registry_path'],
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKIHELPER_NAMESPACE_RESERVED_NAME_2 % (
-                        self.mdict['pki_instance_name'],
-                        self.mdict['pki_instance_registry_path']))
-        elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-            # Top-Level Tomcat PKI registry path reserved name collision
-            if self.mdict['pki_instance_name'] in\
-               config.PKI_TOMCAT_REGISTRY_RESERVED_NAMES:
-                config.pki_log.error(
-                    log.PKIHELPER_NAMESPACE_RESERVED_NAME_2,
-                    self.mdict['pki_instance_name'],
-                    self.mdict['pki_instance_registry_path'],
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKIHELPER_NAMESPACE_RESERVED_NAME_2 % (
-                        self.mdict['pki_instance_name'],
-                        self.mdict['pki_instance_registry_path']))
-
-
-class ConfigurationFile:
-    """PKI Deployment Configuration File Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-        # set useful 'boolean' object variables for this class
-        self.clone = config.str2bool(self.mdict['pki_clone'])
-        self.external = config.str2bool(self.mdict['pki_external'])
-        self.external_step_two = config.str2bool(
-            self.mdict['pki_external_step_two'])
-        self.skip_configuration = config.str2bool(
-            self.mdict['pki_skip_configuration'])
-        self.standalone = config.str2bool(self.mdict['pki_standalone'])
-        self.subordinate = config.str2bool(self.mdict['pki_subordinate'])
-        # set useful 'string' object variables for this class
-        self.subsystem = self.mdict['pki_subsystem']
-
-    def log_configuration_url(self):
-        # NOTE:  This is the one and only parameter containing a sensitive
-        #        parameter that may be stored in a log file.
-        config.pki_log.info(log.PKI_CONFIGURATION_WIZARD_URL_1,
-                            self.mdict['pki_configuration_url'],
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-        config.pki_log.info(log.PKI_CONFIGURATION_WIZARD_RESTART_1,
-                            self.mdict['pki_registry_initscript_command'],
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-
-    def display_configuration_url(self):
-        # NOTE:  This is the one and only parameter containing a sensitive
-        #        parameter that may be displayed to the screen.
-        print log.PKI_CONFIGURATION_URL_1 % self.mdict['pki_configuration_url']
-        print
-        print log.PKI_CONFIGURATION_RESTART_1 % \
-            self.mdict['pki_registry_initscript_command']
-        print
-
-    def confirm_external(self):
-        # ALWAYS defined via 'pkiparser.py'
-        if self.external:
-            # Only allowed for External CA
-            if self.subsystem != "CA":
-                config.pki_log.error(log.PKI_EXTERNAL_UNSUPPORTED_1,
-                                     self.subsystem,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKI_EXTERNAL_UNSUPPORTED_1,
-                                self.subsystem)
-
-    def confirm_standalone(self):
-        # ALWAYS defined via 'pkiparser.py'
-        if self.standalone:
-            # Only allowed for Stand-alone PKI
-            #
-            # ADD checks for valid types of Stand-alone PKI subsystems here
-            # AND to the 'private void validateData(ConfigurationRequest data)'
-            # Java method located in the file called 'SystemConfigService.java'
-            #
-            if self.subsystem != "KRA":
-                config.pki_log.error(log.PKI_STANDALONE_UNSUPPORTED_1,
-                                     self.subsystem,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKI_STANDALONE_UNSUPPORTED_1,
-                                self.subsystem)
-
-    def confirm_subordinate(self):
-        # ALWAYS defined via 'pkiparser.py'
-        if self.subordinate:
-            # Only allowed for Subordinate CA
-            if self.subsystem != "CA":
-                config.pki_log.error(log.PKI_SUBORDINATE_UNSUPPORTED_1,
-                                     self.subsystem,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKI_SUBORDINATE_UNSUPPORTED_1,
-                                self.subsystem)
-
-    def confirm_external_step_two(self):
-        # ALWAYS defined via 'pkiparser.py'
-        if self.external_step_two:
-            # Only allowed for External CA or Stand-alone PKI
-            if self.subsystem != "CA" and not self.standalone:
-                config.pki_log.error(log.PKI_EXTERNAL_STEP_TWO_UNSUPPORTED_1,
-                                     self.subsystem,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKI_EXTERNAL_STEP_TWO_UNSUPPORTED_1,
-                                self.subsystem)
-
-    def confirm_data_exists(self, param):
-        if not param in self.mdict or not len(self.mdict[param]):
-            config.pki_log.error(
-                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
-                param,
-                self.mdict['pki_user_deployment_cfg'],
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            raise Exception(
-                log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 %
-                (param, self.mdict['pki_user_deployment_cfg']))
-
-    def confirm_missing_file(self, param):
-        if os.path.exists(self.mdict[param]):
-            config.pki_log.error(log.PKI_FILE_ALREADY_EXISTS_1,
-                                 self.mdict[param],
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise Exception(log.PKI_FILE_ALREADY_EXISTS_1 % param)
-
-    def confirm_file_exists(self, param):
-        if not os.path.exists(self.mdict[param]) or\
-           not os.path.isfile(self.mdict[param]):
-            config.pki_log.error(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
-                                 self.mdict[param],
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % param)
-
-    def verify_sensitive_data(self):
-        # Silently verify the existence of 'sensitive' data
-        if self.subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
-            # Verify existence of Directory Server Password
-            # (unless configuration will not be automatically executed)
-            if not self.skip_configuration:
-                self.confirm_data_exists("pki_ds_password")
-            # Verify existence of Admin Password (except for Clones)
-            if not self.clone:
-                self.confirm_data_exists("pki_admin_password")
-            # If required, verify existence of Backup Password
-            if config.str2bool(self.mdict['pki_backup_keys']):
-                self.confirm_data_exists("pki_backup_password")
-            # Verify existence of Client Pin for NSS client security databases
-            self.confirm_data_exists("pki_client_database_password")
-            # Verify existence of Client PKCS #12 Password for Admin Cert
-            self.confirm_data_exists("pki_client_pkcs12_password")
-            # Verify existence of PKCS #12 Password (ONLY for Clones)
-            if self.clone:
-                self.confirm_data_exists("pki_clone_pkcs12_password")
-            # Verify existence of Security Domain Password
-            # (ONLY for PKI KRA, PKI OCSP, PKI TKS, PKI TPS, Clones, or
-            #  Subordinate CA that will be automatically configured and
-            #  are not Stand-alone PKI)
-            if (self.subsystem == "KRA" or
-                    self.subsystem == "OCSP" or
-                    self.subsystem == "TKS" or
-                    self.subsystem == "TPS" or
-                    self.clone or
-                    self.subordinate):
-                if not self.skip_configuration and not self.standalone:
-                    self.confirm_data_exists("pki_security_domain_password")
-            # If required, verify existence of Token Password
-            if not self.mdict['pki_token_name'] == "internal":
-                self.confirm_data_exists("pki_token_password")
-        return
-
-    def verify_mutually_exclusive_data(self):
-        # Silently verify the existence of 'mutually exclusive' data
-        if self.subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
-            if self.subsystem == "CA":
-                if self.clone and self.external and self.subordinate:
-                    config.pki_log.error(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_SUB_CA,
-                        self.mdict['pki_user_deployment_cfg'],
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_SUB_CA %
-                        self.mdict['pki_user_deployment_cfg'])
-                elif self.clone and self.external:
-                    config.pki_log.error(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_CA,
-                        self.mdict['pki_user_deployment_cfg'],
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_CA %
-                        self.mdict['pki_user_deployment_cfg'])
-                elif self.clone and self.subordinate:
-                    config.pki_log.error(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_SUB_CA,
-                        self.mdict['pki_user_deployment_cfg'],
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_SUB_CA %
-                        self.mdict['pki_user_deployment_cfg'])
-                elif self.external and self.subordinate:
-                    config.pki_log.error(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_EXTERNAL_SUB_CA,
-                        self.mdict['pki_user_deployment_cfg'],
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_EXTERNAL_SUB_CA %
-                        self.mdict['pki_user_deployment_cfg'])
-            elif self.standalone:
-                if self.clone:
-                    config.pki_log.error(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_STANDALONE_PKI,
-                        self.mdict['pki_user_deployment_cfg'],
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(
-                        log.PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_STANDALONE_PKI %
-                        self.mdict['pki_user_deployment_cfg'])
-
-    def verify_predefined_configuration_file_data(self):
-        # Silently verify the existence of any required 'predefined' data
-        #
-        # FUTURE:  As much as is possible, alter this routine to verify
-        #          ALL name/value pairs for the requested configuration
-        #          scenario.  This should include checking for the
-        #          "existence" of ALL required "name" parameters, as well as
-        #          the "existence", "type" (e. g. -  string, boolean, number,
-        #          etc.), and "correctness" (e. g. - file, directory, boolean
-        #          'True' or 'False', etc.) of ALL required "value" parameters.
-        #
-        if self.subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
-            self.confirm_external()
-            self.confirm_standalone()
-            self.confirm_subordinate()
-            self.confirm_external_step_two()
-            if self.clone:
-                # Verify existence of clone parameters
-                #
-                #     NOTE:  Although this will be checked prior to getting to
-                #            this method, this clone's 'pki_instance_name' MUST
-                #            be different from the master's 'pki_instance_name'
-                #            IF AND ONLY IF the master and clone are located on
-                #            the same host!
-                #
-                self.confirm_data_exists("pki_ds_base_dn")
-                # FUTURE:  Check for unused port value(s)
-                #          (e. g. - must be different from master if the
-                #                   master is located on the same host)
-                self.confirm_data_exists("pki_ds_ldap_port")
-                self.confirm_data_exists("pki_ds_ldaps_port")
-                self.confirm_data_exists("pki_ajp_port")
-                self.confirm_data_exists("pki_http_port")
-                self.confirm_data_exists("pki_https_port")
-                self.confirm_data_exists("pki_tomcat_server_port")
-                self.confirm_data_exists("pki_clone_pkcs12_path")
-                self.confirm_file_exists("pki_clone_pkcs12_path")
-                self.confirm_data_exists("pki_clone_replication_security")
-                self.confirm_data_exists("pki_clone_uri")
-            elif self.external:
-                # External CA
-                if not self.external_step_two:
-                    # External CA (Step 1)
-                    self.confirm_data_exists("pki_external_csr_path")
-                    self.confirm_missing_file("pki_external_csr_path")
-                else:
-                    # External CA (Step 2)
-                    self.confirm_data_exists("pki_external_ca_cert_chain_path")
-                    self.confirm_file_exists("pki_external_ca_cert_chain_path")
-                    self.confirm_data_exists("pki_external_ca_cert_path")
-                    self.confirm_file_exists("pki_external_ca_cert_path")
-            elif not self.skip_configuration and self.standalone:
-                if not self.external_step_two:
-                    # Stand-alone PKI Admin CSR (Step 1)
-                    self.confirm_data_exists("pki_external_admin_csr_path")
-                    self.confirm_missing_file("pki_external_admin_csr_path")
-                    # Stand-alone PKI Audit Signing CSR (Step 1)
-                    self.confirm_data_exists(
-                        "pki_external_audit_signing_csr_path")
-                    self.confirm_missing_file(
-                        "pki_external_audit_signing_csr_path")
-                    # Stand-alone PKI SSL Server CSR (Step 1)
-                    self.confirm_data_exists("pki_external_sslserver_csr_path")
-                    self.confirm_missing_file("pki_external_sslserver_csr_path")
-                    # Stand-alone PKI Subsystem CSR (Step 1)
-                    self.confirm_data_exists("pki_external_subsystem_csr_path")
-                    self.confirm_missing_file("pki_external_subsystem_csr_path")
-                    # Stand-alone PKI KRA CSRs
-                    if self.subsystem == "KRA":
-                        # Stand-alone PKI KRA Storage CSR (Step 1)
-                        self.confirm_data_exists(
-                            "pki_external_storage_csr_path")
-                        self.confirm_missing_file(
-                            "pki_external_storage_csr_path")
-                        # Stand-alone PKI KRA Transport CSR (Step 1)
-                        self.confirm_data_exists(
-                            "pki_external_transport_csr_path")
-                        self.confirm_missing_file(
-                            "pki_external_transport_csr_path")
-                    # Stand-alone PKI OCSP CSRs
-                    if self.subsystem == "OCSP":
-                        # Stand-alone PKI OCSP OCSP Signing CSR (Step 1)
-                        self.confirm_data_exists(
-                            "pki_external_signing_csr_path")
-                        self.confirm_missing_file(
-                            "pki_external_signing_csr_path")
-                else:
-                    # Stand-alone PKI External CA Certificate Chain (Step 2)
-                    self.confirm_data_exists("pki_external_ca_cert_chain_path")
-                    self.confirm_file_exists("pki_external_ca_cert_chain_path")
-                    # Stand-alone PKI External CA Certificate (Step 2)
-                    self.confirm_data_exists("pki_external_ca_cert_path")
-                    self.confirm_file_exists("pki_external_ca_cert_path")
-                    # Stand-alone PKI Admin Certificate (Step 2)
-                    self.confirm_data_exists("pki_external_admin_cert_path")
-                    self.confirm_file_exists("pki_external_admin_cert_path")
-                    # Stand-alone PKI Audit Signing Certificate (Step 2)
-                    self.confirm_data_exists(
-                        "pki_external_audit_signing_cert_path")
-                    self.confirm_file_exists(
-                        "pki_external_audit_signing_cert_path")
-                    # Stand-alone PKI SSL Server Certificate (Step 2)
-                    self.confirm_data_exists("pki_external_sslserver_cert_path")
-                    self.confirm_file_exists("pki_external_sslserver_cert_path")
-                    # Stand-alone PKI Subsystem Certificate (Step 2)
-                    self.confirm_data_exists("pki_external_subsystem_cert_path")
-                    self.confirm_file_exists("pki_external_subsystem_cert_path")
-                    # Stand-alone PKI KRA Certificates
-                    if self.subsystem == "KRA":
-                        # Stand-alone PKI KRA Storage Certificate (Step 2)
-                        self.confirm_data_exists(
-                            "pki_external_storage_cert_path")
-                        self.confirm_file_exists(
-                            "pki_external_storage_cert_path")
-                        # Stand-alone PKI KRA Transport Certificate (Step 2)
-                        self.confirm_data_exists(
-                            "pki_external_transport_cert_path")
-                        self.confirm_file_exists(
-                            "pki_external_transport_cert_path")
-                    # Stand-alone PKI OCSP Certificates
-                    if self.subsystem == "OCSP":
-                        # Stand-alone PKI OCSP OCSP Signing Certificate (Step 2)
-                        self.confirm_data_exists(
-                            "pki_external_signing_cert_path")
-                        self.confirm_file_exists(
-                            "pki_external_signing_cert_path")
-        return
-
-    def populate_non_default_ports(self):
-        if (self.mdict['pki_http_port'] !=
-                str(config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_HTTP_PORT)):
-            ports.append(self.mdict['pki_http_port'])
-        if (self.mdict['pki_https_port'] !=
-                str(config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_HTTPS_PORT)):
-            ports.append(self.mdict['pki_https_port'])
-        if (self.mdict['pki_tomcat_server_port'] !=
-                str(config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_SERVER_PORT)):
-            ports.append(self.mdict['pki_tomcat_server_port'])
-        if (self.mdict['pki_ajp_port'] !=
-                str(config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_AJP_PORT)):
-            ports.append(self.mdict['pki_ajp_port'])
-        return
-
-    def verify_selinux_ports(self):
-        # Determine which ports still need to be labelled, and if any are
-        # incorrectly labelled
-        if len(ports) == 0:
-            return
-
-        if not bool(selinux.is_selinux_enabled()):
-            config.pki_log.error(
-                log.PKIHELPER_SELINUX_DISABLED,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            return
-
-        portrecs = seobject.portRecords().get_all()
-        portlist = ports[:]
-        for port in portlist:
-            context = ""
-            for i in portrecs:
-                if (portrecs[i][0] == "unreserved_port_t" or
-                        portrecs[i][0] == "reserved_port_t" or
-                        i[2] != "tcp"):
-                    continue
-                if i[0] <= int(port) <= i[1]:
-                    context = portrecs[i][0]
-                    break
-            if context == "":
-                # port has no current context
-                # leave it in list of ports to set
-                continue
-            elif context == config.PKI_PORT_SELINUX_CONTEXT:
-                # port is already set correctly
-                # remove from list of ports to set
-                ports.remove(port)
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_INVALID_SELINUX_CONTEXT_FOR_PORT,
-                    port, context,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKIHELPER_INVALID_SELINUX_CONTEXT_FOR_PORT %
-                    (port, context))
-        return
-
-    def verify_command_matches_configuration_file(self):
-        # Silently verify that the command-line parameters match the values
-        # that are present in the corresponding configuration file
-        if self.mdict['pki_deployment_executable'] == 'pkidestroy':
-            if self.mdict['pki_deployed_instance_name'] != \
-               self.mdict['pki_instance_name']:
-                config.pki_log.error(
-                    log.PKIHELPER_COMMAND_LINE_PARAMETER_MISMATCH_2,
-                    self.mdict['pki_deployed_instance_name'],
-                    self.mdict['pki_instance_name'],
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 % (
-                        self.mdict['pki_deployed_instance_name'],
-                        self.mdict['pki_instance_name']))
-        return
-
-# PKI Deployment XML File Class
-# class xml_file:
-#    def remove_filter_section_from_web_xml(self,
-#                                           web_xml_source,
-#                                           web_xml_target):
-#        config.pki_log.info(log.PKIHELPER_REMOVE_FILTER_SECTION_1,
-#            self.mdict['pki_target_subsystem_web_xml'],
-#            extra=config.PKI_INDENTATION_LEVEL_2)
-#        begin_filters_section = False
-#        begin_servlet_section = False
-#        FILE = open(web_xml_target, "w")
-#        for line in fileinput.FileInput(web_xml_source):
-#            if not begin_filters_section:
-#                # Read and write lines until first "<filter>" tag
-#                if line.count("<filter>") >= 1:
-#                    # Mark filters section
-#                    begin_filters_section = True
-#                else:
-#                    FILE.write(line)
-#            elif not begin_servlet_section:
-#                # Skip lines until first "<servlet>" tag
-#                if line.count("<servlet>") >= 1:
-#                    # Mark servlets section and write out the opening tag
-#                    begin_servlet_section = True
-#                    FILE.write(line)
-#                else:
-#                    continue
-#            else:
-#                # Read and write lines all lines after "<servlet>" tag
-#                FILE.write(line)
-#        FILE.close()
-
-
-class Instance:
-    """PKI Deployment Instance Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-
-    def apache_instance_subsystems(self):
-        rv = 0
-        try:
-            # count number of PKI subsystems present
-            # within the specified Apache instance
-            for subsystem in config.PKI_APACHE_SUBSYSTEMS:
-                path = self.mdict['pki_instance_path'] + "/" + subsystem.lower()
-                if os.path.exists(path) and os.path.isdir(path):
-                    rv += 1
-            config.pki_log.debug(log.PKIHELPER_APACHE_INSTANCE_SUBSYSTEMS_2,
-                                 self.mdict['pki_instance_path'],
-                                 rv, extra=config.PKI_INDENTATION_LEVEL_2)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-        return rv
-
-    def apache_instances(self):
-        rv = 0
-        try:
-            # Since ALL directories under the top-level PKI 'apache' registry
-            # directory SHOULD represent PKI Apache instances, and there
-            # shouldn't be any stray files or symbolic links at this level,
-            # simply count the number of PKI 'apache' instances (directories)
-            # present within the PKI 'apache' registry directory
-            for instance in\
-                    os.listdir(self.mdict['pki_instance_type_registry_path']):
-                if os.path.isdir(
-                        os.path.join(
-                            self.mdict['pki_instance_type_registry_path'],
-                            instance)) and not\
-                   os.path.islink(
-                       os.path.join(
-                           self.mdict['pki_instance_type_registry_path'],
-                           instance)):
-                    rv += 1
-            config.pki_log.debug(log.PKIHELPER_APACHE_INSTANCES_2,
-                                 self.mdict['pki_instance_type_registry_path'],
-                                 rv,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-        return rv
-
-    def pki_instance_subsystems(self):
-        rv = 0
-        try:
-            # Since ALL directories within the top-level PKI infrastructure
-            # SHOULD represent PKI instances, look for all possible
-            # PKI instances within the top-level PKI infrastructure
-            for instance in os.listdir(self.mdict['pki_path']):
-                if os.path.isdir(os.path.join(self.mdict['pki_path'], instance))\
-                   and not\
-                   os.path.islink(os.path.join(self.mdict['pki_path'], instance)):
-                    instance_dir = os.path.join(self.mdict['pki_path'], instance)
-                    # Since ANY directory within this PKI instance COULD
-                    # be a PKI subsystem, look for all possible
-                    # PKI subsystems within this PKI instance
-                    for name in os.listdir(instance_dir):
-                        if os.path.isdir(os.path.join(instance_dir, name)) and\
-                           not os.path.islink(os.path.join(instance_dir, name)):
-                            if name.upper() in config.PKI_SUBSYSTEMS:
-                                rv += 1
-            config.pki_log.debug(log.PKIHELPER_PKI_INSTANCE_SUBSYSTEMS_2,
-                                 self.mdict['pki_instance_path'], rv,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-        return rv
-
-    def tomcat_instance_subsystems(self):
-        # Return list of PKI subsystems in the specified tomcat instance
-        rv = []
-        try:
-            for subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
-                path = self.mdict['pki_instance_path'] + "/" + subsystem.lower()
-                if os.path.exists(path) and os.path.isdir(path):
-                    rv.append(subsystem)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-        return rv
-
-    def tomcat_instances(self):
-        rv = 0
-        try:
-            # Since ALL directories under the top-level PKI 'tomcat' registry
-            # directory SHOULD represent PKI Tomcat instances, and there
-            # shouldn't be any stray files or symbolic links at this level,
-            # simply count the number of PKI 'tomcat' instances (directories)
-            # present within the PKI 'tomcat' registry directory
-            for instance in os.listdir(
-                    self.mdict['pki_instance_type_registry_path']):
-                if os.path.isdir(
-                    os.path.join(
-                        self.mdict['pki_instance_type_registry_path'],
-                        instance)) and not\
-                   os.path.islink(
-                       os.path.join(
-                           self.mdict['pki_instance_type_registry_path'],
-                           instance)):
-                    rv += 1
-            config.pki_log.debug(log.PKIHELPER_TOMCAT_INSTANCES_2,
-                                 self.mdict['pki_instance_type_registry_path'],
-                                 rv,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-        return rv
-
-    def verify_subsystem_exists(self):
-        try:
-            if not os.path.exists(self.mdict['pki_subsystem_path']):
-                config.pki_log.error(log.PKI_SUBSYSTEM_DOES_NOT_EXIST_2,
-                                     self.mdict['pki_subsystem'],
-                                     self.mdict['pki_instance_name'],
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_SUBSYSTEM_DOES_NOT_EXIST_2 % (
-                        self.mdict['pki_subsystem'],
-                        self.mdict['pki_instance_name']))
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-
-    def verify_subsystem_does_not_exist(self):
-        try:
-            if os.path.exists(self.mdict['pki_subsystem_path']):
-                config.pki_log.error(log.PKI_SUBSYSTEM_ALREADY_EXISTS_2,
-                                     self.mdict['pki_subsystem'],
-                                     self.mdict['pki_instance_name'],
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_SUBSYSTEM_DOES_NOT_EXIST_2 % (
-                        self.mdict['pki_subsystem'],
-                        self.mdict['pki_instance_name']))
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-
-    def get_instance_status(self):
-        connection = pki.client.PKIConnection(
-            protocol='https',
-            hostname=self.mdict['pki_hostname'],
-            port=self.mdict['pki_https_port'],
-            subsystem=self.mdict['pki_subsystem_type'],
-            accept='application/xml')
-
-        # catching all exceptions because we do not want to break if underlying
-        # requests or urllib3 use a different exception.
-        # If the connection fails, we will time out in any case
-        # pylint: disable-msg=W0703
-        try:
-            client = pki.system.SystemStatusClient(connection)
-            response = client.get_status()
-            config.pki_log.debug(response, extra=config.PKI_INDENTATION_LEVEL_3)
-
-            root = ET.fromstring(response)
-            status = root.findtext("Status")
-            return status
-        except Exception as exc:
-            config.pki_log.debug(
-                "No connection - server may still be down",
-                extra=config.PKI_INDENTATION_LEVEL_3)
-            config.pki_log.debug(
-                "No connection - exception thrown: " + str(exc),
-                extra=config.PKI_INDENTATION_LEVEL_3)
-            return None
-
-    def wait_for_startup(self, timeout):
-        start_time = datetime.today()
-        status = None
-        while status != "running":
-            status = self.get_instance_status()
-            time.sleep(1)
-            stop_time = datetime.today()
-            if (stop_time - start_time).total_seconds() >= timeout:
-                break
-        return status
-
-
-class Directory:
-    """PKI Deployment Directory Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-        self.identity = deployer.identity
-        self.manifest_db = deployer.manifest_db
-
-    def create(self, name, uid=None, gid=None,
-               perms=config.PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS,
-               acls=None, critical_failure=True):
-        try:
-            if not os.path.exists(name):
-                # mkdir -p <name>
-                config.pki_log.info(log.PKIHELPER_MKDIR_1, name,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                os.makedirs(name)
-                # chmod <perms> <name>
-                config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chmod(name, perms)
-                # chown <uid>:<gid> <name>
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
-                                     uid, gid, name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chown(name, uid, gid)
-                # Store record in installation manifest
-                record = manifest.Record()
-                record.name = name
-                record.type = manifest.RECORD_TYPE_DIRECTORY
-                record.user = self.mdict['pki_user']
-                record.group = self.mdict['pki_group']
-                record.uid = uid
-                record.gid = gid
-                record.permissions = perms
-                record.acls = acls
-                self.manifest_db.append(record)
-            elif not os.path.isdir(name):
-                config.pki_log.error(
-                    log.PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(
-                        log.PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1 %
-                        name)
-        except OSError as exc:
-            if exc.errno == errno.EEXIST:
-                pass
-            else:
-                config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise
-        return
-
-    def modify(self, name, uid=None, gid=None,
-               perms=config.PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS,
-               acls=None, silent=False, critical_failure=True):
-        try:
-            if os.path.exists(name):
-                if not os.path.isdir(name):
-                    config.pki_log.error(
-                        log.PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1,
-                        name, extra=config.PKI_INDENTATION_LEVEL_2)
-                    if critical_failure:
-                        raise Exception(
-                            log.PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1 %
-                            name)
-                # Always re-process each directory whether it needs it or not
-                if not silent:
-                    config.pki_log.info(log.PKIHELPER_MODIFY_DIR_1, name,
-                                        extra=config.PKI_INDENTATION_LEVEL_2)
-                # chmod <perms> <name>
-                if not silent:
-                    config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
-                                         extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chmod(name, perms)
-                # chown <uid>:<gid> <name>
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                if not silent:
-                    config.pki_log.debug(log.PKIHELPER_CHOWN_3,
-                                         uid, gid, name,
-                                         extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chown(name, uid, gid)
-                # Store record in installation manifest
-                if not silent:
-                    record = manifest.Record()
-                    record.name = name
-                    record.type = manifest.RECORD_TYPE_DIRECTORY
-                    record.user = self.mdict['pki_user']
-                    record.group = self.mdict['pki_group']
-                    record.uid = uid
-                    record.gid = gid
-                    record.permissions = perms
-                    record.acls = acls
-                    self.manifest_db.append(record)
-            else:
-                config.pki_log.error(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(
-                        log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % name)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def delete(self, name, recursive_flag=True, critical_failure=True):
-        try:
-            if not os.path.exists(name) or not os.path.isdir(name):
-                # Simply issue a warning and continue
-                config.pki_log.warning(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-            else:
-                if recursive_flag:
-                    # rm -rf <name>
-                    config.pki_log.info(log.PKIHELPER_RM_RF_1, name,
-                                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    shutil.rmtree(name)
-                else:
-                    # rmdir <name>
-                    config.pki_log.info(log.PKIHELPER_RMDIR_1, name,
-                                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    os.rmdir(name)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def exists(self, name):
-        try:
-            if not os.path.exists(name) or not os.path.isdir(name):
-                return False
-            else:
-                return True
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-
-    def is_empty(self, name):
-        try:
-            if not os.listdir(name):
-                config.pki_log.debug(log.PKIHELPER_DIRECTORY_IS_EMPTY_1,
-                                     name, extra=config.PKI_INDENTATION_LEVEL_2)
-                return True
-            else:
-                config.pki_log.debug(log.PKIHELPER_DIRECTORY_IS_NOT_EMPTY_1,
-                                     name, extra=config.PKI_INDENTATION_LEVEL_2)
-                return False
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-
-    def set_mode(
-            self, name, uid=None, gid=None,
-            dir_perms=config.PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS,
-            file_perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
-            symlink_perms=config.PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS,
-            dir_acls=None, file_acls=None, symlink_acls=None,
-            recursive_flag=True, critical_failure=True):
-        try:
-            if not os.path.exists(name) or not os.path.isdir(name):
-                config.pki_log.error(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % name)
-            else:
-                config.pki_log.info(
-                    log.PKIHELPER_SET_MODE_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                if recursive_flag:
-                    for root, dirs, files in os.walk(name):
-                        for name in files:
-                            entity = os.path.join(root, name)
-                            if not os.path.islink(entity):
-                                temp_file = entity
-                                config.pki_log.debug(
-                                    log.PKIHELPER_IS_A_FILE_1, temp_file,
-                                    extra=config.PKI_INDENTATION_LEVEL_3)
-                                # chmod <file_perms> <name>
-                                config.pki_log.debug(
-                                    log.PKIHELPER_CHMOD_2,
-                                    file_perms, temp_file,
-                                    extra=config.PKI_INDENTATION_LEVEL_3)
-                                os.chmod(temp_file, file_perms)
-                                # chown <uid>:<gid> <name>
-                                config.pki_log.debug(
-                                    log.PKIHELPER_CHOWN_3,
-                                    uid, gid, temp_file,
-                                    extra=config.PKI_INDENTATION_LEVEL_3)
-                                os.chown(temp_file, uid, gid)
-                                # Store record in installation manifest
-                                record = manifest.Record()
-                                record.name = name
-                                record.type = manifest.RECORD_TYPE_FILE
-                                record.user = self.mdict['pki_user']
-                                record.group = self.mdict['pki_group']
-                                record.uid = uid
-                                record.gid = gid
-                                record.permissions = file_perms
-                                record.acls = file_acls
-                                self.manifest_db.append(record)
-                            else:
-                                symlink = entity
-                                config.pki_log.debug(
-                                    log.PKIHELPER_IS_A_SYMLINK_1, symlink,
-                                    extra=config.PKI_INDENTATION_LEVEL_3)
-                                # REMINDER:  Due to POSIX compliance, 'lchmod'
-                                #            is NEVER implemented on Linux
-                                #            systems since 'chmod' CANNOT be
-                                #            run directly against symbolic
-                                #            links!
-                                # chown -h <uid>:<gid> <symlink>
-                                config.pki_log.debug(
-                                    log.PKIHELPER_CHOWN_H_3,
-                                    uid, gid, symlink,
-                                    extra=config.PKI_INDENTATION_LEVEL_3)
-                                os.lchown(symlink, uid, gid)
-                                # Store record in installation manifest
-                                record = manifest.Record()
-                                record.name = name
-                                record.type = manifest.RECORD_TYPE_SYMLINK
-                                record.user = self.mdict['pki_user']
-                                record.group = self.mdict['pki_group']
-                                record.uid = uid
-                                record.gid = gid
-                                record.permissions = symlink_perms
-                                record.acls = symlink_acls
-                                self.manifest_db.append(record)
-                        for name in dirs:
-                            temp_dir = os.path.join(root, name)
-                            config.pki_log.debug(
-                                log.PKIHELPER_IS_A_DIRECTORY_1, temp_dir,
-                                extra=config.PKI_INDENTATION_LEVEL_3)
-                            # chmod <dir_perms> <name>
-                            config.pki_log.debug(
-                                log.PKIHELPER_CHMOD_2,
-                                dir_perms, temp_dir,
-                                extra=config.PKI_INDENTATION_LEVEL_3)
-                            os.chmod(temp_dir, dir_perms)
-                            # chown <uid>:<gid> <name>
-                            config.pki_log.debug(
-                                log.PKIHELPER_CHOWN_3,
-                                uid, gid, temp_dir,
-                                extra=config.PKI_INDENTATION_LEVEL_3)
-                            os.chown(temp_dir, uid, gid)
-                            # Store record in installation manifest
-                            record = manifest.Record()
-                            record.name = name
-                            record.type = manifest.RECORD_TYPE_DIRECTORY
-                            record.user = self.mdict['pki_user']
-                            record.group = self.mdict['pki_group']
-                            record.uid = uid
-                            record.gid = gid
-                            record.permissions = dir_perms
-                            record.acls = dir_acls
-                            self.manifest_db.append(record)
-                else:
-                    config.pki_log.debug(
-                        log.PKIHELPER_IS_A_DIRECTORY_1, name,
-                        extra=config.PKI_INDENTATION_LEVEL_3)
-                    # chmod <dir_perms> <name>
-                    config.pki_log.debug(log.PKIHELPER_CHMOD_2,
-                                         dir_perms, name,
-                                         extra=config.PKI_INDENTATION_LEVEL_3)
-                    os.chmod(name, dir_perms)
-                    # chown <uid>:<gid> <name>
-                    config.pki_log.debug(log.PKIHELPER_CHOWN_3,
-                                         uid, gid, name,
-                                         extra=config.PKI_INDENTATION_LEVEL_3)
-                    os.chown(name, uid, gid)
-                    # Store record in installation manifest
-                    record = manifest.Record()
-                    record.name = name
-                    record.type = manifest.RECORD_TYPE_DIRECTORY
-                    record.user = self.mdict['pki_user']
-                    record.group = self.mdict['pki_group']
-                    record.uid = uid
-                    record.gid = gid
-                    record.permissions = dir_perms
-                    record.acls = dir_acls
-                    self.manifest_db.append(record)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-
-    def copy(self, old_name, new_name, uid=None, gid=None,
-             dir_perms=config.PKI_DEPLOYMENT_DEFAULT_DIR_PERMISSIONS,
-             file_perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
-             symlink_perms=config.PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS,
-             dir_acls=None, file_acls=None, symlink_acls=None,
-             recursive_flag=True, overwrite_flag=False, critical_failure=True):
-        try:
-            if not os.path.exists(old_name) or not os.path.isdir(old_name):
-                config.pki_log.error(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, old_name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % old_name)
-            else:
-                if os.path.exists(new_name):
-                    if not overwrite_flag:
-                        config.pki_log.error(
-                            log.PKI_DIRECTORY_ALREADY_EXISTS_1, new_name,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(
-                            log.PKI_DIRECTORY_ALREADY_EXISTS_1 % new_name)
-                if recursive_flag:
-                    # cp -rp <old_name> <new_name>
-                    config.pki_log.info(log.PKIHELPER_CP_RP_2,
-                                        old_name, new_name,
-                                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    # Due to a limitation in the 'shutil.copytree()'
-                    # implementation which requires that
-                    # 'The destination directory must not already exist.',
-                    # an OSError exception is always thrown due to the
-                    # implementation's unchecked call to 'os.makedirs(dst)'.
-                    # Consequently, a 'patched' local copy of this routine has
-                    # been included in this file with the appropriate fix.
-                    pki_copytree(old_name, new_name)
-                else:
-                    # cp -p <old_name> <new_name>
-                    config.pki_log.info(log.PKIHELPER_CP_P_2,
-                                        old_name, new_name,
-                                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    shutil.copy2(old_name, new_name)
-                # set ownerships, permissions, and acls
-                # of newly created top-level directory
-                self.modify(new_name, uid, gid, dir_perms, dir_acls,
-                            True, critical_failure)
-                # set ownerships, permissions, and acls
-                # of contents of newly created top-level directory
-                self.set_mode(new_name, uid, gid,
-                              dir_perms, file_perms, symlink_perms,
-                              dir_acls, file_acls, symlink_acls,
-                              recursive_flag, critical_failure)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except shutil.Error as exc:
-            config.pki_log.error(log.PKI_SHUTIL_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-
-class File:
-    """PKI Deployment File Class (also used for executables)"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-        self.slots = deployer.slots
-        self.identity = deployer.identity
-        self.manifest_db = deployer.manifest_db
-
-    def create(self, name, uid=None, gid=None,
-               perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
-               acls=None, critical_failure=True):
-        try:
-            if not os.path.exists(name):
-                # touch <name>
-                config.pki_log.info(log.PKIHELPER_TOUCH_1, name,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                open(name, "w").close()
-                # chmod <perms> <name>
-                config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chmod(name, perms)
-                # chown <uid>:<gid> <name>
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
-                                     uid, gid, name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chown(name, uid, gid)
-                # Store record in installation manifest
-                record = manifest.Record()
-                record.name = name
-                record.type = manifest.RECORD_TYPE_FILE
-                record.user = self.mdict['pki_user']
-                record.group = self.mdict['pki_group']
-                record.uid = uid
-                record.gid = gid
-                record.permissions = perms
-                record.acls = acls
-                self.manifest_db.append(record)
-            elif not os.path.isfile(name):
-                config.pki_log.error(
-                    log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(
-                        log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 % name)
-        except OSError as exc:
-            if exc.errno == errno.EEXIST:
-                pass
-            else:
-                config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise
-        return
-
-    def modify(self, name, uid=None, gid=None,
-               perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
-               acls=None, silent=False, critical_failure=True):
-        try:
-            if os.path.exists(name):
-                if not os.path.isfile(name):
-                    config.pki_log.error(
-                        log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1,
-                        name, extra=config.PKI_INDENTATION_LEVEL_2)
-                    if critical_failure:
-                        raise Exception(
-                            log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 % name)
-                # Always re-process each file whether it needs it or not
-                if not silent:
-                    config.pki_log.info(log.PKIHELPER_MODIFY_FILE_1, name,
-                                        extra=config.PKI_INDENTATION_LEVEL_2)
-                # chmod <perms> <name>
-                if not silent:
-                    config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
-                                         extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chmod(name, perms)
-                # chown <uid>:<gid> <name>
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                if not silent:
-                    config.pki_log.debug(log.PKIHELPER_CHOWN_3,
-                                         uid, gid, name,
-                                         extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chown(name, uid, gid)
-                # Store record in installation manifest
-                if not silent:
-                    record = manifest.Record()
-                    record.name = name
-                    record.type = manifest.RECORD_TYPE_FILE
-                    record.user = self.mdict['pki_user']
-                    record.group = self.mdict['pki_group']
-                    record.uid = uid
-                    record.gid = gid
-                    record.permissions = perms
-                    record.acls = acls
-                    self.manifest_db.append(record)
-            else:
-                config.pki_log.error(
-                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % name)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def delete(self, name, critical_failure=True):
-        try:
-            if not os.path.exists(name) or not os.path.isfile(name):
-                # Simply issue a warning and continue
-                config.pki_log.warning(
-                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-            else:
-                # rm -f <name>
-                config.pki_log.info(log.PKIHELPER_RM_F_1, name,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                os.remove(name)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def exists(self, name):
-        try:
-            if not os.path.exists(name) or not os.path.isfile(name):
-                return False
-            else:
-                return True
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-
-    def copy(self, old_name, new_name, uid=None, gid=None,
-             perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS, acls=None,
-             overwrite_flag=False, critical_failure=True):
-        try:
-            if not os.path.exists(old_name) or not os.path.isfile(old_name):
-                config.pki_log.error(
-                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, old_name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % old_name)
-            else:
-                if os.path.exists(new_name):
-                    if not overwrite_flag:
-                        config.pki_log.error(
-                            log.PKI_FILE_ALREADY_EXISTS_1, new_name,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(
-                            log.PKI_FILE_ALREADY_EXISTS_1 % new_name)
-                # cp -p <old_name> <new_name>
-                config.pki_log.info(log.PKIHELPER_CP_P_2,
-                                    old_name, new_name,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                shutil.copy2(old_name, new_name)
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                # chmod <perms> <new_name>
-                config.pki_log.debug(log.PKIHELPER_CHMOD_2,
-                                     perms, new_name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chmod(new_name, perms)
-                # chown <uid>:<gid> <new_name>
-                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
-                                     uid, gid, new_name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chown(new_name, uid, gid)
-                # Store record in installation manifest
-                record = manifest.Record()
-                record.name = new_name
-                record.type = manifest.RECORD_TYPE_FILE
-                record.user = self.mdict['pki_user']
-                record.group = self.mdict['pki_group']
-                record.uid = uid
-                record.gid = gid
-                record.permissions = perms
-                record.acls = acls
-                self.manifest_db.append(record)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except shutil.Error as exc:
-            config.pki_log.error(log.PKI_SHUTIL_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def apply_slot_substitution(
-            self, name, uid=None, gid=None,
-            perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
-            acls=None, critical_failure=True):
-        try:
-            if not os.path.exists(name) or not os.path.isfile(name):
-                config.pki_log.error(
-                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % name)
-            # applying in-place slot substitutions on <name>
-            config.pki_log.info(log.PKIHELPER_APPLY_SLOT_SUBSTITUTION_1,
-                                name,
-                                extra=config.PKI_INDENTATION_LEVEL_2)
-            for line in fileinput.FileInput(name, inplace=1):
-                for slot in self.slots:
-                    if slot != '__name__' and self.slots[slot] in line:
-                        config.pki_log.debug(
-                            log.PKIHELPER_SLOT_SUBSTITUTION_2,
-                            self.slots[slot], self.mdict[slot],
-                            extra=config.PKI_INDENTATION_LEVEL_3)
-                        line = line.replace(self.slots[slot], self.mdict[slot])
-                sys.stdout.write(line)
-            if uid is None:
-                uid = self.identity.get_uid()
-            if gid is None:
-                gid = self.identity.get_gid()
-            # chmod <perms> <name>
-            config.pki_log.debug(log.PKIHELPER_CHMOD_2,
-                                 perms, name,
-                                 extra=config.PKI_INDENTATION_LEVEL_3)
-            os.chmod(name, perms)
-            # chown <uid>:<gid> <name>
-            config.pki_log.debug(log.PKIHELPER_CHOWN_3,
-                                 uid, gid, name,
-                                 extra=config.PKI_INDENTATION_LEVEL_3)
-            os.chown(name, uid, gid)
-            # Store record in installation manifest
-            record = manifest.Record()
-            record.name = name
-            record.type = manifest.RECORD_TYPE_FILE
-            record.user = self.mdict['pki_user']
-            record.group = self.mdict['pki_group']
-            record.uid = uid
-            record.gid = gid
-            record.permissions = perms
-            record.acls = acls
-            self.manifest_db.append(record)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except shutil.Error as exc:
-            config.pki_log.error(log.PKI_SHUTIL_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def copy_with_slot_substitution(
-            self, old_name, new_name, uid=None, gid=None,
-            perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
-            acls=None, overwrite_flag=False,
-            critical_failure=True):
-        try:
-            if not os.path.exists(old_name) or not os.path.isfile(old_name):
-                config.pki_log.error(
-                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, old_name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % old_name)
-            else:
-                if os.path.exists(new_name):
-                    if not overwrite_flag:
-                        config.pki_log.error(
-                            log.PKI_FILE_ALREADY_EXISTS_1, new_name,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(
-                            log.PKI_FILE_ALREADY_EXISTS_1 % new_name)
-                # copy <old_name> to <new_name> with slot substitutions
-                config.pki_log.info(log.PKIHELPER_COPY_WITH_SLOT_SUBSTITUTION_2,
-                                    old_name, new_name,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                with open(new_name, "w") as FILE:
-                    for line in fileinput.FileInput(old_name):
-                        for slot in self.slots:
-                            if slot != '__name__' and self.slots[slot] in line:
-                                config.pki_log.debug(
-                                    log.PKIHELPER_SLOT_SUBSTITUTION_2,
-                                    self.slots[slot], self.mdict[slot],
-                                    extra=config.PKI_INDENTATION_LEVEL_3)
-                                line = line.replace(
-                                    self.slots[slot],
-                                    self.mdict[slot])
-                        FILE.write(line)
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                # chmod <perms> <new_name>
-                config.pki_log.debug(log.PKIHELPER_CHMOD_2,
-                                     perms, new_name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chmod(new_name, perms)
-                # chown <uid>:<gid> <new_name>
-                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
-                                     uid, gid, new_name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chown(new_name, uid, gid)
-                # Store record in installation manifest
-                record = manifest.Record()
-                record.name = new_name
-                record.type = manifest.RECORD_TYPE_FILE
-                record.user = self.mdict['pki_user']
-                record.group = self.mdict['pki_group']
-                record.uid = uid
-                record.gid = gid
-                record.permissions = perms
-                record.acls = acls
-                self.manifest_db.append(record)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except shutil.Error as exc:
-            config.pki_log.error(log.PKI_SHUTIL_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def generate_noise_file(
-            self, name, random_bytes, uid=None, gid=None,
-            perms=config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS,
-            acls=None, critical_failure=True):
-        try:
-            if not os.path.exists(name):
-                # generating noise file called <name> and
-                # filling it with <random_bytes> random bytes
-                config.pki_log.info(
-                    log.PKIHELPER_NOISE_FILE_2, name, random_bytes,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                open(name, "w").close()
-                with open(name, "w") as FILE:
-                    noise = ''.join(random.choice(string.ascii_letters +
-                                    string.digits) for x in range(random_bytes))
-                    FILE.write(noise)
-                # chmod <perms> <name>
-                config.pki_log.debug(log.PKIHELPER_CHMOD_2, perms, name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chmod(name, perms)
-                # chown <uid>:<gid> <name>
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                config.pki_log.debug(log.PKIHELPER_CHOWN_3,
-                                     uid, gid, name,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.chown(name, uid, gid)
-                # Store record in installation manifest
-                record = manifest.Record()
-                record.name = name
-                record.type = manifest.RECORD_TYPE_FILE
-                record.user = self.mdict['pki_user']
-                record.group = self.mdict['pki_group']
-                record.uid = uid
-                record.gid = gid
-                record.permissions = perms
-                record.acls = acls
-                self.manifest_db.append(record)
-            elif not os.path.isfile(name):
-                config.pki_log.error(
-                    log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(
-                        log.PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 % name)
-        except OSError as exc:
-            if exc.errno == errno.EEXIST:
-                pass
-            else:
-                config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise
-        return
-
-
-class Symlink:
-    """PKI Deployment Symbolic Link Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-        self.identity = deployer.identity
-        self.manifest_db = deployer.manifest_db
-
-    def create(self, name, link, uid=None, gid=None,
-               acls=None, allow_dangling_symlink=False, critical_failure=True):
-        try:
-            if not os.path.exists(link):
-                if not os.path.exists(name):
-                    config.pki_log.warning(
-                        log.PKIHELPER_DANGLING_SYMLINK_2, link, name,
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    if not allow_dangling_symlink:
-                        raise Exception(
-                            "Dangling symlink " + link + " not allowed")
-                # ln -s <name> <link>
-                config.pki_log.info(log.PKIHELPER_LINK_S_2, name, link,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                os.symlink(name, link)
-                # REMINDER:  Due to POSIX compliance, 'lchmod' is NEVER
-                #            implemented on Linux systems since 'chmod'
-                #            CANNOT be run directly against symbolic links!
-                # chown -h <uid>:<gid> <link>
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                config.pki_log.debug(log.PKIHELPER_CHOWN_H_3,
-                                     uid, gid, link,
-                                     extra=config.PKI_INDENTATION_LEVEL_3)
-                os.lchown(link, uid, gid)
-                # Store record in installation manifest
-                record = manifest.Record()
-                record.name = link
-                record.type = manifest.RECORD_TYPE_SYMLINK
-                record.user = self.mdict['pki_user']
-                record.group = self.mdict['pki_group']
-                record.uid = uid
-                record.gid = gid
-                record.permissions = \
-                    config.PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS
-                record.acls = acls
-                self.manifest_db.append(record)
-            elif not os.path.islink(link):
-                config.pki_log.error(
-                    log.PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1, link,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(
-                        log.PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1 % link)
-        except OSError as exc:
-            if exc.errno == errno.EEXIST:
-                pass
-            else:
-                config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                     extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise
-        return
-
-    def modify(self, link, uid=None, gid=None,
-               acls=None, silent=False, critical_failure=True):
-        try:
-            if os.path.exists(link):
-                if not os.path.islink(link):
-                    config.pki_log.error(
-                        log.PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1,
-                        link, extra=config.PKI_INDENTATION_LEVEL_2)
-                    if critical_failure:
-                        raise Exception(
-                            log.PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1 %
-                            link)
-                # Always re-process each link whether it needs it or not
-                if not silent:
-                    config.pki_log.info(log.PKIHELPER_MODIFY_SYMLINK_1, link,
-                                        extra=config.PKI_INDENTATION_LEVEL_2)
-                # REMINDER:  Due to POSIX compliance, 'lchmod' is NEVER
-                #            implemented on Linux systems since 'chmod'
-                #            CANNOT be run directly against symbolic links!
-                # chown -h <uid>:<gid> <link>
-                if uid is None:
-                    uid = self.identity.get_uid()
-                if gid is None:
-                    gid = self.identity.get_gid()
-                if not silent:
-                    config.pki_log.debug(log.PKIHELPER_CHOWN_H_3,
-                                         uid, gid, link,
-                                         extra=config.PKI_INDENTATION_LEVEL_3)
-                os.lchown(link, uid, gid)
-                # Store record in installation manifest
-                if not silent:
-                    record = manifest.Record()
-                    record.name = link
-                    record.type = manifest.RECORD_TYPE_SYMLINK
-                    record.user = self.mdict['pki_user']
-                    record.group = self.mdict['pki_group']
-                    record.uid = uid
-                    record.gid = gid
-                    record.permissions = \
-                        config.PKI_DEPLOYMENT_DEFAULT_SYMLINK_PERMISSIONS
-                    record.acls = acls
-                    self.manifest_db.append(record)
-            else:
-                config.pki_log.error(
-                    log.PKI_SYMLINK_MISSING_OR_NOT_A_SYMLINK_1, link,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(
-                        log.PKI_SYMLINK_MISSING_OR_NOT_A_SYMLINK_1 % link)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def delete(self, link, critical_failure=True):
-        try:
-            if not os.path.exists(link) or not os.path.islink(link):
-                # Simply issue a warning and continue
-                config.pki_log.warning(
-                    log.PKI_SYMLINK_MISSING_OR_NOT_A_SYMLINK_1, link,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-            else:
-                # rm -f <link>
-                config.pki_log.info(log.PKIHELPER_RM_F_1, link,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                os.remove(link)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def exists(self, name):
-        try:
-            if not os.path.exists(name) or not os.path.islink(name):
-                return False
-            else:
-                return True
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-
-
-class War:
-    """PKI Deployment War File Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-
-    def explode(self, name, path, critical_failure=True):
-        try:
-            if os.path.exists(name) and os.path.isfile(name):
-                if not zipfile.is_zipfile(name):
-                    config.pki_log.error(
-                        log.PKI_FILE_NOT_A_WAR_FILE_1,
-                        name, extra=config.PKI_INDENTATION_LEVEL_2)
-                    if critical_failure:
-                        raise Exception(log.PKI_FILE_NOT_A_WAR_FILE_1 % name)
-                if not os.path.exists(path) or not os.path.isdir(path):
-                    config.pki_log.error(
-                        log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1,
-                        path, extra=config.PKI_INDENTATION_LEVEL_2)
-                    if critical_failure:
-                        raise Exception(
-                            log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1,
-                            path)
-                # jar -xf <name> -C <path>
-                config.pki_log.info(log.PKIHELPER_JAR_XF_C_2, name, path,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                # Open war file
-                war = zipfile.ZipFile(name, 'r')
-                # Extract contents of war file to path
-                war.extractall(path)
-            else:
-                config.pki_log.error(
-                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1, name)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except zipfile.BadZipfile as exc:
-            config.pki_log.error(log.PKI_BADZIPFILE_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except zipfile.LargeZipFile as exc:
-            config.pki_log.error(log.PKI_LARGEZIPFILE_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-
-class Password:
-    """PKI Deployment Password Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-
-    def create_password_conf(self, path, pin, pin_sans_token=False,
-                             overwrite_flag=False, critical_failure=True):
-        try:
-            if os.path.exists(path):
-                if overwrite_flag:
-                    config.pki_log.info(
-                        log.PKIHELPER_PASSWORD_CONF_1, path,
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    # overwrite the existing 'password.conf' file
-                    with open(path, "w") as fd:
-                        if pin_sans_token:
-                            fd.write(str(pin))
-                        elif self.mdict['pki_subsystem'] in \
-                                config.PKI_APACHE_SUBSYSTEMS:
-                            fd.write(self.mdict['pki_self_signed_token'] +
-                                     ":" + str(pin))
-                        else:
-                            fd.write(self.mdict['pki_self_signed_token'] +
-                                     "=" + str(pin))
-            else:
-                config.pki_log.info(log.PKIHELPER_PASSWORD_CONF_1, path,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                # create a new 'password.conf' file
-                with open(path, "w") as fd:
-                    if pin_sans_token:
-                        fd.write(str(pin))
-                    elif self.mdict['pki_subsystem'] in\
-                            config.PKI_APACHE_SUBSYSTEMS:
-                        fd.write(self.mdict['pki_self_signed_token'] +
-                                 ":" + str(pin))
-                    else:
-                        fd.write(self.mdict['pki_self_signed_token'] +
-                                 "=" + str(pin))
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def create_client_pkcs12_password_conf(self, path, overwrite_flag=False,
-                                           critical_failure=True):
-        try:
-            if os.path.exists(path):
-                if overwrite_flag:
-                    config.pki_log.info(
-                        log.PKIHELPER_PASSWORD_CONF_1, path,
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    # overwrite the existing 'pkcs12_password.conf' file
-                    with open(path, "w") as fd:
-                        fd.write(self.mdict['pki_client_pkcs12_password'])
-            else:
-                config.pki_log.info(log.PKIHELPER_PASSWORD_CONF_1, path,
-                                    extra=config.PKI_INDENTATION_LEVEL_2)
-                # create a new 'pkcs12_password.conf' file
-                with open(path, "w") as fd:
-                    fd.write(self.mdict['pki_client_pkcs12_password'])
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def get_password(self, path, token_name, critical_failure=True):
-        token_pwd = None
-        if os.path.exists(path) and os.path.isfile(path) and\
-           os.access(path, os.R_OK):
-            tokens = PKIConfigParser.read_simple_configuration_file(path)
-            hardware_token = "hardware-" + token_name
-            if hardware_token in tokens:
-                token_name = hardware_token
-                token_pwd = tokens[hardware_token]
-            elif token_name in tokens:
-                token_pwd = tokens[token_name]
-
-        if token_pwd is None or token_pwd == '':
-            # TODO prompt for this password
-            config.pki_log.error(log.PKIHELPER_PASSWORD_NOT_FOUND_1,
-                                 token_name,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise Exception(log.PKIHELPER_PASSWORD_NOT_FOUND_1 % token_name)
-            else:
-                return
-        return token_pwd
-
-
-class Certutil:
-    """PKI Deployment NSS 'certutil' Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-
-    def create_security_databases(self, path, pki_cert_database,
-                                  pki_key_database, pki_secmod_database,
-                                  password_file=None, prefix=None,
-                                  critical_failure=True):
-        try:
-            # Compose this "certutil" command
-            command = ["certutil", "-N"]
-            #   Provide a path to the NSS security databases
-            if path:
-                command.extend(["-d", path])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_PATH,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PATH)
-            if password_file is not None:
-                command.extend(["-f", password_file])
-            if prefix is not None:
-                command.extend(["-P", prefix])
-            if not os.path.exists(path):
-                config.pki_log.error(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, path,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % path)
-            if os.path.exists(pki_cert_database) or\
-               os.path.exists(pki_key_database) or\
-               os.path.exists(pki_secmod_database):
-                # Simply notify user that the security databases exist
-                config.pki_log.info(
-                    log.PKI_SECURITY_DATABASES_ALREADY_EXIST_3,
-                    pki_cert_database,
-                    pki_key_database,
-                    pki_secmod_database,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-            else:
-                if password_file is not None:
-                    if not os.path.exists(password_file) or\
-                       not os.path.isfile(password_file):
-                        config.pki_log.error(
-                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
-                            password_file,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise Exception(
-                            log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 %
-                            password_file)
-                # Display this "certutil" command
-                config.pki_log.info(
-                    log.PKIHELPER_CREATE_SECURITY_DATABASES_1,
-                    ' '.join(command),
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                # Execute this "certutil" command
-                subprocess.check_call(command)
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def verify_certificate_exists(self, path, pki_cert_database,
-                                  pki_key_database, pki_secmod_database,
-                                  token, nickname, password_file=None,
-                                  silent=True, critical_failure=True):
-        try:
-            # Compose this "certutil" command
-            command = ["certutil", "-L"]
-            #   Provide a path to the NSS security databases
-            if path:
-                command.extend(["-d", path])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_PATH,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PATH)
-            #   Specify the 'token'
-            if token:
-                command.extend(["-h", token])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_TOKEN,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_TOKEN)
-            #   Specify the nickname of this self-signed certificate
-            if nickname:
-                command.extend(["-n", nickname])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_NICKNAME,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NICKNAME)
-            #   OPTIONALLY specify a password file
-            if password_file is not None:
-                command.extend(["-f", password_file])
-            if not os.path.exists(path):
-                config.pki_log.error(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, path,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % path)
-            if not os.path.exists(pki_cert_database) or\
-               not os.path.exists(pki_key_database) or\
-               not os.path.exists(pki_secmod_database):
-                # NSS security databases MUST exist!
-                config.pki_log.error(
-                    log.PKI_SECURITY_DATABASES_DO_NOT_EXIST_3,
-                    pki_cert_database,
-                    pki_key_database,
-                    pki_secmod_database,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_SECURITY_DATABASES_DO_NOT_EXIST_3 % (
-                        pki_cert_database,
-                        pki_key_database,
-                        pki_secmod_database))
-            if password_file is not None:
-                if not os.path.exists(password_file) or\
-                   not os.path.isfile(password_file):
-                    config.pki_log.error(
-                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
-                        password_file,
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(
-                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % password_file)
-            # Display this "certutil" command
-            config.pki_log.info(
-                log.PKIHELPER_CERTUTIL_SELF_SIGNED_CERTIFICATE_1,
-                ' '.join(command), extra=config.PKI_INDENTATION_LEVEL_2)
-            # Execute this "certutil" command
-            if silent:
-                # By default, execute this command silently
-                with open(os.devnull, "w") as fnull:
-                    subprocess.check_call(command, stdout=fnull, stderr=fnull)
-            else:
-                subprocess.check_call(command)
-        except subprocess.CalledProcessError:
-            return False
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return True
-
-    def generate_self_signed_certificate(self, path, pki_cert_database,
-                                         pki_key_database, pki_secmod_database,
-                                         token, nickname,
-                                         subject, serial_number,
-                                         validity_period, issuer_name,
-                                         trustargs, noise_file,
-                                         password_file=None,
-                                         critical_failure=True):
-        try:
-            # Compose this "certutil" command
-            command = ["certutil", "-S"]
-            #   Provide a path to the NSS security databases
-            if path:
-                command.extend(["-d", path])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_PATH,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PATH)
-            #   Specify the 'token'
-            if token:
-                command.extend(["-h", token])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_TOKEN,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_TOKEN)
-            #   Specify the nickname of this self-signed certificate
-            if nickname:
-                command.extend(["-n", nickname])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_NICKNAME,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NICKNAME)
-            #   Specify the subject name (RFC1485)
-            if subject:
-                command.extend(["-s", subject])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_SUBJECT,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_SUBJECT)
-            #   Specify the serial number
-            if serial_number is not None:
-                command.extend(["-m", str(serial_number)])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_SERIAL_NUMBER,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_SERIAL_NUMBER)
-            #   Specify the months valid
-            if validity_period is not None:
-                command.extend(["-v", str(validity_period)])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_VALIDITY_PERIOD,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_VALIDITY_PERIOD)
-            #   Specify the nickname of the issuer certificate
-            if issuer_name:
-                command.extend(["-c", issuer_name])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_ISSUER_NAME,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_ISSUER_NAME)
-            #   Specify the certificate trust attributes
-            if trustargs:
-                command.extend(["-t", trustargs])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_TRUSTARGS,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_TRUSTARGS)
-            #   Specify a noise file to be used for key generation
-            if noise_file:
-                command.extend(["-z", noise_file])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_NOISE_FILE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NOISE_FILE)
-            #   OPTIONALLY specify a password file
-            if password_file is not None:
-                command.extend(["-f", password_file])
-            #   ALWAYS self-sign this certificate
-            command.append("-x")
-            # Display this "certutil" command
-            config.pki_log.info(
-                log.PKIHELPER_CERTUTIL_SELF_SIGNED_CERTIFICATE_1,
-                ' '.join(command), extra=config.PKI_INDENTATION_LEVEL_2)
-            if not os.path.exists(path):
-                config.pki_log.error(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1, path,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % path)
-            if not os.path.exists(pki_cert_database) or\
-               not os.path.exists(pki_key_database) or\
-               not os.path.exists(pki_secmod_database):
-                # NSS security databases MUST exist!
-                config.pki_log.error(
-                    log.PKI_SECURITY_DATABASES_DO_NOT_EXIST_3,
-                    pki_cert_database,
-                    pki_key_database,
-                    pki_secmod_database,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_SECURITY_DATABASES_DO_NOT_EXIST_3 % (
-                        pki_cert_database,
-                        pki_key_database,
-                        pki_secmod_database))
-            if not os.path.exists(noise_file):
-                config.pki_log.error(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1,
-                    noise_file,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % noise_file)
-            if password_file is not None:
-                if not os.path.exists(password_file) or\
-                   not os.path.isfile(password_file):
-                    config.pki_log.error(
-                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
-                        password_file,
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(
-                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % password_file)
-            # Execute this "certutil" command
-            #
-            #     NOTE:  ALWAYS mask the command-line output of this command
-            #
-            with open(os.devnull, "w") as fnull:
-                subprocess.check_call(command, stdout=fnull, stderr=fnull)
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def import_cert(self, nickname, trust, input_file, password_file,
-                    path=None, token=None, critical_failure=True):
-        try:
-            command = ["certutil", "-A"]
-            if path:
-                command.extend(["-d", path])
-
-            if token:
-                command.extend(["-h", token])
-
-            if nickname:
-                command.extend(["-n", nickname])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_NICKNAME,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NICKNAME)
-
-            if trust:
-                command.extend(["-t", trust])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_TRUSTARGS,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_TRUSTARGS)
-
-            if input_file:
-                command.extend(["-i", input_file])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_INPUT_FILE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_INPUT_FILE)
-
-            if password_file:
-                command.extend(["-f", password_file])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE)
-
-            config.pki_log.info(
-                ' '.join(command),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            subprocess.check_call(command)
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def generate_certificate_request(self, subject, key_size,
-                                     password_file, noise_file,
-                                     output_file=None, path=None,
-                                     ascii_format=None, token=None,
-                                     critical_failure=True):
-        try:
-            command = ["certutil", "-R"]
-            if path:
-                command.extend(["-d", path])
-            else:
-                command.extend(["-d", "."])
-
-            if token:
-                command.extend(["-h", token])
-
-            if subject:
-                command.extend(["-s", subject])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_SUBJECT,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_SUBJECT)
-
-            if key_size:
-                command.extend(["-g", str(key_size)])
-
-            if noise_file:
-                command.extend(["-z", noise_file])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_NOISE_FILE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_NOISE_FILE)
-
-            if password_file:
-                command.extend(["-f", password_file])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE)
-
-            if output_file:
-                command.extend(["-o", output_file])
-
-            # set acsii output
-            if ascii_format:
-                command.append("-a")
-
-            # Display this "certutil" command
-            config.pki_log.info(
-                log.PKIHELPER_CERTUTIL_GENERATE_CSR_1, ' '.join(command),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            if not os.path.exists(noise_file):
-                config.pki_log.error(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1,
-                    noise_file,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % noise_file)
-            if not os.path.exists(password_file) or\
-               not os.path.isfile(password_file):
-                config.pki_log.error(
-                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
-                    password_file,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(
-                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % password_file)
-            # Execute this "certutil" command
-            with open(os.devnull, "w") as fnull:
-                subprocess.check_call(command, stdout=fnull, stderr=fnull)
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-
-class PK12util:
-    """PKI Deployment pk12util class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-
-    def create_file(self, out_file, nickname, out_pwfile,
-                    db_pwfile, path=None, critical_failure=True):
-        try:
-            command = ["pk12util"]
-            if path:
-                command.extend(["-d", path])
-            if out_file:
-                command.extend(["-o", out_file])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_PK12UTIL_MISSING_OUTFILE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_PK12UTIL_MISSING_OUTFILE)
-            if nickname:
-                command.extend(["-n", nickname])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_PK12UTIL_MISSING_NICKNAME,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_PK12UTIL_MISSING_NICKNAME)
-            if out_pwfile:
-                command.extend(["-w", out_pwfile])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_PK12UTIL_MISSING_PWFILE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_PK12UTIL_MISSING_PWFILE)
-            if db_pwfile:
-                command.extend(["-k", db_pwfile])
-            else:
-                config.pki_log.error(
-                    log.PKIHELPER_PK12UTIL_MISSING_DBPWFILE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                raise Exception(log.PKIHELPER_PK12UTIL_MISSING_DBPWFILE)
-
-            config.pki_log.info(
-                ' '.join(command),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            with open(os.devnull, "w") as fnull:
-                subprocess.check_call(command, stdout=fnull, stderr=fnull)
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-
-class KRAConnector:
-    """PKI Deployment KRA Connector Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-        self.password = deployer.password
-
-    def deregister(self, critical_failure=False):
-        krahost = None
-        kraport = None
-        try:
-            # this is applicable to KRAs only
-            if self.mdict['pki_subsystem_type'] != "kra":
-                return
-
-            config.pki_log.info(
-                log.PKIHELPER_KRACONNECTOR_UPDATE_CONTACT,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-
-            cs_cfg = PKIConfigParser.read_simple_configuration_file(
-                self.mdict['pki_target_cs_cfg'])
-            krahost = cs_cfg.get('service.machineName')
-            kraport = cs_cfg.get('pkicreate.secure_port')
-            cahost = cs_cfg.get('cloning.ca.hostname')
-            caport = cs_cfg.get('cloning.ca.httpsport')
-            if cahost is None or\
-               caport is None:
-                config.pki_log.warning(
-                    log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                config.pki_log.error(
-                    log.PKIHELPER_UNDEFINED_CA_HOST_PORT,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(log.PKIHELPER_UNDEFINED_CA_HOST_PORT)
-                else:
-                    return
-
-            # retrieve subsystem nickname
-            subsystemnick = cs_cfg.get('kra.cert.subsystem.nickname')
-            if subsystemnick is None:
-                config.pki_log.warning(
-                    log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                config.pki_log.error(
-                    log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME)
-                else:
-                    return
-
-            # retrieve name of token based upon type (hardware/software)
-            if ':' in subsystemnick:
-                token_name = subsystemnick.split(':')[0]
-            else:
-                token_name = "internal"
-
-            token_pwd = self.password.get_password(
-                self.mdict['pki_shared_password_conf'],
-                token_name,
-                critical_failure)
-
-            if token_pwd is None or token_pwd == '':
-                config.pki_log.warning(
-                    log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                config.pki_log.error(
-                    log.PKIHELPER_UNDEFINED_TOKEN_PASSWD_1,
-                    token_name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(
-                        log.PKIHELPER_UNDEFINED_TOKEN_PASSWD_1 % token_name)
-                else:
-                    return
-
-            self.execute_using_sslget(
-                caport, cahost, subsystemnick,
-                token_pwd, krahost, kraport)
-
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.warning(
-                log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE_2,
-                str(krahost),
-                str(kraport),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def execute_using_pki(
-            self, caport, cahost, subsystemnick,
-            token_pwd, krahost, kraport, critical_failure=False):
-        command = ["/bin/pki",
-                   "-p", str(caport),
-                   "-h", cahost,
-                   "-n", subsystemnick,
-                   "-P", "https",
-                   "-d", self.mdict['pki_database_path'],
-                   "-c", token_pwd,
-                   "ca-kraconnector-del", krahost, str(kraport)]
-
-        output = subprocess.check_output(command,
-                                         stderr=subprocess.STDOUT,
-                                         shell=True)
-
-        error = re.findall("ClientResponseFailure:(.*?)", output)
-        if error:
-            config.pki_log.warning(
-                log.PKIHELPER_KRACONNECTOR_UPDATE_FAILURE_2,
-                str(krahost),
-                str(kraport),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(
-                log.PKI_SUBPROCESS_ERROR_1, output,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-        if critical_failure:
-            raise Exception(log.PKI_SUBPROCESS_ERROR_1 % output)
-
-    def execute_using_sslget(
-            self, caport, cahost, subsystemnick,
-            token_pwd, krahost, kraport):
-        update_url = "/ca/rest/admin/kraconnector/remove"
-
-        params = "host=" + str(krahost) + \
-                 "&port=" + str(kraport)
-
-        command = ["/usr/bin/sslget",
-                   "-n", subsystemnick,
-                   "-p", token_pwd,
-                   "-d", self.mdict['pki_database_path'],
-                   "-e", params,
-                   "-v",
-                   "-r", update_url, cahost + ":" + str(caport)]
-
-        # update KRA connector
-        # Execute this "sslget" command
-        # Note that sslget will return non-zero value for HTTP code != 200
-        # and this will raise an exception
-        subprocess.check_output(command, stderr=subprocess.STDOUT)
-
-
-class TPSConnector:
-    """PKI Deployment TPS Connector Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-        self.password = deployer.password
-
-    def deregister(self, critical_failure=False):
-        tkshost = None
-        tksport = None
-        try:
-            # this is applicable to TPSs only
-            if self.mdict['pki_subsystem_type'] != "tps":
-                return
-
-            config.pki_log.info(
-                log.PKIHELPER_TPSCONNECTOR_UPDATE_CONTACT,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-
-            cs_cfg = PKIConfigParser.read_simple_configuration_file(
-                self.mdict['pki_target_cs_cfg'])
-            tpshost = cs_cfg.get('service.machineName')
-            tpsport = cs_cfg.get('pkicreate.secure_port')
-            tkshostport = cs_cfg.get('conn.tks1.hostport')
-            if tkshostport is None:
-                config.pki_log.warning(
-                    log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                config.pki_log.error(
-                    log.PKIHELPER_UNDEFINED_TKS_HOST_PORT,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(log.PKIHELPER_UNDEFINED_TKS_HOST_PORT)
-                else:
-                    return
-
-            #retrieve tks host and port
-            if ':' in tkshostport:
-                tkshost = tkshostport.split(':')[0]
-                tksport = tkshostport.split(':')[1]
-            else:
-                tkshost = tkshostport
-                tksport = '443'
-
-            # retrieve subsystem nickname
-            subsystemnick = cs_cfg.get('tps.cert.subsystem.nickname')
-            if subsystemnick is None:
-                config.pki_log.warning(
-                    log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                config.pki_log.error(
-                    log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME)
-                else:
-                    return
-
-            # retrieve name of token based upon type (hardware/software)
-            if ':' in subsystemnick:
-                token_name = subsystemnick.split(':')[0]
-            else:
-                token_name = "internal"
-
-            token_pwd = self.password.get_password(
-                self.mdict['pki_shared_password_conf'],
-                token_name,
-                critical_failure)
-
-            if token_pwd is None or token_pwd == '':
-                config.pki_log.warning(
-                    log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                config.pki_log.error(
-                    log.PKIHELPER_UNDEFINED_TOKEN_PASSWD_1,
-                    token_name,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(
-                        log.PKIHELPER_UNDEFINED_TOKEN_PASSWD_1 % token_name)
-                else:
-                    return
-
-            self.execute_using_pki(
-                tkshost, tksport, subsystemnick,
-                token_pwd, tpshost, tpsport)
-
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.warning(
-                log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE_2,
-                str(tkshost),
-                str(tksport),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def execute_using_pki(
-            self, tkshost, tksport, subsystemnick,
-            token_pwd, tpshost, tpsport, critical_failure=False):
-        command = ["/bin/pki",
-                   "-p", str(tksport),
-                   "-h", tkshost,
-                   "-n", subsystemnick,
-                   "-P", "https",
-                   "-d", self.mdict['pki_database_path'],
-                   "-c", token_pwd,
-                   "-t", "tks",
-                   "tks-tpsconnector-del",
-                   "--host", tpshost,
-                   "--port", str(tpsport)]
-
-        output = subprocess.check_output(command,
-                                         stderr=subprocess.STDOUT,
-                                         shell=False)
-
-        error = re.findall("ClientResponseFailure:(.*?)", output)
-        if error:
-            config.pki_log.warning(
-                log.PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE_2,
-                str(tpshost),
-                str(tpsport),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(
-                log.PKI_SUBPROCESS_ERROR_1, output,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-        if critical_failure:
-            raise Exception(log.PKI_SUBPROCESS_ERROR_1 % output)
-
-
-class SecurityDomain:
-    """PKI Deployment Security Domain Class"""
-
-    def __init__(self, deployer):
-        self.mdict = deployer.mdict
-        self.password = deployer.password
-
-    def deregister(self, install_token, critical_failure=False):
-        # process this PKI subsystem instance's 'CS.cfg'
-        cs_cfg = PKIConfigParser.read_simple_configuration_file(
-            self.mdict['pki_target_cs_cfg'])
-
-        # assign key name/value pairs
-        machinename = cs_cfg.get('service.machineName')
-        sport = cs_cfg.get('service.securityDomainPort')
-        ncsport = cs_cfg.get('service.non_clientauth_securePort', '')
-        sechost = cs_cfg.get('securitydomain.host')
-        seceeport = cs_cfg.get('securitydomain.httpseeport')
-        secagentport = cs_cfg.get('securitydomain.httpsagentport')
-        secadminport = cs_cfg.get('securitydomain.httpsadminport')
-        secname = cs_cfg.get('securitydomain.name', 'unknown')
-        adminsport = cs_cfg.get('pkicreate.admin_secure_port', '')
-        typeval = cs_cfg.get('cs.type', '')
-        agentsport = cs_cfg.get('pkicreate.agent_secure_port', '')
-
-        # fix ports for proxy settings
-        proxy_secure_port = cs_cfg.get('proxy.securePort', '')
-        if proxy_secure_port != '':
-            adminsport = proxy_secure_port
-            agentsport = proxy_secure_port
-            sport = proxy_secure_port
-            ncsport = proxy_secure_port
-
-        # NOTE:  Don't check for the existence of 'httpport', as this will
-        #        be undefined for a Security Domain that has been migrated!
-        if sechost is None or\
-           seceeport is None or\
-           secagentport is None or\
-           secadminport is None:
-            config.pki_log.warning(
-                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2,
-                typeval,
-                secname,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(
-                log.PKIHELPER_SECURITY_DOMAIN_UNDEFINED,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise Exception(log.PKIHELPER_SECURITY_DOMAIN_UNDEFINED)
-            else:
-                return
-
-        config.pki_log.info(log.PKIHELPER_SECURITY_DOMAIN_CONTACT_1,
-                            secname,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-        listval = typeval.lower() + "List"
-        update_url = "/ca/agent/ca/updateDomainXML"
-
-        params = "name=" + "\"" + self.mdict['pki_instance_path'] + "\"" + \
-                 "&type=" + str(typeval) + \
-                 "&list=" + str(listval) + \
-                 "&host=" + str(machinename) + \
-                 "&sport=" + str(sport) + \
-                 "&ncsport=" + str(ncsport) + \
-                 "&adminsport=" + str(adminsport) + \
-                 "&agentsport=" + str(agentsport) + \
-                 "&operation=remove"
-
-        if install_token:
-            try:
-                # first try install token-based servlet
-                params += "&sessionID=" + str(install_token)
-                admin_update_url = "/ca/admin/ca/updateDomainXML"
-                command = ["/usr/bin/sslget",
-                           "-p", str(123456),
-                           "-d", self.mdict['pki_database_path'],
-                           "-e", params,
-                           "-v",
-                           "-r", admin_update_url,
-                           sechost + ":" + str(secadminport)]
-                output = subprocess.check_output(
-                    command,
-                    stderr=subprocess.STDOUT)
-            except subprocess.CalledProcessError:
-                config.pki_log.warning(
-                    log.PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1,
-                    secname,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                output = self.update_domain_using_agent_port(
-                    typeval, secname, params, update_url, sechost, secagentport,
-                    critical_failure)
-        else:
-            output = self.update_domain_using_agent_port(
-                typeval, secname, params, update_url, sechost, secagentport,
-                critical_failure)
-
-        if not output:
-            if critical_failure:
-                raise Exception("Cannot update domain using agent port")
-            else:
-                return
-
-        config.pki_log.debug(log.PKIHELPER_SSLGET_OUTPUT_1,
-                             output,
-                             extra=config.PKI_INDENTATION_LEVEL_2)
-        # Search the output for Status
-        status = re.findall('<Status>(.*?)</Status>', output)
-        if not status:
-            config.pki_log.warning(
-                log.PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1,
-                secname,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise Exception(
-                    log.PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1 % secname)
-        elif status[0] != "0":
-            error = re.findall('<Error>(.*?)</Error>', output)
-            if not error:
-                error = ""
-            config.pki_log.warning(
-                log.PKIHELPER_SECURITY_DOMAIN_UNREGISTERED_2,
-                typeval,
-                secname,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(
-                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_3,
-                typeval,
-                secname,
-                error,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise Exception(log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_3
-                                %
-                                (typeval, secname, error))
-        else:
-            config.pki_log.info(
-                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_SUCCESS_2,
-                typeval,
-                secname,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-
-    def update_domain_using_agent_port(
-            self, typeval, secname, params,
-            update_url, sechost, secagentport, critical_failure=False):
-        cs_cfg = PKIConfigParser.read_simple_configuration_file(
-            self.mdict['pki_target_cs_cfg'])
-        # retrieve subsystem nickname
-        subsystemnick_param = typeval.lower() + ".cert.subsystem.nickname"
-        subsystemnick = cs_cfg.get(subsystemnick_param)
-        if subsystemnick is None:
-            config.pki_log.warning(
-                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2,
-                typeval,
-                secname,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(
-                log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise Exception(log.PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME)
-            else:
-                return
-
-        # retrieve name of token based upon type (hardware/software)
-        if ':' in subsystemnick:
-            token_name = subsystemnick.split(':')[0]
-        else:
-            token_name = "internal"
-
-        token_pwd = self.password.get_password(
-            self.mdict['pki_shared_password_conf'],
-            token_name,
-            critical_failure)
-
-        if token_pwd is None or token_pwd == '':
-            config.pki_log.warning(
-                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2,
-                typeval,
-                secname,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise Exception(
-                    log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2 %
-                    (typeval, secname))
-            else:
-                return
-
-        command = ["/usr/bin/sslget",
-                   "-n", subsystemnick,
-                   "-p", token_pwd,
-                   "-d", self.mdict['pki_database_path'],
-                   "-e", params,
-                   "-v",
-                   "-r", update_url, sechost + ":" + str(secagentport)]
-        try:
-            output = subprocess.check_output(command,
-                                             stderr=subprocess.STDOUT)
-            return output
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.warning(
-                log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2,
-                typeval,
-                secname,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.warning(
-                log.PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1,
-                secname,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-
-        return None
-
-    def get_installation_token(self, secuser, secpass, critical_failure=True):
-        if not secuser or not secpass:
-            return None
-
-        # process this PKI subsystem instance's 'CS.cfg'
-        cs_cfg = PKIConfigParser.read_simple_configuration_file(
-            self.mdict['pki_target_cs_cfg'])
-
-        # assign key name/value pairs
-        machinename = cs_cfg.get('service.machineName')
-        cstype = cs_cfg.get('cs.type', '')
-        sechost = cs_cfg.get('securitydomain.host')
-        secadminport = cs_cfg.get('securitydomain.httpsadminport')
-        #secselect = cs_cfg.get('securitydomain.select') - Selected
-        # security domain
-
-        command = ["/bin/pki",
-                   "-p", str(secadminport),
-                   "-h", sechost,
-                   "-P", "https",
-                   "-u", secuser,
-                   "-w", secpass,
-                   "-d", self.mdict['pki_database_path'],
-                   "securitydomain-get-install-token",
-                   "--hostname", machinename,
-                   "--subsystem", cstype]
-        try:
-            output = subprocess.check_output(
-                command,
-                stderr=subprocess.STDOUT,
-                shell=True)
-
-            token_list = re.findall("Install token: \"(.*)\"", output)
-            if not token_list:
-                config.pki_log.error(
-                    log.PKIHELPER_SECURITY_DOMAIN_GET_TOKEN_FAILURE_2,
-                    str(sechost),
-                    str(secadminport),
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                config.pki_log.error(
-                    log.PKI_SUBPROCESS_ERROR_1, output,
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                if critical_failure:
-                    raise Exception(
-                        log.PKIHELPER_SECURITY_DOMAIN_GET_TOKEN_FAILURE_2 %
-                        (str(sechost), str(secadminport)))
-            else:
-                token = token_list[0]
-                return token
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(
-                log.PKIHELPER_SECURITY_DOMAIN_GET_TOKEN_FAILURE_2,
-                str(sechost),
-                str(secadminport),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return None
-
-
-class Systemd(object):
-    """PKI Deployment Execution Management Class"""
-
-    def __init__(self, deployer):
-        """PKI Deployment execution management __init__ method.
-
-        Args:
-          deployer (dictionary):  PKI Deployment name/value parameters
-
-        Attributes:
-
-        Returns:
-
-        Raises:
-
-        Examples:
-
-        """
-        self.mdict = deployer.mdict
-
-    def daemon_reload(self, critical_failure=True):
-        """PKI Deployment execution management lifecycle function.
-
-        Executes a 'systemd daemon-reload' system command.
-
-        Args:
-          critical_failure (boolean, optional):  Raise exception on failures;
-                                                 defaults to 'True'.
-
-        Attributes:
-
-        Returns:
-
-        Raises:
-          subprocess.CalledProcessError:  If 'critical_failure' is 'True'.
-
-        Examples:
-
-        """
-        try:
-            # Un-defined command on Debian systems
-            if pki.system.SYSTEM_TYPE == "debian":
-                return
-            # Compose this "systemd" execution management lifecycle command
-            command = ["systemctl", "daemon-reload"]
-            # Display this "systemd" execution management lifecycle command
-            config.pki_log.info(
-                log.PKIHELPER_SYSTEMD_COMMAND_1, ' '.join(command),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            # Execute this "systemd" execution management lifecycle command
-            subprocess.check_call(command)
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def start(self, critical_failure=True, reload_daemon=True):
-        """PKI Deployment execution management 'start' method.
-
-           Executes a 'systemd start <service>' system command, or
-           an '/etc/init.d/pki-tomcatd start <instance>' system command.
-           on Debian systems.
-
-        Args:
-          critical_failure (boolean, optional):  Raise exception on failures;
-                                                 defaults to 'True'.
-          reload_daemon (boolean, optional):     Perform a reload of the
-                                                 'systemd' daemon prior to
-                                                 starting;
-                                                 defaults to 'True'.
-
-        Attributes:
-
-        Returns:
-
-        Raises:
-          subprocess.CalledProcessError:  If 'critical_failure' is 'True'.
-
-        Examples:
-
-        """
-        try:
-            service = None
-            # Execute the "systemd daemon-reload" management lifecycle command
-            if reload_daemon:
-                self.daemon_reload(critical_failure)
-            # Compose this "systemd" execution management command
-            if self.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
-                service = "pki-apached" + "@" +\
-                          self.mdict['pki_instance_name'] + "." +\
-                          "service"
-            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-                service = "pki-tomcatd" + "@" +\
-                          self.mdict['pki_instance_name'] + "." +\
-                          "service"
-
-            if pki.system.SYSTEM_TYPE == "debian":
-                command = ["/etc/init.d/pki-tomcatd", "start",
-                           self.mdict['pki_instance_name']]
-            else:
-                command = ["systemctl", "start", service]
-
-            # Display this "systemd" execution managment command
-            config.pki_log.info(
-                log.PKIHELPER_SYSTEMD_COMMAND_1, ' '.join(command),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            # Execute this "systemd" execution management command
-            subprocess.check_call(command)
-        except subprocess.CalledProcessError as exc:
-            if pki.system.SYSTEM_TYPE == "debian":
-                if exc.returncode == 6:
-                    return
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def stop(self, critical_failure=True):
-        """PKI Deployment execution management 'stop' method.
-
-        Executes a 'systemd stop <service>' system command, or
-        an '/etc/init.d/pki-tomcatd stop <instance>' system command
-        on Debian systems.
-
-        Args:
-          critical_failure (boolean, optional):  Raise exception on failures;
-                                                 defaults to 'True'.
-
-        Attributes:
-
-        Returns:
-
-        Raises:
-          subprocess.CalledProcessError:  If 'critical_failure' is 'True'.
-
-        Examples:
-
-        """
-        try:
-            service = None
-            # Compose this "systemd" execution management command
-            if self.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
-                service = "pki-apached" + "@" +\
-                          self.mdict['pki_instance_name'] + "." +\
-                          "service"
-            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-                service = "pki-tomcatd" + "@" +\
-                          self.mdict['pki_instance_name'] + "." +\
-                          "service"
-
-            if pki.system.SYSTEM_TYPE == "debian":
-                command = ["/etc/init.d/pki-tomcatd", "stop",
-                           self.mdict['pki_instance_name']]
-            else:
-                command = ["systemctl", "stop", service]
-
-            # Display this "systemd" execution managment command
-            config.pki_log.info(
-                log.PKIHELPER_SYSTEMD_COMMAND_1, ' '.join(command),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            # Execute this "systemd" execution management command
-            subprocess.check_call(command)
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-    def restart(self, critical_failure=True, reload_daemon=True):
-        """PKI Deployment execution management 'restart' method.
-
-        Executes a 'systemd restart <service>' system command, or
-        an '/etc/init.d/pki-tomcatd restart <instance>' system command
-        on Debian systems.
-
-        Args:
-          critical_failure (boolean, optional):  Raise exception on failures;
-                                                 defaults to 'True'.
-          reload_daemon (boolean, optional):     Perform a reload of the
-                                                 'systemd' daemon prior to
-                                                 restarting;
-                                                 defaults to 'True'.
-
-        Attributes:
-
-        Returns:
-
-        Raises:
-          subprocess.CalledProcessError:  If 'critical_failure' is 'True'.
-
-        Examples:
-
-        """
-        try:
-            service = None
-            # Compose this "systemd" execution management command
-            # Execute the "systemd daemon-reload" management lifecycle command
-            if reload_daemon:
-                self.daemon_reload(critical_failure)
-            if self.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
-                service = "pki-apached" + "@" +\
-                          self.mdict['pki_instance_name'] + "." +\
-                          "service"
-            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-                service = "pki-tomcatd" + "@" +\
-                          self.mdict['pki_instance_name'] + "." +\
-                          "service"
-
-            if pki.system.SYSTEM_TYPE == "debian":
-                command = ["/etc/init.d/pki-tomcatd", "restart",
-                           self.mdict['pki_instance_name']]
-            else:
-                command = ["systemctl", "restart", service]
-
-            # Display this "systemd" execution managment command
-            config.pki_log.info(
-                log.PKIHELPER_SYSTEMD_COMMAND_1, ' '.join(command),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            # Execute this "systemd" execution management command
-            subprocess.check_call(command)
-        except subprocess.CalledProcessError as exc:
-            if pki.system.SYSTEM_TYPE == "debian":
-                if exc.returncode == 6:
-                    return
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure:
-                raise
-        return
-
-
-class ConfigClient:
-    """PKI Deployment Configuration Client"""
-
-    def __init__(self, deployer):
-        self.deployer = deployer
-        self.mdict = deployer.mdict
-        # set useful 'boolean' object variables for this class
-        self.clone = config.str2bool(self.mdict['pki_clone'])
-        self.external = config.str2bool(self.mdict['pki_external'])
-        self.external_step_two = config.str2bool(
-            self.mdict['pki_external_step_two'])
-        self.standalone = config.str2bool(self.mdict['pki_standalone'])
-        self.subordinate = config.str2bool(self.mdict['pki_subordinate'])
-        # set useful 'string' object variables for this class
-        self.subsystem = self.mdict['pki_subsystem']
-
-    def configure_pki_data(self, data):
-        config.pki_log.info(
-            log.PKI_CONFIG_CONFIGURING_PKI_DATA,
-            extra=config.PKI_INDENTATION_LEVEL_2)
-
-        connection = pki.client.PKIConnection(
-            protocol='https',
-            hostname=self.mdict['pki_hostname'],
-            port=self.mdict['pki_https_port'],
-            subsystem=self.mdict['pki_subsystem_type'])
-
-        try:
-            client = pki.system.SystemConfigClient(connection)
-            response = client.configure(data)
-
-            config.pki_log.debug(
-                log.PKI_CONFIG_RESPONSE_STATUS + " " + str(response['status']),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            try:
-                certs = response['systemCerts']
-            except KeyError:
-                # no system certs created
-                config.pki_log.debug(
-                    "No new system certificates generated.",
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                certs = []
-
-            if not isinstance(certs, types.ListType):
-                certs = [certs]
-            for cdata in certs:
-                if (self.subsystem == "CA" and self.external and
-                        not self.external_step_two):
-                    # External CA (Step 1)
-                    if cdata['tag'].lower() == "signing":
-                        # Save 'External CA Signing Certificate' CSR (Step 1)
-                        self.save_system_csr(
-                            cdata['request'],
-                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE,
-                            self.mdict['pki_external_csr_path'])
-                        return
-                elif self.standalone and not self.external_step_two:
-                    # Stand-alone PKI (Step 1)
-                    if cdata['tag'].lower() == "audit_signing":
-                        # Save Stand-alone PKI 'Audit Signing Certificate' CSR
-                        # (Step 1)
-                        self.save_system_csr(
-                            cdata['request'],
-                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_AUDIT_SIGNING_1,
-                            self.mdict['pki_external_audit_signing_csr_path'],
-                            self.subsystem)
-                    elif cdata['tag'].lower() == "signing":
-                        # Save Stand-alone PKI OCSP 'OCSP Signing Certificate'
-                        # CSR (Step 1)
-                        self.save_system_csr(
-                            cdata['request'],
-                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_OCSP_SIGNING,
-                            self.mdict['pki_external_signing_csr_path'])
-                    elif cdata['tag'].lower() == "sslserver":
-                        # Save Stand-alone PKI 'SSL Server Certificate' CSR
-                        # (Step 1)
-                        self.save_system_csr(
-                            cdata['request'],
-                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SSLSERVER_1,
-                            self.mdict['pki_external_sslserver_csr_path'],
-                            self.subsystem)
-                    elif cdata['tag'].lower() == "storage":
-                        # Save Stand-alone PKI KRA 'Storage Certificate' CSR
-                        # (Step 1)
-                        self.save_system_csr(
-                            cdata['request'],
-                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_STORAGE,
-                            self.mdict['pki_external_storage_csr_path'])
-                    elif cdata['tag'].lower() == "subsystem":
-                        # Save Stand-alone PKI 'Subsystem Certificate' CSR
-                        # (Step 1)
-                        self.save_system_csr(
-                            cdata['request'],
-                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SUBSYSTEM_1,
-                            self.mdict['pki_external_subsystem_csr_path'],
-                            self.subsystem)
-                    elif cdata['tag'].lower() == "transport":
-                        # Save Stand-alone PKI KRA 'Transport Certificate' CSR
-                        # (Step 1)
-                        self.save_system_csr(
-                            cdata['request'],
-                            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_TRANSPORT,
-                            self.mdict['pki_external_transport_csr_path'])
-                else:
-                    config.pki_log.debug(
-                        log.PKI_CONFIG_CDATA_TAG + " " + cdata['tag'],
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    config.pki_log.debug(
-                        log.PKI_CONFIG_CDATA_CERT + "\n" + cdata['cert'],
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    config.pki_log.debug(
-                        log.PKI_CONFIG_CDATA_REQUEST + "\n" + cdata['request'],
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-
-            # Cloned PKI subsystems do not return an Admin Certificate
-            if not self.clone:
-                if self.standalone:
-                    if not self.external_step_two:
-                        # NOTE:  Do nothing for Stand-alone PKI (Step 1)
-                        #        as this has already been addressed
-                        #        in 'set_admin_parameters()'
-                        pass
-                    else:
-                        admin_cert = response['adminCert']['cert']
-                        self.process_admin_cert(admin_cert)
-                elif not config.str2bool(self.mdict['pki_import_admin_cert']):
-                    admin_cert = response['adminCert']['cert']
-                    self.process_admin_cert(admin_cert)
-
-        except Exception, e:
-            if hasattr(e, 'response'):
-                root = ET.fromstring(e.response.text)
-                if root.tag == 'PKIException':
-                    message = root.findall('.//Message')[0].text
-                    if message is not None:
-                        config.pki_log.error(
-                            log.PKI_CONFIG_JAVA_CONFIGURATION_EXCEPTION + " "
-                            + message,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        raise
-            config.pki_log.error(
-                log.PKI_CONFIG_JAVA_CONFIGURATION_EXCEPTION + " " + str(e),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-        return
-
-    def process_admin_cert(self, admin_cert):
-        config.pki_log.debug(
-            log.PKI_CONFIG_RESPONSE_ADMIN_CERT + "\n" + admin_cert,
-            extra=config.PKI_INDENTATION_LEVEL_2)
-
-        # Store the Administration Certificate in a file
-        admin_cert_file = self.mdict['pki_client_admin_cert']
-        admin_cert_bin_file = admin_cert_file + ".der"
-        self.save_admin_cert(log.PKI_CONFIG_ADMIN_CERT_SAVE_1,
-                             admin_cert, admin_cert_file,
-                             self.mdict['pki_subsystem_name'])
-
-        # convert the cert file to binary
-        command = ["AtoB", admin_cert_file, admin_cert_bin_file]
-        config.pki_log.info(
-            ' '.join(command),
-            extra=config.PKI_INDENTATION_LEVEL_2)
-        try:
-            subprocess.check_call(command)
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-
-        os.chmod(admin_cert_file,
-                 config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS)
-
-        os.chmod(admin_cert_bin_file,
-                 config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS)
-
-        # Import the Administration Certificate
-        # into the client NSS security database
-        self.deployer.certutil.import_cert(
-            re.sub("&#39;", "'", self.mdict['pki_admin_nickname']),
-            "u,u,u",
-            admin_cert_bin_file,
-            self.mdict['pki_client_password_conf'],
-            self.mdict['pki_client_database_dir'],
-            None,
-            True)
-
-        # create directory for p12 file if it does not exist
-        self.deployer.directory.create(os.path.dirname(
-            self.mdict['pki_client_admin_cert_p12']))
-
-        # Export the Administration Certificate from the
-        # client NSS security database into a PKCS #12 file
-        self.deployer.pk12util.create_file(
-            self.mdict['pki_client_admin_cert_p12'],
-            re.sub("&#39;", "'", self.mdict['pki_admin_nickname']),
-            self.mdict['pki_client_pkcs12_password_conf'],
-            self.mdict['pki_client_password_conf'],
-            self.mdict['pki_client_database_dir'])
-
-        os.chmod(
-            self.mdict['pki_client_admin_cert_p12'],
-            config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
-
-    def construct_pki_configuration_data(self):
-        config.pki_log.info(log.PKI_CONFIG_CONSTRUCTING_PKI_DATA,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-
-        data = pki.system.ConfigurationRequest()
-
-        # Miscellaneous Configuration Information
-        data.pin = self.mdict['pki_one_time_pin']
-        data.subsystemName = self.mdict['pki_subsystem_name']
-        data.standAlone = self.standalone
-        data.stepTwo = self.external_step_two
-
-        # Cloning parameters
-        if self.mdict['pki_instance_type'] == "Tomcat":
-            if self.clone:
-                self.set_cloning_parameters(data)
-            else:
-                data.isClone = "false"
-
-        # Hierarchy
-        self.set_hierarchy_parameters(data)
-
-        # Security Domain
-        if ((self.subsystem != "CA" or self.clone or self.subordinate) and
-                not self.standalone):
-            # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
-            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone, or
-            # Subordinate CA
-            self.set_existing_security_domain(data)
-        else:
-            # PKI CA, External CA, or Stand-alone PKI
-            self.set_new_security_domain(data)
-
-        # database
-        if self.subsystem != "RA":
-            self.set_database_parameters(data)
-
-        # backup
-        if self.mdict['pki_instance_type'] == "Tomcat":
-            self.set_backup_parameters(data)
-
-        # admin user
-        if not self.clone:
-            self.set_admin_parameters(data)
-
-        # Issuing CA Information
-        self.set_issuing_ca_parameters(data)
-
-        # Create system certs
-        self.set_system_certs(data)
-
-        # TPS parameters
-        if self.subsystem == "TPS":
-            self.set_tps_parameters(data)
-
-        return data
-
-    def save_admin_csr(self):
-        config.pki_log.info(
-            log.PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_ADMIN_1 + " '" +
-            self.mdict['pki_external_admin_csr_path'] + "'", self.subsystem,
-            extra=config.PKI_INDENTATION_LEVEL_2)
-        self.deployer.directory.create(
-            os.path.dirname(self.mdict['pki_external_admin_csr_path']))
-        with open(self.mdict['pki_external_admin_csr_path'], "w") as f:
-            f.write("-----BEGIN CERTIFICATE REQUEST-----\n")
-        admin_certreq = None
-        with open(os.path.join(
-                  self.mdict['pki_client_database_dir'],
-                  "admin_pkcs10.bin.asc"), "r") as f:
-            admin_certreq = f.read()
-        with open(self.mdict['pki_external_admin_csr_path'], "a") as f:
-            f.write(admin_certreq)
-            f.write("-----END CERTIFICATE REQUEST-----")
-        # Read in and print Admin certificate request
-        with open(self.mdict['pki_external_admin_csr_path'], "r") as f:
-            admin_certreq = f.read()
-        config.pki_log.info(
-            log.PKI_CONFIG_CDATA_REQUEST + "\n" + admin_certreq,
-            extra=config.PKI_INDENTATION_LEVEL_2)
-
-    def save_admin_cert(self, message, input_data, output_file, subsystem_name):
-        config.pki_log.debug(message + " '" + output_file + "'", subsystem_name,
-                             extra=config.PKI_INDENTATION_LEVEL_2)
-        with open(output_file, "w") as f:
-            f.write(input_data)
-
-    def save_system_csr(self, csr, message, path, subsystem=None):
-        if subsystem is not None:
-            config.pki_log.info(message + " '" + path + "'", subsystem,
-                                extra=config.PKI_INDENTATION_LEVEL_2)
-        else:
-            config.pki_log.info(message + " '" + path + "'",
-                                extra=config.PKI_INDENTATION_LEVEL_2)
-        self.deployer.directory.create(os.path.dirname(path))
-        with open(path, "w") as f:
-            f.write(csr)
-        # Print this certificate request
-        config.pki_log.info(log.PKI_CONFIG_CDATA_REQUEST + "\n" + csr,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-
-    def load_system_cert(self, cert, message, path, subsystem=None):
-        if subsystem is not None:
-            config.pki_log.info(message + " '" + path + "'", subsystem,
-                                extra=config.PKI_INDENTATION_LEVEL_2)
-        else:
-            config.pki_log.info(message + " '" + path + "'",
-                                extra=config.PKI_INDENTATION_LEVEL_2)
-        with open(path, "r") as f:
-            cert.cert = f.read()
-
-    def load_system_cert_chain(self, cert, message, path):
-        config.pki_log.info(message + " '" + path + "'",
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-        with open(path, "r") as f:
-            cert.certChain = f.read()
-
-    def set_system_certs(self, data):
-        systemCerts = []
-
-        # Create 'CA Signing Certificate'
-        if not self.clone:
-            if self.subsystem == "CA" or self.standalone:
-                cert1 = None
-                if self.subsystem == "CA":
-                    # PKI CA, Subordinate CA, or External CA
-                    cert1 = self.create_system_cert("ca_signing")
-                    cert1.signingAlgorithm = \
-                        self.mdict['pki_ca_signing_signing_algorithm']
-                if self.external_step_two:
-                    # External CA (Step 2) or Stand-alone PKI (Step 2)
-                    if not self.subsystem == "CA":
-                        # Stand-alone PKI (Step 2)
-                        cert1 = pki.system.SystemCertData()
-                        cert1.tag = self.mdict['pki_ca_signing_tag']
-                    # Load the External CA or Stand-alone PKI
-                    # 'External CA Signing Certificate' (Step 2)
-                    self.load_system_cert(
-                        cert1,
-                        log.PKI_CONFIG_EXTERNAL_CA_LOAD,
-                        self.mdict['pki_external_ca_cert_path'])
-                    # Load the External CA or Stand-alone PKI
-                    # 'External CA Signing Certificate Chain' (Step 2)
-                    self.load_system_cert_chain(
-                        cert1,
-                        log.PKI_CONFIG_EXTERNAL_CA_CHAIN_LOAD,
-                        self.mdict['pki_external_ca_cert_chain_path'])
-                    systemCerts.append(cert1)
-                elif self.subsystem == "CA":
-                    # PKI CA or Subordinate CA
-                    systemCerts.append(cert1)
-
-        # Create 'OCSP Signing Certificate'
-        if not self.clone:
-            if (self.subsystem == "OCSP" and
-                    self.standalone and
-                    self.external_step_two):
-                # Stand-alone PKI OCSP (Step 2)
-                cert2 = self.create_system_cert("ocsp_signing")
-                # Load the Stand-alone PKI OCSP 'OCSP Signing Certificate'
-                # (Step 2)
-                self.load_system_cert(
-                    cert2,
-                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_OCSP_SIGNING,
-                    self.mdict['pki_external_signing_cert_path'])
-                cert2.signingAlgorithm = \
-                    self.mdict['pki_ocsp_signing_signing_algorithm']
-                systemCerts.append(cert2)
-            elif self.subsystem == "CA" or self.subsystem == "OCSP":
-                # External CA, Subordinate CA, PKI CA, or PKI OCSP
-                cert2 = self.create_system_cert("ocsp_signing")
-                cert2.signingAlgorithm = \
-                    self.mdict['pki_ocsp_signing_signing_algorithm']
-                systemCerts.append(cert2)
-
-        # Create 'SSL Server Certificate'
-        # all subsystems
-
-        # create new sslserver cert only if this is a new instance
-        system_list = self.deployer.instance.tomcat_instance_subsystems()
-        if self.standalone and self.external_step_two:
-            # Stand-alone PKI (Step 2)
-            cert3 = self.create_system_cert("ssl_server")
-            # Load the Stand-alone PKI 'SSL Server Certificate' (Step 2)
-            self.load_system_cert(
-                cert3,
-                log.PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SSLSERVER_1,
-                self.mdict['pki_external_sslserver_cert_path'],
-                self.subsystem)
-            systemCerts.append(cert3)
-        elif len(system_list) >= 2:
-            # Existing PKI Instance
-            data.generateServerCert = "false"
-            for subsystem in system_list:
-                dst = self.mdict['pki_instance_path'] + '/conf/' + \
-                    subsystem.lower() + '/CS.cfg'
-                if subsystem != self.subsystem and os.path.exists(dst):
-                    cert3 = self.retrieve_existing_server_cert(dst)
-                    systemCerts.append(cert3)
-                    break
-        else:
-            # PKI CA, PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
-            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone,
-            # Subordinate CA, or External CA
-            cert3 = self.create_system_cert("ssl_server")
-            systemCerts.append(cert3)
-
-        # Create 'Subsystem Certificate'
-        if not self.clone:
-            if self.standalone and self.external_step_two:
-                data.generateSubsystemCert = "true"
-                # Stand-alone PKI (Step 2)
-                cert4 = self.create_system_cert("subsystem")
-                # Load the Stand-alone PKI 'Subsystem Certificate' (Step 2)
-                self.load_system_cert(
-                    cert4,
-                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SUBSYSTEM_1,
-                    self.mdict['pki_external_subsystem_cert_path'],
-                    self.subsystem)
-                systemCerts.append(cert4)
-            elif len(system_list) >= 2:
-                # Existing PKI Instance
-                data.generateSubsystemCert = "false"
-                for subsystem in system_list:
-                    dst = self.mdict['pki_instance_path'] + '/conf/' + \
-                        subsystem.lower() + '/CS.cfg'
-                    if subsystem != self.subsystem and os.path.exists(dst):
-                        cert4 = self.retrieve_existing_subsystem_cert(dst)
-                        systemCerts.append(cert4)
-                        break
-            else:
-                # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
-                # Subordinate CA, or External CA
-                data.generateSubsystemCert = "true"
-                cert4 = self.create_system_cert("subsystem")
-                systemCerts.append(cert4)
-
-        # Create 'Audit Signing Certificate'
-        if not self.clone:
-            if self.standalone and self.external_step_two:
-                # Stand-alone PKI (Step 2)
-                cert5 = self.create_system_cert("audit_signing")
-                # Load the Stand-alone PKI 'Audit Signing Certificate' (Step 2)
-                self.load_system_cert(
-                    cert5,
-                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_AUDIT_SIGNING_1,
-                    self.mdict['pki_external_audit_signing_cert_path'],
-                    self.subsystem)
-                cert5.signingAlgorithm = \
-                    self.mdict['pki_audit_signing_signing_algorithm']
-                systemCerts.append(cert5)
-            elif self.subsystem != "RA":
-                cert5 = self.create_system_cert("audit_signing")
-                cert5.signingAlgorithm = \
-                    self.mdict['pki_audit_signing_signing_algorithm']
-                systemCerts.append(cert5)
-
-        # Create 'DRM Transport Certificate' and 'DRM Storage Certificate'
-        if not self.clone:
-            if (self.subsystem == "KRA" and
-                    self.standalone and
-                    self.external_step_two):
-                # Stand-alone PKI KRA Transport Certificate (Step 2)
-                cert6 = self.create_system_cert("transport")
-                # Load the Stand-alone PKI KRA 'Transport Certificate' (Step 2)
-                self.load_system_cert(
-                    cert6,
-                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_TRANSPORT,
-                    self.mdict['pki_external_transport_cert_path'])
-                systemCerts.append(cert6)
-                # Stand-alone PKI KRA Storage Certificate (Step 2)
-                cert7 = self.create_system_cert("storage")
-                # Load the Stand-alone PKI KRA 'Storage Certificate' (Step 2)
-                self.load_system_cert(
-                    cert7,
-                    log.PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_STORAGE,
-                    self.mdict['pki_external_storage_cert_path'])
-                systemCerts.append(cert7)
-            elif self.subsystem == "KRA":
-                # PKI KRA Transport Certificate
-                cert6 = self.create_system_cert("transport")
-                systemCerts.append(cert6)
-                # PKI KRA Storage Certificate
-                cert7 = self.create_system_cert("storage")
-                systemCerts.append(cert7)
-
-        data.systemCerts = systemCerts
-
-    def set_cloning_parameters(self, data):
-        data.isClone = "true"
-        data.cloneUri = self.mdict['pki_clone_uri']
-        data.p12File = self.mdict['pki_clone_pkcs12_path']
-        data.p12Password = self.mdict['pki_clone_pkcs12_password']
-        if config.str2bool(self.mdict['pki_clone_replicate_schema']):
-            data.replicateSchema = "true"
-        else:
-            data.replicateSchema = "false"
-        data.replicationSecurity = \
-            self.mdict['pki_clone_replication_security']
-        if self.mdict['pki_clone_replication_master_port']:
-            data.masterReplicationPort = \
-                self.mdict['pki_clone_replication_master_port']
-        if self.mdict['pki_clone_replication_clone_port']:
-            data.cloneReplicationPort = \
-                self.mdict['pki_clone_replication_clone_port']
-        data.setupReplication = self.mdict['pki_clone_setup_replication']
-
-    def set_hierarchy_parameters(self, data):
-        if self.subsystem == "CA":
-            if self.clone:
-                # Cloned CA
-                data.hierarchy = "root"
-            elif self.external:
-                # External CA
-                data.hierarchy = "join"
-            elif self.subordinate:
-                # Subordinate CA
-                data.hierarchy = "join"
-            else:
-                # PKI CA
-                data.hierarchy = "root"
-
-    def set_existing_security_domain(self, data):
-        data.securityDomainType = "existingdomain"
-        data.securityDomainUri = self.mdict['pki_security_domain_uri']
-        data.securityDomainUser = self.mdict['pki_security_domain_user']
-        data.securityDomainPassword = self.mdict['pki_security_domain_password']
-
-    def set_new_security_domain(self, data):
-        data.securityDomainType = "newdomain"
-        data.securityDomainName = self.mdict['pki_security_domain_name']
-
-    def set_database_parameters(self, data):
-        data.dsHost = self.mdict['pki_ds_hostname']
-        data.dsPort = self.mdict['pki_ds_ldap_port']
-        data.baseDN = self.mdict['pki_ds_base_dn']
-        data.bindDN = self.mdict['pki_ds_bind_dn']
-        data.database = self.mdict['pki_ds_database']
-        data.bindpwd = self.mdict['pki_ds_password']
-        if config.str2bool(self.mdict['pki_ds_create_new_db']):
-            data.createNewDB = "true"
-        else:
-            data.createNewDB = "false"
-        if config.str2bool(self.mdict['pki_ds_remove_data']):
-            data.removeData = "true"
-        else:
-            data.removeData = "false"
-        if config.str2bool(self.mdict['pki_ds_secure_connection']):
-            data.secureConn = "true"
-        else:
-            data.secureConn = "false"
-        if config.str2bool(self.mdict['pki_share_db']):
-            data.sharedDB = "true"
-            data.sharedDBUserDN = self.mdict['pki_share_dbuser_dn']
-        else:
-            data.sharedDB = "false"
-
-    def set_backup_parameters(self, data):
-        if config.str2bool(self.mdict['pki_backup_keys']):
-            data.backupKeys = "true"
-            data.backupFile = self.mdict['pki_backup_keys_p12']
-            data.backupPassword = self.mdict['pki_backup_password']
-        else:
-            data.backupKeys = "false"
-
-    def set_admin_parameters(self, data):
-        data.adminEmail = self.mdict['pki_admin_email']
-        data.adminName = self.mdict['pki_admin_name']
-        data.adminPassword = self.mdict['pki_admin_password']
-        data.adminProfileID = self.mdict['pki_admin_profile_id']
-        data.adminUID = self.mdict['pki_admin_uid']
-        data.adminSubjectDN = self.mdict['pki_admin_subject_dn']
-        if self.standalone:
-            if not self.external_step_two:
-                # IMPORTANT:  ALWAYS set 'pki_import_admin_cert' FALSE for
-                #             Stand-alone PKI (Step 1)
-                self.mdict['pki_import_admin_cert'] = "False"
-            else:
-                # IMPORTANT:  ALWAYS set 'pki_import_admin_cert' TRUE for
-                #             Stand-alone PKI (Step 2)
-                self.mdict['pki_import_admin_cert'] = "True"
-        if config.str2bool(self.mdict['pki_import_admin_cert']):
-            data.importAdminCert = "true"
-            if self.standalone:
-                # Stand-alone PKI (Step 2)
-                #
-                # Copy the Stand-alone PKI 'Admin Certificate'
-                # (that was previously generated via an external CA) into
-                # 'ca_admin.cert' under the specified 'pki_client_dir'
-                # stripping the certificate HEADER/FOOTER prior to saving it.
-                imported_admin_cert = ""
-                with open(self.mdict['pki_external_admin_cert_path'], "r") as f:
-                    for line in f:
-                        if line.startswith("-----BEGIN CERTIFICATE-----"):
-                            continue
-                        elif line.startswith("-----END CERTIFICATE-----"):
-                            continue
-                        else:
-                            imported_admin_cert += line
-                with open(self.mdict['pki_admin_cert_file'], "w") as f:
-                    f.write(imported_admin_cert)
-            # read config from file
-            with open(self.mdict['pki_admin_cert_file'], "r") as f:
-                b64 = f.read().replace('\n', '')
-            data.adminCert = b64
-        else:
-            data.importAdminCert = "false"
-            data.adminSubjectDN = self.mdict['pki_admin_subject_dn']
-            if self.mdict['pki_admin_cert_request_type'] == "pkcs10":
-                data.adminCertRequestType = "pkcs10"
-
-                noise_file = os.path.join(
-                    self.mdict['pki_client_database_dir'], "noise")
-
-                output_file = os.path.join(
-                    self.mdict['pki_client_database_dir'], "admin_pkcs10.bin")
-
-                self.deployer.file.generate_noise_file(
-                    noise_file, int(self.mdict['pki_admin_keysize']))
-
-                self.deployer.certutil.generate_certificate_request(
-                    self.mdict['pki_admin_subject_dn'],
-                    self.mdict['pki_admin_keysize'],
-                    self.mdict['pki_client_password_conf'],
-                    noise_file,
-                    output_file,
-                    self.mdict['pki_client_database_dir'],
-                    None, None, True)
-
-                # convert output to ascii
-                command = ["BtoA", output_file, output_file + ".asc"]
-                config.pki_log.info(
-                    ' '.join(command),
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                try:
-                    subprocess.check_call(command)
-                except subprocess.CalledProcessError as exc:
-                    config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
-                                         extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise
-
-                if self.standalone and not self.external_step_two:
-                    # For convenience and consistency, save a copy of
-                    # the Stand-alone PKI 'Admin Certificate' CSR to the
-                    # specified "pki_external_admin_csr_path" location
-                    # (Step 1)
-                    self.save_admin_csr()
-                    # IMPORTANT:  ALWAYS save the client database for
-                    #             Stand-alone PKI (Step 1)
-                    self.mdict['pki_client_database_purge'] = "False"
-
-                with open(output_file + ".asc", "r") as f:
-                    b64 = f.read().replace('\n', '')
-
-                data.adminCertRequest = b64
-            else:
-                print "log.PKI_CONFIG_PKCS10_SUPPORT_ONLY"
-                raise Exception(log.PKI_CONFIG_PKCS10_SUPPORT_ONLY)
-
-    def set_issuing_ca_parameters(self, data):
-        if (self.subsystem != "CA" or
-                self.clone or
-                self.subordinate or
-                self.external):
-            # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
-            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone,
-            # Subordinate CA, External CA, or Stand-alone PKI
-            data.issuingCA = self.mdict['pki_issuing_ca']
-
-    def set_tps_parameters(self, data):
-        data.caUri = self.mdict['pki_ca_uri']
-        data.tksUri = self.mdict['pki_tks_uri']
-        data.enableServerSideKeyGen = \
-            self.mdict['pki_enable_server_side_keygen']
-        if config.str2bool(self.mdict['pki_enable_server_side_keygen']):
-            data.kraUri = self.mdict['pki_kra_uri']
-        data.authdbHost = self.mdict['pki_authdb_hostname']
-        data.authdbPort = self.mdict['pki_authdb_port']
-        data.authdbBaseDN = self.mdict['pki_authdb_basedn']
-        data.authdbSecureConn = self.mdict['pki_authdb_secure_conn']
-        data.importSharedSecret = self.mdict['pki_import_shared_secret']
-
-    def create_system_cert(self, tag):
-        cert = pki.system.SystemCertData()
-        cert.tag = self.mdict["pki_%s_tag" % tag]
-        cert.keyAlgorithm = self.mdict["pki_%s_key_algorithm" % tag]
-        cert.keySize = self.mdict["pki_%s_key_size" % tag]
-        cert.keyType = self.mdict["pki_%s_key_type" % tag]
-        cert.nickname = self.mdict["pki_%s_nickname" % tag]
-        cert.subjectDN = self.mdict["pki_%s_subject_dn" % tag]
-        cert.token = self.mdict["pki_%s_token" % tag]
-        return cert
-
-    def retrieve_existing_server_cert(self, cfg_file):
-        cs_cfg = PKIConfigParser.read_simple_configuration_file(cfg_file)
-        cstype = cs_cfg.get('cs.type').lower()
-        cert = pki.system.SystemCertData()
-        cert.tag = self.mdict["pki_ssl_server_tag"]
-        cert.keyAlgorithm = self.mdict["pki_ssl_server_key_algorithm"]
-        cert.keySize = self.mdict["pki_ssl_server_key_size"]
-        cert.keyType = self.mdict["pki_ssl_server_key_type"]
-        cert.nickname = cs_cfg.get(cstype + ".sslserver.nickname")
-        cert.cert = cs_cfg.get(cstype + ".sslserver.cert")
-        cert.request = cs_cfg.get(cstype + ".sslserver.certreq")
-        cert.subjectDN = self.mdict["pki_ssl_server_subject_dn"]
-        cert.token = cs_cfg.get(cstype + ".sslserver.tokenname")
-        return cert
-
-    def retrieve_existing_subsystem_cert(self, cfg_file):
-        cs_cfg = PKIConfigParser.read_simple_configuration_file(cfg_file)
-        cstype = cs_cfg.get('cs.type').lower()
-        cert = pki.system.SystemCertData()
-        cert.tag = self.mdict["pki_subsystem_tag"]
-        cert.keyAlgorithm = cs_cfg.get("cloning.subsystem.keyalgorithm")
-        cert.keySize = self.mdict["pki_subsystem_key_size"]
-        cert.keyType = cs_cfg.get("cloning.subsystem.keytype")
-        cert.nickname = cs_cfg.get(cstype + ".subsystem.nickname")
-        cert.cert = cs_cfg.get(cstype + ".subsystem.cert")
-        cert.request = cs_cfg.get(cstype + ".subsystem.certreq")
-        cert.subjectDN = cs_cfg.get("cloning.subsystem.dn")
-        cert.token = cs_cfg.get(cstype + ".subsystem.tokenname")
-        return cert
-
-
-class PKIDeployer:
-    """Holds the global dictionaries and the utility objects"""
-
-    def __init__(self, pki_mdict, slots_dict=None):
-        # Global dictionary variables
-        self.mdict = pki_mdict
-        self.slots = slots_dict
-        self.manifest_db = []
-
-        # Utility objects
-        self.identity = Identity(self)
-        self.namespace = Namespace(self)
-        self.configuration_file = ConfigurationFile(self)
-        self.instance = Instance(self)
-        self.directory = Directory(self)
-        self.file = File(self)
-        self.symlink = Symlink(self)
-        self.war = War(self)
-        self.password = Password(self)
-        self.certutil = Certutil(self)
-        self.pk12util = PK12util(self)
-        self.kra_connector = KRAConnector(self)
-        self.security_domain = SecurityDomain(self)
-        self.systemd = Systemd(self)
-        self.tps_connector = TPSConnector(self)
-        self.config_client = ConfigClient(self)
-
-
diff --git a/base/server/python/pki/server/deployment/pkilogging.py b/base/server/python/pki/server/deployment/pkilogging.py
deleted file mode 100644
index 14c11cf..0000000
--- a/base/server/python/pki/server/deployment/pkilogging.py
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# System Imports
-import logging
-import os
-import pprint
-
-sensitive_parameters = []
-
-# Initialize 'pretty print' for objects
-pp = pprint.PrettyPrinter(indent=4)
-
-
-def log_format(given_dict):
-    new_dict = {}
-
-    # mask sensitive data
-    for key in given_dict:
-        if key in sensitive_parameters:
-            value = 'XXXXXXXX'
-        else:
-            value = given_dict[key]
-        new_dict[key] = value
-
-    return pp.pformat(new_dict)
-
-
-# PKI Deployment Logging Functions
-def enable_pki_logger(log_dir, log_name, log_level, console_log_level, name):
-    if not os.path.isdir(log_dir):
-        try:
-            os.makedirs(log_dir)
-        except OSError:
-            return OSError
-
-    # Configure logger
-    logger = logging.getLogger(name)
-    logger.setLevel(log_level)
-
-    # Configure console handler
-    console = logging.StreamHandler()
-    console.setLevel(console_log_level)
-    console_format = logging.Formatter('%(name)-12s: ' +
-                                       '%(levelname)-8s ' +
-                                       '%(indent)s%(message)s')
-    console.setFormatter(console_format)
-    logger.addHandler(console)
-
-    # Configure file handler
-    log_file = logging.FileHandler(log_dir + "/" + log_name, 'w')
-    log_file.setLevel(log_level)
-    file_format = logging.Formatter('%(asctime)s %(name)-12s: ' +
-                                    '%(levelname)-8s ' +
-                                    '%(indent)s%(message)s',
-                                    '%Y-%m-%d %H:%M:%S')
-    log_file.setFormatter(file_format)
-    logger.addHandler(log_file)
-
-    return logger
diff --git a/base/server/python/pki/server/deployment/pkimanifest.py b/base/server/python/pki/server/deployment/pkimanifest.py
deleted file mode 100644
index 593fb20..0000000
--- a/base/server/python/pki/server/deployment/pkimanifest.py
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# System Imports
-import csv
-
-# PKI Deployment Imports
-from . import pkiconfig as config
-from . import pkimessages as log
-
-
-# PKI Deployment Manifest Constants
-RECORD_TYPE_DIRECTORY = "directory"
-RECORD_TYPE_FILE = "file"
-RECORD_TYPE_SYMLINK = "symlink"
-
-
-# PKI Deployment Manifest Record Class
-class Record(object):
-    __slots__ = "name", \
-                "type", \
-                "user", \
-                "group", \
-                "uid", \
-                "gid", \
-                "permissions", \
-                "acls",
-
-    def __init__(self):
-        self.name = None
-        self.type = None
-        self.user = None
-        self.group = None
-        self.uid = None
-        self.gid = None
-        self.permissions = None
-        self.acls = None
-
-    def items(self):
-        """dict style items"""
-        return [
-            (field_name, getattr(self, field_name))
-            for field_name in self.__slots__]
-
-    def __iter__(self):
-        """iterate over fields tuple/list style"""
-        for field_name in self.__slots__:
-            yield getattr(self, field_name)
-
-    def __getitem__(self, index):
-        """tuple/list style getitem"""
-        return getattr(self, self.__slots__[index])
-
-
-# PKI Deployment Manifest File Class
-class File:
-
-    def __init__(self, database):
-        self.filename = None
-        self.database = database
-
-    def register(self, name):
-        self.filename = name
-
-    def write(self):
-        try:
-            with open(self.filename, "w") as fd:
-                c = csv.writer(fd)
-                for record in self.database:
-                    c.writerow(tuple(record))
-        except IOError as exc:
-            config.pki_log.error(log.PKI_IOERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_1)
-            raise
-
-    def read(self):
-        try:
-            with open(self.filename, "r") as fd:
-                cr = csv.reader(fd)
-                for row in cr:
-                    print tuple(row)
-        except IOError as exc:
-            config.pki_log.error(log.PKI_IOERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_1)
-            raise
-
diff --git a/base/server/python/pki/server/deployment/pkimessages.py b/base/server/python/pki/server/deployment/pkimessages.py
deleted file mode 100644
index 405118a..0000000
--- a/base/server/python/pki/server/deployment/pkimessages.py
+++ /dev/null
@@ -1,421 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# PKI Deployment Engine Messages
-PKI_DICTIONARY_DEFAULT = '''
-=====================================================
-    DISPLAY CONTENTS OF PKI DEFAULT DICTIONARY
-=====================================================
-'''
-PKI_DICTIONARY_MASTER = '''
-=====================================================
-    DISPLAY CONTENTS OF PKI MASTER DICTIONARY
-=====================================================
-'''
-PKI_DICTIONARY_SLOTS = '''
-=====================================================
-    DISPLAY CONTENTS OF PKI SLOTS DICTIONARY
-=====================================================
-'''
-PKI_DICTIONARY_SUBSYSTEM = '''
-=====================================================
-    DISPLAY CONTENTS OF PKI SUBSYSTEM DICTIONARY
-=====================================================
-'''
-PKI_DICTIONARY_WEB_SERVER = '''
-=====================================================
-    DISPLAY CONTENTS OF PKI WEB SERVER DICTIONARY
-=====================================================
-'''
-# NEVER print out 'sensitive' data dictionary!!!
-
-
-# PKI Deployment Log Messages
-PKI_VERBOSITY = '''
-VERBOSITY FLAGS    CONSOLE MESSAGE LEVEL       LOG MESSAGE LEVEL
-=======================================================================
-  NONE             error|warning               error|warning|info|debug
-  -v               error|warning|info          error|warning|info|debug
-  -vv              error|warning|info|debug    error|warning|info|debug
-
-'''
-
-
-# PKI Deployment Error Messages
-PKI_BADZIPFILE_ERROR_1 = "zipfile.BadZipFile:  %s!"
-PKI_CONFIGURATION_RESTART_1 = '''
-    After configuration, the server can be operated by the command:
-        %s
-'''
-PKI_CONFIGURATION_STANDALONE_1 = '''
-      Please obtain the necessary certificates for this stand-alone %s,
-      and re-run the configuration for step two.
-'''
-PKI_CONFIGURATION_URL_1 = \
-    "    Please start the configuration by accessing:\n    %s"
-PKI_CONFIGURATION_WIZARD_RESTART_1 = \
-    "After configuration, the server can be operated by the command:\n%s"
-PKI_CONFIGURATION_WIZARD_URL_1 = "Configuration Wizard listening on\n%s"
-PKI_DIRECTORY_ALREADY_EXISTS_1 = "Directory '%s' already exists!"
-PKI_DIRECTORY_ALREADY_EXISTS_NOT_A_DIRECTORY_1 = \
-    "Directory '%s' already exists BUT it is NOT a directory!"
-PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 = \
-    "Directory '%s' is either missing or is NOT a directory!"
-PKI_DNS_DOMAIN_NOT_SET = \
-    "A valid DNS domain name MUST be established to use PKI services!"
-PKI_FILE_ALREADY_EXISTS_1 = "File '%s' already exists!"
-PKI_FILE_ALREADY_EXISTS_NOT_A_FILE_1 = \
-    "File '%s' already exists BUT it is NOT a file!"
-PKI_FILE_MISSING_OR_NOT_A_FILE_1 = \
-    "File '%s' is either missing or is NOT a regular file!"
-PKI_FILE_NOT_A_WAR_FILE_1 = "File '%s' is NOT a war file!"
-PKI_INSTANCE_DOES_NOT_EXIST_1 = "PKI instance '%s' does NOT exist!"
-PKI_SECURITY_DATABASES_ALREADY_EXIST_3 = \
-    "Security databases '%s', '%s', and/or '%s' already exist!"
-PKI_SECURITY_DATABASES_DO_NOT_EXIST_3 = \
-    "Security databases '%s', '%s', and/or '%s' do NOT exist!"
-PKI_SUBSYSTEM_NOT_INSTALLED_1 = "Package pki-%s is NOT installed!"
-PKI_SUBSYSTEM_ALREADY_EXISTS_2 = \
-    "PKI subsystem '%s' for instance '%s' already exists!"
-PKI_SUBSYSTEM_DOES_NOT_EXIST_2 = \
-    "PKI subsystem '%s' for instance '%s' does NOT exist!"
-PKI_EXTERNAL_UNSUPPORTED_1 = \
-    "PKI '%s' subsystems do NOT support the 'pki_external' parameter!"
-PKI_EXTERNAL_STEP_TWO_UNSUPPORTED_1 = \
-    "PKI '%s' subsystems do NOT support the 'pki_external_step_two' parameter!"
-PKI_STANDALONE_UNSUPPORTED_1 = \
-    "PKI '%s' subsystems do NOT support the 'pki_standalone' parameter!"
-PKI_SUBORDINATE_UNSUPPORTED_1 = \
-    "PKI '%s' subsystems do NOT support the 'pki_subordinate' parameter!"
-
-PKI_IOERROR_1 = "IOError:  %s!"
-PKI_KEYERROR_1 = "KeyError:  %s!"
-PKI_LARGEZIPFILE_ERROR_1 = "zipfile.LargeZipFile:  %s!"
-PKI_MANIFEST_MESSAGE_1 = "generating manifest file called '%s'"
-PKI_OSERROR_1 = "OSError:  %s!"
-PKI_SHUTIL_ERROR_1 = "shutil.Error:  %s!"
-PKI_SUBPROCESS_ERROR_1 = "subprocess.CalledProcessError:  %s!"
-PKI_SYMLINK_ALREADY_EXISTS_1 = "Symlink '%s' already exists!"
-PKI_SYMLINK_ALREADY_EXISTS_NOT_A_SYMLINK_1 = \
-    "Symlink '%s' already exists BUT it is NOT a symlink!"
-PKI_SYMLINK_MISSING_OR_NOT_A_SYMLINK_1 = \
-    "Symlink '%s' is either missing or is NOT a symbolic link!"
-PKI_UNABLE_TO_PARSE_1 = "'Could not parse:  '%s'"
-PKI_UNABLE_TO_CREATE_LOG_DIRECTORY_1 = "Could not create log directory '%s'!"
-
-
-# PKI Deployment 'pkispawn' and 'pkidestroy' Messages
-PKIDESTROY_BEGIN_MESSAGE_2 = \
-    "BEGIN destroying subsystem '%s' of instance '%s' . . ."
-PKIDESTROY_END_MESSAGE_2 = "END destroying subsystem '%s' of instance '%s'"
-PKIDESTROY_EPILOG = '''
-REMINDER:
-
-    The default PKI instance path will be calculated and placed in front
-    of the mandatory '-i <instance>' parameter, and the values that reside
-    in deployment configuration file that was most recently used
-    by this instance's 'pkispawn' (or 'pkispawn -u') command will be
-    utilized by 'pkidestroy' to remove this instance.
-
-    Finally, if an optional '-p <prefix>' is defined, this value WILL be
-    prepended to the default PKI instance path which is placed in front
-    of the specified '-i <instance>' parameter.
-''' + PKI_VERBOSITY
-PKISPAWN_BEGIN_MESSAGE_2 = \
-    "BEGIN spawning subsystem '%s' of instance '%s' . . ."
-PKISPAWN_END_MESSAGE_2 = \
-    "END spawning subsystem '%s' of instance '%s'"
-PKISPAWN_EPILOG = """
-REMINDER:
-
-    If two or more Apache or Tomcat PKI 'instances' are specified via
-    separate configuration files, remember that the following parameters
-    MUST differ between PKI 'instances':
-
-        Apache:  'pki_instance_name', 'pki_http_port', and 'pki_https_port'
-        Tomcat:  'pki_instance_name', 'pki_http_port', 'pki_https_port',
-                 'pki_ajp_port', and 'pki_tomcat_server_port'
-
-    Finally, if an optional '-p <prefix>' is defined, this value WILL NOT
-    be prepended in front of the mandatory '-f <configuration_file>'.
-""" + PKI_VERBOSITY
-
-
-# PKI Deployment "Helper" Messages
-PKIHELPER_APACHE_INSTANCE_SUBSYSTEMS_2 = \
-    "instance '%s' contains '%d' Apache PKI subsystems"
-PKIHELPER_APACHE_INSTANCES_2 = \
-    "PKI Apache registry '%s' contains '%d' Apache PKI instances"
-PKIHELPER_APPLY_SLOT_SUBSTITUTION_1 = \
-    "applying in-place slot substitutions on '%s'"
-PKIHELPER_CERTUTIL_GENERATE_CSR_1 = "executing '%s'"
-PKIHELPER_CERTUTIL_MISSING_INPUT_FILE = \
-    "certutil: Missing '-i input-file' option!"
-PKIHELPER_CERTUTIL_MISSING_ISSUER_NAME = \
-    "certutil:  Missing '-c issuer-name' option!"
-PKIHELPER_CERTUTIL_MISSING_NICKNAME = \
-    "certutil:  Missing '-n nickname' option!"
-PKIHELPER_CERTUTIL_MISSING_NOISE_FILE = \
-    "certutil:  Missing '-z noise-file' option!"
-PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE = \
-    "certutil:  Missing '-f password-file' option!"
-PKIHELPER_CERTUTIL_MISSING_PATH = "certutil:  Missing '-d path' option!"
-PKIHELPER_CERTUTIL_MISSING_SERIAL_NUMBER = \
-    "certutil:  Missing '-m serial-number' option!"
-PKIHELPER_CERTUTIL_MISSING_SUBJECT = "certutil:  Missing '-s subject' option!"
-PKIHELPER_CERTUTIL_MISSING_TOKEN = "certutil:  Missing '-h token' option!"
-PKIHELPER_CERTUTIL_MISSING_TRUSTARGS = \
-    "certutil:  Missing '-t trustargs' option!"
-PKIHELPER_CERTUTIL_MISSING_VALIDITY_PERIOD = \
-    "certutil:  Missing '-v months-valid' option!"
-PKIHELPER_CERTUTIL_SELF_SIGNED_CERTIFICATE_1 = "executing '%s'"
-PKIHELPER_CHMOD_2 = "chmod %o %s"
-PKIHELPER_CHOWN_3 = "chown %s:%s %s"
-PKIHELPER_CHOWN_H_3 = "chown -h %s:%s %s"
-PKIHELPER_COMMAND_LINE_PARAMETER_MISMATCH_2 = \
-    "the command-line parameter '%s' DOES NOT match the "\
-    "configuration file value '%s'!"
-PKIHELPER_COPY_WITH_SLOT_SUBSTITUTION_2 = \
-    "copying '%s' --> '%s' with slot substitution"
-PKIHELPER_CP_P_2 = "cp -p %s %s"
-PKIHELPER_CP_RP_2 = "cp -rp %s %s"
-PKIHELPER_CREATE_SECURITY_DATABASES_1 = "executing '%s'"
-PKIHELPER_DANGLING_SYMLINK_2 = "Dangling symlink '%s'-->'%s'"
-PKIHELPER_DICTIONARY_MASTER_MISSING_KEY_1 = \
-    "KeyError:  Master dictionary is missing the key called '%s'!"
-PKIHELPER_DICTIONARY_INTERPOLATION_1 = \
-    "Deployment file could not be parsed correctly.  This might be because of "\
-    "unescaped '%%' characters.  You must escape '%%' characters in deployment"\
-    " files (example - 'setting=foo%%%%bar')."
-PKIHELPER_DICTIONARY_INTERPOLATION_2 = "Interpolation error (%s)"
-PKIHELPER_DIRECTORY_IS_EMPTY_1 = "directory '%s' is empty"
-PKIHELPER_DIRECTORY_IS_NOT_EMPTY_1 = "directory '%s' is NOT empty"
-PKIHELPER_GID_2 = "GID of '%s' is %s"
-PKIHELPER_GROUP_1 = "retrieving GID for '%s' . . ."
-PKIHELPER_GROUP_ADD_2 = "adding GID '%s' for group '%s' . . ."
-PKIHELPER_GROUP_ADD_DEFAULT_2 = "adding default GID '%s' for group '%s' . . ."
-PKIHELPER_GROUP_ADD_GID_KEYERROR_1 = "KeyError:  pki_gid %s"
-PKIHELPER_GROUP_ADD_KEYERROR_1 = "KeyError:  pki_group %s"
-PKIHELPER_INVALID_SELINUX_CONTEXT_FOR_PORT = \
-    "port %s has invalid selinux context %s"
-PKIHELPER_IS_A_DIRECTORY_1 = "'%s' is a directory"
-PKIHELPER_IS_A_FILE_1 = "'%s' is a file"
-PKIHELPER_IS_A_SYMLINK_1 = "'%s' is a symlink"
-PKIHELPER_JAR_XF_C_2 = "jar -xf %s -C %s"
-PKIHELPER_KRACONNECTOR_UPDATE_CONTACT = \
-    "contacting the CA to update the KRA connector"
-PKIHELPER_KRACONNECTOR_UPDATE_FAILURE = "Failed to update KRA connector on CA"
-PKIHELPER_KRACONNECTOR_UPDATE_FAILURE_2 = \
-    "Failed to update KRA connector for %s:%s"
-PKIHELPER_LINK_S_2 = "ln -s %s %s"
-PKIHELPER_MKDIR_1 = "mkdir -p %s"
-PKIHELPER_MODIFY_DIR_1 = "modifying '%s'"
-PKIHELPER_MODIFY_FILE_1 = "modifying '%s'"
-PKIHELPER_MODIFY_SYMLINK_1 = "modifying '%s'"
-PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_CA = \
-    "cloned CAs and external CAs MUST be MUTUALLY EXCLUSIVE in '%s'"
-PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_EXTERNAL_SUB_CA = \
-    "cloned CAs, external CAs, and subordinate CAs MUST ALL be MUTUALLY "\
-    "EXCLUSIVE in '%s'"
-PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_STANDALONE_PKI = \
-    "cloned PKIs and stand-alone PKIs MUST be MUTUALLY EXCLUSIVE in '%s'"
-PKIHELPER_MUTUALLY_EXCLUSIVE_CLONE_SUB_CA = \
-    "cloned CAs and subordinate CAs MUST be MUTUALLY EXCLUSIVE in '%s'"
-PKIHELPER_MUTUALLY_EXCLUSIVE_EXTERNAL_SUB_CA = \
-    "external CAs and subordinate CAs MUST be MUTUALLY EXCLUSIVE in '%s'"
-PKIHELPER_NAMESPACE_COLLISION_2 = \
-    "PKI instance '%s' would produce a namespace collision with '%s'!"
-PKIHELPER_NAMESPACE_RESERVED_NAME_2 = \
-    "PKI instance '%s' is already a reserved name under '%s'!"
-PKIHELPER_NOISE_FILE_2 = \
-    "generating noise file called '%s' and filling it with '%d' random bytes"
-PKIHELPER_PASSWORD_CONF_1 = "generating '%s'"
-PKIHELPER_PASSWORD_NOT_FOUND_1 = "no password found for '%s'!"
-PKIHELPER_PK12UTIL_MISSING_DBPWFILE = \
-    "pk12util missing -k db-password-file option!"
-PKIHELPER_PK12UTIL_MISSING_NICKNAME = \
-    "pk12util missing -n nickname option!"
-PKIHELPER_PK12UTIL_MISSING_OUTFILE = \
-    "pk12util missing -o output-file option!"
-PKIHELPER_PK12UTIL_MISSING_PWFILE = \
-    "pk12util missing -w pw-file option!"
-
-PKIHELPER_PKI_INSTANCE_SUBSYSTEMS_2 = \
-    "instance '%s' contains '%d' PKI subsystems"
-PKIHELPER_REMOVE_FILTER_SECTION_1 = "removing filter section from '%s'"
-PKIHELPER_RM_F_1 = "rm -f %s"
-PKIHELPER_RM_RF_1 = "rm -rf %s"
-PKIHELPER_RMDIR_1 = "rmdir %s"
-PKIHELPER_SECURITY_DOMAIN_CONTACT_1 = \
-    "contacting the security domain master to update security domain '%s'"
-PKIHELPER_SECURITY_DOMAIN_GET_TOKEN_FAILURE_2 = \
-    "Failed to get installation token from security domain '%s:%s'"
-PKIHELPER_SECURITY_DOMAIN_UNDEFINED = \
-    "No security domain defined.\n"\
-    "If this is an unconfigured instance, then that is OK.\n"\
-    "Otherwise, manually delete the entry from the security domain master."
-PKIHELPER_SECURITY_DOMAIN_UNREACHABLE_1 = \
-    "security domain '%s' may be offline or unreachable!"
-PKIHELPER_SECURITY_DOMAIN_UNREGISTERED_2 = \
-    "this '%s' entry may not be registered with security domain '%s'!"
-PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_2 = \
-    "this '%s' entry will NOT be deleted from security domain '%s'!"
-PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_3 = \
-    "updateDomainXML FAILED to delete this '%s' entry from "\
-    "security domain '%s': '%s'"
-PKIHELPER_SECURITY_DOMAIN_UPDATE_SUCCESS_2 = \
-    "updateDomainXML SUCCESSFULLY deleted this '%s' entry from "\
-    "security domain '%s'"
-PKIHELPER_SELINUX_DISABLED = "Selinux is disabled.  Not checking port contexts"
-PKIHELPER_SET_MODE_1 = "setting ownerships, permissions, and acls on '%s'"
-PKIHELPER_SLOT_SUBSTITUTION_2 = "slot substitution: '%s' ==> '%s'"
-PKIHELPER_SSLGET_OUTPUT_1 = '''
-    Dump of 'sslget' output:
-    =====================================================
-    %s
-    =====================================================
-'''
-PKIHELPER_SYSTEMD_COMMAND_1 = "executing '%s'"
-PKIHELPER_TOMCAT_INSTANCE_SUBSYSTEMS_2 = \
-    "instance '%s' contains '%d' Tomcat PKI subsystems"
-PKIHELPER_TOMCAT_INSTANCES_2 = \
-    "PKI Tomcat registry '%s' contains '%d' Tomcat PKI instances"
-PKIHELPER_TOUCH_1 = "touch %s"
-PKIHELPER_TPSCONNECTOR_UPDATE_CONTACT = \
-    "contacting the TKS to update the TPS connector"
-PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE = "Failed to update TPS connector on TKS"
-PKIHELPER_TPSCONNECTOR_UPDATE_FAILURE_2 = \
-    "Failed to update TPS connector for %s:%s"
-PKIHELPER_UID_2 = "UID of '%s' is %s"
-PKIHELPER_UNDEFINED_CA_HOST_PORT = "CA Host or Port is undefined"
-PKIHELPER_UNDEFINED_CLIENT_DATABASE_PASSWORD_2 = \
-    "Either a value for '%s' MUST be defined in '%s', or "\
-    "the randomly generated client pin MUST be used"
-PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2 = \
-    "A value for '%s' MUST be defined in '%s'"
-PKIHELPER_UNDEFINED_SUBSYSTEM_NICKNAME = "subsystem nickname not defined"
-PKIHELPER_UNDEFINED_TKS_HOST_PORT = "TKS Host or Port is undefined"
-PKIHELPER_UNDEFINED_TOKEN_PASSWD_1 = "Password for token '%s' not defined"
-PKIHELPER_USER_1 = "retrieving UID for '%s' . . ."
-PKIHELPER_USER_ADD_2 = "adding UID '%s' for user '%s' . . ."
-PKIHELPER_USER_ADD_DEFAULT_2 = "adding default UID '%s' for user '%s' . . ."
-PKIHELPER_USER_ADD_KEYERROR_1 = "KeyError:  pki_user %s"
-PKIHELPER_USER_ADD_UID_KEYERROR_1 = "KeyError:  pki_uid %s"
-
-PKI_CONFIG_ADMIN_CERT_SAVE_1 = "saving %s Admin Certificate to file:"
-PKI_CONFIG_ADMIN_CERT_ATOB_1 = "converting %s Admin Certificate to binary:"
-PKI_CONFIG_CDATA_TAG = "tag:"
-PKI_CONFIG_CDATA_CERT = "cert:"
-PKI_CONFIG_CDATA_REQUEST = "request:"
-PKI_CONFIG_CONFIGURING_PKI_DATA = "configuring PKI configuration data."
-PKI_CONFIG_CONSTRUCTING_PKI_DATA = "constructing PKI configuration data."
-PKI_CONFIG_PKCS10_SUPPORT_ONLY = \
-    "only the 'pkcs10' certificate request type is currently supported"
-PKI_CONFIG_EXTERNAL_CA_LOAD = \
-    "loading external CA signing certificate from file:"
-PKI_CONFIG_EXTERNAL_CA_CHAIN_LOAD = \
-    "loading external CA signing certificate chain from file:"
-PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_STORAGE = \
-    "loading external CA signed KRA Storage certificate from file:"
-PKI_CONFIG_EXTERNAL_CERT_LOAD_KRA_TRANSPORT = \
-    "loading external CA signed KRA Transport certificate from file:"
-PKI_CONFIG_EXTERNAL_CERT_LOAD_OCSP_SIGNING = \
-    "loading external CA signed OCSP Signing certificate from file:"
-PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SSLSERVER_1 = \
-    "loading external CA signed %s SSL Server certificate from file:"
-PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_SUBSYSTEM_1 = \
-    "loading external CA signed %s Subsystem certificate from file:"
-PKI_CONFIG_EXTERNAL_CERT_LOAD_PKI_AUDIT_SIGNING_1 = \
-    "loading external CA signed %s Audit Signing certificate from file:"
-PKI_CONFIG_EXTERNAL_CSR_SAVE = "saving CA Signing CSR to file:"
-PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_STORAGE = "saving KRA Storage CSR to file:"
-PKI_CONFIG_EXTERNAL_CSR_SAVE_KRA_TRANSPORT = "saving KRA Transport CSR to file:"
-PKI_CONFIG_EXTERNAL_CSR_SAVE_OCSP_SIGNING = "saving OCSP Signing CSR to file:"
-PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_ADMIN_1 = "saving %s Admin CSR to file:"
-PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_AUDIT_SIGNING_1 = \
-    "saving %s Audit Signing CSR to file:"
-PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SSLSERVER_1 = \
-    "saving %s SSL Server CSR to file:"
-PKI_CONFIG_EXTERNAL_CSR_SAVE_PKI_SUBSYSTEM_1 = \
-    "saving %s Subsystem CSR to file:"
-PKI_CONFIG_JAVA_CONFIGURATION_EXCEPTION = \
-    "Exception from Java Configuration Servlet:"
-PKI_CONFIG_RESPONSE_ADMIN_CERT = "adminCert:"
-PKI_CONFIG_RESPONSE_STATUS = "status:"
-PKI_CONFIG_NOT_YET_IMPLEMENTED_1 = " %s NOT YET IMPLEMENTED"
-PKI_CHECK_STATUS_MESSAGE = '''
-      To check the status of the subsystem:
-            systemctl status pki-tomcatd@%s.service
-'''
-PKI_ACCESS_URL = "      The URL for the subsystem is: \n"\
-                 "            https://%s:%s/%s"
-PKI_INSTANCE_RESTART_MESSAGE = \
-    "      To restart the subsystem: \n"\
-    "            systemctl restart pki-tomcatd@%s.service"
-
-
-PKI_SPAWN_INFORMATION_HEADER = '''
-    ==========================================================================
-                                INSTALLATION SUMMARY\n\
-    ==========================================================================
-'''
-
-PKI_SPAWN_INFORMATION_FOOTER = '''
-    ==========================================================================
-'''
-
-
-# PKI Deployment "Scriptlet" Messages
-ADMIN_DOMAIN_DESTROY_1 = "depopulating '%s'"
-ADMIN_DOMAIN_SPAWN_1 = "populating '%s'"
-CONFIGURATION_DESTROY_1 = "unconfiguring '%s'"
-CONFIGURATION_SPAWN_1 = "configuring '%s'"
-FINALIZATION_DESTROY_1 = "finalizing '%s'"
-FINALIZATION_SPAWN_1 = "finalizing '%s'"
-INITIALIZATION_DESTROY_1 = "initializing '%s'"
-INITIALIZATION_SPAWN_1 = "initializing '%s'"
-INSTANCE_DESTROY_1 = "depopulating '%s'"
-INSTANCE_SPAWN_1 = "populating '%s'"
-RESIDUAL_DESTROY_1 = "depopulating '%s'"
-RESIDUAL_SPAWN_1 = "populating '%s'"
-SECURITY_DATABASES_DESTROY_1 = "removing '%s'"
-SECURITY_DATABASES_SPAWN_1 = "generating '%s'"
-SELINUX_DESTROY_1 = "depopulating '%s'"
-SELINUX_SPAWN_1 = "populating '%s'"
-SELINUX_DISABLED_DESTROY_1 = "selinux disabled. skipping unlabelling '%s'"
-SELINUX_DISABLED_SPAWN_1 = "selinux disabled. skipping labelling '%s'"
-SLOT_ASSIGNMENT_DESTROY_1 = "unassigning slots for '%s'"
-SLOT_ASSIGNMENT_SPAWN_1 = "assigning slots for '%s'"
-SUBSYSTEM_DESTROY_1 = "depopulating '%s'"
-SUBSYSTEM_SPAWN_1 = "populating '%s'"
-WEBAPP_DEPLOYMENT_DESTROY_1 = "removing '%s'"
-WEBAPP_DEPLOYMENT_SPAWN_1 = "deploying '%s'"
-SKIP_ADMIN_DOMAIN_SPAWN_1 = "skip populating '%s'"
-SKIP_CONFIGURATION_SPAWN_1 = "skip configuring '%s'"
-SKIP_FINALIZATION_SPAWN_1 = "skip finalizing '%s'"
-SKIP_INITIALIZATION_SPAWN_1 = "skip initializing '%s'"
-SKIP_INSTANCE_SPAWN_1 = "skip populating '%s'"
-SKIP_RESIDUAL_SPAWN_1 = "skip populating '%s'"
-SKIP_SECURITY_DATABASES_SPAWN_1 = "skip generating '%s'"
-SKIP_SELINUX_SPAWN_1 = "skip populating '%s'"
-SKIP_SLOT_ASSIGNMENT_SPAWN_1 = "skip assigning slots for '%s'"
-SKIP_SUBSYSTEM_SPAWN_1 = "skip populating '%s'"
-SKIP_WEBAPP_DEPLOYMENT_SPAWN_1 = "skip deploying '%s'"
diff --git a/base/server/python/pki/server/deployment/pkiparser.py b/base/server/python/pki/server/deployment/pkiparser.py
deleted file mode 100644
index 1d201ce..0000000
--- a/base/server/python/pki/server/deployment/pkiparser.py
+++ /dev/null
@@ -1,1273 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# System Imports
-import ConfigParser
-import argparse
-import getpass
-import ldap
-import logging
-import os
-import random
-import requests
-import string
-import subprocess
-import xml.etree.ElementTree as ET
-from urlparse import urlparse
-
-# PKI Imports
-import pki
-import pki.upgrade
-import pki.account
-import pki.client
-import pki.system
-from . import pkiconfig as config
-from . import pkimessages as log
-from . import pkilogging
-
-
-class PKIConfigParser:
-
-    COMMENT_CHAR = '#'
-    OPTION_CHAR = '='
-
-    def __init__(self, description, epilog):
-        self.pki_config = None
-
-        #Read and process command-line options
-        self.arg_parser = argparse.ArgumentParser(
-            description=description,
-            add_help=False,
-            formatter_class=argparse.RawDescriptionHelpFormatter,
-            epilog=epilog)
-
-        # Establish 'Mandatory' command-line options
-        self.mandatory = self.arg_parser.add_argument_group(
-            'mandatory arguments')
-
-        # Establish 'Optional' command-line options
-        self.optional = self.arg_parser.add_argument_group('optional arguments')
-        self.optional.add_argument(
-            '-s',
-            dest='pki_subsystem', action='store',
-            nargs=1, choices=config.PKI_SUBSYSTEMS,
-            metavar='<subsystem>',
-            help='where <subsystem> is '
-            'CA, KRA, OCSP, RA, TKS, or TPS')
-        self.optional.add_argument(
-            '-h', '--help',
-            dest='help', action='help',
-            help='show this help message and exit')
-        self.optional.add_argument(
-            '-v',
-            dest='pki_verbosity', action='count',
-            help='display verbose information (details below)')
-
-        # Establish 'Test' command-line options
-        test = self.arg_parser.add_argument_group('test arguments')
-        test.add_argument(
-            '-p',
-            dest='pki_root_prefix', action='store',
-            nargs=1, metavar='<prefix>',
-            help='directory prefix to specify local directory '
-            '[TEST ONLY]')
-        self.indent = 0
-        self.ds_connection = None
-        self.sd_connection = None
-        self.authdb_connection = None
-
-        # Master and Slot dictionaries
-        self.mdict = dict()
-        self.slots_dict = dict()
-
-    # PKI Deployment Helper Functions
-    def process_command_line_arguments(self):
-
-        # Parse command-line options
-        args = self.arg_parser.parse_args()
-
-        # Process 'Mandatory' command-line options
-
-        # Process 'Optional' command-line options
-        #    '-v'
-        if args.pki_verbosity == 1:
-            config.pki_console_log_level = logging.INFO
-        elif args.pki_verbosity >= 2:
-            config.pki_console_log_level = logging.DEBUG
-        else:
-            # Set default log levels
-            config.pki_console_log_level = logging.WARNING
-
-        # Debug log is always at DEBUG level
-        config.pki_log_level = logging.DEBUG
-
-        # Process 'Test' command-line options
-        #    '-p'
-        if args.pki_root_prefix is None:
-            config.pki_root_prefix = ""
-        else:
-            config.pki_root_prefix = str(args.pki_root_prefix).strip('[\']')
-
-        return args
-
-    def validate(self):
-
-        # Validate command-line options
-        if len(config.pki_root_prefix) > 0:
-            if not os.path.exists(config.pki_root_prefix) or \
-                    not os.path.isdir(config.pki_root_prefix):
-                print "ERROR:  " + \
-                      log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1 % \
-                      config.pki_root_prefix
-                print
-                self.arg_parser.print_help()
-                self.arg_parser.exit(-1)
-
-        # always default that configuration file exists
-        if not os.path.exists(config.default_deployment_cfg) or \
-                not os.path.isfile(config.default_deployment_cfg):
-            print "ERROR:  " + \
-                  log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % \
-                  config.default_deployment_cfg
-            print
-            self.arg_parser.print_help()
-            self.arg_parser.exit(-1)
-
-        if config.user_deployment_cfg:
-            # verify user configuration file exists
-            if not os.path.exists(config.user_deployment_cfg) or \
-                    not os.path.isfile(config.user_deployment_cfg):
-                print "ERROR:  " + \
-                      log.PKI_FILE_MISSING_OR_NOT_A_FILE_1 % \
-                      config.user_deployment_cfg
-                print
-                self.arg_parser.print_help()
-                self.arg_parser.exit(-1)
-
-    def init_config(self):
-
-        # RESTEasy
-        resteasy_lib = subprocess.check_output(
-            '. /etc/pki/pki.conf && echo $RESTEASY_LIB',
-            shell=True)
-        # workaround for pylint error E1103
-        resteasy_lib = str(resteasy_lib).strip()
-
-        # JNI jar location
-        jni_jar_dir = subprocess.check_output(
-            '. /usr/share/pki/etc/pki.conf && echo $JNI_JAR_DIR',
-            shell=True)
-        # workaround for pylint error E1103
-        jni_jar_dir = str(jni_jar_dir).strip()
-
-        if config.pki_subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
-            default_instance_name = 'pki-tomcat'
-            default_http_port = '8080'
-            default_https_port = '8443'
-        else:
-            default_instance_name = 'pki-apache'
-            default_http_port = '80'
-            default_https_port = '443'
-
-        application_version = str(pki.upgrade.Version(
-            pki.implementation_version()))
-
-        self.pki_config = ConfigParser.SafeConfigParser({
-            'application_version': application_version,
-            'pki_instance_name': default_instance_name,
-            'pki_http_port': default_http_port,
-            'pki_https_port': default_https_port,
-            'pki_dns_domainname': config.pki_dns_domainname,
-            'pki_subsystem': config.pki_subsystem,
-            'pki_subsystem_type': config.pki_subsystem.lower(),
-            'pki_root_prefix': config.pki_root_prefix,
-            'resteasy_lib': resteasy_lib,
-            'jni_jar_dir': jni_jar_dir,
-            'home_dir': os.path.expanduser("~"),
-            'pki_hostname': config.pki_hostname})
-
-        # Make keys case-sensitive!
-        self.pki_config.optionxform = str
-
-        config.user_config = ConfigParser.SafeConfigParser()
-        config.user_config.optionxform = str
-
-        with open(config.default_deployment_cfg) as f:
-            self.pki_config.readfp(f)
-
-        self.flatten_master_dict()
-
-    # The following code is based heavily upon
-    # "http://www.decalage.info/en/python/configparser"
-    @staticmethod
-    def read_simple_configuration_file(filename):
-        values = {}
-        with open(filename) as f:
-            for line in f:
-                # First, remove comments:
-                if PKIConfigParser.COMMENT_CHAR in line:
-                    # split on comment char, keep only the part before
-                    line, _ = line.split(PKIConfigParser.COMMENT_CHAR, 1)
-                # Second, find lines with an name=value:
-                if PKIConfigParser.OPTION_CHAR in line:
-                    # split on name char:
-                    name, value = line.split(PKIConfigParser.OPTION_CHAR, 1)
-                    # strip spaces:
-                    name = name.strip()
-                    value = value.strip()
-                    # store in dictionary:
-                    values[name] = value
-        return values
-
-    def set_property(self, section, key, value):
-        if section != "DEFAULT" and not self.pki_config.has_section(section):
-            self.pki_config.add_section(section)
-        self.pki_config.set(section, key, value)
-        self.flatten_master_dict()
-
-        if section != "DEFAULT" and not config.user_config.has_section(section):
-            config.user_config.add_section(section)
-        config.user_config.set(section, key, value)
-
-    def print_text(self, message):
-        print ' ' * self.indent + message
-
-    def read_text(
-            self, message,
-            section=None, key=None, default=None,
-            options=None, sign=':', allow_empty=True, case_sensitive=True):
-
-        if default is None and key is not None:
-            default = self.mdict[key]
-        if default:
-            message = message + ' [' + default + ']'
-        message = ' ' * self.indent + message + sign + ' '
-
-        done = False
-        while not done:
-            value = raw_input(message)
-            value = value.strip()
-
-            if len(value) == 0:  # empty value
-                if allow_empty:
-                    value = default
-                    done = True
-                    break
-
-            else:  # non-empty value
-                if options is not None:
-                    for v in options:
-                        if case_sensitive:
-                            if v == value:
-                                done = True
-                                break
-                        else:
-                            if v.lower() == value.lower():
-                                done = True
-                                break
-                else:
-                    done = True
-                    break
-
-        value = value.replace("%", "%%")
-        if section:
-            self.set_property(section, key, value)
-
-        return value
-
-    def read_password(
-            self, message, section=None, key=None,
-            verifyMessage=None):
-        message = ' ' * self.indent + message + ': '
-        if verifyMessage is not None:
-            verifyMessage = ' ' * self.indent + verifyMessage + ': '
-
-        while True:
-            password = ''
-            while len(password) == 0:
-                password = getpass.getpass(prompt=message)
-
-            if verifyMessage is not None:
-                verification = ''
-                while len(verification) == 0:
-                    verification = getpass.getpass(prompt=verifyMessage)
-
-                if password != verification:
-                    self.print_text('Passwords do not match.')
-                    continue
-
-            break
-
-        password = password.replace("%", "%%")
-        if section:
-            self.set_property(section, key, password)
-
-        return password
-
-    def read_pki_configuration_file(self):
-        """Read configuration file sections into dictionaries"""
-        rv = 0
-        try:
-            if config.user_deployment_cfg:
-                # We don't allow interpolation in password settings, which
-                # means that we need to deal with escaping '%' characters
-                # that might be present.
-                no_interpolation = (
-                    'pki_admin_password', 'pki_backup_password',
-                    'pki_client_database_password',
-                    'pki_client_pkcs12_password',
-                    'pki_ds_password', 'pki_security_domain_password')
-
-                print 'Loading deployment configuration from ' + \
-                      config.user_deployment_cfg + '.'
-                self.pki_config.read([config.user_deployment_cfg])
-                config.user_config.read([config.user_deployment_cfg])
-
-                # Look through each section and see if any password settings
-                # are present.  If so, escape any '%' characters.
-                sections = self.pki_config.sections()
-                if sections:
-                    sections.append('DEFAULT')
-                    for section in sections:
-                        for key in no_interpolation:
-                            try:
-                                val = self.pki_config.get(
-                                    section, key, raw=True)
-                                if val:
-                                    self.pki_config.set(
-                                        section, key, val.replace("%", "%%"))
-                            except ConfigParser.NoOptionError:
-                                continue
-
-                sections = config.user_config.sections()
-                if sections:
-                    sections.append('DEFAULT')
-                    for section in sections:
-                        for key in no_interpolation:
-                            try:
-                                val = config.user_config.get(
-                                    section, key, raw=True)
-                                if val:
-                                    config.user_config.set(
-                                        section, key, val.replace("%", "%%"))
-                            except ConfigParser.NoOptionError:
-                                continue
-        except ConfigParser.ParsingError, err:
-            print err
-            rv = err
-        return rv
-
-    def flatten_master_dict(self):
-        self.mdict.update(__name__="PKI Master Dictionary")
-
-        default_dict = dict(self.pki_config.items('DEFAULT'))
-        default_dict[0] = None
-        self.mdict.update(default_dict)
-
-        web_server_dict = None
-        if config.pki_subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
-            if self.pki_config.has_section('Tomcat'):
-                web_server_dict = dict(self.pki_config.items('Tomcat'))
-        else:
-            if self.pki_config.has_section('Apache'):
-                web_server_dict = dict(self.pki_config.items('Apache'))
-
-        if web_server_dict:
-            web_server_dict[0] = None
-            self.mdict.update(web_server_dict)
-
-        if self.pki_config.has_section(config.pki_subsystem):
-            subsystem_dict = dict(self.pki_config.items(config.pki_subsystem))
-            subsystem_dict[0] = None
-            self.mdict.update(subsystem_dict)
-
-    def ds_connect(self):
-
-        hostname = self.mdict['pki_ds_hostname']
-
-        if config.str2bool(self.mdict['pki_ds_secure_connection']):
-            protocol = 'ldaps'
-            port = self.mdict['pki_ds_ldaps_port']
-        else:
-            protocol = 'ldap'
-            port = self.mdict['pki_ds_ldap_port']
-
-        self.ds_connection = ldap.initialize(
-            protocol + '://' + hostname + ':' + port)
-
-    def ds_bind(self):
-        self.ds_connection.simple_bind_s(
-            self.mdict['pki_ds_bind_dn'],
-            self.mdict['pki_ds_password'])
-
-    def ds_search(self, key=None):
-        if key is None:
-            key = ''
-        self.ds_connection.search_s(key, ldap.SCOPE_BASE)
-
-    def ds_close(self):
-        self.ds_connection.unbind_s()
-
-    def ds_verify_configuration(self):
-
-        try:
-            self.ds_connect()
-            self.ds_bind()
-            self.ds_search()
-        except:
-            raise
-        finally:
-            self.ds_close()
-
-    def ds_base_dn_exists(self):
-        base_dn_exists = True
-        try:
-            self.ds_connect()
-            self.ds_bind()
-            self.ds_search()
-            try:
-                results = self.ds_search(self.mdict['pki_ds_base_dn'])
-
-                if results is None or len(results) == 0:
-                    base_dn_exists = False
-
-            except ldap.NO_SUCH_OBJECT:
-                base_dn_exists = False
-        except:
-            raise
-        finally:
-            self.ds_close()
-        return base_dn_exists
-
-    def sd_connect(self):
-        self.sd_connection = pki.client.PKIConnection(
-            protocol='https',
-            hostname=self.mdict['pki_security_domain_hostname'],
-            port=self.mdict['pki_security_domain_https_port'],
-            subsystem='ca')
-
-    def sd_get_info(self):
-        sd = pki.system.SecurityDomainClient(self.sd_connection)
-        try:
-            info = sd.get_security_domain_info()
-        except requests.exceptions.HTTPError as e:
-            config.pki_log.info(
-                "unable to access security domain through REST interface.  " +
-                "Trying old interface. " + str(e),
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            info = sd.get_old_security_domain_info()
-        return info
-
-    def sd_authenticate(self):
-        self.sd_connection.authenticate(
-            self.mdict['pki_security_domain_user'],
-            self.mdict['pki_security_domain_password'])
-
-        account = pki.account.AccountClient(self.sd_connection)
-        try:
-            account.login()
-            account.logout()
-        except requests.exceptions.HTTPError as e:
-            code = e.response.status_code
-            if code == 404 or code == 501:
-                config.pki_log.warning(
-                    "unable to validate security domain user/password " +
-                    "through REST interface. Interface not available",
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-            else:
-                raise
-
-    def authdb_connect(self):
-
-        hostname = self.mdict['pki_authdb_hostname']
-        port = self.mdict['pki_authdb_port']
-
-        if config.str2bool(self.mdict['pki_authdb_secure_conn']):
-            protocol = 'ldaps'
-        else:
-            protocol = 'ldap'
-
-        self.authdb_connection = ldap.initialize(
-            protocol + '://' + hostname + ':' + port)
-        self.authdb_connection.search_s('', ldap.SCOPE_BASE)
-
-    def authdb_base_dn_exists(self):
-        try:
-            results = self.authdb_connection.search_s(
-                self.mdict['pki_authdb_basedn'],
-                ldap.SCOPE_BASE)
-
-            if results is None or len(results) == 0:
-                return False
-
-            return True
-
-        except ldap.NO_SUCH_OBJECT:
-            return False
-
-    def get_server_status(self, system_type, system_uri):
-        parse = urlparse(self.mdict[system_uri])
-        conn = pki.client.PKIConnection(
-            protocol=parse.scheme,
-            hostname=parse.hostname,
-            port=str(parse.port),
-            subsystem=system_type)
-        client = pki.system.SystemStatusClient(conn)
-        response = client.get_status()
-        root = ET.fromstring(response)
-        return root.findtext("Status")
-
-    def compose_pki_master_dictionary(self):
-        """
-        Create a single master PKI dictionary from the
-        sectional dictionaries
-        """
-        try:
-            # 'pkispawn'/'pkidestroy' name/value pairs
-            self.mdict['pki_deployment_executable'] = \
-                config.pki_deployment_executable
-            self.mdict['pki_install_time'] = config.pki_install_time
-            self.mdict['pki_timestamp'] = config.pki_timestamp
-            self.mdict['pki_certificate_timestamp'] = \
-                config.pki_certificate_timestamp
-            self.mdict['pki_architecture'] = config.pki_architecture
-            self.mdict['pki_default_deployment_cfg'] = \
-                config.default_deployment_cfg
-            self.mdict['pki_user_deployment_cfg'] = config.user_deployment_cfg
-            self.mdict['pki_deployed_instance_name'] = \
-                config.pki_deployed_instance_name
-            # Generate random 'pin's for use as security database passwords
-            # and add these to the "sensitive" key value pairs read in from
-            # the configuration file
-            pin_low = 100000000000
-            pin_high = 999999999999
-            self.mdict['pki_pin'] = \
-                random.randint(pin_low, pin_high)
-            self.mdict['pki_client_pin'] = \
-                random.randint(pin_low, pin_high)
-
-            self.flatten_master_dict()
-
-            pkilogging.sensitive_parameters = \
-                self.mdict['sensitive_parameters'].split()
-
-            # Always create "false" values for these missing "boolean" keys
-            if not 'pki_enable_access_log' in self.mdict or\
-               not len(self.mdict['pki_enable_access_log']):
-                self.mdict['pki_enable_access_log'] = "false"
-            if not 'pki_external' in self.mdict or\
-               not len(self.mdict['pki_external']):
-                self.mdict['pki_external'] = "false"
-            if not 'pki_external_step_two' in self.mdict or\
-               not len(self.mdict['pki_external_step_two']):
-                self.mdict['pki_external_step_two'] = "false"
-            if not 'pki_standalone' in self.mdict or\
-               not len(self.mdict['pki_standalone']):
-                self.mdict['pki_standalone'] = "false"
-            if not 'pki_subordinate' in self.mdict or\
-               not len(self.mdict['pki_subordinate']):
-                self.mdict['pki_subordinate'] = "false"
-
-            # PKI Target (slot substitution) name/value pairs
-            self.mdict['pki_target_cs_cfg'] = \
-                os.path.join(
-                    self.mdict['pki_subsystem_configuration_path'],
-                    "CS.cfg")
-            self.mdict['pki_target_registry'] = \
-                os.path.join(self.mdict['pki_instance_registry_path'],
-                             self.mdict['pki_instance_name'])
-            if config.str2bool(self.mdict['pki_external_step_two']) or\
-               config.str2bool(self.mdict['pki_skip_installation']):
-                # For CA (External CA Step 2) and Stand-alone PKI (Step 2),
-                # use the 'pki_one_time_pin' established during the setup
-                # of (Step 1)
-                #
-                # Similarly, if the only code being processed is for
-                # configuration, re-use the 'pki_one_time_pin' generated
-                # during the installation phase
-                #
-                if os.path.exists(self.mdict['pki_target_cs_cfg'])\
-                   and\
-                   os.path.isfile(self.mdict['pki_target_cs_cfg']):
-                    cs_cfg = self.read_simple_configuration_file(
-                        self.mdict['pki_target_cs_cfg'])
-                    self.mdict['pki_one_time_pin'] = \
-                        cs_cfg.get('preop.pin')
-                else:
-                    config.pki_log.error(
-                        log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
-                        self.mdict['pki_target_cs_cfg'],
-                        extra=config.PKI_INDENTATION_LEVEL_2)
-                    raise Exception(log.PKI_FILE_MISSING_OR_NOT_A_FILE_1)
-            else:
-                # Generate a one-time pin to be used prior to configuration
-                # and add this to the "sensitive" key value pairs read in from
-                # the configuration file
-                self.mdict['pki_one_time_pin'] = \
-                    ''.join(random.choice(string.ascii_letters + string.digits)
-                    for x in range(20))
-            if self.mdict['pki_subsystem'] in\
-               config.PKI_TOMCAT_SUBSYSTEMS:
-                self.mdict['pki_target_catalina_properties'] = \
-                    os.path.join(
-                        self.mdict['pki_instance_configuration_path'],
-                        "catalina.properties")
-                self.mdict['pki_target_servercertnick_conf'] = \
-                    os.path.join(
-                        self.mdict['pki_instance_configuration_path'],
-                        "serverCertNick.conf")
-                self.mdict['pki_target_server_xml'] = \
-                    os.path.join(
-                        self.mdict['pki_instance_configuration_path'],
-                        "server.xml")
-                self.mdict['pki_target_context_xml'] = \
-                    os.path.join(
-                        self.mdict['pki_instance_configuration_path'],
-                        "context.xml")
-                self.mdict['pki_target_tomcat_conf_instance_id'] = \
-                    self.mdict['pki_root_prefix'] + \
-                    "/etc/sysconfig/" + \
-                    self.mdict['pki_instance_name']
-                self.mdict['pki_target_tomcat_conf'] = \
-                    os.path.join(
-                        self.mdict['pki_instance_configuration_path'],
-                        "tomcat.conf")
-                # in-place slot substitution name/value pairs
-                self.mdict['pki_target_velocity_properties'] = \
-                    os.path.join(
-                        self.mdict['pki_tomcat_webapps_subsystem_path'],
-                        "WEB-INF",
-                        "velocity.properties")
-                self.mdict['pki_target_subsystem_web_xml'] = \
-                    os.path.join(
-                        self.mdict['pki_tomcat_webapps_subsystem_path'],
-                        "WEB-INF",
-                        "web.xml")
-                self.mdict['pki_target_subsystem_web_xml_orig'] = \
-                    os.path.join(
-                        self.mdict['pki_tomcat_webapps_subsystem_path'],
-                        "WEB-INF",
-                        "web.xml.orig")
-                # subystem-specific slot substitution name/value pairs
-                if self.mdict['pki_subsystem'] == "CA":
-                    self.mdict['pki_target_flatfile_txt'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "flatfile.txt")
-                    self.mdict['pki_target_proxy_conf'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "proxy.conf")
-                    self.mdict['pki_target_registry_cfg'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "registry.cfg")
-                    # '*.profile'
-                    self.mdict['pki_target_admincert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "adminCert.profile")
-                    self.mdict['pki_target_caauditsigningcert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "caAuditSigningCert.profile")
-                    self.mdict['pki_target_cacert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "caCert.profile")
-                    self.mdict['pki_target_caocspcert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "caOCSPCert.profile")
-                    self.mdict['pki_target_servercert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "serverCert.profile")
-                    self.mdict['pki_target_subsystemcert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "subsystemCert.profile")
-                    # in-place slot substitution name/value pairs
-                    self.mdict['pki_target_profileselect_template'] = \
-                        os.path.join(
-                            self.mdict['pki_tomcat_webapps_subsystem_path'],
-                            "ee",
-                            self.mdict['pki_subsystem'].lower(),
-                            "ProfileSelect.template")
-                elif self.mdict['pki_subsystem'] == "KRA":
-                    # '*.profile'
-                    self.mdict['pki_target_servercert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "serverCert.profile")
-                    self.mdict['pki_target_storagecert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "storageCert.profile")
-                    self.mdict['pki_target_subsystemcert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "subsystemCert.profile")
-                    self.mdict['pki_target_transportcert_profile'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "transportCert.profile")
-                elif self.mdict['pki_subsystem'] == "TPS":
-                    self.mdict['pki_target_registry_cfg'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "registry.cfg")
-                    self.mdict['pki_target_phone_home_xml'] = \
-                        os.path.join(
-                            self.mdict['pki_subsystem_configuration_path'],
-                            "phoneHome.xml")
-
-            # Slot assignment name/value pairs
-            #     NOTE:  Master key == Slots key; Master value ==> Slots value
-            self.mdict['PKI_INSTANCE_NAME_SLOT'] = \
-                self.mdict['pki_instance_name']
-            self.mdict['PKI_INSTANCE_INITSCRIPT_SLOT'] = \
-                os.path.join(self.mdict['pki_instance_path'],
-                             self.mdict['pki_instance_name'])
-            self.mdict['PKI_REGISTRY_FILE_SLOT'] = \
-                os.path.join(self.mdict['pki_subsystem_registry_path'],
-                             self.mdict['pki_instance_name'])
-            if self.mdict['pki_subsystem'] in\
-               config.PKI_APACHE_SUBSYSTEMS:
-                self.mdict['FORTITUDE_APACHE_SLOT'] = None
-                self.mdict['FORTITUDE_AUTH_MODULES_SLOT'] = None
-                self.mdict['FORTITUDE_DIR_SLOT'] = None
-                self.mdict['FORTITUDE_LIB_DIR_SLOT'] = None
-                self.mdict['FORTITUDE_MODULE_SLOT'] = None
-                self.mdict['FORTITUDE_NSS_MODULES_SLOT'] = None
-                self.mdict['HTTPD_CONF_SLOT'] = None
-                self.mdict['LIB_PREFIX_SLOT'] = None
-                self.mdict['NON_CLIENTAUTH_SECURE_PORT_SLOT'] = None
-                self.mdict['NSS_CONF_SLOT'] = None
-                self.mdict['OBJ_EXT_SLOT'] = None
-                self.mdict['PKI_LOCKDIR_SLOT'] = \
-                    os.path.join("/var/lock/pki",
-                                 "apache")
-                self.mdict['PKI_PIDDIR_SLOT'] = \
-                    os.path.join("/var/run/pki",
-                                 "apache")
-                self.mdict['PKI_WEB_SERVER_TYPE_SLOT'] = "apache"
-                self.mdict['PORT_SLOT'] = None
-                self.mdict['PROCESS_ID_SLOT'] = None
-                self.mdict['REQUIRE_CFG_PL_SLOT'] = None
-                self.mdict['SECURE_PORT_SLOT'] = None
-                self.mdict['SECURITY_LIBRARIES_SLOT'] = None
-                self.mdict['PKI_HOSTNAME_SLOT'] = None
-                self.mdict['SERVER_ROOT_SLOT'] = None
-                self.mdict['SYSTEM_LIBRARIES_SLOT'] = None
-                self.mdict['SYSTEM_USER_LIBRARIES_SLOT'] = None
-                self.mdict['TMP_DIR_SLOT'] = None
-            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-                self.mdict['INSTALL_TIME_SLOT'] = \
-                    self.mdict['pki_install_time']
-                self.mdict['PKI_ADMIN_SECURE_PORT_SLOT'] = \
-                    self.mdict['pki_https_port']
-                self.mdict['PKI_ADMIN_SECURE_PORT_CONNECTOR_NAME_SLOT'] = \
-                    "Unused"
-                self.mdict['PKI_ADMIN_SECURE_PORT_SERVER_COMMENT_SLOT'] = ""
-                self.mdict['PKI_AGENT_CLIENTAUTH_SLOT'] = "want"
-                self.mdict['PKI_AGENT_SECURE_PORT_SLOT'] = \
-                    self.mdict['pki_https_port']
-                self.mdict['PKI_AJP_PORT_SLOT'] = \
-                    self.mdict['pki_ajp_port']
-                self.mdict['PKI_AJP_REDIRECT_PORT_SLOT'] = \
-                    self.mdict['pki_https_port']
-                self.mdict['PKI_CA_HOSTNAME_SLOT'] = \
-                    self.mdict['pki_ca_hostname']
-                self.mdict['PKI_CA_PORT_SLOT'] = \
-                    self.mdict['pki_ca_port']
-                self.mdict['PKI_CERT_DB_PASSWORD_SLOT'] = \
-                    self.mdict['pki_pin']
-                self.mdict['PKI_CFG_PATH_NAME_SLOT'] = \
-                    self.mdict['pki_target_cs_cfg']
-                self.mdict['PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT_SLOT'] = \
-                    "-->"
-                self.mdict['PKI_CLOSE_SEPARATE_PORTS_WEB_COMMENT_SLOT'] = \
-                    "-->"
-                self.mdict['PKI_EE_SECURE_CLIENT_AUTH_PORT_SLOT'] = \
-                    self.mdict['pki_https_port']
-                self.mdict\
-                    ['PKI_EE_SECURE_CLIENT_AUTH_PORT_CONNECTOR_NAME_SLOT'] = \
-                    "Unused"
-                self.mdict\
-                    ['PKI_EE_SECURE_CLIENT_AUTH_PORT_SERVER_COMMENT_SLOT'] = \
-                    ""
-                self.mdict['PKI_EE_SECURE_CLIENT_AUTH_PORT_UI_SLOT'] = \
-                    self.mdict['pki_https_port']
-                self.mdict['PKI_EE_SECURE_PORT_SLOT'] = \
-                    self.mdict['pki_https_port']
-                self.mdict['PKI_EE_SECURE_PORT_CONNECTOR_NAME_SLOT'] = \
-                    "Unused"
-                self.mdict['PKI_EE_SECURE_PORT_SERVER_COMMENT_SLOT'] = \
-                    ""
-                self.mdict['PKI_GROUP_SLOT'] = \
-                    self.mdict['pki_group']
-                self.mdict['PKI_INSTANCE_PATH_SLOT'] = \
-                    self.mdict['pki_instance_path']
-                self.mdict['PKI_INSTANCE_ROOT_SLOT'] = \
-                    self.mdict['pki_path']
-                self.mdict['PKI_LOCKDIR_SLOT'] = \
-                    os.path.join("/var/lock/pki",
-                                 "tomcat")
-                self.mdict['PKI_HOSTNAME_SLOT'] = \
-                    self.mdict['pki_hostname']
-                self.mdict['PKI_OPEN_SEPARATE_PORTS_SERVER_COMMENT_SLOT'] = \
-                    "<!--"
-                self.mdict['PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT_SLOT'] = \
-                    "<!--"
-                self.mdict['PKI_PIDDIR_SLOT'] = \
-                    os.path.join("/var/run/pki", "tomcat")
-                if config.str2bool(self.mdict['pki_enable_proxy']):
-                    self.mdict['PKI_CLOSE_AJP_PORT_COMMENT_SLOT'] = \
-                        ""
-                    self.mdict['PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT'] = \
-                        ""
-                    self.mdict['PKI_PROXY_SECURE_PORT_SLOT'] = \
-                        self.mdict['pki_proxy_https_port']
-                    self.mdict['PKI_PROXY_UNSECURE_PORT_SLOT'] = \
-                        self.mdict['pki_proxy_http_port']
-                    self.mdict['PKI_OPEN_AJP_PORT_COMMENT_SLOT'] = \
-                        ""
-                    self.mdict['PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT'] = \
-                        ""
-                else:
-                    self.mdict['PKI_CLOSE_AJP_PORT_COMMENT_SLOT'] = \
-                        "-->"
-                    self.mdict['PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT'] = \
-                        "-->"
-                    self.mdict['PKI_PROXY_SECURE_PORT_SLOT'] = ""
-                    self.mdict['PKI_PROXY_UNSECURE_PORT_SLOT'] = ""
-                    self.mdict['PKI_OPEN_AJP_PORT_COMMENT_SLOT'] = \
-                        "<!--"
-                    self.mdict['PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT'] = \
-                        "<!--"
-                if config.str2bool(self.mdict['pki_standalone']):
-                    # Stand-alone PKI
-                    self.mdict['PKI_CLOSE_STANDALONE_COMMENT_SLOT'] = \
-                        ""
-                    self.mdict['PKI_OPEN_STANDALONE_COMMENT_SLOT'] = \
-                        ""
-                    self.mdict['PKI_STANDALONE_SLOT'] = "true"
-                else:
-                    self.mdict['PKI_CLOSE_STANDALONE_COMMENT_SLOT'] = \
-                        "-->"
-                    self.mdict['PKI_OPEN_STANDALONE_COMMENT_SLOT'] = \
-                        "<!--"
-                    self.mdict['PKI_STANDALONE_SLOT'] = "false"
-                if config.str2bool(self.mdict['pki_enable_access_log']):
-                    self.mdict['PKI_CLOSE_TOMCAT_ACCESS_LOG_COMMENT_SLOT'] = \
-                        ""
-                    self.mdict['PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT_SLOT'] = \
-                        ""
-                else:
-                    self.mdict['PKI_CLOSE_TOMCAT_ACCESS_LOG_COMMENT_SLOT'] = \
-                        "-->"
-                    self.mdict['PKI_OPEN_TOMCAT_ACCESS_LOG_COMMENT_SLOT'] = \
-                        "<!--"
-                self.mdict['PKI_TMPDIR_SLOT'] = \
-                    self.mdict['pki_tomcat_tmpdir_path']
-                self.mdict['PKI_RESTEASY_LIB_SLOT'] = \
-                    self.mdict['resteasy_lib']
-                self.mdict['PKI_RANDOM_NUMBER_SLOT'] = \
-                    self.mdict['pki_one_time_pin']
-                self.mdict['PKI_SECURE_PORT_SLOT'] = \
-                    self.mdict['pki_https_port']
-                self.mdict['PKI_SECURE_PORT_CONNECTOR_NAME_SLOT'] = \
-                    "Secure"
-                self.mdict['PKI_SECURE_PORT_SERVER_COMMENT_SLOT'] = \
-                    "<!-- " + \
-                    "Shared Ports:  Agent, EE, and Admin Secure Port Connector " + \
-                    "-->"
-                self.mdict['PKI_SECURITY_MANAGER_SLOT'] = \
-                    self.mdict['pki_security_manager']
-                self.mdict['PKI_SERVER_XML_CONF_SLOT'] = \
-                    self.mdict['pki_target_server_xml']
-                self.mdict['PKI_SSL_SERVER_NICKNAME_SLOT'] = \
-                    self.mdict['pki_ssl_server_nickname']
-                self.mdict['PKI_SUBSYSTEM_TYPE_SLOT'] = \
-                    self.mdict['pki_subsystem'].lower()
-                self.mdict['PKI_SYSTEMD_SERVICENAME_SLOT'] = \
-                    "pki-tomcatd" + "@" + \
-                    self.mdict['pki_instance_name'] + ".service"
-                self.mdict['PKI_UNSECURE_PORT_SLOT'] = \
-                    self.mdict['pki_http_port']
-                self.mdict['PKI_UNSECURE_PORT_CONNECTOR_NAME_SLOT'] = \
-                    "Unsecure"
-                self.mdict['PKI_UNSECURE_PORT_SERVER_COMMENT_SLOT'] = \
-                    "<!-- Shared Ports:  Unsecure Port Connector -->"
-                self.mdict['PKI_USER_SLOT'] = \
-                    self.mdict['pki_user']
-                self.mdict['PKI_WEB_SERVER_TYPE_SLOT'] = \
-                    "tomcat"
-                self.mdict['PKI_WEBAPPS_NAME_SLOT'] = \
-                    "webapps"
-                self.mdict['TOMCAT_CFG_SLOT'] = \
-                    self.mdict['pki_target_tomcat_conf']
-                self.mdict['TOMCAT_INSTANCE_COMMON_LIB_SLOT'] = \
-                    os.path.join(
-                        self.mdict['pki_tomcat_common_lib_path'],
-                        "*.jar")
-                self.mdict['TOMCAT_LOG_DIR_SLOT'] = \
-                    self.mdict['pki_instance_log_path']
-                self.mdict['TOMCAT_PIDFILE_SLOT'] = \
-                    "/var/run/pki/tomcat/" + self.mdict['pki_instance_name'] + \
-                    ".pid"
-                self.mdict['TOMCAT_SERVER_PORT_SLOT'] = \
-                    self.mdict['pki_tomcat_server_port']
-                self.mdict['TOMCAT_SSL2_CIPHERS_SLOT'] = \
-                    "-SSL2_RC4_128_WITH_MD5," + \
-                    "-SSL2_RC4_128_EXPORT40_WITH_MD5," + \
-                    "-SSL2_RC2_128_CBC_WITH_MD5," + \
-                    "-SSL2_RC2_128_CBC_EXPORT40_WITH_MD5," + \
-                    "-SSL2_DES_64_CBC_WITH_MD5," + \
-                    "-SSL2_DES_192_EDE3_CBC_WITH_MD5"
-                self.mdict['TOMCAT_SSL3_CIPHERS_SLOT'] = \
-                    "-SSL3_FORTEZZA_DMS_WITH_NULL_SHA," + \
-                    "-SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA," + \
-                    "+SSL3_RSA_WITH_RC4_128_SHA," + \
-                    "-SSL3_RSA_EXPORT_WITH_RC4_40_MD5," + \
-                    "+SSL3_RSA_WITH_3DES_EDE_CBC_SHA," + \
-                    "-SSL3_RSA_WITH_DES_CBC_SHA," + \
-                    "-SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5," + \
-                    "-SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA," + \
-                    "-SSL_RSA_FIPS_WITH_DES_CBC_SHA," + \
-                    "+SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA," + \
-                    "-SSL3_RSA_WITH_NULL_MD5," + \
-                    "-TLS_RSA_EXPORT1024_WITH_RC4_56_SHA," + \
-                    "-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA," + \
-                    "+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA"
-                self.mdict['TOMCAT_SSL_OPTIONS_SLOT'] = \
-                    "ssl2=true," + \
-                    "ssl3=true," + \
-                    "tls=true"
-                self.mdict['TOMCAT_TLS_CIPHERS_SLOT'] = \
-                    "-TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA," + \
-                    "-TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA," + \
-                    "+TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA," + \
-                    "+TLS_ECDH_RSA_WITH_AES_128_CBC_SHA," + \
-                    "+TLS_ECDH_RSA_WITH_AES_256_CBC_SHA," + \
-                    "-TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA," + \
-                    "+TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA," + \
-                    "+TLS_RSA_WITH_3DES_EDE_CBC_SHA," + \
-                    "+TLS_RSA_WITH_AES_128_CBC_SHA," + \
-                    "+TLS_RSA_WITH_AES_256_CBC_SHA," + \
-                    "+TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA," + \
-                    "+TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA," + \
-                    "-TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA," + \
-                    "-TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA," + \
-                    "-TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA," + \
-                    "+TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA," + \
-                    "+TLS_DHE_DSS_WITH_AES_128_CBC_SHA," + \
-                    "+TLS_DHE_DSS_WITH_AES_256_CBC_SHA," + \
-                    "+TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA," + \
-                    "+TLS_DHE_RSA_WITH_AES_128_CBC_SHA," + \
-                    "+TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
-
-                # tps parameters
-                self.mdict['TOKENDB_HOST_SLOT'] = \
-                    self.mdict['pki_ds_hostname']
-
-                if config.str2bool(self.mdict['pki_ds_secure_connection']):
-                    self.mdict['TOKENDB_PORT_SLOT'] = \
-                        self.mdict['pki_ds_ldaps_port']
-                else:
-                    self.mdict['TOKENDB_PORT_SLOT'] = \
-                        self.mdict['pki_ds_ldap_port']
-
-                self.mdict['TOKENDB_ROOT_SLOT'] = \
-                    self.mdict['pki_ds_base_dn']
-
-                self.mdict['TPS_DIR_SLOT'] = \
-                    self.mdict['pki_source_subsystem_path']
-
-                if self.mdict['pki_subsystem'] == "CA":
-                    self.mdict['PKI_ENABLE_RANDOM_SERIAL_NUMBERS'] = \
-                        self.mdict['pki_random_serial_numbers_enable'].lower()
-            # Shared Apache/Tomcat NSS security database name/value pairs
-            self.mdict['pki_shared_pfile'] = \
-                os.path.join(
-                    self.mdict['pki_instance_configuration_path'],
-                    "pfile")
-            self.mdict['pki_shared_password_conf'] = \
-                os.path.join(
-                    self.mdict['pki_instance_configuration_path'],
-                    "password.conf")
-            self.mdict['pki_cert_database'] = \
-                os.path.join(self.mdict['pki_database_path'],
-                             "cert8.db")
-            self.mdict['pki_key_database'] = \
-                os.path.join(self.mdict['pki_database_path'],
-                             "key3.db")
-            self.mdict['pki_secmod_database'] = \
-                os.path.join(self.mdict['pki_database_path'],
-                             "secmod.db")
-            self.mdict['pki_self_signed_token'] = "internal"
-            self.mdict['pki_self_signed_nickname'] = \
-                self.mdict['pki_ssl_server_nickname']
-            self.mdict['pki_self_signed_subject'] = \
-                "cn=" + self.mdict['pki_hostname'] + "," + \
-                "o=" + self.mdict['pki_certificate_timestamp']
-            self.mdict['pki_self_signed_serial_number'] = 0
-            self.mdict['pki_self_signed_validity_period'] = 12
-            self.mdict['pki_self_signed_issuer_name'] = \
-                "cn=" + self.mdict['pki_hostname'] + "," + \
-                "o=" + self.mdict['pki_certificate_timestamp']
-            self.mdict['pki_self_signed_trustargs'] = "CTu,CTu,CTu"
-            self.mdict['pki_self_signed_noise_file'] = \
-                os.path.join(
-                    self.mdict['pki_subsystem_configuration_path'],
-                    "noise")
-            self.mdict['pki_self_signed_noise_bytes'] = 1024
-            # Shared Apache/Tomcat NSS security database convenience
-            # symbolic links
-            self.mdict['pki_subsystem_configuration_password_conf_link'] = \
-                os.path.join(
-                    self.mdict['pki_subsystem_configuration_path'],
-                    "password.conf")
-
-            if not len(self.mdict['pki_client_database_password']):
-                # use randomly generated client 'pin'
-                self.mdict['pki_client_database_password'] = \
-                    str(self.mdict['pki_client_pin'])
-
-            # Configuration scriptlet
-            # 'Security Domain' Configuration name/value pairs
-            # 'Subsystem Name'  Configuration name/value pairs
-            # 'Token'           Configuration name/value pairs
-            #
-            #     Apache - [RA]
-            #     Tomcat - [CA], [KRA], [OCSP], [TKS], [TPS]
-            #            - [CA Clone], [KRA Clone], [OCSP Clone], [TKS Clone],
-            #              [TPS Clone]
-            #            - [External CA]
-            #            - [Subordinate CA]
-            #
-            #     The following variables are defined below:
-            #
-            #         self.mdict['pki_security_domain_type']
-            #         self.mdict['pki_security_domain_uri']
-            #
-            #     The following variables are established via the specified PKI
-            #     deployment configuration file and are NOT redefined below:
-            #
-            #         self.mdict['pki_clone_pkcs12_password']
-            #         self.mdict['pki_security_domain_password']
-            #         self.mdict['pki_token_password']
-            #         self.mdict['pki_clone_pkcs12_path']
-            #         self.mdict['pki_clone_uri']
-            #         self.mdict['pki_security_domain_https_port']
-            #         self.mdict['pki_token_name']
-            #
-            #     The following variables are established via the specified PKI
-            #     deployment configuration file and potentially overridden
-            #     below:
-            #
-            #         self.mdict['pki_security_domain_user']
-            #         self.mdict['pki_issuing_ca']
-            #
-
-            # if security domain user is not defined
-            if not len(self.mdict['pki_security_domain_user']):
-
-                # use the CA admin uid if it's defined
-                if self.pki_config.has_option('CA', 'pki_admin_uid') and\
-                        len(self.pki_config.get('CA', 'pki_admin_uid')) > 0:
-                    self.mdict['pki_security_domain_user'] = \
-                        self.pki_config.get('CA', 'pki_admin_uid')
-
-                # or use the Default admin uid if it's defined
-                elif self.pki_config.has_option('DEFAULT', 'pki_admin_uid') and\
-                        len(self.pki_config.get('DEFAULT', 'pki_admin_uid')) > 0:
-                    self.mdict['pki_security_domain_user'] = \
-                        self.pki_config.get('DEFAULT', 'pki_admin_uid')
-
-                # otherwise use the default CA admin uid
-                else:
-                    self.mdict['pki_security_domain_user'] = "caadmin"
-
-            if not config.str2bool(self.mdict['pki_skip_configuration']) and\
-                    (config.str2bool(self.mdict['pki_standalone'])):
-                # Stand-alone PKI
-                self.mdict['pki_security_domain_type'] = "new"
-                self.mdict['pki_issuing_ca'] = "External CA"
-            elif config.pki_subsystem != "CA" or\
-                    config.str2bool(self.mdict['pki_clone']) or\
-                    config.str2bool(self.mdict['pki_subordinate']):
-                # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
-                # CA Clone, KRA Clone, OCSP Clone, TKS Clone, TPS Clone, or
-                # Subordinate CA
-                self.mdict['pki_security_domain_type'] = "existing"
-                self.mdict['pki_security_domain_uri'] = \
-                    "https" + "://" + \
-                    self.mdict['pki_security_domain_hostname'] + ":" + \
-                    self.mdict['pki_security_domain_https_port']
-
-            elif config.str2bool(self.mdict['pki_external']):
-                # External CA
-                self.mdict['pki_security_domain_type'] = "new"
-                self.mdict['pki_issuing_ca'] = "External CA"
-            else:
-                # PKI CA
-                self.mdict['pki_security_domain_type'] = "new"
-
-            # 'External CA' Configuration name/value pairs
-            #
-            #     Tomcat - [External CA]
-            #
-            #     The following variables are established via the specified PKI
-            #     deployment configuration file and are NOT redefined below:
-            #
-            #        self.mdict['pki_external_ca_cert_chain_path']
-            #        self.mdict['pki_external_ca_cert_path']
-            #        self.mdict['pki_external_csr_path']
-            #        self.mdict['pki_external_step_two']
-            #
-
-            # 'Backup' Configuration name/value pairs
-            #
-            #     Apache - [RA]
-            #     Tomcat - [CA], [KRA], [OCSP], [TKS], [TPS]
-            #            - [External CA]
-            #            - [Subordinate CA]
-            #
-            #     The following variables are established via the specified PKI
-            #     deployment configuration file and are NOT redefined below:
-            #
-            #        self.mdict['pki_backup_password']
-            #        self.mdict['pki_backup_keys']
-            #
-            if config.str2bool(self.mdict['pki_backup_keys']):
-                # NOTE:  ALWAYS store the PKCS #12 backup keys file
-                #        in with the NSS "server" security databases
-                self.mdict['pki_backup_keys_p12'] = \
-                    self.mdict['pki_database_path'] + "/" + \
-                    self.mdict['pki_subsystem'].lower() + "_" + \
-                    "backup" + "_" + "keys" + "." + "p12"
-
-            self.mdict['pki_admin_profile_id'] = "caAdminCert"
-
-            if not 'pki_import_admin_cert' in self.mdict:
-                self.mdict['pki_import_admin_cert'] = 'false'
-            elif not config.str2bool(self.mdict['pki_skip_configuration']) and \
-                    (config.str2bool(self.mdict['pki_standalone'])):
-                # Stand-alone PKI
-                self.mdict['pki_import_admin_cert'] = 'false'
-
-            if config.str2bool(self.mdict['pki_standalone']):
-                self.mdict['pki_ca_signing_tag'] = "external_signing"
-            else:
-                self.mdict['pki_ca_signing_tag'] = "signing"
-            if self.mdict['pki_subsystem'] == "CA":
-                self.mdict['pki_ocsp_signing_tag'] = "ocsp_signing"
-            elif self.mdict['pki_subsystem'] == "OCSP":
-                self.mdict['pki_ocsp_signing_tag'] = "signing"
-            self.mdict['pki_ssl_server_tag'] = "sslserver"
-            self.mdict['pki_subsystem_tag'] = "subsystem"
-            self.mdict['pki_audit_signing_tag'] = "audit_signing"
-            self.mdict['pki_transport_tag'] = "transport"
-            self.mdict['pki_storage_tag'] = "storage"
-
-            # Finalization name/value pairs
-            self.mdict['pki_default_deployment_cfg_replica'] = \
-                os.path.join(self.mdict['pki_subsystem_registry_path'],
-                             config.DEFAULT_DEPLOYMENT_CONFIGURATION)
-            self.mdict['pki_user_deployment_cfg_replica'] = \
-                os.path.join(self.mdict['pki_subsystem_registry_path'],
-                             config.USER_DEPLOYMENT_CONFIGURATION)
-            self.mdict['pki_user_deployment_cfg_spawn_archive'] = \
-                self.mdict['pki_subsystem_archive_log_path'] + "/" + \
-                "spawn" + "_" + \
-                config.USER_DEPLOYMENT_CONFIGURATION + "." + \
-                self.mdict['pki_timestamp']
-            self.mdict['pki_manifest'] = \
-                self.mdict['pki_subsystem_registry_path'] + "/" + \
-                "manifest"
-            self.mdict['pki_manifest_spawn_archive'] = \
-                self.mdict['pki_subsystem_archive_log_path'] + "/" + \
-                "spawn" + "_" + "manifest" + "." + \
-                self.mdict['pki_timestamp']
-            # Construct the configuration URL containing the one-time pin
-            # and add this to the "sensitive" key value pairs read in from
-            # the configuration file
-            #
-            # NOTE:  This is the one and only parameter containing a sensitive
-            #        parameter that may be stored in a log file and displayed
-            #        to the screen.
-            #
-            self.mdict['pki_configuration_url'] = \
-                "https://{}:{}/{}/{}?pin={}".format(
-                    self.mdict['pki_hostname'],
-                    self.mdict['pki_https_port'],
-                    self.mdict['pki_subsystem'].lower(),
-                    "admin/console/config/login",
-                    self.mdict['pki_one_time_pin'])
-            # Compose this "systemd" execution management command
-            if self.mdict['pki_subsystem'] in\
-               config.PKI_APACHE_SUBSYSTEMS:
-                self.mdict['pki_registry_initscript_command'] = \
-                    "systemctl" + " " + \
-                    "restart" + " " + \
-                    "pki-apached" + "@" + \
-                    self.mdict['pki_instance_name'] + "." + "service"
-            elif self.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-                self.mdict['pki_registry_initscript_command'] = \
-                    "systemctl" + " " + \
-                    "restart" + " " + \
-                    "pki-tomcatd" + "@" + \
-                    self.mdict['pki_instance_name'] + "." + "service"
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-        except KeyError as err:
-            config.pki_log.error(log.PKIHELPER_DICTIONARY_MASTER_MISSING_KEY_1,
-                                 err, extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-        except ConfigParser.InterpolationSyntaxError as err:
-            config.pki_log.error(log.PKIHELPER_DICTIONARY_INTERPOLATION_1,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            config.pki_log.error(log.PKIHELPER_DICTIONARY_INTERPOLATION_2, err,
-                                 extra=config.PKI_INDENTATION_LEVEL_2)
-            raise
-        return
-
-    def compose_pki_slots_dictionary(self):
-        """Read the slots configuration file to create
-           the appropriate PKI slots dictionary"""
-        rv = 0
-        try:
-            parser = ConfigParser.ConfigParser()
-            # Make keys case-sensitive!
-            parser.optionxform = str
-            parser.read(config.PKI_DEPLOYMENT_SLOTS_CONFIGURATION_FILE)
-            # Slots configuration file name/value pairs
-            if config.pki_subsystem in config.PKI_APACHE_SUBSYSTEMS:
-                self.slots_dict = dict(parser.items('Apache'))
-            elif config.pki_subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
-                self.slots_dict = dict(parser.items('Tomcat'))
-        except ConfigParser.ParsingError, err:
-            rv = err
-        return rv
diff --git a/base/server/python/pki/server/deployment/pkiscriptlet.py b/base/server/python/pki/server/deployment/pkiscriptlet.py
deleted file mode 100644
index 2bf4d07..0000000
--- a/base/server/python/pki/server/deployment/pkiscriptlet.py
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# System Imports
-import abc
-
-
-# PKI Deployment Abstract Base PKI Scriptlet
-class AbstractBasePkiScriptlet(object):
-    __metaclass__ = abc.ABCMeta
-
-    # pylint: disable-msg=W0613
-    @abc.abstractmethod
-    def spawn(self, deployer):
-        """Retrieve data from the specified PKI dictionary and
-           use it to install a new PKI instance."""
-        return
-
-    # pylint: disable-msg=W0613
-    @abc.abstractmethod
-    def destroy(self, deployer):
-        """Retrieve data from the specified PKI dictionary and
-           use it to destroy an existing PKI instance."""
-        return
diff --git a/base/server/python/pki/server/deployment/scriptlets/__init__.py b/base/server/python/pki/server/deployment/scriptlets/__init__.py
deleted file mode 100644
index e69de29..0000000
diff --git a/base/server/python/pki/server/deployment/scriptlets/configuration.py b/base/server/python/pki/server/deployment/scriptlets/configuration.py
deleted file mode 100644
index 78ec9ba..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/configuration.py
+++ /dev/null
@@ -1,149 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-import json
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from .. import pkimessages as log
-from .. import pkiscriptlet
-import pki.system
-import pki.encoder
-
-
-# PKI Deployment Configuration Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-
-    def spawn(self, deployer):
-
-        # ALWAYS establish the following Tomcat instance symbolic link since
-        # this link is required by both automatic pkispawn instance
-        # configuration as well as manual browser GUI instance configuration
-        deployer.symlink.create(deployer.mdict['pki_systemd_service'],
-                                deployer.mdict['pki_systemd_service_link'])
-
-        if config.str2bool(deployer.mdict['pki_skip_configuration']):
-            config.pki_log.info(log.SKIP_CONFIGURATION_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-        config.pki_log.info(log.CONFIGURATION_SPAWN_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-
-        # Place "slightly" less restrictive permissions on
-        # the top-level client directory ONLY
-        deployer.directory.create(
-            deployer.mdict['pki_client_subsystem_dir'],
-            uid=0, gid=0,
-            perms=config.PKI_DEPLOYMENT_DEFAULT_CLIENT_DIR_PERMISSIONS)
-        # Since 'certutil' does NOT strip the 'token=' portion of
-        # the 'token=password' entries, create a client password file
-        # which ONLY contains the 'password' for the purposes of
-        # allowing 'certutil' to generate the security databases
-        deployer.password.create_password_conf(
-            deployer.mdict['pki_client_password_conf'],
-            deployer.mdict['pki_client_database_password'], pin_sans_token=True)
-        deployer.file.modify(
-            deployer.mdict['pki_client_password_conf'],
-            uid=0, gid=0)
-        # Similarly, create a simple password file containing the
-        # PKCS #12 password used when exporting the "Admin Certificate"
-        # into a PKCS #12 file
-        deployer.password.create_client_pkcs12_password_conf(
-            deployer.mdict['pki_client_pkcs12_password_conf'])
-        deployer.file.modify(deployer.mdict['pki_client_pkcs12_password_conf'])
-        deployer.directory.create(
-            deployer.mdict['pki_client_database_dir'],
-            uid=0, gid=0)
-        deployer.certutil.create_security_databases(
-            deployer.mdict['pki_client_database_dir'],
-            deployer.mdict['pki_client_cert_database'],
-            deployer.mdict['pki_client_key_database'],
-            deployer.mdict['pki_client_secmod_database'],
-            password_file=deployer.mdict['pki_client_password_conf'])
-
-        # Start/Restart this Apache/Tomcat PKI Process
-        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS:
-            apache_instance_subsystems = \
-                deployer.instance.apache_instance_subsystems()
-            if apache_instance_subsystems == 1:
-                deployer.systemd.start()
-            elif apache_instance_subsystems > 1:
-                deployer.systemd.restart()
-        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-            # Optionally prepare to enable a java debugger
-            # (e. g. - 'eclipse'):
-            if config.str2bool(deployer.mdict['pki_enable_java_debugger']):
-                config.prepare_for_an_external_java_debugger(
-                    deployer.mdict['pki_target_tomcat_conf_instance_id'])
-            tomcat_instance_subsystems = \
-                len(deployer.instance.tomcat_instance_subsystems())
-            if tomcat_instance_subsystems == 1:
-                deployer.systemd.start()
-            elif tomcat_instance_subsystems > 1:
-                deployer.systemd.restart()
-
-        # wait for startup
-        status = deployer.instance.wait_for_startup(60)
-        if status is None:
-            config.pki_log.error(
-                "server failed to restart",
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            raise Exception("server failed to restart")
-
-        # Optionally wait for debugger to attach (e. g. - 'eclipse'):
-        if config.str2bool(deployer.mdict['pki_enable_java_debugger']):
-            config.wait_to_attach_an_external_java_debugger()
-
-        # Construct PKI Subsystem Configuration Data
-        data = None
-        if deployer.mdict['pki_instance_type'] == "Apache":
-            if deployer.mdict['pki_subsystem'] == "RA":
-                config.pki_log.info(
-                    log.PKI_CONFIG_NOT_YET_IMPLEMENTED_1,
-                    deployer.mdict['pki_subsystem'],
-                    extra=config.PKI_INDENTATION_LEVEL_2)
-                return self.rv
-        elif deployer.mdict['pki_instance_type'] == "Tomcat":
-            # CA, KRA, OCSP, TKS, or TPS
-            data = deployer.config_client.construct_pki_configuration_data()
-
-        # Configure the subsystem
-        deployer.config_client.configure_pki_data(
-            json.dumps(data, cls=pki.encoder.CustomTypeEncoder))
-
-        return self.rv
-
-    def destroy(self, deployer):
-
-        config.pki_log.info(log.CONFIGURATION_DESTROY_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS and\
-           deployer.instance.apache_instance_subsystems() == 1:
-            if deployer.directory.exists(deployer.mdict['pki_client_dir']):
-                deployer.directory.delete(deployer.mdict['pki_client_dir'])
-            deployer.symlink.delete(deployer.mdict['pki_systemd_service_link'])
-        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
-                and len(deployer.instance.tomcat_instance_subsystems()) == 1:
-            if deployer.directory.exists(deployer.mdict['pki_client_dir']):
-                deployer.directory.delete(deployer.mdict['pki_client_dir'])
-            deployer.symlink.delete(deployer.mdict['pki_systemd_service_link'])
-        return self.rv
diff --git a/base/server/python/pki/server/deployment/scriptlets/finalization.py b/base/server/python/pki/server/deployment/scriptlets/finalization.py
deleted file mode 100644
index d3756b7..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/finalization.py
+++ /dev/null
@@ -1,102 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from .. import pkimanifest as manifest
-from .. import pkimessages as log
-from .. import pkiscriptlet
-
-
-# PKI Deployment Finalization Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-
-    def spawn(self, deployer):
-
-        # ALWAYS finalize execution of scriptlets
-        config.pki_log.info(log.FINALIZATION_SPAWN_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        # For debugging/auditing purposes, save a timestamped copy of
-        # this configuration file in the subsystem archive
-        deployer.file.copy(
-            deployer.mdict['pki_user_deployment_cfg_replica'],
-            deployer.mdict['pki_user_deployment_cfg_spawn_archive'])
-        # Save a copy of the installation manifest file
-        config.pki_log.info(
-            log.PKI_MANIFEST_MESSAGE_1, deployer.mdict['pki_manifest'],
-            extra=config.PKI_INDENTATION_LEVEL_2)
-        # for record in manifest.database:
-        #     print tuple(record)
-        manifest_file = manifest.File(deployer.manifest_db)
-        manifest_file.register(deployer.mdict['pki_manifest'])
-        manifest_file.write()
-        deployer.file.modify(deployer.mdict['pki_manifest'], silent=True)
-
-        # Also, for debugging/auditing purposes, save a timestamped copy of
-        # this installation manifest file
-        deployer.file.copy(
-            deployer.mdict['pki_manifest'],
-            deployer.mdict['pki_manifest_spawn_archive'])
-        # Optionally, programmatically 'restart' the configured PKI instance
-        if config.str2bool(deployer.mdict['pki_restart_configured_instance']):
-            deployer.systemd.restart()
-        # Optionally, 'purge' the entire temporary client infrastructure
-        # including the client NSS security databases and password files
-        #
-        #     WARNING:  If the PKCS #12 file containing the Admin Cert was
-        #               placed under this infrastructure, it may accidentally
-        #               be deleted!
-        #
-        if config.str2bool(deployer.mdict['pki_client_database_purge']):
-            if deployer.directory.exists(
-                    deployer.mdict['pki_client_subsystem_dir']):
-                deployer.directory.delete(
-                    deployer.mdict['pki_client_subsystem_dir'])
-        # If instance has not been configured, print the
-        # configuration URL to the log
-        if config.str2bool(deployer.mdict['pki_skip_configuration']):
-            deployer.configuration_file.log_configuration_url()
-        # Log final process messages
-        config.pki_log.info(log.PKISPAWN_END_MESSAGE_2,
-                            deployer.mdict['pki_subsystem'],
-                            deployer.mdict['pki_instance_name'],
-                            extra=config.PKI_INDENTATION_LEVEL_0)
-        deployer.file.modify(deployer.mdict['pki_spawn_log'], silent=True)
-        return self.rv
-
-    def destroy(self, deployer):
-
-        config.pki_log.info(log.FINALIZATION_DESTROY_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        deployer.file.modify(deployer.mdict['pki_destroy_log'], silent=True)
-        # Start this Apache/Tomcat PKI Process
-        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS and\
-           deployer.instance.apache_instance_subsystems() >= 1:
-            deployer.systemd.start()
-        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
-                and len(deployer.instance.tomcat_instance_subsystems()) >= 1:
-            deployer.systemd.start()
-        config.pki_log.info(log.PKIDESTROY_END_MESSAGE_2,
-                            deployer.mdict['pki_subsystem'],
-                            deployer.mdict['pki_instance_name'],
-                            extra=config.PKI_INDENTATION_LEVEL_0)
-        return self.rv
diff --git a/base/server/python/pki/server/deployment/scriptlets/infrastructure_layout.py b/base/server/python/pki/server/deployment/scriptlets/infrastructure_layout.py
deleted file mode 100644
index 60ce601..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/infrastructure_layout.py
+++ /dev/null
@@ -1,121 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from .. import pkimessages as log
-from .. import pkiscriptlet
-
-
-# PKI Deployment Top-Level Infrastructure Layout Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-
-    def spawn(self, deployer):
-
-        if config.str2bool(deployer.mdict['pki_skip_installation']):
-            config.pki_log.info(log.SKIP_ADMIN_DOMAIN_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-        config.pki_log.info(log.ADMIN_DOMAIN_SPAWN_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        # NOTE:  It was determined that since the "pkidestroy" command
-        #        relies upon a symbolic link to a replica of the original
-        #        deployment configuration file used by the
-        #        "pkispawn" command of an instance, it is necessary to
-        #        create any required instance and subsystem directories
-        #        in this top-level "infrastructure_layout" scriptlet
-        #        (rather than the "instance_layout" and "subsystem_layout"
-        #        scriptlets) so that a copy of this configuration file can
-        #        be saved, and the required symbolic link can be created.
-        #
-        # establish the top-level infrastructure, instance, and subsystem
-        # registry directories for storage of a copy of the original
-        # deployment configuration file used to spawn this instance,
-        # and save a copy of this file
-        deployer.directory.create(deployer.mdict['pki_registry_path'])
-        deployer.directory.create(
-            deployer.mdict['pki_instance_type_registry_path'])
-        deployer.directory.create(deployer.mdict['pki_instance_registry_path'])
-        deployer.directory.create(deployer.mdict['pki_subsystem_registry_path'])
-        deployer.file.copy(
-            deployer.mdict['pki_default_deployment_cfg'],
-            deployer.mdict['pki_default_deployment_cfg_replica'])
-
-        print "Storing deployment configuration into " + \
-              deployer.mdict['pki_user_deployment_cfg_replica'] + "."
-
-        # Archive the user deployment configuration excluding the sensitive
-        # parameters
-        sensitive_parameters = deployer.mdict['sensitive_parameters'].split()
-        sections = config.user_config.sections()
-        for s in sections:
-            for k in sensitive_parameters:
-                config.user_config.set(s, k, 'XXXXXXXX')
-        with open(deployer.mdict['pki_user_deployment_cfg_replica'], 'w') as f:
-            config.user_config.write(f)
-
-        # establish top-level infrastructure, instance, and subsystem
-        # base directories and create the "registry" symbolic link that
-        # the "pkidestroy" executable relies upon
-        deployer.directory.create(deployer.mdict['pki_path'])
-        deployer.directory.create(deployer.mdict['pki_instance_path'])
-        deployer.directory.create(deployer.mdict['pki_subsystem_path'])
-        deployer.symlink.create(
-            deployer.mdict['pki_instance_registry_path'],
-            deployer.mdict['pki_subsystem_registry_link'])
-        #
-        # NOTE:  If "infrastructure_layout" scriptlet execution has been
-        #        successfully executed to this point, the "pkidestroy" command
-        #        may always be utilized to remove the entire infrastructure.
-        #
-        # no need to establish top-level infrastructure logs
-        # since it now stores 'pkispawn'/'pkidestroy' logs
-        # and will already exist
-        # deployer.directory.create(deployer.mdict['pki_log_path'])
-        # establish top-level infrastructure configuration
-        if deployer.mdict['pki_configuration_path'] != \
-           config.PKI_DEPLOYMENT_CONFIGURATION_ROOT:
-            deployer.directory.create(deployer.mdict['pki_configuration_path'])
-        return self.rv
-
-    def destroy(self, deployer):
-
-        config.pki_log.info(log.ADMIN_DOMAIN_DESTROY_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        # remove top-level infrastructure base
-        if deployer.mdict['pki_subsystem'] in config.PKI_SUBSYSTEMS and\
-           deployer.instance.pki_instance_subsystems() == 0:
-            # remove top-level infrastructure base
-            deployer.directory.delete(deployer.mdict['pki_path'])
-            # do NOT remove top-level infrastructure logs
-            # since it now stores 'pkispawn'/'pkidestroy' logs
-            # deployer.directory.delete(deployer.mdict['pki_log_path'])
-            # remove top-level infrastructure configuration
-            if deployer.directory.is_empty(
-                    deployer.mdict['pki_configuration_path']) and \
-                deployer.mdict['pki_configuration_path'] != \
-                    config.PKI_DEPLOYMENT_CONFIGURATION_ROOT:
-                deployer.directory.delete(
-                    deployer.mdict['pki_configuration_path'])
-            # remove top-level infrastructure registry
-            deployer.directory.delete(deployer.mdict['pki_registry_path'])
-        return self.rv
diff --git a/base/server/python/pki/server/deployment/scriptlets/initialization.py b/base/server/python/pki/server/deployment/scriptlets/initialization.py
deleted file mode 100644
index a555a89..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/initialization.py
+++ /dev/null
@@ -1,118 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from .. import pkimessages as log
-from .. import pkiscriptlet
-
-
-# PKI Deployment Initialization Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-
-    def spawn(self, deployer):
-
-        # begin official logging
-        config.pki_log.info(log.PKISPAWN_BEGIN_MESSAGE_2,
-                            deployer.mdict['pki_subsystem'],
-                            deployer.mdict['pki_instance_name'],
-                            extra=config.PKI_INDENTATION_LEVEL_0)
-        # ALWAYS initialize 'uid' and 'gid'
-        deployer.identity.add_uid_and_gid(deployer.mdict['pki_user'],
-                                          deployer.mdict['pki_group'])
-        # ALWAYS establish 'uid' and 'gid'
-        deployer.identity.set_uid(deployer.mdict['pki_user'])
-        deployer.identity.set_gid(deployer.mdict['pki_group'])
-        if config.str2bool(deployer.mdict['pki_skip_installation']):
-            config.pki_log.info(log.SKIP_INITIALIZATION_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-        else:
-            config.pki_log.info(log.INITIALIZATION_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            if (deployer.mdict['pki_subsystem'] == "CA" or
-                config.str2bool(deployer.mdict['pki_standalone'])) and\
-               config.str2bool(deployer.mdict['pki_external_step_two']):
-                # verify that this External CA (Step 2), or Stand-alone PKI
-                # (Step 2) currently EXISTS for this "instance"
-                deployer.instance.verify_subsystem_exists()
-                deployer.mdict['pki_skip_installation'] = "True"
-            else:
-                # verify that this type of "subsystem" does NOT yet
-                # exist for this "instance"
-                deployer.instance.verify_subsystem_does_not_exist()
-                # detect and avoid any namespace collisions
-                deployer.namespace.collision_detection()
-        # verify existence of SENSITIVE configuration file data
-        deployer.configuration_file.verify_sensitive_data()
-        # verify existence of MUTUALLY EXCLUSIVE configuration file data
-        deployer.configuration_file.verify_mutually_exclusive_data()
-        # verify existence of PREDEFINED configuration file data
-        deployer.configuration_file.verify_predefined_configuration_file_data()
-        # verify selinux context of selected ports
-        deployer.configuration_file.populate_non_default_ports()
-        deployer.configuration_file.verify_selinux_ports()
-        return self.rv
-
-    def destroy(self, deployer):
-
-        # begin official logging
-        config.pki_log.info(log.PKIDESTROY_BEGIN_MESSAGE_2,
-                            deployer.mdict['pki_subsystem'],
-                            deployer.mdict['pki_instance_name'],
-                            extra=config.PKI_INDENTATION_LEVEL_0)
-        config.pki_log.info(log.INITIALIZATION_DESTROY_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        # verify that this type of "subsystem" currently EXISTS
-        # for this "instance"
-        deployer.instance.verify_subsystem_exists()
-        # verify that the command-line parameters match the values
-        # that are present in the corresponding configuration file
-        deployer.configuration_file.verify_command_matches_configuration_file()
-        # establish 'uid' and 'gid'
-        deployer.identity.set_uid(deployer.mdict['pki_user'])
-        deployer.identity.set_gid(deployer.mdict['pki_group'])
-        # get ports to remove selinux context
-        deployer.configuration_file.populate_non_default_ports()
-
-        # get deinstallation token
-        token = deployer.security_domain.get_installation_token(
-            config.pki_secdomain_user, config.pki_secdomain_pass)
-
-        # remove kra connector from CA if this is a KRA
-        deployer.kra_connector.deregister()
-
-        # remove tps connector from TKS if this is a TPS
-        deployer.tps_connector.deregister()
-
-        # de-register instance from its Security Domain
-        #
-        #     NOTE:  Since the security domain of an instance must be up
-        #            and running in order to be de-registered, this step
-        #            must be done PRIOR to instance shutdown because this
-        #            instance's security domain may be a part of a
-        #            tightly-coupled shared instance.
-        #
-        deployer.security_domain.deregister(token)
-        # ALWAYS Stop this Apache/Tomcat PKI Process
-        deployer.systemd.stop()
-        return self.rv
diff --git a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py b/base/server/python/pki/server/deployment/scriptlets/instance_layout.py
deleted file mode 100644
index b5ec19e..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/instance_layout.py
+++ /dev/null
@@ -1,331 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# System Imports
-import os
-
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from .. import pkimessages as log
-from .. import pkiscriptlet
-
-
-# PKI Deployment Instance Layout Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-
-    def spawn(self, deployer):
-
-        if config.str2bool(deployer.mdict['pki_skip_installation']):
-            config.pki_log.info(log.SKIP_INSTANCE_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-
-        config.pki_log.info(log.INSTANCE_SPAWN_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-
-        # if this is the first subsystem
-        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
-                and len(deployer.instance.tomcat_instance_subsystems()) == 1:
-
-            # establish instance logs
-            deployer.directory.create(deployer.mdict['pki_instance_log_path'])
-
-            # establish Tomcat instance configuration
-            deployer.directory.copy(
-                deployer.mdict['pki_source_server_path'],
-                deployer.mdict['pki_instance_configuration_path'])
-
-            # establish Tomcat instance base
-            deployer.directory.create(deployer.mdict['pki_tomcat_common_path'])
-            deployer.directory.create(
-                deployer.mdict['pki_tomcat_common_lib_path'])
-            # establish Tomcat instance library
-            deployer.directory.create(deployer.mdict['pki_instance_lib'])
-            for name in os.listdir(deployer.mdict['pki_tomcat_lib_path']):
-                deployer.symlink.create(
-                    os.path.join(
-                        deployer.mdict['pki_tomcat_lib_path'],
-                        name),
-                    os.path.join(
-                        deployer.mdict['pki_instance_lib'],
-                        name))
-            deployer.symlink.create(
-                deployer.mdict['pki_instance_conf_log4j_properties'],
-                deployer.mdict['pki_instance_lib_log4j_properties'])
-            deployer.directory.create(deployer.mdict['pki_tomcat_tmpdir_path'])
-
-            # Copy /usr/share/pki/server/webapps to <instance>/webapps
-            deployer.directory.copy(
-                os.path.join(
-                    config.PKI_DEPLOYMENT_SOURCE_ROOT,
-                    "server",
-                    "webapps"),
-                deployer.mdict['pki_tomcat_webapps_path'])
-
-            # If desired and available,
-            # copy selected server theme
-            # to <instance>/webapps/pki
-            if config.str2bool(deployer.mdict['pki_theme_enable']) and\
-                    os.path.exists(deployer.mdict['pki_theme_server_dir']):
-                deployer.directory.copy(
-                    deployer.mdict['pki_theme_server_dir'],
-                    os.path.join(
-                        deployer.mdict['pki_tomcat_webapps_path'],
-                        "pki"),
-                    overwrite_flag=True)
-
-            deployer.directory.create(deployer.mdict['pki_tomcat_work_path'])
-            deployer.directory.create(
-                deployer.mdict['pki_tomcat_work_catalina_path'])
-            deployer.directory.create(
-                deployer.mdict['pki_tomcat_work_catalina_host_path'])
-            deployer.directory.create(
-                deployer.mdict['pki_tomcat_work_catalina_host_run_path'])
-            deployer.directory.create(
-                deployer.mdict['pki_tomcat_work_catalina_host_subsystem_path'])
-            # establish Tomcat instance logs
-            # establish Tomcat instance registry
-            # establish Tomcat instance convenience symbolic links
-            deployer.symlink.create(
-                deployer.mdict['pki_tomcat_bin_path'],
-                deployer.mdict['pki_tomcat_bin_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_tomcat_systemd'],
-                deployer.mdict['pki_instance_systemd_link'],
-                uid=0, gid=0)
-            # establish Tomcat instance common lib jar symbolic links
-            deployer.symlink.create(
-                deployer.mdict['pki_apache_commons_collections_jar'],
-                deployer.mdict['pki_apache_commons_collections_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_apache_commons_io_jar'],
-                deployer.mdict['pki_apache_commons_io_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_apache_commons_lang_jar'],
-                deployer.mdict['pki_apache_commons_lang_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_apache_commons_logging_jar'],
-                deployer.mdict['pki_apache_commons_logging_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_commons_codec_jar'],
-                deployer.mdict['pki_commons_codec_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_httpclient_jar'],
-                deployer.mdict['pki_httpclient_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_httpcore_jar'],
-                deployer.mdict['pki_httpcore_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_javassist_jar'],
-                deployer.mdict['pki_javassist_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_jss_jar'],
-                deployer.mdict['pki_jss_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_ldapjdk_jar'],
-                deployer.mdict['pki_ldapjdk_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_tomcat_jar'],
-                deployer.mdict['pki_tomcat_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_scannotation_jar'],
-                deployer.mdict['pki_scannotation_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_tomcatjss_jar'],
-                deployer.mdict['pki_tomcatjss_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_velocity_jar'],
-                deployer.mdict['pki_velocity_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_xerces_j2_jar'],
-                deployer.mdict['pki_xerces_j2_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_xml_commons_apis_jar'],
-                deployer.mdict['pki_xml_commons_apis_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_xml_commons_resolver_jar'],
-                deployer.mdict['pki_xml_commons_resolver_jar_link'])
-
-            # Jackson
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_annotations_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-annotations.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_core_asl_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-core-asl.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_core_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-core.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_databind_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-databind.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_jaxrs_base_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-jaxrs-base.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_jaxrs_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-jaxrs.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_jaxrs_json_provider_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-jaxrs-json-provider.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_mapper_asl_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-mapper-asl.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_module_jaxb_annotations_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-module-jaxb-annotations.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_mrbean_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-mrbean.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_smile_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-smile.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_jackson_xc_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jackson-xc.jar'))
-
-            # RESTEasy
-            deployer.symlink.create(
-                deployer.mdict['pki_resteasy_atom_provider_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'resteasy-atom-provider.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_resteasy_client_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'resteasy-client.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_resteasy_jaxb_provider_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'resteasy-jaxb-provider.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_resteasy_jaxrs_api_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'jaxrs-api.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_resteasy_jaxrs_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'resteasy-jaxrs.jar'))
-            deployer.symlink.create(
-                deployer.mdict['pki_resteasy_jackson_provider_jar'],
-                os.path.join(
-                    deployer.mdict['pki_tomcat_common_lib_path'],
-                    'resteasy-jackson-provider.jar'))
-
-            # establish shared NSS security databases for this instance
-            deployer.directory.create(deployer.mdict['pki_database_path'])
-            # establish instance convenience symbolic links
-            deployer.symlink.create(
-                deployer.mdict['pki_database_path'],
-                deployer.mdict['pki_instance_database_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_instance_configuration_path'],
-                deployer.mdict['pki_instance_conf_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_instance_log_path'],
-                deployer.mdict['pki_instance_logs_link'])
-
-        if deployer.mdict['pki_subsystem'] == 'TKS':
-            deployer.symlink.create(
-                deployer.mdict['pki_symkey_jar'],
-                deployer.mdict['pki_symkey_jar_link'])
-
-        return self.rv
-
-    def destroy(self, deployer):
-
-        config.pki_log.info(log.INSTANCE_DESTROY_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-
-        if deployer.mdict['pki_subsystem'] == 'TKS':
-            deployer.symlink.delete(deployer.mdict['pki_symkey_jar_link'])
-
-        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS and\
-           deployer.instance.apache_instance_subsystems() == 0:
-            # remove Apache instance base
-            deployer.directory.delete(deployer.mdict['pki_instance_path'])
-            # remove Apache instance logs
-            # remove shared NSS security database path for this instance
-            deployer.directory.delete(deployer.mdict['pki_database_path'])
-            # remove Apache instance configuration
-            deployer.directory.delete(
-                deployer.mdict['pki_instance_configuration_path'])
-            # remove Apache instance registry
-            deployer.directory.delete(
-                deployer.mdict['pki_instance_registry_path'])
-            # remove Apache PKI registry (if empty)
-            if deployer.instance.apache_instances() == 0:
-                deployer.directory.delete(
-                    deployer.mdict['pki_instance_type_registry_path'])
-
-        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
-                and len(deployer.instance.tomcat_instance_subsystems()) == 0:
-            # remove Tomcat instance base
-            deployer.directory.delete(deployer.mdict['pki_instance_path'])
-            # remove Tomcat instance logs
-            deployer.directory.delete(deployer.mdict['pki_instance_log_path'])
-            # remove shared NSS security database path for this instance
-            deployer.directory.delete(deployer.mdict['pki_database_path'])
-            # remove Tomcat instance configuration
-            deployer.directory.delete(
-                deployer.mdict['pki_instance_configuration_path'])
-            # remove PKI 'tomcat.conf' instance file
-            deployer.file.delete(
-                deployer.mdict['pki_target_tomcat_conf_instance_id'])
-            # remove Tomcat instance registry
-            deployer.directory.delete(
-                deployer.mdict['pki_instance_registry_path'])
-            # remove Tomcat PKI registry (if empty)
-            if deployer.instance.tomcat_instances() == 0:
-                deployer.directory.delete(
-                    deployer.mdict['pki_instance_type_registry_path'])
-
-        return self.rv
diff --git a/base/server/python/pki/server/deployment/scriptlets/security_databases.py b/base/server/python/pki/server/deployment/scriptlets/security_databases.py
deleted file mode 100644
index dc175cd..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/security_databases.py
+++ /dev/null
@@ -1,118 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from .. import pkimessages as log
-from .. import pkiscriptlet
-
-
-# PKI Deployment Security Databases Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-
-    def spawn(self, deployer):
-
-        if config.str2bool(deployer.mdict['pki_skip_installation']):
-            config.pki_log.info(log.SKIP_SECURITY_DATABASES_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-        config.pki_log.info(log.SECURITY_DATABASES_SPAWN_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        deployer.password.create_password_conf(
-            deployer.mdict['pki_shared_password_conf'],
-            deployer.mdict['pki_pin'])
-        # Since 'certutil' does NOT strip the 'token=' portion of
-        # the 'token=password' entries, create a temporary server 'pfile'
-        # which ONLY contains the 'password' for the purposes of
-        # allowing 'certutil' to generate the security databases
-        deployer.password.create_password_conf(
-            deployer.mdict['pki_shared_pfile'],
-            deployer.mdict['pki_pin'], pin_sans_token=True)
-        deployer.file.modify(deployer.mdict['pki_shared_password_conf'])
-        deployer.certutil.create_security_databases(
-            deployer.mdict['pki_database_path'],
-            deployer.mdict['pki_cert_database'],
-            deployer.mdict['pki_key_database'],
-            deployer.mdict['pki_secmod_database'],
-            password_file=deployer.mdict['pki_shared_pfile'])
-        deployer.file.modify(
-            deployer.mdict['pki_cert_database'],
-            perms=config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
-        deployer.file.modify(
-            deployer.mdict['pki_key_database'],
-            perms=config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
-        deployer.file.modify(
-            deployer.mdict['pki_secmod_database'],
-            perms=config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
-
-        if len(deployer.instance.tomcat_instance_subsystems()) < 2:
-            # only create a self signed cert for a new instance
-            rv = deployer.certutil.verify_certificate_exists(
-                deployer.mdict['pki_database_path'],
-                deployer.mdict['pki_cert_database'],
-                deployer.mdict['pki_key_database'],
-                deployer.mdict['pki_secmod_database'],
-                deployer.mdict['pki_self_signed_token'],
-                deployer.mdict['pki_self_signed_nickname'],
-                password_file=deployer.mdict['pki_shared_pfile'])
-            if not rv:
-                deployer.file.generate_noise_file(
-                    deployer.mdict['pki_self_signed_noise_file'],
-                    deployer.mdict['pki_self_signed_noise_bytes'])
-                deployer.certutil.generate_self_signed_certificate(
-                    deployer.mdict['pki_database_path'],
-                    deployer.mdict['pki_cert_database'],
-                    deployer.mdict['pki_key_database'],
-                    deployer.mdict['pki_secmod_database'],
-                    deployer.mdict['pki_self_signed_token'],
-                    deployer.mdict['pki_self_signed_nickname'],
-                    deployer.mdict['pki_self_signed_subject'],
-                    deployer.mdict['pki_self_signed_serial_number'],
-                    deployer.mdict['pki_self_signed_validity_period'],
-                    deployer.mdict['pki_self_signed_issuer_name'],
-                    deployer.mdict['pki_self_signed_trustargs'],
-                    deployer.mdict['pki_self_signed_noise_file'],
-                    password_file=deployer.mdict['pki_shared_pfile'])
-                # Delete the temporary 'noise' file
-                deployer.file.delete(
-                    deployer.mdict['pki_self_signed_noise_file'])
-            # Delete the temporary 'pfile'
-            deployer.file.delete(deployer.mdict['pki_shared_pfile'])
-        return self.rv
-
-    def destroy(self, deployer):
-
-        config.pki_log.info(log.SECURITY_DATABASES_DESTROY_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        if deployer.mdict['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS \
-                and deployer.instance.apache_instance_subsystems() == 0:
-            deployer.file.delete(deployer.mdict['pki_cert_database'])
-            deployer.file.delete(deployer.mdict['pki_key_database'])
-            deployer.file.delete(deployer.mdict['pki_secmod_database'])
-            deployer.file.delete(deployer.mdict['pki_shared_password_conf'])
-        elif deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS \
-                and len(deployer.instance.tomcat_instance_subsystems()) == 0:
-            deployer.file.delete(deployer.mdict['pki_cert_database'])
-            deployer.file.delete(deployer.mdict['pki_key_database'])
-            deployer.file.delete(deployer.mdict['pki_secmod_database'])
-            deployer.file.delete(deployer.mdict['pki_shared_password_conf'])
-        return self.rv
diff --git a/base/server/python/pki/server/deployment/scriptlets/selinux_setup.py b/base/server/python/pki/server/deployment/scriptlets/selinux_setup.py
deleted file mode 100644
index daf4142..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/selinux_setup.py
+++ /dev/null
@@ -1,241 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Ade Lee <alee@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-import selinux
-import time
-if selinux.is_selinux_enabled():
-    import seobject
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from ..pkiconfig import pki_selinux_config_ports as ports
-from .. import pkimessages as log
-from .. import pkiscriptlet
-
-
-# PKI Deployment Selinux Setup Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-    suffix = "(/.*)?"
-
-    def restore_context(self, mdict):
-        selinux.restorecon(mdict['pki_instance_path'], True)
-        selinux.restorecon(config.PKI_DEPLOYMENT_LOG_ROOT, True)
-        selinux.restorecon(mdict['pki_instance_log_path'], True)
-        selinux.restorecon(mdict['pki_instance_configuration_path'], True)
-
-    def spawn(self, deployer):
-
-        if config.str2bool(deployer.mdict['pki_skip_installation']):
-            config.pki_log.info(log.SKIP_SELINUX_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-
-        if not bool(selinux.is_selinux_enabled()):
-            config.pki_log.info(log.SELINUX_DISABLED_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-
-        config.pki_log.info(log.SELINUX_SPAWN_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        # A maximum of 10 tries to create the SELinux contexts
-        counter = 0
-        max_tries = 10
-        while True:
-            try:
-                # check first if any transactions are required
-                if len(ports) == 0 and deployer.mdict['pki_instance_name'] == \
-                        config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME:
-                    self.restore_context(deployer.mdict)
-                    return self.rv
-
-                # add SELinux contexts when adding the first subsystem
-                if deployer.mdict['pki_subsystem'] in \
-                        config.PKI_APACHE_SUBSYSTEMS and \
-                        deployer.instance.apache_instance_subsystems() == 1 \
-                        or deployer.mdict['pki_subsystem'] in \
-                        config.PKI_TOMCAT_SUBSYSTEMS and \
-                        len(deployer.instance.tomcat_instance_subsystems()) == 1:
-
-                    trans = seobject.semanageRecords("targeted")
-                    trans.start()
-                    if deployer.mdict['pki_instance_name'] != \
-                            config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME:
-
-                        fcon = seobject.fcontextRecords()
-
-                        config.pki_log.info(
-                            "adding selinux fcontext \"%s\"",
-                            deployer.mdict['pki_instance_path'] + self.suffix,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        fcon.add(
-                            deployer.mdict['pki_instance_path'] + self.suffix,
-                            config.PKI_INSTANCE_SELINUX_CONTEXT, "", "s0", "")
-
-                        config.pki_log.info(
-                            "adding selinux fcontext \"%s\"",
-                            deployer.mdict['pki_instance_log_path'] +
-                            self.suffix,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        fcon.add(
-                            deployer.mdict['pki_instance_log_path'] +
-                            self.suffix,
-                            config.PKI_LOG_SELINUX_CONTEXT, "", "s0", "")
-
-                        config.pki_log.info(
-                            "adding selinux fcontext \"%s\"",
-                            deployer.mdict['pki_instance_configuration_path'] +
-                            self.suffix,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        fcon.add(
-                            deployer.mdict['pki_instance_configuration_path'] +
-                            self.suffix,
-                            config.PKI_CFG_SELINUX_CONTEXT, "", "s0", "")
-
-                        config.pki_log.info(
-                            "adding selinux fcontext \"%s\"",
-                            deployer.mdict['pki_database_path'] + self.suffix,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        fcon.add(
-                            deployer.mdict['pki_database_path'] + self.suffix,
-                            config.PKI_CERTDB_SELINUX_CONTEXT, "", "s0", "")
-
-                        port_records = seobject.portRecords()
-                        for port in ports:
-                            config.pki_log.info(
-                                "adding selinux port %s", port,
-                                extra=config.PKI_INDENTATION_LEVEL_2)
-                            port_records.add(
-                                port, "tcp", "s0",
-                                config.PKI_PORT_SELINUX_CONTEXT)
-
-                    trans.finish()
-
-                    self.restore_context(deployer.mdict)
-                break
-            except ValueError as e:
-                error_message = str(e)
-                config.pki_log.debug(error_message)
-                if error_message.strip() == \
-                        "Could not start semanage transaction":
-                    counter += 1
-                    if counter >= max_tries:
-                        raise
-                    time.sleep(5)
-                    config.pki_log.debug(
-                        "Retrying to setup the selinux context ...")
-                else:
-                    raise
-
-        return self.rv
-
-    def destroy(self, deployer):
-
-        if not bool(selinux.is_selinux_enabled()):
-            config.pki_log.info(log.SELINUX_DISABLED_DESTROY_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-        config.pki_log.info(log.SELINUX_DESTROY_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-
-        # check first if any transactions are required
-        if (len(ports) == 0 and deployer.mdict['pki_instance_name'] ==
-                config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME):
-            return self.rv
-        # A maximum of 10 tries to delete the SELinux contexts
-        counter = 1
-        max_tries = 10
-        while True:
-            try:
-                # remove SELinux contexts when removing the last subsystem
-                if (deployer.mdict['pki_subsystem'] in
-                        config.PKI_APACHE_SUBSYSTEMS and
-                        deployer.instance.apache_instance_subsystems() == 0 or
-                        deployer.mdict['pki_subsystem'] in
-                        config.PKI_TOMCAT_SUBSYSTEMS and
-                        len(deployer.instance.tomcat_instance_subsystems()) == 0):
-
-                    trans = seobject.semanageRecords("targeted")
-                    trans.start()
-
-                    if deployer.mdict['pki_instance_name'] != \
-                            config.PKI_DEPLOYMENT_DEFAULT_TOMCAT_INSTANCE_NAME:
-
-                        fcon = seobject.fcontextRecords()
-
-                        config.pki_log.info(
-                            "deleting selinux fcontext \"%s\"",
-                            deployer.mdict['pki_instance_path'] + self.suffix,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        fcon.delete(
-                            deployer.mdict['pki_instance_path'] +
-                            self.suffix, "")
-
-                        config.pki_log.info(
-                            "deleting selinux fcontext \"%s\"",
-                            deployer.mdict['pki_instance_log_path'] +
-                            self.suffix,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        fcon.delete(
-                            deployer.mdict['pki_instance_log_path'] +
-                            self.suffix, "")
-
-                        config.pki_log.info(
-                            "deleting selinux fcontext \"%s\"",
-                            deployer.mdict['pki_instance_configuration_path'] +
-                            self.suffix,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        fcon.delete(
-                            deployer.mdict['pki_instance_configuration_path'] +
-                            self.suffix, "")
-
-                        config.pki_log.info(
-                            "deleting selinux fcontext \"%s\"",
-                            deployer.mdict['pki_database_path'] + self.suffix,
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-                        fcon.delete(
-                            deployer.mdict['pki_database_path'] +
-                            self.suffix, "")
-
-                        port_records = seobject.portRecords()
-                        for port in ports:
-                            config.pki_log.info(
-                                "deleting selinux port %s", port,
-                                extra=config.PKI_INDENTATION_LEVEL_2)
-                            port_records.delete(port, "tcp")
-
-                    trans.finish()
-                break
-            except ValueError as e:
-                error_message = str(e)
-                config.pki_log.debug(error_message)
-                if error_message.strip() == \
-                        "Could not start semanage transaction":
-                    counter += 1
-                    if counter >= max_tries:
-                        raise
-                    time.sleep(5)
-                    config.pki_log.debug(
-                        "Retrying to remove selinux context ...")
-                else:
-                    raise
-
-        return self.rv
diff --git a/base/server/python/pki/server/deployment/scriptlets/slot_substitution.py b/base/server/python/pki/server/deployment/scriptlets/slot_substitution.py
deleted file mode 100644
index f86ae49..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/slot_substitution.py
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from .. import pkimessages as log
-from .. import pkiscriptlet
-
-
-# PKI Deployment Slot Substitution Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-
-    def spawn(self, deployer):
-
-        if config.str2bool(deployer.mdict['pki_skip_installation']):
-            config.pki_log.info(log.SKIP_SLOT_ASSIGNMENT_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-        config.pki_log.info(log.SLOT_ASSIGNMENT_SPAWN_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        deployer.file.copy_with_slot_substitution(
-            deployer.mdict['pki_source_cs_cfg'],
-            deployer.mdict['pki_target_cs_cfg'])
-        deployer.file.copy_with_slot_substitution(
-            deployer.mdict['pki_source_registry'],
-            deployer.mdict['pki_target_registry'],
-            overwrite_flag=True)
-        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-            deployer.file.copy_with_slot_substitution(
-                deployer.mdict['pki_source_catalina_properties'],
-                deployer.mdict['pki_target_catalina_properties'],
-                overwrite_flag=True)
-            deployer.file.copy_with_slot_substitution(
-                deployer.mdict['pki_source_servercertnick_conf'],
-                deployer.mdict['pki_target_servercertnick_conf'],
-                overwrite_flag=True)
-            deployer.file.copy_with_slot_substitution(
-                deployer.mdict['pki_source_server_xml'],
-                deployer.mdict['pki_target_server_xml'],
-                overwrite_flag=True)
-            deployer.file.copy_with_slot_substitution(
-                deployer.mdict['pki_source_context_xml'],
-                deployer.mdict['pki_target_context_xml'],
-                overwrite_flag=True)
-            deployer.file.copy_with_slot_substitution(
-                deployer.mdict['pki_source_tomcat_conf'],
-                deployer.mdict['pki_target_tomcat_conf_instance_id'],
-                uid=0, gid=0, overwrite_flag=True)
-            deployer.file.copy_with_slot_substitution(
-                deployer.mdict['pki_source_tomcat_conf'],
-                deployer.mdict['pki_target_tomcat_conf'],
-                overwrite_flag=True)
-
-            # Configure web.xml and velocity.properties for each subsystem.
-            # For TPS this is not necessary since the files are no longer
-            # copied to the target location in the instance directory.
-            if deployer.mdict['pki_subsystem'] != "TPS":
-                deployer.file.apply_slot_substitution(
-                    deployer.mdict['pki_target_velocity_properties'])
-                deployer.file.apply_slot_substitution(
-                    deployer.mdict['pki_target_subsystem_web_xml'])
-
-            # Strip "<filter>" section from subsystem "web.xml"
-            # This is ONLY necessary because XML comments cannot be "nested"!
-            # deployer.file.copy(deployer.mdict['pki_target_subsystem_web_xml'],
-            #               deployer.mdict['pki_target_subsystem_web_xml_orig'])
-            # deployer.file.delete(
-            #   deployer.mdict['pki_target_subsystem_web_xml'])
-            # util.xml_file.remove_filter_section_from_web_xml(
-            #    deployer.mdict['pki_target_subsystem_web_xml_orig'],
-            #    deployer.mdict['pki_target_subsystem_web_xml'])
-            # deployer.file.delete(
-            #   deployer.mdict['pki_target_subsystem_web_xml_orig'])
-            if deployer.mdict['pki_subsystem'] == "CA":
-                deployer.file.copy_with_slot_substitution(
-                    deployer.mdict['pki_source_proxy_conf'],
-                    deployer.mdict['pki_target_proxy_conf'])
-                deployer.file.apply_slot_substitution(
-                    deployer.mdict['pki_target_profileselect_template'])
-            elif deployer.mdict['pki_subsystem'] == "TPS":
-                deployer.file.copy_with_slot_substitution(
-                    deployer.mdict['pki_source_registry_cfg'],
-                    deployer.mdict['pki_target_registry_cfg'])
-                deployer.file.copy_with_slot_substitution(
-                    deployer.mdict['pki_source_phone_home_xml'],
-                    deployer.mdict['pki_target_phone_home_xml'])
-        return self.rv
-
-    def destroy(self, deployer):
-        config.pki_log.info(log.SLOT_ASSIGNMENT_DESTROY_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        config.pki_log.info("NOTHING NEEDS TO BE IMPLEMENTED",
-                            extra=config.PKI_INDENTATION_LEVEL_2)
-        return self.rv
diff --git a/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py b/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py
deleted file mode 100644
index 432fba9..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/subsystem_layout.py
+++ /dev/null
@@ -1,153 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from .. import pkimessages as log
-from .. import pkiscriptlet
-
-
-# PKI Deployment Subsystem Layout Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-
-    def spawn(self, deployer):
-
-        if config.str2bool(deployer.mdict['pki_skip_installation']):
-            config.pki_log.info(log.SKIP_SUBSYSTEM_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-            return self.rv
-        config.pki_log.info(log.SUBSYSTEM_SPAWN_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        # establish instance-based subsystem logs
-        deployer.directory.create(deployer.mdict['pki_subsystem_log_path'])
-        deployer.directory.create(
-            deployer.mdict['pki_subsystem_archive_log_path'])
-        if deployer.mdict['pki_subsystem'] in \
-                config.PKI_SIGNED_AUDIT_SUBSYSTEMS:
-            deployer.directory.create(
-                deployer.mdict['pki_subsystem_signed_audit_log_path'])
-        # establish instance-based subsystem configuration
-        deployer.directory.create(
-            deployer.mdict['pki_subsystem_configuration_path'])
-        # deployer.directory.copy(
-        #   deployer.mdict['pki_source_conf_path'],
-        #   deployer.mdict['pki_subsystem_configuration_path'])
-        # establish instance-based Apache/Tomcat specific subsystems
-        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-            # establish instance-based Tomcat PKI subsystem base
-            if deployer.mdict['pki_subsystem'] == "CA":
-                deployer.directory.copy(
-                    deployer.mdict['pki_source_emails'],
-                    deployer.mdict['pki_subsystem_emails_path'])
-                deployer.directory.copy(
-                    deployer.mdict['pki_source_profiles'],
-                    deployer.mdict['pki_subsystem_profiles_path'])
-            # establish instance-based Tomcat PKI subsystem logs
-            # establish instance-based Tomcat PKI subsystem configuration
-            if deployer.mdict['pki_subsystem'] == "CA":
-                deployer.file.copy(
-                    deployer.mdict['pki_source_flatfile_txt'],
-                    deployer.mdict['pki_target_flatfile_txt'])
-                deployer.file.copy(
-                    deployer.mdict['pki_source_registry_cfg'],
-                    deployer.mdict['pki_target_registry_cfg'])
-                # '*.profile'
-                deployer.file.copy(
-                    deployer.mdict['pki_source_admincert_profile'],
-                    deployer.mdict['pki_target_admincert_profile'])
-                deployer.file.copy(
-                    deployer.mdict['pki_source_caauditsigningcert_profile'],
-                    deployer.mdict['pki_target_caauditsigningcert_profile'])
-                deployer.file.copy(
-                    deployer.mdict['pki_source_cacert_profile'],
-                    deployer.mdict['pki_target_cacert_profile'])
-                deployer.file.copy(
-                    deployer.mdict['pki_source_caocspcert_profile'],
-                    deployer.mdict['pki_target_caocspcert_profile'])
-                deployer.file.copy(
-                    deployer.mdict['pki_source_servercert_profile'],
-                    deployer.mdict['pki_target_servercert_profile'])
-                deployer.file.copy(
-                    deployer.mdict['pki_source_subsystemcert_profile'],
-                    deployer.mdict['pki_target_subsystemcert_profile'])
-            elif deployer.mdict['pki_subsystem'] == "KRA":
-                # '*.profile'
-                deployer.file.copy(
-                    deployer.mdict['pki_source_servercert_profile'],
-                    deployer.mdict['pki_target_servercert_profile'])
-                deployer.file.copy(
-                    deployer.mdict['pki_source_storagecert_profile'],
-                    deployer.mdict['pki_target_storagecert_profile'])
-                deployer.file.copy(
-                    deployer.mdict['pki_source_subsystemcert_profile'],
-                    deployer.mdict['pki_target_subsystemcert_profile'])
-                deployer.file.copy(
-                    deployer.mdict['pki_source_transportcert_profile'],
-                    deployer.mdict['pki_target_transportcert_profile'])
-            # establish instance-based Tomcat PKI subsystem registry
-            # establish instance-based Tomcat PKI subsystem convenience
-            # symbolic links
-            deployer.symlink.create(
-                deployer.mdict['pki_tomcat_webapps_path'],
-                deployer.mdict['pki_subsystem_tomcat_webapps_link'])
-        # establish instance-based subsystem convenience symbolic links
-        deployer.symlink.create(
-            deployer.mdict['pki_instance_database_link'],
-            deployer.mdict['pki_subsystem_database_link'])
-        deployer.symlink.create(
-            deployer.mdict['pki_subsystem_configuration_path'],
-            deployer.mdict['pki_subsystem_conf_link'])
-        deployer.symlink.create(
-            deployer.mdict['pki_subsystem_log_path'],
-            deployer.mdict['pki_subsystem_logs_link'])
-        deployer.symlink.create(
-            deployer.mdict['pki_instance_registry_path'],
-            deployer.mdict['pki_subsystem_registry_link'])
-        return self.rv
-
-    def destroy(self, deployer):
-
-        config.pki_log.info(log.SUBSYSTEM_DESTROY_1, __name__,
-                            extra=config.PKI_INDENTATION_LEVEL_1)
-        # remove instance-based subsystem base
-        if deployer.mdict['pki_subsystem'] == "CA":
-            deployer.directory.delete(
-                deployer.mdict['pki_subsystem_emails_path'])
-            deployer.directory.delete(
-                deployer.mdict['pki_subsystem_profiles_path'])
-        deployer.directory.delete(deployer.mdict['pki_subsystem_path'])
-        # remove instance-based subsystem logs
-        if deployer.mdict['pki_subsystem'] in \
-                config.PKI_SIGNED_AUDIT_SUBSYSTEMS:
-            deployer.directory.delete(
-                deployer.mdict['pki_subsystem_signed_audit_log_path'])
-        deployer.directory.delete(
-            deployer.mdict['pki_subsystem_archive_log_path'])
-        deployer.directory.delete(
-            deployer.mdict['pki_subsystem_log_path'])
-        # remove instance-based subsystem configuration
-        deployer.directory.delete(
-            deployer.mdict['pki_subsystem_configuration_path'])
-        # remove instance-based subsystem registry
-        deployer.directory.delete(
-            deployer.mdict['pki_subsystem_registry_path'])
-        return self.rv
diff --git a/base/server/python/pki/server/deployment/scriptlets/webapp_deployment.py b/base/server/python/pki/server/deployment/scriptlets/webapp_deployment.py
deleted file mode 100644
index 962de72..0000000
--- a/base/server/python/pki/server/deployment/scriptlets/webapp_deployment.py
+++ /dev/null
@@ -1,177 +0,0 @@
-#!/usr/bin/python -t
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-#
-
-# System Imports
-import os
-
-# PKI Deployment Imports
-from .. import pkiconfig as config
-from .. import pkimessages as log
-from .. import pkiscriptlet
-
-
-# PKI Web Application Deployment Scriptlet
-class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
-    rv = 0
-
-    def spawn(self, deployer):
-
-        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-            if config.str2bool(deployer.mdict['pki_skip_installation']):
-                config.pki_log.info(log.SKIP_WEBAPP_DEPLOYMENT_SPAWN_1,
-                                    __name__,
-                                    extra=config.PKI_INDENTATION_LEVEL_1)
-                return self.rv
-
-            config.pki_log.info(log.WEBAPP_DEPLOYMENT_SPAWN_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-
-            # For TPS, deploy web application directly from /usr/share/pki.
-            if deployer.mdict['pki_subsystem'] == "TPS":
-                deployer.file.copy(
-                    os.path.join(
-                        config.PKI_DEPLOYMENT_SOURCE_ROOT,
-                        "tps",
-                        "conf",
-                        "Catalina",
-                        "localhost",
-                        "tps.xml"),
-                    os.path.join(
-                        deployer.mdict['pki_instance_configuration_path'],
-                        "Catalina",
-                        "localhost",
-                        "tps.xml"))
-                return self.rv
-
-            # For other subsystems, deploy web application into Tomcat instance.
-            deployer.directory.create(
-                deployer.mdict['pki_tomcat_webapps_subsystem_path'])
-
-            # Copy /usr/share/pki/<subsystem>/webapps/<subsystem>
-            # to <instance>/webapps/<subsystem>
-            deployer.directory.copy(
-                os.path.join(
-                    config.PKI_DEPLOYMENT_SOURCE_ROOT,
-                    deployer.mdict['pki_subsystem'].lower(),
-                    "webapps",
-                    deployer.mdict['pki_subsystem'].lower()),
-                deployer.mdict['pki_tomcat_webapps_subsystem_path'],
-                overwrite_flag=True)
-
-            # Copy /usr/share/pki/server/webapps/pki/admin
-            # to <instance>/webapps/<subsystem>/admin
-            # TODO: common templates should be deployed in common webapp
-            deployer.directory.copy(
-                os.path.join(
-                    config.PKI_DEPLOYMENT_SOURCE_ROOT,
-                    "server",
-                    "webapps",
-                    "pki",
-                    "admin"),
-                os.path.join(
-                    deployer.mdict['pki_tomcat_webapps_subsystem_path'],
-                    "admin"),
-                overwrite_flag=True)
-
-            deployer.directory.create(
-                deployer.mdict['pki_tomcat_webapps_subsystem_webinf_classes_path'])
-            deployer.directory.create(
-                deployer.mdict['pki_tomcat_webapps_subsystem_webinf_lib_path'])
-            # establish Tomcat webapps subsystem WEB-INF lib symbolic links
-            deployer.symlink.create(
-                deployer.mdict['pki_certsrv_jar'],
-                deployer.mdict['pki_certsrv_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_cmsbundle'],
-                deployer.mdict['pki_cmsbundle_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_cmscore'],
-                deployer.mdict['pki_cmscore_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_cms'],
-                deployer.mdict['pki_cms_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_cmsutil'],
-                deployer.mdict['pki_cmsutil_jar_link'])
-            deployer.symlink.create(
-                deployer.mdict['pki_nsutil'],
-                deployer.mdict['pki_nsutil_jar_link'])
-            if deployer.mdict['pki_subsystem'] == "CA":
-                deployer.symlink.create(
-                    deployer.mdict['pki_ca_jar'],
-                    deployer.mdict['pki_ca_jar_link'])
-            elif deployer.mdict['pki_subsystem'] == "KRA":
-                deployer.symlink.create(
-                    deployer.mdict['pki_kra_jar'],
-                    deployer.mdict['pki_kra_jar_link'])
-            elif deployer.mdict['pki_subsystem'] == "OCSP":
-                deployer.symlink.create(
-                    deployer.mdict['pki_ocsp_jar'],
-                    deployer.mdict['pki_ocsp_jar_link'])
-            elif deployer.mdict['pki_subsystem'] == "TKS":
-                deployer.symlink.create(
-                    deployer.mdict['pki_tks_jar'],
-                    deployer.mdict['pki_tks_jar_link'])
-
-            # set ownerships, permissions, and acls
-            deployer.directory.set_mode(
-                deployer.mdict['pki_tomcat_webapps_subsystem_path'])
-
-            # Copy web application context file
-            # from /usr/share/pki/<subsystem>/conf/Catalina/localhost/
-            # <subsystem>.xml
-            # to <instance>/conf/Catalina/localhost/<subsystem>.xml
-            deployer.file.copy(
-                os.path.join(
-                    config.PKI_DEPLOYMENT_SOURCE_ROOT,
-                    deployer.mdict['pki_subsystem'].lower(),
-                    "conf",
-                    "Catalina",
-                    "localhost",
-                    deployer.mdict['pki_subsystem'].lower() + ".xml"),
-                os.path.join(
-                    deployer.mdict['pki_instance_configuration_path'],
-                    "Catalina",
-                    "localhost",
-                    deployer.mdict['pki_subsystem'].lower() + ".xml"))
-
-        return self.rv
-
-    def destroy(self, deployer):
-        if deployer.mdict['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS:
-            config.pki_log.info(log.WEBAPP_DEPLOYMENT_DESTROY_1, __name__,
-                                extra=config.PKI_INDENTATION_LEVEL_1)
-
-            # Delete <instance>/conf/Catalina/localhost/<subsystem>.xml
-            deployer.file.delete(
-                os.path.join(
-                    deployer.mdict['pki_instance_configuration_path'],
-                    "Catalina",
-                    "localhost",
-                    deployer.mdict['pki_subsystem'].lower() + ".xml"))
-
-            # For subsystems other than TPS, delete
-            # <instance>/webapps/<subsystem>.
-            if deployer.mdict['pki_subsystem'] != "TPS":
-                deployer.directory.delete(
-                    deployer.mdict['pki_tomcat_webapps_subsystem_path'])
-
-        return self.rv
diff --git a/base/server/sbin/pkidestroy b/base/server/sbin/pkidestroy
deleted file mode 100755
index f0fa27a..0000000
--- a/base/server/sbin/pkidestroy
+++ /dev/null
@@ -1,278 +0,0 @@
-#!/usr/bin/python -tu
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2011 Red Hat, Inc.
-# All rights reserved.
-#
-
-# System Imports
-import sys
-import signal
-
-if not hasattr(sys, "hexversion") or sys.hexversion < 0x020700f0:
-    print "Python version %s.%s.%s is too old." % sys.version_info[:3]
-    print "Please upgrade to at least Python 2.7.0."
-    sys.exit(1)
-try:
-    import os
-    import socket
-    import struct
-    import subprocess
-    import time
-    from time import strftime as date
-    from pki.server.deployment import pkiconfig as config
-    from pki.server.deployment.pkiparser import PKIConfigParser
-    from pki.server.deployment import pkilogging
-    from pki.server.deployment import pkimessages as log
-    import pki.server.deployment.pkihelper as util
-except ImportError:
-    print >> sys.stderr, """\
-There was a problem importing one of the required Python modules. The
-error was:
-
-    %s
-""" % sys.exc_value
-    sys.exit(1)
-
-
-#Handle the Keyboard Interrupt
-# pylint: disable-msg=W0613
-def interrupt_handler(event, frame):
-    print
-    print '\nUninstallation canceled.'
-    sys.exit(1)
-
-
-# PKI Deployment Functions
-def main(argv):
-    """main entry point"""
-
-    config.pki_deployment_executable = os.path.basename(argv[0])
-
-    # Only run this program as "root".
-    if not os.geteuid() == 0:
-        sys.exit("'%s' must be run as root!" % argv[0])
-
-    # Set the umask
-    os.umask(config.PKI_DEPLOYMENT_DEFAULT_UMASK)
-
-    # Set installation time
-    ticks = time.time()
-    config.pki_install_time = time.asctime(time.localtime(ticks))
-
-    # Generate a timestamp
-    config.pki_timestamp = date('%Y%m%d%H%M%S', time.localtime(ticks))
-    config.pki_certificate_timestamp =\
-        date('%Y-%m-%d %H:%M:%S', time.localtime(ticks))
-
-    # Obtain the architecture bit-size
-    config.pki_architecture = struct.calcsize("P") * 8
-
-    # Retrieve hostname
-    config.pki_hostname = socket.getfqdn()
-
-    # Retrieve DNS domainname
-    config.pki_dns_domainname = None
-    try:
-        dnsdomainname = subprocess.check_output(
-            "dnsdomainname",
-            shell=True)
-        # workaround for pylint error E1103
-        config.pki_dns_domainname = str(dnsdomainname).rstrip('\n')
-        if not len(config.pki_dns_domainname):
-            print log.PKI_DNS_DOMAIN_NOT_SET
-            sys.exit(1)
-    except subprocess.CalledProcessError as exc:
-        print log.PKI_SUBPROCESS_ERROR_1 % exc
-        sys.exit(1)
-
-    # Read and process command-line arguments.
-    parser = PKIConfigParser(
-        'PKI Instance Removal',
-        log.PKIDESTROY_EPILOG)
-
-    parser.optional.add_argument(
-        '-i',
-        dest='pki_deployed_instance_name',
-        action='store',
-        nargs=1, metavar='<instance>',
-        help='FORMAT:  ${pki_instance_name}')
-
-    parser.optional.add_argument(
-        '-u',
-        dest='pki_secdomain_user',
-        action='store',
-        nargs=1, metavar='<security domain user>',
-        help='security domain user')
-    
-    parser.optional.add_argument(
-        '-W',
-        dest='pki_secdomain_pass_file',
-        action='store',
-        nargs=1, metavar='<security domain password file>',
-        help='security domain password file path')
-
-    args = parser.process_command_line_arguments()
-
-    interactive = False
-
-    while True:
-
-        # -s <subsystem>
-        if args.pki_subsystem is None:
-            interactive = True
-            config.pki_subsystem = parser.read_text(
-                'Subsystem (CA/KRA/OCSP/TKS/TPS)',
-                options=['CA', 'KRA', 'OCSP', 'TKS', 'TPS'],
-                default='CA', case_sensitive=False).upper()
-        else:
-            config.pki_subsystem = str(args.pki_subsystem).strip('[\']')
-
-        # -i <instance name>
-        if args.pki_deployed_instance_name is None:
-            interactive = True
-            config.pki_deployed_instance_name = \
-                parser.read_text('Instance', default='pki-tomcat')
-        else:
-            config.pki_deployed_instance_name = \
-                str(args.pki_deployed_instance_name).strip('[\']')
-
-        if interactive:
-            print
-            parser.indent = 0
-
-            begin = parser.read_text(
-                'Begin uninstallation (Yes/No/Quit)',
-                options=['Yes', 'Y', 'No', 'N', 'Quit', 'Q'],
-                sign='?', allow_empty=False, case_sensitive=False).lower()
-
-            print
-
-            if begin == 'q' or begin == 'quit':
-                print "Uninstallation canceled."
-                sys.exit(0)
-
-            elif begin == 'y' or begin == 'yes':
-                break
-
-        else:
-            break
-
-    #    '-u'
-    if args.pki_secdomain_user:
-        config.pki_secdomain_user = str(args.pki_secdomain_user).strip('[\']')
-
-    #    '-W' password file
-    if args.pki_secdomain_pass_file:
-        with open(str(args.pki_secdomain_pass_file).strip('[\']'), 'r') as \
-                pwd_file:
-            config.pki_secdomain_pass = pwd_file.readline().strip('\n')
-
-    # verify that previously deployed instance exists
-    deployed_pki_instance_path = \
-        config.pki_root_prefix + config.PKI_DEPLOYMENT_BASE_ROOT + "/" + \
-        config.pki_deployed_instance_name
-    if not os.path.exists(deployed_pki_instance_path):
-        print "ERROR:  " + log.PKI_INSTANCE_DOES_NOT_EXIST_1 %\
-              deployed_pki_instance_path
-        print
-        parser.arg_parser.exit(-1)
-
-    # verify that previously deployed subsystem for this instance exists
-    deployed_pki_subsystem_path = \
-        deployed_pki_instance_path + "/" + config.pki_subsystem.lower()
-    if not os.path.exists(deployed_pki_subsystem_path):
-        print "ERROR:  " + log.PKI_SUBSYSTEM_DOES_NOT_EXIST_2 %\
-              (config.pki_subsystem, deployed_pki_instance_path)
-        print
-        parser.arg_parser.exit(-1)
-
-    config.default_deployment_cfg = \
-        config.PKI_DEPLOYMENT_DEFAULT_CONFIGURATION_FILE
-
-    # establish complete path to previously deployed configuration file
-    config.user_deployment_cfg =\
-        deployed_pki_subsystem_path + "/" +\
-        "registry" + "/" +\
-        config.pki_subsystem.lower() + "/" +\
-        config.USER_DEPLOYMENT_CONFIGURATION
-
-    parser.validate()
-    parser.init_config()
-
-    # Enable 'pkidestroy' logging.
-    config.pki_log_dir = \
-        config.pki_root_prefix + config.PKI_DEPLOYMENT_LOG_ROOT
-    config.pki_log_name = "pki" + "-" +\
-                          config.pki_subsystem.lower() +\
-                          "-" + "destroy" + "." +\
-                          config.pki_timestamp + "." + "log"
-    rv = pkilogging.enable_pki_logger(config.pki_log_dir,
-                                      config.pki_log_name,
-                                      config.pki_log_level,
-                                      config.pki_console_log_level,
-                                      "pkidestroy")
-    if rv != OSError:
-        config.pki_log = rv
-    else:
-        print log.PKI_UNABLE_TO_CREATE_LOG_DIRECTORY_1 % config.pki_log_dir
-        sys.exit(1)
-
-    # Read the specified PKI configuration file.
-    rv = parser.read_pki_configuration_file()
-    if rv != 0:
-        config.pki_log.error(log.PKI_UNABLE_TO_PARSE_1, rv,
-                             extra=config.PKI_INDENTATION_LEVEL_0)
-        sys.exit(1)
-
-    # Combine the various sectional dictionaries into a PKI master dictionary
-    parser.compose_pki_master_dictionary()
-    parser.mdict['pki_destroy_log'] = \
-        config.pki_log_dir + "/" + config.pki_log_name
-    config.pki_log.debug(log.PKI_DICTIONARY_MASTER,
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-    config.pki_log.debug(pkilogging.log_format(parser.mdict),
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-
-    print "Uninstalling " + config.pki_subsystem + " from " + \
-          deployed_pki_instance_path + "."
-
-    # Process the various "scriptlets" to remove the specified PKI subsystem.
-    pki_subsystem_scriptlets = parser.mdict['destroy_scriplets'].split()
-    deployer = util.PKIDeployer(parser.mdict)
-    rv = 0
-    for pki_scriptlet in pki_subsystem_scriptlets:
-        scriptlet = __import__("pki.server.deployment.scriptlets." +
-                               pki_scriptlet,
-                               fromlist=[pki_scriptlet])
-        instance = scriptlet.PkiScriptlet()
-        rv = instance.destroy(deployer)
-        if rv != 0:
-            sys.exit(1)
-    config.pki_log.debug(log.PKI_DICTIONARY_MASTER,
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-    config.pki_log.debug(pkilogging.log_format(parser.mdict),
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-
-    print
-    print "Uninstallation complete."
-
-
-# PKI Deployment Entry Point
-if __name__ == "__main__":
-    signal.signal(signal.SIGINT, interrupt_handler)
-    main(sys.argv)
diff --git a/base/server/sbin/pkispawn b/base/server/sbin/pkispawn
deleted file mode 100755
index 2f41afc..0000000
--- a/base/server/sbin/pkispawn
+++ /dev/null
@@ -1,586 +0,0 @@
-#!/usr/bin/python -tu
-# Authors:
-#     Matthew Harmsen <mharmsen@redhat.com>
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; version 2 of the License.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-#
-# Copyright (C) 2011 Red Hat, Inc.
-# All rights reserved.
-#
-
-# System Imports
-import sys
-import signal
-
-if not hasattr(sys, "hexversion") or sys.hexversion < 0x020700f0:
-    print "Python version %s.%s.%s is too old." % sys.version_info[:3]
-    print "Please upgrade to at least Python 2.7.0."
-    sys.exit(1)
-try:
-    import ldap
-    import os
-    import requests
-    import socket
-    import struct
-    import subprocess
-    import time
-    import traceback
-    from time import strftime as date
-    from pki.server.deployment import pkiconfig as config
-    from pki.server.deployment.pkiparser import PKIConfigParser
-    from pki.server.deployment import pkilogging
-    from pki.server.deployment import pkimessages as log
-    import pki.server.deployment.pkihelper as util
-except ImportError:
-    print >> sys.stderr, """\
-There was a problem importing one of the required Python modules. The
-error was:
-
-    %s
-""" % sys.exc_value
-    sys.exit(1)
-
-
-# Handle the Keyboard Interrupt
-# pylint: disable-msg=W0613
-def interrupt_handler(event, frame):
-    print
-    print '\nInstallation canceled.'
-    sys.exit(1)
-
-
-# PKI Deployment Functions
-def main(argv):
-    """main entry point"""
-
-    config.pki_deployment_executable = os.path.basename(argv[0])
-
-    # Only run this program as "root".
-    if not os.geteuid() == 0:
-        sys.exit("'%s' must be run as root!" % argv[0])
-
-    # Set the umask
-    os.umask(config.PKI_DEPLOYMENT_DEFAULT_UMASK)
-
-    # Set installation time
-    ticks = time.time()
-    config.pki_install_time = time.asctime(time.localtime(ticks))
-
-    # Generate a timestamp
-    config.pki_timestamp = date('%Y%m%d%H%M%S', time.localtime(ticks))
-    config.pki_certificate_timestamp = \
-        date('%Y-%m-%d %H:%M:%S', time.localtime(ticks))
-
-    # Obtain the architecture bit-size
-    config.pki_architecture = struct.calcsize("P") * 8
-
-    # Retrieve hostname
-    config.pki_hostname = socket.getfqdn()
-
-    # Retrieve DNS domainname
-    try:
-        dnsdomainname = subprocess.check_output(
-            "dnsdomainname", shell=True)
-        # workaround for pylint error E1103
-        config.pki_dns_domainname = str(dnsdomainname).rstrip('\n')
-        if not len(config.pki_dns_domainname):
-            print log.PKI_DNS_DOMAIN_NOT_SET
-            sys.exit(1)
-    except subprocess.CalledProcessError as exc:
-        print log.PKI_SUBPROCESS_ERROR_1 % exc
-        sys.exit(1)
-
-    # Read and process command-line arguments.
-    parser = PKIConfigParser(
-        'PKI Instance Installation and Configuration',
-        log.PKISPAWN_EPILOG)
-
-    parser.optional.add_argument(
-        '-f',
-        dest='user_deployment_cfg', action='store',
-        nargs=1, metavar='<file>',
-        help='configuration filename '
-        '(MUST specify complete path)')
-
-    args = parser.process_command_line_arguments()
-
-    config.default_deployment_cfg = \
-        config.PKI_DEPLOYMENT_DEFAULT_CONFIGURATION_FILE
-
-    # -f <user deployment config>
-    if args.user_deployment_cfg is not None:
-        config.user_deployment_cfg = str(args.user_deployment_cfg).strip('[\']')
-
-    parser.validate()
-    interactive = False
-
-    while True:
-
-        # -s <subsystem>
-        if args.pki_subsystem is None:
-            interactive = True
-            parser.indent = 0
-
-            config.pki_subsystem = parser.read_text(
-                'Subsystem (CA/KRA/OCSP/TKS/TPS)',
-                options=['CA', 'KRA', 'OCSP', 'TKS', 'TPS'],
-                default='CA', case_sensitive=False).upper()
-            print
-        else:
-            config.pki_subsystem = str(args.pki_subsystem).strip('[\']')
-
-        parser.init_config()
-
-        if config.user_deployment_cfg is None:
-            interactive = True
-            parser.indent = 2
-
-            print "Tomcat:"
-            parser.read_text('Instance', 'DEFAULT', 'pki_instance_name')
-            parser.read_text('HTTP port', config.pki_subsystem, 'pki_http_port')
-            parser.read_text('Secure HTTP port', config.pki_subsystem,
-                             'pki_https_port')
-            parser.read_text('AJP port', config.pki_subsystem, 'pki_ajp_port')
-            parser.read_text('Management port', config.pki_subsystem,
-                             'pki_tomcat_server_port')
-            print
-
-            print "Administrator:"
-            parser.read_text('Username', config.pki_subsystem, 'pki_admin_uid')
-
-            admin_password = parser.read_password(
-                'Password', config.pki_subsystem, 'pki_admin_password',
-                verifyMessage='Verify password')
-
-            parser.set_property(config.pki_subsystem, 'pki_backup_password',
-                                admin_password)
-            parser.set_property(config.pki_subsystem,
-                                'pki_client_database_password',
-                                admin_password)
-            parser.set_property(config.pki_subsystem,
-                                'pki_client_pkcs12_password',
-                                admin_password)
-
-            if parser.mdict['pki_import_admin_cert'] == 'True':
-                import_cert = 'Y'
-            else:
-                import_cert = 'N'
-
-            import_cert = parser.read_text(
-                'Import certificate (Yes/No)',
-                default=import_cert, options=['Yes', 'Y', 'No', 'N'],
-                sign='?', case_sensitive=False).lower()
-
-            if import_cert == 'y' or import_cert == 'yes':
-                parser.set_property(config.pki_subsystem,
-                                    'pki_import_admin_cert',
-                                    'True')
-                parser.read_text('Import certificate from',
-                                 config.pki_subsystem,
-                                 'pki_admin_cert_file')
-            else:
-                parser.set_property(config.pki_subsystem,
-                                    'pki_import_admin_cert',
-                                    'False')
-
-            parser.read_text('Export certificate to',
-                             config.pki_subsystem,
-                             'pki_client_admin_cert')
-            print
-
-            print "Directory Server:"
-            while True:
-                parser.read_text('Hostname',
-                                 config.pki_subsystem,
-                                 'pki_ds_hostname')
-                parser.read_text('Port',
-                                 config.pki_subsystem,
-                                 'pki_ds_ldap_port')
-                parser.read_text('Bind DN',
-                                 config.pki_subsystem,
-                                 'pki_ds_bind_dn')
-                parser.read_password('Password',
-                                     config.pki_subsystem,
-                                     'pki_ds_password')
-
-                try:
-                    parser.ds_verify_configuration()
-
-                except ldap.LDAPError as e:
-                    parser.print_text('ERROR: ' + e.message['desc'])
-                    continue
-
-                parser.read_text('Base DN',
-                                 config.pki_subsystem,
-                                 'pki_ds_base_dn')
-                try:
-                    if not parser.ds_base_dn_exists():
-                        break
-
-                except ldap.LDAPError as e:
-                    parser.print_text('ERROR: ' + e.message['desc'])
-                    continue
-
-                remove = parser.read_text(
-                    'Base DN already exists. Overwrite (Yes/No/Quit)',
-                    options=['Yes', 'Y', 'No', 'N', 'Quit', 'Q'],
-                    sign='?', allow_empty=False, case_sensitive=False).lower()
-
-                if remove == 'q' or remove == 'quit':
-                    print "Installation canceled."
-                    sys.exit(0)
-
-                if remove == 'y' or remove == 'yes':
-                    break
-
-            print
-
-            print "Security Domain:"
-
-            if config.pki_subsystem == "CA":
-                parser.read_text('Name',
-                                 config.pki_subsystem,
-                                 'pki_security_domain_name')
-
-            else:
-                while True:
-                    parser.read_text('Hostname',
-                                     config.pki_subsystem,
-                                     'pki_security_domain_hostname')
-
-                    parser.read_text('Secure HTTP port',
-                                     config.pki_subsystem,
-                                     'pki_security_domain_https_port')
-
-                    try:
-                        parser.sd_connect()
-                        info = parser.sd_get_info()
-                        parser.print_text('Name: ' + info.name)
-                        parser.set_property(config.pki_subsystem,
-                                            'pki_security_domain_name',
-                                            info.name)
-                        break
-                    except requests.exceptions.ConnectionError as e:
-                        parser.print_text('ERROR: ' + str(e))
-
-                while True:
-                    parser.read_text('Username',
-                                     config.pki_subsystem,
-                                     'pki_security_domain_user')
-                    parser.read_password('Password',
-                                         config.pki_subsystem,
-                                         'pki_security_domain_password')
-
-                    try:
-                        parser.sd_authenticate()
-                        break
-                    except requests.exceptions.HTTPError as e:
-                        parser.print_text('ERROR: ' + str(e))
-
-            print
-
-            if config.pki_subsystem == "TPS":
-                print "External Servers:"
-
-                while True:
-                    parser.read_text('CA URL',
-                                     config.pki_subsystem,
-                                     'pki_ca_uri')
-                    try:
-                        status = parser.get_server_status('ca', 'pki_ca_uri')
-                        if status == 'running':
-                            break
-                        parser.print_text('ERROR: CA is not running')
-                    except requests.exceptions.ConnectionError as e:
-                        parser.print_text('ERROR: ' + str(e))
-
-                while True:
-                    parser.read_text('TKS URL',
-                                     config.pki_subsystem,
-                                     'pki_tks_uri')
-                    try:
-                        status = parser.get_server_status('tks', 'pki_tks_uri')
-                        if status == 'running':
-                            break
-                        parser.print_text('ERROR: TKS is not running')
-                    except requests.exceptions.ConnectionError as e:
-                        parser.print_text('ERROR: ' + str(e))
-
-                while True:
-                    keygen = parser.read_text(
-                        'Enable server side key generation (Yes/No)',
-                        options=['Yes', 'Y', 'No', 'N'], default='N',
-                        sign='?', case_sensitive=False).lower()
-
-                    if keygen == 'y' or keygen == 'yes':
-                        parser.set_property(config.pki_subsystem,
-                                            'pki_enable_server_side_keygen',
-                                            'True')
- 
-                        parser.read_text('KRA URL',
-                                         config.pki_subsystem,
-                                         'pki_kra_uri')
-                        try:
-                            status = parser.get_server_status(
-                                'kra', 'pki_kra_uri')
-                            if status == 'running':
-                                break
-                            parser.print_text('ERROR: KRA is not running')
-                        except requests.exceptions.ConnectionError as e:
-                            parser.print_text('ERROR: ' + str(e))
-                    else:
-                        parser.set_property(config.pki_subsystem,
-                                            'pki_enable_server_side_keygen',
-                                            'False')
-                        break
-
-                print
-
-                print "Authentication Database:"
-
-                while True:
-                    parser.read_text('Hostname',
-                                     config.pki_subsystem,
-                                     'pki_authdb_hostname')
-                    parser.read_text('Port',
-                                     config.pki_subsystem,
-                                     'pki_authdb_port')
-                    basedn = parser.read_text('Base DN', allow_empty=False)
-                    parser.set_property(config.pki_subsystem,
-                                        'pki_authdb_basedn',
-                                        basedn)
-
-                    try:
-                        parser.authdb_connect()
-                        if parser.authdb_base_dn_exists():
-                            break
-                        else:
-                            parser.print_text('ERROR: base DN does not exist')
-
-                    except ldap.LDAPError as e:
-                        parser.print_text('ERROR: ' + e.message['desc'])
-
-                print
-
-        if interactive:
-            parser.indent = 0
-
-            begin = parser.read_text(
-                'Begin installation (Yes/No/Quit)',
-                options=['Yes', 'Y', 'No', 'N', 'Quit', 'Q'],
-                sign='?', allow_empty=False, case_sensitive=False).lower()
-            print
-
-            if begin == 'q' or begin == 'quit':
-                print "Installation canceled."
-                sys.exit(0)
-
-            if begin == 'y' or begin == 'yes':
-                break
-
-        else:
-            break
-
-    if not os.path.exists(config.PKI_DEPLOYMENT_SOURCE_ROOT +
-                          "/" + config.pki_subsystem.lower()):
-        print "ERROR:  " + log.PKI_SUBSYSTEM_NOT_INSTALLED_1 % \
-            config.pki_subsystem.lower()
-        sys.exit(1)
-
-    # Enable 'pkispawn' logging.
-    config.pki_log_dir = config.pki_root_prefix + config.PKI_DEPLOYMENT_LOG_ROOT
-    config.pki_log_name = "pki" + "-" + \
-                          config.pki_subsystem.lower() + \
-                          "-" + "spawn" + "." + \
-                          config.pki_timestamp + "." + "log"
-    rv = pkilogging.enable_pki_logger(config.pki_log_dir,
-                                      config.pki_log_name,
-                                      config.pki_log_level,
-                                      config.pki_console_log_level,
-                                      "pkispawn")
-    if rv != OSError:
-        config.pki_log = rv
-    else:
-        print log.PKI_UNABLE_TO_CREATE_LOG_DIRECTORY_1 % config.pki_log_dir
-        sys.exit(1)
-
-    # Read the specified PKI configuration file.
-    rv = parser.read_pki_configuration_file()
-    if rv != 0:
-        config.pki_log.error(log.PKI_UNABLE_TO_PARSE_1, rv,
-                             extra=config.PKI_INDENTATION_LEVEL_0)
-        sys.exit(1)
-
-    # Read in the PKI slots configuration file.
-    parser.compose_pki_slots_dictionary()
-    config.pki_log.debug(log.PKI_DICTIONARY_SLOTS,
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-    config.pki_log.debug(pkilogging.log_format(parser.slots_dict),
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-
-    # Combine the various sectional dictionaries into a PKI master dictionary
-    parser.compose_pki_master_dictionary()
-
-    parser.mdict['pki_spawn_log'] = \
-        config.pki_log_dir + "/" + config.pki_log_name
-    config.pki_log.debug(log.PKI_DICTIONARY_MASTER,
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-    config.pki_log.debug(pkilogging.log_format(parser.mdict),
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-
-    if not interactive and \
-            not config.str2bool(parser.mdict['pki_skip_configuration']):
-        try:
-            # Verify existence of Directory Server Password
-            if not 'pki_ds_password' in parser.mdict or\
-               not len(parser.mdict['pki_ds_password']):
-                config.pki_log.error(
-                    log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
-                    "pki_ds_password",
-                    parser.mdict['pki_user_deployment_cfg'],
-                    extra=config.PKI_INDENTATION_LEVEL_0)
-                sys.exit(1)
-
-            parser.ds_verify_configuration()
-
-            if parser.ds_base_dn_exists() and\
-                    not config.str2bool(parser.mdict['pki_ds_remove_data']):
-                print 'ERROR:  Base DN already exists.'
-                sys.exit(1)
-
-        except ldap.LDAPError as e:
-            print 'ERROR:  Unable to access directory server: ' + \
-                  e.message['desc']
-            sys.exit(1)
-
-        if ((config.pki_subsystem == "KRA" or
-             config.pki_subsystem == "OCSP") and
-            not config.str2bool(parser.mdict['pki_standalone'])) or\
-           config.pki_subsystem == "TKS" or\
-           config.pki_subsystem == "TPS" or\
-           config.str2bool(parser.mdict['pki_clone']) or\
-           (config.pki_subsystem == "CA" and
-            config.str2bool(parser.mdict['pki_subordinate'])):
-            try:
-                # Verify existence of Security Domain Password
-                if not 'pki_security_domain_password' in parser.mdict or\
-                   not len(parser.mdict['pki_security_domain_password']):
-                    config.pki_log.error(
-                        log.PKIHELPER_UNDEFINED_CONFIGURATION_FILE_ENTRY_2,
-                        "pki_security_domain_password",
-                        parser.mdict['pki_user_deployment_cfg'],
-                        extra=config.PKI_INDENTATION_LEVEL_0)
-                    sys.exit(1)
-
-                parser.sd_connect()
-                info = parser.sd_get_info()
-                parser.set_property(config.pki_subsystem,
-                                    'pki_security_domain_name',
-                                    info.name)
-                parser.sd_authenticate()
-
-            except requests.exceptions.ConnectionError as e:
-                print('ERROR:  Unable to access security domain: ' + str(e))
-                sys.exit(1)
-
-            except requests.exceptions.HTTPError as e:
-                print('ERROR:  Unable to access security domain: ' + str(e))
-                sys.exit(1)
-
-    print "Installing " + config.pki_subsystem + " into " + \
-          parser.mdict['pki_instance_path'] + "."
-
-    # Process the various "scriptlets" to create the specified PKI subsystem.
-    pki_subsystem_scriptlets = parser.mdict['spawn_scriplets'].split()
-    deployer = util.PKIDeployer(parser.mdict, parser.slots_dict)
-    rv = 0
-    for pki_scriptlet in pki_subsystem_scriptlets:
-        scriptlet = __import__("pki.server.deployment.scriptlets." +
-                               pki_scriptlet,
-                               fromlist=[pki_scriptlet])
-        instance = scriptlet.PkiScriptlet()
-        try:
-            rv = instance.spawn(deployer)
-        # pylint: disable-msg=W0703
-        except Exception:
-            log_error_details()
-            print
-            print "Installation failed."
-            print
-            sys.exit(1)
-        if rv != 0:
-            print "Nothing here!!!"
-            print "Installation failed."
-            sys.exit(1)
-    config.pki_log.debug(log.PKI_DICTIONARY_MASTER,
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-    config.pki_log.debug(pkilogging.log_format(parser.mdict),
-                         extra=config.PKI_INDENTATION_LEVEL_0)
-
-    print_install_information(parser.mdict)
-
-
-def print_install_information(mdict):
-
-    skip_configuration = config.str2bool(mdict['pki_skip_configuration'])
-    print log.PKI_SPAWN_INFORMATION_HEADER
-    if skip_configuration:
-        print log.PKI_CONFIGURATION_URL_1 % mdict['pki_configuration_url']
-        print log.PKI_CONFIGURATION_RESTART_1 % \
-            mdict['pki_registry_initscript_command']
-    else:
-        print "      Administrator's username:             %s" % \
-              mdict['pki_admin_uid']
-        if os.path.isfile(mdict['pki_client_admin_cert_p12']):
-            print "      Administrator's PKCS #12 file:\n            %s" % \
-                  mdict['pki_client_admin_cert_p12']
-        if not config.str2bool(mdict['pki_client_database_purge']):
-            print
-            print "      Administrator's certificate nickname:\n            %s"\
-                  % mdict['pki_admin_nickname']
-            print "      Administrator's certificate database:\n            %s"\
-                  % mdict['pki_client_database_dir']
-        print log.PKI_CHECK_STATUS_MESSAGE % mdict['pki_instance_name']
-        print log.PKI_INSTANCE_RESTART_MESSAGE % mdict['pki_instance_name']
-        if (((config.pki_subsystem == "KRA" or
-              config.pki_subsystem == "OCSP") and
-            config.str2bool(mdict['pki_standalone'])) and
-            not config.str2bool(mdict['pki_external_step_two'])):
-            # Stand-alone PKI KRA/OCSP (External CA Step 1)
-            print log.PKI_CONFIGURATION_STANDALONE_1 % config.pki_subsystem
-        else:
-            print log.PKI_ACCESS_URL % (mdict['pki_hostname'],
-                                        mdict['pki_https_port'],
-                                        config.pki_subsystem.lower())
-    print log.PKI_SPAWN_INFORMATION_FOOTER
-
-
-def log_error_details():
-
-    e_type, e_value, e_stacktrace = sys.exc_info()
-    config.pki_log.debug(
-        "Error Type: " + e_type.__name__, extra=config.PKI_INDENTATION_LEVEL_2)
-    config.pki_log.debug(
-        "Error Message: " + str(e_value), extra=config.PKI_INDENTATION_LEVEL_2)
-    stacktrace_list = traceback.format_list(traceback.extract_tb(e_stacktrace))
-    e_stacktrace = ""
-    for l in stacktrace_list:
-        e_stacktrace += l
-    config.pki_log.debug(e_stacktrace, extra=config.PKI_INDENTATION_LEVEL_2)
-    sys.exc_clear()
-
-# PKI Deployment Entry Point
-if __name__ == "__main__":
-    signal.signal(signal.SIGINT, interrupt_handler)
-    main(sys.argv)
diff --git a/scripts/compose_pki_core_packages b/scripts/compose_pki_core_packages
index 67d85a5..da692fc 100755
--- a/scripts/compose_pki_core_packages
+++ b/scripts/compose_pki_core_packages
@@ -38,7 +38,7 @@ PKI_CORE_VERSION="10.2.0"
 ##
 
 PKI_SPECS_FILE="${PKI_DIR}/specs/${PKI_CORE}.spec"
-PKI_COMPONENT_LIST="test symkey util common native-tools java-tools"
+PKI_COMPONENT_LIST="test symkey util common native-tools java-tools admin"
 
 if [ "$WITHOUT_JAVADOC" = "" ]; then
     PKI_COMPONENT_LIST="$PKI_COMPONENT_LIST javadoc"
diff --git a/specs/pki-core.spec b/specs/pki-core.spec
index 7c10c1f..59bdca9 100644
--- a/specs/pki-core.spec
+++ b/specs/pki-core.spec
@@ -5,7 +5,7 @@ distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
 
 Name:             pki-core
 Version:          10.2.0
-Release:          0.7%{?dist}
+Release:          0.8%{?dist}
 Summary:          Certificate System - PKI Core Components
 URL:              http://pki.fedoraproject.org/
 License:          GPLv2
@@ -92,6 +92,7 @@ PKI Core contains ALL top-level java-based Tomcat PKI components:      \
   * pki-symkey                                                         \
   * pki-base                                                           \
   * pki-tools                                                          \
+  * pki-admin                                                          \
   * pki-server                                                         \
   * pki-ca                                                             \
   * pki-kra                                                            \
@@ -120,6 +121,7 @@ required ONLY by ALL java-based Tomcat Certificate System instances:   \
   * pki-symkey                                                         \
   * pki-base                                                           \
   * pki-tools                                                          \
+  * pki-admin                                                          \
   * pki-server                                                         \
                                                                        \
 PKI Core also includes the following components:                       \
@@ -243,6 +245,24 @@ This package is a part of the PKI Core used by the Certificate System.
 %{overview}
 
 
+%package -n       pki-admin
+Summary:          Certificate System - PKI Server Administration
+Group:            System Environment/Base
+
+BuildArch:        noarch
+
+#Requires:         pki-base = %{version}-%{release}
+#Requires:         pki-tools = %{version}-%{release}
+
+%description -n   pki-admin
+This package contains PKI utilities that can be used for administration
+of a Certificate System.
+
+This package is a part of the PKI Core used by the Certificate System.
+
+%{overview}
+
+
 %if %{with server}
 
 %package -n       pki-server
@@ -266,6 +286,7 @@ Requires:         perl(XML::LibXML)
 Requires:         perl-Crypt-SSLeay
 Requires:         policycoreutils
 Requires:         openldap-clients
+Requires:         pki-admin = %{version}-%{release}
 Requires:         pki-base = %{version}-%{release}
 Requires:         pki-tools = %{version}-%{release}
 Requires:         policycoreutils-python
@@ -283,7 +304,7 @@ Requires(postun): systemd-units
 Requires:         tomcatjss >= 7.1.0
 
 %description -n   pki-server
-The PKI Server Framework is required by the following four PKI subsystems:
+The PKI Server Framework is required by the following PKI subsystems:
 
     the Certificate Authority (CA),
     the Data Recovery Manager (DRM),
@@ -693,6 +714,18 @@ echo >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
 %{_mandir}/man1/pki-securitydomain.1.gz
 %{_mandir}/man1/pki-user.1.gz
 
+%files -n pki-admin
+%defattr(-,root,root,-)
+%doc base/admin/LICENSE
+%{_sysconfdir}/pki/default.cfg
+%{_sbindir}/pkispawn
+%{_sbindir}/pkidestroy
+%{python_sitelib}/pki/admin/
+%dir %{_datadir}/pki/deployment
+%{_datadir}/pki/deployment/config/
+%{_mandir}/man5/pki_default.cfg.5.gz
+%{_mandir}/man8/pkidestroy.8.gz
+%{_mandir}/man8/pkispawn.8.gz
 
 %if %{with server}
 
@@ -701,14 +734,9 @@ echo >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
 %doc base/common/THIRD_PARTY_LICENSES
 %doc base/server/LICENSE
 %doc base/server/README
-%{_sysconfdir}/pki/default.cfg
-%{_sbindir}/pkispawn
-%{_sbindir}/pkidestroy
 %{_sbindir}/pki-server-upgrade
 #%{_bindir}/pki-setup-proxy
 %{python_sitelib}/pki/server/
-%dir %{_datadir}/pki/deployment
-%{_datadir}/pki/deployment/config/
 %dir %{_datadir}/pki/scripts
 %{_datadir}/pki/scripts/operations
 %{_datadir}/pki/scripts/pkicommon.pm
@@ -730,15 +758,10 @@ echo >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
 %{_bindir}/pkisilent
 %{_datadir}/pki/silent/
 %{_bindir}/pkicontrol
-%{_mandir}/man5/pki_default.cfg.5.gz
 %{_mandir}/man8/pki-server-upgrade.8.gz
-%{_mandir}/man8/pkidestroy.8.gz
-%{_mandir}/man8/pkispawn.8.gz
-
 %{_datadir}/pki/setup/
 %{_datadir}/pki/server/
 
-
 %files -n pki-ca
 %defattr(-,root,root,-)
 %doc base/ca/LICENSE
@@ -799,6 +822,10 @@ echo >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
 %endif # %{with server}
 
 %changelog
+* Fri Aug 22 2014 Matthew Harmsen <mharmsen@redhat.com> - 10.2.0-0.8
+- PKI TRAC Ticket #1118 - Move 'pkispawn' and 'pkidestroy' to a separate
+  package called 'pki-admin'
+
 * Wed Aug 13 2014 Jack Magne <jmagne@redhat.com> - 10.2.0-0.7
 - Respin to include the applet files with the rpm install. No change
   to spec file needed.
-- 
1.9.3

