>From 72fec14779ed5279b4387e4d78a2b0d0c8a57b4f Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata@redhat.com>
Date: Thu, 14 Apr 2016 23:12:17 +0200
Subject: [PATCH] Moved self-signed SSL server certificate creation.

To avoid possible conflicts imported external certificates, the
self-signed SSL server certificate creation has been moved after
the external certificates have been imported into the NSS database
and before the server is started.

https://fedorahosted.org/pki/ticket/1736
---
 .../server/deployment/scriptlets/configuration.py  | 55 ++++++++++++++++++++++
 .../deployment/scriptlets/security_databases.py    | 41 ----------------
 2 files changed, 55 insertions(+), 41 deletions(-)

diff --git a/base/server/python/pki/server/deployment/scriptlets/configuration.py b/base/server/python/pki/server/deployment/scriptlets/configuration.py
index 1474d2fbbdb5f842109b0d319e7f16388720bff9..aa127651ef083ee506c2cad38b1af16ceaaab13d 100644
--- a/base/server/python/pki/server/deployment/scriptlets/configuration.py
+++ b/base/server/python/pki/server/deployment/scriptlets/configuration.py
@@ -236,6 +236,61 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
         if external and step_one:
             return self.rv
 
+        if len(deployer.instance.tomcat_instance_subsystems()) < 2:
+
+            deployer.password.create_password_conf(
+                deployer.mdict['pki_shared_pfile'],
+                deployer.mdict['pki_pin'], pin_sans_token=True)
+
+            # only create a self signed cert for a new instance
+            #
+            # NOTE:  ALWAYS create the temporary sslserver certificate
+            #        in the software DB regardless of whether the
+            #        instance will utilize 'softokn' or an HSM
+            #
+            rv = deployer.certutil.verify_certificate_exists(
+                deployer.mdict['pki_database_path'],
+                deployer.mdict['pki_cert_database'],
+                deployer.mdict['pki_key_database'],
+                deployer.mdict['pki_secmod_database'],
+                deployer.mdict['pki_self_signed_token'],
+                deployer.mdict['pki_self_signed_nickname'],
+                password_file=deployer.mdict['pki_shared_pfile'])
+
+            if not rv:
+
+                # note: in the function below, certutil is used to generate
+                # the request for the self signed cert.  The keys are generated
+                # by NSS, which does not actually use the data in the noise
+                # file, so it does not matter what is in this file.  Certutil
+                # still requires it though, otherwise it waits for keyboard
+                # input
+                with open(
+                        deployer.mdict['pki_self_signed_noise_file'], 'w') as f:
+                    f.write("not_so_random_data")
+
+                deployer.certutil.generate_self_signed_certificate(
+                    deployer.mdict['pki_database_path'],
+                    deployer.mdict['pki_cert_database'],
+                    deployer.mdict['pki_key_database'],
+                    deployer.mdict['pki_secmod_database'],
+                    deployer.mdict['pki_self_signed_token'],
+                    deployer.mdict['pki_self_signed_nickname'],
+                    deployer.mdict['pki_self_signed_subject'],
+                    deployer.mdict['pki_self_signed_serial_number'],
+                    deployer.mdict['pki_self_signed_validity_period'],
+                    deployer.mdict['pki_self_signed_issuer_name'],
+                    deployer.mdict['pki_self_signed_trustargs'],
+                    deployer.mdict['pki_self_signed_noise_file'],
+                    password_file=deployer.mdict['pki_shared_pfile'])
+
+                # Delete the temporary 'noise' file
+                deployer.file.delete(
+                    deployer.mdict['pki_self_signed_noise_file'])
+
+            # Always delete the temporary 'pfile'
+            deployer.file.delete(deployer.mdict['pki_shared_pfile'])
+
         # Start/Restart this Tomcat PKI Process
         # Optionally prepare to enable a java debugger
         # (e. g. - 'eclipse'):
diff --git a/base/server/python/pki/server/deployment/scriptlets/security_databases.py b/base/server/python/pki/server/deployment/scriptlets/security_databases.py
index a567b7cdf6ef164b60b9924412388892cbb02efa..ed8c0ce0981f2d4c09b9cabebaeabf4bfd348d2f 100644
--- a/base/server/python/pki/server/deployment/scriptlets/security_databases.py
+++ b/base/server/python/pki/server/deployment/scriptlets/security_databases.py
@@ -128,47 +128,6 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 no_user_certs=True)
 
         if len(deployer.instance.tomcat_instance_subsystems()) < 2:
-            # only create a self signed cert for a new instance
-            #
-            # NOTE:  ALWAYS create the temporary sslserver certificate
-            #        in the software DB regardless of whether the
-            #        instance will utilize 'softokn' or an HSM
-            #
-            rv = deployer.certutil.verify_certificate_exists(
-                deployer.mdict['pki_database_path'],
-                deployer.mdict['pki_cert_database'],
-                deployer.mdict['pki_key_database'],
-                deployer.mdict['pki_secmod_database'],
-                deployer.mdict['pki_self_signed_token'],
-                deployer.mdict['pki_self_signed_nickname'],
-                password_file=deployer.mdict['pki_shared_pfile'])
-            if not rv:
-                # note: in the function below, certutil is used to generate
-                # the request for the self signed cert.  The keys are generated
-                # by NSS, which does not actually use the data in the noise
-                # file, so it does not matter what is in this file.  Certutil
-                # still requires it though, otherwise it waits for keyboard
-                # input
-                with open(
-                        deployer.mdict['pki_self_signed_noise_file'], 'w') as f:
-                    f.write("not_so_random_data")
-                deployer.certutil.generate_self_signed_certificate(
-                    deployer.mdict['pki_database_path'],
-                    deployer.mdict['pki_cert_database'],
-                    deployer.mdict['pki_key_database'],
-                    deployer.mdict['pki_secmod_database'],
-                    deployer.mdict['pki_self_signed_token'],
-                    deployer.mdict['pki_self_signed_nickname'],
-                    deployer.mdict['pki_self_signed_subject'],
-                    deployer.mdict['pki_self_signed_serial_number'],
-                    deployer.mdict['pki_self_signed_validity_period'],
-                    deployer.mdict['pki_self_signed_issuer_name'],
-                    deployer.mdict['pki_self_signed_trustargs'],
-                    deployer.mdict['pki_self_signed_noise_file'],
-                    password_file=deployer.mdict['pki_shared_pfile'])
-                # Delete the temporary 'noise' file
-                deployer.file.delete(
-                    deployer.mdict['pki_self_signed_noise_file'])
 
             # Check to see if a secure connection is being used for the DS
             if config.str2bool(deployer.mdict['pki_ds_secure_connection']):
-- 
2.5.5

