From 730e60617b09246145593f95414e23ec4d51be73 Mon Sep 17 00:00:00 2001
From: Endi Sukma Dewata <edewata@redhat.com>
Date: Wed, 29 May 2013 15:42:46 -0400
Subject: [PATCH] Fixed hard-coded server certificate nickname.

Previously the server certificate name was partially hard-coded as
"Server-Cert cert-[PKI_INSTANCE_NAME]". Now in Tomcat-based subsystems
it can be fully configured using pki_ssl_server_nickname parameter.
In Apache-based subsystems it's left unchanged.

Unused copies of serverCertNick.conf have been removed.

Ticket #631
---
 base/ca/shared/conf/CS.cfg.in                                      | 4 ++--
 base/ca/shared/conf/serverCertNick.conf                            | 1 -
 base/common/shared/conf/serverCertNick.conf                        | 7 +------
 .../src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java   | 6 ++----
 base/kra/shared/conf/CS.cfg.in                                     | 2 +-
 base/kra/shared/conf/serverCertNick.conf                           | 1 -
 base/ocsp/shared/conf/CS.cfg.in                                    | 2 +-
 base/ocsp/shared/conf/serverCertNick.conf                          | 6 ------
 base/server/config/pkislots.cfg                                    | 1 +
 base/server/src/engine/pkiparser.py                                | 4 +++-
 base/tks/shared/conf/CS.cfg.in                                     | 2 +-
 base/tks/shared/conf/serverCertNick.conf                           | 6 ------
 12 files changed, 12 insertions(+), 30 deletions(-)
 delete mode 100644 base/ca/shared/conf/serverCertNick.conf
 delete mode 100644 base/kra/shared/conf/serverCertNick.conf
 delete mode 100644 base/ocsp/shared/conf/serverCertNick.conf
 delete mode 100644 base/tks/shared/conf/serverCertNick.conf

diff --git a/base/ca/shared/conf/CS.cfg.in b/base/ca/shared/conf/CS.cfg.in
index a2cb612cf8ff2bbb831a3b80ccee994c8a3218c1..f1b1303c4296ec7fcb2c9cbc5915e840b3ae4cd9 100644
--- a/base/ca/shared/conf/CS.cfg.in
+++ b/base/ca/shared/conf/CS.cfg.in
@@ -104,7 +104,7 @@ preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA
 preop.cert.sslserver.dn=CN=[PKI_HOSTNAME]
 preop.cert.sslserver.keysize.custom_size=2048
 preop.cert.sslserver.keysize.size=2048
-preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_NAME]
+preop.cert.sslserver.nickname=[PKI_SSL_SERVER_NICKNAME]
 preop.cert.sslserver.profile=serverCert.profile
 preop.cert.sslserver.signing.required=false
 preop.cert.sslserver.subsystem=ca
@@ -146,7 +146,7 @@ preop.name.subsystemDN=CN=CA Subsystem Certificate
 preop.name.canickname=caSigningCert cert-[PKI_INSTANCE_NAME]
 preop.name.ocspnickname=ocspSigningCert cert-[PKI_INSTANCE_NAME]
 preop.name.subsystemnickname=subsystemCert cert-[PKI_INSTANCE_NAME]
-preop.name.sslnickname=Server-Cert cert-[PKI_INSTANCE_NAME]
+preop.name.sslnickname=[PKI_SSL_SERVER_NICKNAME]
 preop.subsystem.count=0
 subsystem.count=0
 passwordFile=[PKI_INSTANCE_PATH]/conf/password.conf
diff --git a/base/ca/shared/conf/serverCertNick.conf b/base/ca/shared/conf/serverCertNick.conf
deleted file mode 100644
index a359645f888afb750b983f55ea6b6c4c0d9a3cbc..0000000000000000000000000000000000000000
--- a/base/ca/shared/conf/serverCertNick.conf
+++ /dev/null
@@ -1 +0,0 @@
-Server-Cert cert-[PKI_INSTANCE_NAME]
diff --git a/base/common/shared/conf/serverCertNick.conf b/base/common/shared/conf/serverCertNick.conf
index 4f35a63496f074a35236a56ca727163f8c24b8ca..ae5153c529ab7e58879d9b82da353472024754bb 100644
--- a/base/common/shared/conf/serverCertNick.conf
+++ b/base/common/shared/conf/serverCertNick.conf
@@ -1,6 +1 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2012 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-Server-Cert cert-[PKI_INSTANCE_NAME]
+[PKI_SSL_SERVER_NICKNAME]
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
index 719efd3bf692cb19fc699ec26f94b90bea14901f..99ccdf5be752fdf57166113c3b3ba179fee2e837 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
@@ -2797,8 +2797,7 @@ public class ConfigurationUtils {
     public static boolean findBootstrapServerCert() throws EBaseException, NotInitializedException, TokenException {
         IConfigStore cs = CMS.getConfigStore();
 
-        String instanceID = cs.getString("instanceId", "");
-        String nickname = "Server-Cert cert-" + instanceID;
+        String nickname = cs.getString("preop.cert.sslserver.nickname");
 
         CryptoManager cm = CryptoManager.getInstance();
         X509Certificate cert;
@@ -2817,8 +2816,7 @@ public class ConfigurationUtils {
     public static void deleteBootstrapServerCert() throws EBaseException, NotInitializedException,
             NoSuchTokenException, TokenException {
         IConfigStore cs = CMS.getConfigStore();
-        String instanceID = cs.getString("instanceId", "");
-        String nickname = "Server-Cert cert-" + instanceID;
+        String nickname = cs.getString("preop.cert.sslserver.nickname");
         deleteCert("Internal Key Storage Token", nickname);
     }
 
diff --git a/base/kra/shared/conf/CS.cfg.in b/base/kra/shared/conf/CS.cfg.in
index a20b16033dcaf33217a8d482854f24d3189036b0..48d285d6ad0ca56864b36d4675158da78eff6b47 100644
--- a/base/kra/shared/conf/CS.cfg.in
+++ b/base/kra/shared/conf/CS.cfg.in
@@ -93,7 +93,7 @@ preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA
 preop.cert.sslserver.dn=CN=[PKI_HOSTNAME]
 preop.cert.sslserver.keysize.custom_size=2048
 preop.cert.sslserver.keysize.size=2048
-preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_NAME]
+preop.cert.sslserver.nickname=[PKI_SSL_SERVER_NICKNAME]
 preop.cert.sslserver.profile=caInternalAuthServerCert
 preop.cert.sslserver.signing.required=false
 preop.cert.sslserver.subsystem=kra
diff --git a/base/kra/shared/conf/serverCertNick.conf b/base/kra/shared/conf/serverCertNick.conf
deleted file mode 100644
index a359645f888afb750b983f55ea6b6c4c0d9a3cbc..0000000000000000000000000000000000000000
--- a/base/kra/shared/conf/serverCertNick.conf
+++ /dev/null
@@ -1 +0,0 @@
-Server-Cert cert-[PKI_INSTANCE_NAME]
diff --git a/base/ocsp/shared/conf/CS.cfg.in b/base/ocsp/shared/conf/CS.cfg.in
index 9d3a5333589fabcd164611d4039b0bca2d8aa46c..25e4c9e9e77f588ec997f07b83f3e7167fd74c56 100644
--- a/base/ocsp/shared/conf/CS.cfg.in
+++ b/base/ocsp/shared/conf/CS.cfg.in
@@ -78,7 +78,7 @@ preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA
 preop.cert.sslserver.dn=CN=[PKI_HOSTNAME]
 preop.cert.sslserver.keysize.custom_size=2048
 preop.cert.sslserver.keysize.size=2048
-preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_NAME]
+preop.cert.sslserver.nickname=[PKI_SSL_SERVER_NICKNAME]
 preop.cert.sslserver.profile=caInternalAuthServerCert
 preop.cert.sslserver.signing.required=false
 preop.cert.sslserver.subsystem=ocsp
diff --git a/base/ocsp/shared/conf/serverCertNick.conf b/base/ocsp/shared/conf/serverCertNick.conf
deleted file mode 100644
index a7a0d28995ab6a25f650662ded8fece8104ca507..0000000000000000000000000000000000000000
--- a/base/ocsp/shared/conf/serverCertNick.conf
+++ /dev/null
@@ -1,6 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2006 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-Server-Cert cert-[PKI_INSTANCE_NAME]
diff --git a/base/server/config/pkislots.cfg b/base/server/config/pkislots.cfg
index 0b239020fe67ac89b6b1f521bffd1d0e54d729d3..8c521232025842896d74230a9580fea90572777e 100644
--- a/base/server/config/pkislots.cfg
+++ b/base/server/config/pkislots.cfg
@@ -75,6 +75,7 @@ PKI_SECURE_PORT_CONNECTOR_NAME_SLOT=[PKI_SECURE_PORT_CONNECTOR_NAME]
 PKI_SECURE_PORT_SERVER_COMMENT_SLOT=[PKI_SECURE_PORT_SERVER_COMMENT]
 PKI_SECURITY_MANAGER_SLOT=[PKI_SECURITY_MANAGER]
 PKI_SERVER_XML_CONF_SLOT=[PKI_SERVER_XML_CONF]
+PKI_SSL_SERVER_NICKNAME_SLOT=[PKI_SSL_SERVER_NICKNAME]
 PKI_SUBSYSTEM_TYPE_SLOT=[PKI_SUBSYSTEM_TYPE]
 PKI_SYSTEMD_SERVICENAME_SLOT=[PKI_SYSTEMD_SERVICENAME]
 PKI_TMPDIR_SLOT=[PKI_TMPDIR]
diff --git a/base/server/src/engine/pkiparser.py b/base/server/src/engine/pkiparser.py
index 99c8855b935ade8af08320d87420729b8c8e5c93..6a94e382719a1e35da764336542ac10e470c2f3a 100644
--- a/base/server/src/engine/pkiparser.py
+++ b/base/server/src/engine/pkiparser.py
@@ -746,6 +746,8 @@ class PKIConfigParser:
                     config.pki_master_dict['pki_security_manager']
                 config.pki_master_dict['PKI_SERVER_XML_CONF_SLOT'] =\
                     config.pki_master_dict['pki_target_server_xml']
+                config.pki_master_dict['PKI_SSL_SERVER_NICKNAME_SLOT'] =\
+                    config.pki_master_dict['pki_ssl_server_nickname']
                 config.pki_master_dict['PKI_SUBSYSTEM_TYPE_SLOT'] =\
                     config.pki_master_dict['pki_subsystem'].lower()
                 config.pki_master_dict['PKI_SYSTEMD_SERVICENAME_SLOT'] =\
@@ -847,7 +849,7 @@ class PKIConfigParser:
                              "secmod.db")
             config.pki_master_dict['pki_self_signed_token'] = "internal"
             config.pki_master_dict['pki_self_signed_nickname'] =\
-                "Server-Cert cert-" + config.pki_master_dict['pki_instance_name']
+                config.pki_master_dict['pki_ssl_server_nickname']
             config.pki_master_dict['pki_self_signed_subject'] =\
                 "cn=" + config.pki_master_dict['pki_hostname'] + "," +\
                 "o=" + config.pki_master_dict['pki_certificate_timestamp']
diff --git a/base/tks/shared/conf/CS.cfg.in b/base/tks/shared/conf/CS.cfg.in
index 74749055f12285b50f39cd7cb05f9513e1184dd7..4fbf21e68bc8da0f07d4cad6c1b76fdd6930f76f 100644
--- a/base/tks/shared/conf/CS.cfg.in
+++ b/base/tks/shared/conf/CS.cfg.in
@@ -53,7 +53,7 @@ preop.cert.sslserver.defaultSigningAlgorithm=SHA256withRSA
 preop.cert.sslserver.dn=CN=[PKI_HOSTNAME]
 preop.cert.sslserver.keysize.custom_size=2048
 preop.cert.sslserver.keysize.size=2048
-preop.cert.sslserver.nickname=Server-Cert cert-[PKI_INSTANCE_NAME]
+preop.cert.sslserver.nickname=[PKI_SSL_SERVER_NICKNAME]
 preop.cert.sslserver.profile=caInternalAuthServerCert
 preop.cert.sslserver.signing.required=false
 preop.cert.sslserver.subsystem=tks
diff --git a/base/tks/shared/conf/serverCertNick.conf b/base/tks/shared/conf/serverCertNick.conf
deleted file mode 100644
index a7a0d28995ab6a25f650662ded8fece8104ca507..0000000000000000000000000000000000000000
--- a/base/tks/shared/conf/serverCertNick.conf
+++ /dev/null
@@ -1,6 +0,0 @@
-# --- BEGIN COPYRIGHT BLOCK ---
-# Copyright (C) 2006 Red Hat, Inc.
-# All rights reserved.
-# --- END COPYRIGHT BLOCK ---
-#
-Server-Cert cert-[PKI_INSTANCE_NAME]
-- 
1.8.1.4

