>From 225277e30b2a2b31f1a6f8e1579bf54c60fea4dd Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Tue, 11 Sep 2012 15:42:36 -0400
Subject: [PATCH] Various fixes to installation servlet and pki-deploy

Added logging so that we can see what is passed in to server from pkispawn.
Fixed incorrect dbuser specification.
Added required replication config items to pkispawn.
Initial refactoring of construct_pki_configuration_data in pkijython.py
---
 .../certsrv/system/ConfigurationRequest.java       |  42 +++
 .../cms/servlet/csadmin/SystemConfigService.java   |   5 +-
 base/deploy/config/pkideployment.cfg               |   2 +
 base/deploy/src/scriptlets/configuration.jy        |  14 +-
 base/deploy/src/scriptlets/pkihelper.py            |   2 +-
 base/deploy/src/scriptlets/pkijython.py            | 402 ++++++++-------------
 6 files changed, 212 insertions(+), 255 deletions(-)

diff --git a/base/common/src/com/netscape/certsrv/system/ConfigurationRequest.java b/base/common/src/com/netscape/certsrv/system/ConfigurationRequest.java
index ac29b2da7f40e790823c492e6d9cc23eec88b5ba..6482b5f42a3e061340962f1a787c9d3af7aa5c9d 100644
--- a/base/common/src/com/netscape/certsrv/system/ConfigurationRequest.java
+++ b/base/common/src/com/netscape/certsrv/system/ConfigurationRequest.java
@@ -721,4 +721,46 @@ public class ConfigurationRequest {
         this.stepTwo = stepTwo;
     }
 
+    @Override
+    public String toString() {
+        return "ConfigurationRequest [pin=XXXX" +
+               ", token=" + token + ", tokenPassword=XXXX" +
+               ", securityDomainType=" + securityDomainType +
+               ", securityDomainUri=" + securityDomainUri +
+               ", securityDomainName=" + securityDomainName +
+               ", securityDomainUser=" + securityDomainUser +
+               ", securityDomainPassword=XXXX" +
+               ", isClone=" + isClone +
+               ", cloneUri=" + cloneUri +
+               ", subsystemName=" + subsystemName +
+               ", p12File=" + p12File +
+               ", p12Password=XXXX" +
+               ", hierarchy=" + hierarchy +
+               ", dsHost=" + dsHost +
+               ", dsPort=" + dsPort +
+               ", baseDN=" + baseDN +
+               ", bindDN=" + bindDN +
+               ", bindpwd=XXXX" +
+               ", database=" + database +
+               ", secureConn=" + secureConn +
+               ", removeData=" + removeData +
+               ", masterReplicationPort=" + masterReplicationPort +
+               ", cloneReplicationPort=" + cloneReplicationPort +
+               ", replicationSecurity=" + replicationSecurity +
+               ", systemCerts=" + systemCerts +
+               ", issuingCA=" + issuingCA +
+               ", backupKeys=" + backupKeys +
+               ", backupPassword=XXXX" +
+               ", backupFile=" + backupFile +
+               ", adminUID=" + adminUID +
+               ", adminPassword=XXXX" +
+               ", adminEmail=" + adminEmail +
+               ", adminCertRequest=" + adminCertRequest +
+               ", adminCertRequestType=" + adminCertRequestType +
+               ", adminSubjectDN=" + adminSubjectDN +
+               ", adminName=" + adminName +
+               ", adminProfileID=" + adminProfileID +
+               ", stepTwo=" + stepTwo + "]";
+    }
+
 }
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/SystemConfigService.java b/base/common/src/com/netscape/cms/servlet/csadmin/SystemConfigService.java
index 53b004846b0b631a451553804d0046be805e61f2..4ae9579f29479a2e01e2e14b386f14f8a0b80f7e 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/SystemConfigService.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/SystemConfigService.java
@@ -118,6 +118,9 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
             throw new PKIException("Unable to get certList from config file");
         }
 
+        CMS.debug("SystemConfigService(): configure() called");
+        CMS.debug(data.toString());
+
         validateData(data);
         ConfigurationResponse response = new ConfigurationResponse();
 
@@ -700,7 +703,7 @@ public class SystemConfigService extends PKIService implements SystemConfigResou
         }
 
         try {
-            String dbuser = csType + "-" + CMS.getEEHost() + "-" + CMS.getEESSLPort();
+            String dbuser = csType + "-" + CMS.getEEHost() + "-" + cs.getString("service.securePort");
             if (! securityDomainType.equals(ConfigurationRequest.NEW_DOMAIN)) {
                 ConfigurationUtils.setupDBUser(dbuser);
             }
diff --git a/base/deploy/config/pkideployment.cfg b/base/deploy/config/pkideployment.cfg
index 0061116223a1097a1cc424ffa0b70a7536fd8179..a7e61ccb8186a06d005c5f2e91fc3c809fe558eb 100644
--- a/base/deploy/config/pkideployment.cfg
+++ b/base/deploy/config/pkideployment.cfg
@@ -107,6 +107,8 @@ pki_https_port=443
 pki_ajp_port=8009
 pki_clone=False
 pki_clone_pkcs12_path=
+pki_clone_replication_master_port=
+pki_clone_replication_clone_port=
 pki_clone_replication_security=None
 pki_clone_uri=
 pki_enable_java_debugger=False
diff --git a/base/deploy/src/scriptlets/configuration.jy b/base/deploy/src/scriptlets/configuration.jy
index a53cf9d76c7ae7be678ff1e7f416dad547521f52..0f5968bce41ed8246c78c76cb15bc55d303e05b4 100644
--- a/base/deploy/src/scriptlets/configuration.jy
+++ b/base/deploy/src/scriptlets/configuration.jy
@@ -86,8 +86,8 @@ def main(argv):
     # Establish REST Client
     client = jyutil.rest_client.initialize(
                  client_config,
-                 master['pki_dry_run_flag'],
-                 master['pki_jython_log_level'])
+                 master,
+                 sensitive)
 
     # Construct PKI Subsystem Configuration Data
     data = None
@@ -123,17 +123,13 @@ def main(argv):
             else:
                 # PKI or Cloned CA
                 data = jyutil.rest_client.construct_pki_configuration_data(
-                           master, sensitive, token)
+                           token)
         else:
             # PKI or Cloned KRA, OCSP, or TKS
-            data = jyutil.rest_client.construct_pki_configuration_data(
-                       master, sensitive, token)
+            data = jyutil.rest_client.construct_pki_configuration_data(token)
 
     # Formulate PKI Subsystem Configuration Data Response
-    jyutil.rest_client.configure_pki_data(data,
-                                          master,
-                                          sensitive)
-
+    jyutil.rest_client.configure_pki_data(data)
 
 if __name__ == "__main__":
     main(sys.argv)
diff --git a/base/deploy/src/scriptlets/pkihelper.py b/base/deploy/src/scriptlets/pkihelper.py
index 038198ad3eea32c3de48702ae77200b4f7471823..adbbe7cb5e6e5c91e30e56a0f15eb1c85d3484f7 100644
--- a/base/deploy/src/scriptlets/pkihelper.py
+++ b/base/deploy/src/scriptlets/pkihelper.py
@@ -2562,7 +2562,7 @@ class security_domain:
                             log.PKIHELPER_SECURITY_DOMAIN_UPDATE_FAILURE_3,
                             typeval,
                             secname,
-                            error[0],
+                            error,
                             extra=config.PKI_INDENTATION_LEVEL_2)
                         if critical_failure == True:
                             sys.exit(-1)
diff --git a/base/deploy/src/scriptlets/pkijython.py b/base/deploy/src/scriptlets/pkijython.py
index c489fb13ffb054450532000b50ead6c87059fbdf..28a70504693abe41f939801cd602d5e92ef58ee5 100644
--- a/base/deploy/src/scriptlets/pkijython.py
+++ b/base/deploy/src/scriptlets/pkijython.py
@@ -254,23 +254,115 @@ class security_databases:
 # PKI Deployment 'REST Client' Class
 class rest_client:
     client = None
+    master = None
+    sensitive = None
 
-    def initialize(self, client_config, pki_dry_run_flag, log_level):
+    def initialize(self, client_config, master, sensitive):
         try:
+            self.master = master
+            self.sensitive = sensitive
+            log_level = master['pki_jython_log_level']
             if log_level >= config.PKI_JYTHON_INFO_LOG_LEVEL:
                 print "%s %s '%s'" %\
                       (log.PKI_JYTHON_INDENTATION_2,
                        log.PKI_JYTHON_INITIALIZING_REST_CLIENT,
                        client_config.serverURI)
-            if not pki_dry_run_flag:
+            if not master['pki_dry_run_flag']:
                 self.client = SystemConfigClient(client_config)
             return self.client
         except URISyntaxException, e:
             e.printStackTrace()
             javasystem.exit(1)
 
-    def construct_pki_configuration_data(self, master, sensitive, token):
+    def set_existing_security_domain(self, data):
+        data.setSecurityDomainType(ConfigurationRequest.EXISTING_DOMAIN)
+        data.setSecurityDomainUri(self.master['pki_security_domain_uri'])
+        data.setSecurityDomainUser(self.master['pki_security_domain_user'])
+        data.setSecurityDomainPassword(
+            self.sensitive['pki_security_domain_password'])
+
+    def set_new_security_domain(self, data):
+        data.setSecurityDomainType(ConfigurationRequest.NEW_DOMAIN)
+        data.setSecurityDomainName(self.master['pki_security_domain_name'])
+
+    def set_cloning_parameters(self, data):
+        data.setIsClone("true")
+        data.setCloneUri(self.master['pki_clone_uri'])
+        data.setP12File(self.master['pki_clone_pkcs12_path'])
+        data.setP12Password(self.sensitive['pki_clone_pkcs12_password'])
+        data.setReplicationSecurity(
+            self.master['pki_clone_replication_security'])
+        if self.master['pki_clone_replication_master_port']:
+            data.setMasterReplicationPort(
+                self.master['pki_clone_replication_master_port'])
+        if self.master['pki_clone_replication_clone_port']:
+            data.setCloneReplicationPort(
+                self.master['pki_clone_replication_clone_port'])
+
+    def set_database_parameters(self, data):
+        data.setDsHost(self.master['pki_ds_hostname'])
+        data.setDsPort(self.master['pki_ds_ldap_port'])
+        data.setBaseDN(self.master['pki_ds_base_dn'])
+        data.setBindDN(self.master['pki_ds_bind_dn'])
+        data.setDatabase(self.master['pki_ds_database'])
+        data.setBindpwd(self.sensitive['pki_ds_password'])
+        if config.str2bool(self.master['pki_ds_remove_data']):
+            data.setRemoveData("true")
+        else:
+            data.setRemoveData("false")
+        if config.str2bool(self.master['pki_ds_secure_connection']):
+            data.setSecureConn("true")
+        else:
+            data.setSecureConn("false")
+
+    def set_backup_parameters(self, data):
+        if config.str2bool(self.master['pki_backup_keys']):
+            data.setBackupKeys("true")
+            data.setBackupFile(self.master['pki_backup_keys_p12'])
+            data.setBackupPassword(self.sensitive['pki_backup_password'])
+        else:
+            data.setBackupKeys("false")
+
+    def set_admin_parameters(self, token, data):
+        data.setAdminEmail(self.master['pki_admin_email'])
+        data.setAdminName(self.master['pki_admin_name'])
+        data.setAdminPassword(self.sensitive['pki_admin_password'])
+        data.setAdminProfileID(self.master['pki_admin_profile_id'])
+        data.setAdminUID(self.master['pki_admin_uid'])
+        data.setAdminSubjectDN(self.master['pki_admin_subject_dn'])
+        if self.master['pki_admin_cert_request_type'] == "crmf":
+            data.setAdminCertRequestType("crmf")
+            if config.str2bool(self.master['pki_admin_dualkey']):
+                crmf_request = generateCRMFRequest(
+                                   token,
+                                   self.master['pki_admin_keysize'],
+                                   self.master['pki_admin_subject_dn'],
+                                   "true")
+            else:
+                crmf_request = generateCRMFRequest(
+                                   token,
+                                   self.master['pki_admin_keysize'],
+                                   self.master['pki_admin_subject_dn'],
+                                   "false")
+            data.setAdminCertRequest(crmf_request)
+        else:
+            javasystem.out.println(log.PKI_JYTHON_CRMF_SUPPORT_ONLY)
+            javasystem.exit(1)
+
+    def create_system_cert(self, tag):
+        cert = SystemCertData()
+        cert.setTag(self.master["pki_%s_tag" % tag])
+        cert.setKeyAlgorithm(self.master["pki_%s_key_algorithm" % tag])
+        cert.setKeySize(self.master["pki_%s_key_size" % tag])
+        cert.setKeyType(self.master["pki_%s_key_type" % tag])
+        cert.setNickname(self.master["pki_%s_nickname" % tag])
+        cert.setSubjectDN(self.master["pki_%s_subject_dn" % tag])
+        cert.setToken(self.master["pki_%s_token" % tag])
+        return cert
+
+    def construct_pki_configuration_data(self, token):
         data = None
+        master = self.master
         if master['pki_jython_log_level'] >= config.PKI_JYTHON_INFO_LOG_LEVEL:
             print "%s %s '%s'" %\
                   (log.PKI_JYTHON_INDENTATION_2,
@@ -278,141 +370,57 @@ class rest_client:
                    master['pki_subsystem'])
         if not master['pki_dry_run_flag']:
             data = ConfigurationRequest()
+
             # Miscellaneous Configuration Information
-            data.setPin(sensitive['pki_one_time_pin'])
+            data.setPin(self.sensitive['pki_one_time_pin'])
             data.setToken(ConfigurationRequest.TOKEN_DEFAULT)
+            data.setSubsystemName(master['pki_subsystem_name'])
+
+            # Hierarchy
             if master['pki_instance_type'] == "Tomcat":
-                data.setSubsystemName(master['pki_subsystem_name'])
                 if master['pki_subsystem'] == "CA":
                     if config.str2bool(master['pki_clone']):
                         # Cloned CA
+                        # alee - is this correct?
                         data.setHierarchy("root")
-                        data.setIsClone("true")
-                        data.setCloneUri(master['pki_clone_uri'])
-                        data.setP12File(master['pki_clone_pkcs12_path'])
-                        data.setP12Password(
-                            sensitive['pki_clone_pkcs12_password'])
                     elif config.str2bool(master['pki_external']):
                         # External CA
                         data.setHierarchy("join")
-                        data.setIsClone("false")
                     elif config.str2bool(master['pki_subordinate']):
                         # Subordinate CA
                         data.setHierarchy("join")
-                        data.setIsClone("false")
                     else:
                         # PKI CA
                         data.setHierarchy("root")
-                        data.setIsClone("false")
-                elif master['pki_subsystem'] == "KRA":
-                    if config.str2bool(master['pki_clone']):
-                        # Cloned KRA
-                        data.setIsClone("true")
-                        data.setCloneUri(master['pki_clone_uri'])
-                        data.setP12File(master['pki_clone_pkcs12_path'])
-                        data.setP12Password(
-                            sensitive['pki_clone_pkcs12_password'])
-                    else:
-                        # PKI KRA
-                        data.setIsClone("false")
-                elif master['pki_subsystem'] == "OCSP":
-                    if config.str2bool(master['pki_clone']):
-                        # Cloned OCSP
-                        data.setIsClone("true")
-                        data.setCloneUri(master['pki_clone_uri'])
-                        data.setP12File(master['pki_clone_pkcs12_path'])
-                        data.setP12Password(
-                            sensitive['pki_clone_pkcs12_password'])
-                    else:
-                        # PKI OCSP
-                        data.setIsClone("false")
-                elif master['pki_subsystem'] == "TKS":
-                    if config.str2bool(master['pki_clone']):
-                        # Cloned TKS
-                        data.setIsClone("true")
-                        data.setCloneUri(master['pki_clone_uri'])
-                        data.setP12File(master['pki_clone_pkcs12_path'])
-                        data.setP12Password(
-                            sensitive['pki_clone_pkcs12_password'])
-                    else:
-                        # PKI TKS
-                        data.setIsClone("false")
-            # Security Domain Information
-            #
-            #     NOTE:  External CA's DO NOT require a security domain
-            #
+
+            # Cloning parameters
+            if master['pki_instance_type'] == "Tomcat":
+                if config.str2bool(master['pki_clone']):
+                    self.set_cloning_parameters(data)
+                else:
+                    data.setIsClone("false")
+
+            # Security Domain
             if master['pki_subsystem'] != "CA" or\
                config.str2bool(master['pki_clone']) or\
                config.str2bool(master['pki_subordinate']):
                 # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
                 # CA Clone, KRA Clone, OCSP Clone, TKS Clone, or
                 # Subordinate CA
-                data.setSecurityDomainType(
-                    ConfigurationRequest.EXISTING_DOMAIN)
-                data.setSecurityDomainUri(
-                    master['pki_security_domain_uri'])
-                data.setSecurityDomainUser(
-                    master['pki_security_domain_user'])
-                data.setSecurityDomainPassword(
-                    sensitive['pki_security_domain_password'])
+                self.set_existing_security_domain(data)
             elif not config.str2bool(master['pki_external']):
                 # PKI CA
-                data.setSecurityDomainType(
-                    ConfigurationRequest.NEW_DOMAIN)
-                data.setSecurityDomainName(
-                    master['pki_security_domain_name'])
-            # Directory Server Information
+                self.set_new_security_domain(data)
+
             if master['pki_subsystem'] != "RA":
-                data.setDsHost(master['pki_ds_hostname'])
-                data.setDsPort(master['pki_ds_ldap_port'])
-                data.setBaseDN(master['pki_ds_base_dn'])
-                data.setBindDN(master['pki_ds_bind_dn'])
-                data.setDatabase(master['pki_ds_database'])
-                data.setBindpwd(sensitive['pki_ds_password'])
-                if config.str2bool(master['pki_ds_remove_data']):
-                    data.setRemoveData("true")
-                else:
-                    data.setRemoveData("false")
-                if config.str2bool(master['pki_ds_secure_connection']):
-                    data.setSecureConn("true")
-                else:
-                    data.setSecureConn("false")
-            # Backup Information
+                self.set_database_parameters(data)
+
             if master['pki_instance_type'] == "Tomcat":
-                if config.str2bool(master['pki_backup_keys']):
-                    data.setBackupKeys("true")
-                    data.setBackupFile(master['pki_backup_keys_p12'])
-                    data.setBackupPassword(
-                        sensitive['pki_backup_password'])
-                else:
-                    data.setBackupKeys("false")
-            # Admin Information
-            if master['pki_instance_type'] == "Tomcat":
-                if not config.str2bool(master['pki_clone']):
-                    data.setAdminEmail(master['pki_admin_email'])
-                    data.setAdminName(master['pki_admin_name'])
-                    data.setAdminPassword(sensitive['pki_admin_password'])
-                    data.setAdminProfileID(master['pki_admin_profile_id'])
-                    data.setAdminUID(master['pki_admin_uid'])
-                    data.setAdminSubjectDN(master['pki_admin_subject_dn'])
-                    if master['pki_admin_cert_request_type'] == "crmf":
-                        data.setAdminCertRequestType("crmf")
-                        if config.str2bool(master['pki_admin_dualkey']):
-                            crmf_request = generateCRMFRequest(
-                                               token,
-                                               master['pki_admin_keysize'],
-                                               master['pki_admin_subject_dn'],
-                                               "true")
-                        else:
-                            crmf_request = generateCRMFRequest(
-                                               token,
-                                               master['pki_admin_keysize'],
-                                               master['pki_admin_subject_dn'],
-                                               "false")
-                        data.setAdminCertRequest(crmf_request)
-                    else:
-                        javasystem.out.println(log.PKI_JYTHON_CRMF_SUPPORT_ONLY)
-                        javasystem.exit(1)
+                self.set_backup_parameters(data)
+
+            if not config.str2bool(master['pki_clone']):
+                self.set_admin_parameters(token, data)
+
             # Issuing CA Information
             if master['pki_subsystem'] != "CA" or\
                config.str2bool(master['pki_clone']) or\
@@ -422,154 +430,60 @@ class rest_client:
                 # CA Clone, KRA Clone, OCSP Clone, TKS Clone,
                 # Subordinate CA, or External CA
                 data.setIssuingCA(master['pki_issuing_ca'])
+
             # Create system certs
             systemCerts = ArrayList()
+
             # Create 'CA Signing Certificate'
-            if master['pki_instance_type'] == "Tomcat":
+            if master['pki_subsystem'] == "CA":
                 if not config.str2bool(master['pki_clone']):
-                    if master['pki_subsystem'] == "CA":
-                        # External CA, Subordinate CA, or PKI CA
-                        cert1 = SystemCertData()
-                        cert1.setTag(master['pki_ca_signing_tag'])
-                        cert1.setKeyAlgorithm(
-                            master['pki_ca_signing_key_algorithm'])
-                        cert1.setKeySize(master['pki_ca_signing_key_size'])
-                        cert1.setKeyType(master['pki_ca_signing_key_type'])
-                        cert1.setNickname(master['pki_ca_signing_nickname'])
-                        cert1.setSigningAlgorithm(
-                            master['pki_ca_signing_signing_algorithm'])
-                        cert1.setSubjectDN(master['pki_ca_signing_subject_dn'])
-                        cert1.setToken(master['pki_ca_signing_token'])
-                        systemCerts.add(cert1)
+                    cert = self.create_system_cert("ca_signing")
+                    cert.setSigningAlgorithm(
+                        master['pki_ca_signing_signing_algorithm'])
+                    systemCerts.add(cert)
+
             # Create 'OCSP Signing Certificate'
-            if master['pki_instance_type'] == "Tomcat":
-                if not config.str2bool(master['pki_clone']):
-                    if master['pki_subsystem'] == "CA" or\
-                       master['pki_subsystem'] == "OCSP":
-                        # External CA, Subordinate CA, PKI CA, or PKI OCSP
-                        cert2 = SystemCertData()
-                        cert2.setTag(master['pki_ocsp_signing_tag'])
-                        cert2.setKeyAlgorithm(
-                            master['pki_ocsp_signing_key_algorithm'])
-                        cert2.setKeySize(master['pki_ocsp_signing_key_size'])
-                        cert2.setKeyType(master['pki_ocsp_signing_key_type'])
-                        cert2.setNickname(master['pki_ocsp_signing_nickname'])
-                        cert2.setSigningAlgorithm(
-                            master['pki_ocsp_signing_signing_algorithm'])
-                        cert2.setSubjectDN(
-                            master['pki_ocsp_signing_subject_dn'])
-                        cert2.setToken(master['pki_ocsp_signing_token'])
-                        systemCerts.add(cert2)
+            if not config.str2bool(master['pki_clone']):
+                if master['pki_subsystem'] == "CA" or\
+                   master['pki_subsystem'] == "OCSP":
+                    # External CA, Subordinate CA, PKI CA, or PKI OCSP
+                    cert2 = self.create_system_cert("ocsp_signing")
+                    cert2.setSigningAlgorithm(
+                        master['pki_ocsp_signing_signing_algorithm'])
+                    systemCerts.add(cert2)
+
             # Create 'SSL Server Certificate'
-            #     PKI RA, PKI TPS,
-            #     PKI CA, PKI KRA, PKI OCSP, PKI TKS,
-            #     PKI CA CLONE, PKI KRA CLONE, PKI OCSP CLONE, PKI TKS CLONE,
-            #     External CA, or Subordinate CA
-            cert3 = SystemCertData()
-            cert3.setTag(master['pki_ssl_server_tag'])
-            cert3.setKeyAlgorithm(master['pki_ssl_server_key_algorithm'])
-            cert3.setKeySize(master['pki_ssl_server_key_size'])
-            cert3.setKeyType(master['pki_ssl_server_key_type'])
-            cert3.setNickname(master['pki_ssl_server_nickname'])
-            cert3.setSubjectDN(master['pki_ssl_server_subject_dn'])
-            cert3.setToken(master['pki_ssl_server_token'])
+            # all subsystems
+            cert3 = self.create_system_cert("ssl_server")
             systemCerts.add(cert3)
+
             # Create 'Subsystem Certificate'
-            if master['pki_instance_type'] == "Apache":
-                # PKI RA or PKI TPS
-                cert4 = SystemCertData()
-                cert4.setTag(master['pki_subsystem_tag'])
-                cert4.setKeyAlgorithm(master['pki_subsystem_key_algorithm'])
-                cert4.setKeySize(master['pki_subsystem_key_size'])
-                cert4.setKeyType(master['pki_subsystem_key_type'])
-                cert4.setNickname(master['pki_subsystem_nickname'])
-                cert4.setSubjectDN(master['pki_subsystem_subject_dn'])
-                cert4.setToken(master['pki_subsystem_token'])
+            if not config.str2bool(master['pki_clone']):
+                cert4 = self.create_system_cert("subsystem")
                 systemCerts.add(cert4)
-            elif master['pki_instance_type'] == "Tomcat":
-                if not config.str2bool(master['pki_clone']):
-                    # PKI CA, PKI KRA, PKI OCSP, PKI TKS,
-                    # External CA, or Subordinate CA
-                    cert4 = SystemCertData()
-                    cert4.setTag(master['pki_subsystem_tag'])
-                    cert4.setKeyAlgorithm(master['pki_subsystem_key_algorithm'])
-                    cert4.setKeySize(master['pki_subsystem_key_size'])
-                    cert4.setKeyType(master['pki_subsystem_key_type'])
-                    cert4.setNickname(master['pki_subsystem_nickname'])
-                    cert4.setSubjectDN(master['pki_subsystem_subject_dn'])
-                    cert4.setToken(master['pki_subsystem_token'])
-                    systemCerts.add(cert4)
+
             # Create 'Audit Signing Certificate'
-            if master['pki_instance_type'] == "Apache":
+            if not config.str2bool(master['pki_clone']):
                 if master['pki_subsystem'] != "RA":
-                    # PKI TPS
-                    cert5 = SystemCertData()
-                    cert5.setTag(master['pki_audit_signing_tag'])
-                    cert5.setKeyAlgorithm(
-                        master['pki_audit_signing_key_algorithm'])
-                    cert5.setKeySize(master['pki_audit_signing_key_size'])
-                    cert5.setKeyType(master['pki_audit_signing_key_type'])
-                    cert5.setNickname(master['pki_audit_signing_nickname'])
-                    cert5.setKeyAlgorithm(
+                    cert5 = self.create_system_cert("audit_signing")
+                    cert5.setSigningAlgorithm(
                         master['pki_audit_signing_signing_algorithm'])
-                    cert5.setSubjectDN(master['pki_audit_signing_subject_dn'])
-                    cert5.setToken(master['pki_audit_signing_token'])
                     systemCerts.add(cert5)
-            elif master['pki_instance_type'] == "Tomcat":
-                if not config.str2bool(master['pki_clone']):
-                    # PKI CA, PKI KRA, PKI OCSP, PKI TKS,
-                    # External CA, or Subordinate CA
-                    cert5 = SystemCertData()
-                    cert5.setTag(master['pki_audit_signing_tag'])
-                    cert5.setKeyAlgorithm(
-                        master['pki_audit_signing_key_algorithm'])
-                    cert5.setKeySize(master['pki_audit_signing_key_size'])
-                    cert5.setKeyType(master['pki_audit_signing_key_type'])
-                    cert5.setNickname(master['pki_audit_signing_nickname'])
-                    cert5.setKeyAlgorithm(
-                        master['pki_audit_signing_signing_algorithm'])
-                    cert5.setSubjectDN(master['pki_audit_signing_subject_dn'])
-                    cert5.setToken(master['pki_audit_signing_token'])
-                    systemCerts.add(cert5)
-            # Create 'DRM Transport Certificate'
-            if master['pki_instance_type'] == "Tomcat":
-                if not config.str2bool(master['pki_clone']):
-                    if master['pki_subsystem'] == "KRA":
-                        # PKI KRA
-                        cert6 = SystemCertData()
-                        cert6.setTag(master['pki_transport_tag'])
-                        cert6.setKeyAlgorithm(
-                            master['pki_transport_key_algorithm'])
-                        cert6.setKeySize(master['pki_transport_key_size'])
-                        cert6.setKeyType(master['pki_transport_key_type'])
-                        cert6.setNickname(master['pki_transport_nickname'])
-                        cert6.setKeyAlgorithm(
-                            master['pki_transport_signing_algorithm'])
-                        cert6.setSubjectDN(master['pki_transport_subject_dn'])
-                        cert6.setToken(master['pki_transport_token'])
-                        systemCerts.add(cert6)
-            # Create 'DRM Storage Certificate'
-            if master['pki_instance_type'] == "Tomcat":
-                if not config.str2bool(master['pki_clone']):
-                    if master['pki_subsystem'] == "KRA":
-                        # PKI KRA
-                        cert7 = SystemCertData()
-                        cert7.setTag(master['pki_storage_tag'])
-                        cert7.setKeyAlgorithm(
-                            master['pki_storage_key_algorithm'])
-                        cert7.setKeySize(master['pki_storage_key_size'])
-                        cert7.setKeyType(master['pki_storage_key_type'])
-                        cert7.setNickname(master['pki_storage_nickname'])
-                        cert7.setKeyAlgorithm(
-                            master['pki_storage_signing_algorithm'])
-                        cert7.setSubjectDN(master['pki_storage_subject_dn'])
-                        cert7.setToken(master['pki_storage_token'])
-                        systemCerts.add(cert7)
-            # Create system certs
+
+            # Create DRM Transport and storage Certificates
+            if not config.str2bool(master['pki_clone']):
+                if master['pki_subsystem'] == "KRA":
+                    cert6 = self.create_system_cert("transport")
+                    systemCerts.add(cert6)
+
+                    cert7 = self.create_system_cert("storage")
+                    systemCerts.add(cert7)
+
             data.setSystemCerts(systemCerts)
         return data
 
-    def configure_pki_data(self, data, master, sensitive):
+    def configure_pki_data(self, data):
+        master = self.master
         if master['pki_jython_log_level'] >= config.PKI_JYTHON_INFO_LOG_LEVEL:
             print "%s %s '%s'" %\
                   (log.PKI_JYTHON_INDENTATION_2,
-- 
1.7.11.4

