Re: [Pki-devel] [PATCH] 0113..0114 Lightweight CAs: renewal support
On 5/17/2016 12:26 AM, Fraser Tweedale wrote:
Attached patches implement LWCA renewal support
(https://fedorahosted.org/pki/ticket/2327).
It includes REST API
POST /ca/rest/authorities/<id>/renew
But not implemented in CLI tool yet. If we decide to make it a
first-class CLI feature (cf certmonger, IPA, etc managing the
renewal) then I'll file the ticket and implement it at that time.
Cheers,
Fraser
Some comments:
1. This is related to patch #111 too. Suppose an authority is
added/deleted/renewed in one replica while another replica is down, when
the second replica is brought back up will it know that it's missing the
changes and be able to update the NSSDB accordingly?
I'm thinking when the server is started there should be a process to
synchronize the NSSDB with the authorities in LDAP. Do we have something
like that already, or is this not an issue?
2. The locale object for the RenewalProcessor should be obtained from
the client, not from the server. See PKIService.getLocale(). In this
case you probably need to pass HttpServletRequest to the renewAuthority().
3. The HttpServletRequest can be used to call processRenewal() as well.
I think #1 can be done separately later. The patches are ACKed assuming
#2 and #3 are addressed.
--
Endi S. Dewata