From bc12765d512dbcb074edfeb12ef7c15b190bd9ea Mon Sep 17 00:00:00 2001
From: Abhishek Koneru <akoneru@redhat.com>
Date: Fri, 15 Mar 2013 11:41:40 -0400
Subject: [PATCH]    Minor fixes to pkispawn man page, updating the sample
 configuration file entries in default CA and subordinate CA
 installation.    Added sample configuration files for each
 installation type mentioned in the man page.

   #Tickets 509, 525
---
 base/deploy/config/sample.cfg                         |    3 ++-
 base/deploy/config/sampleCAclone.cfg                  |   16 ++++++++++++++++
 .../{sample.cfg => sampleExternalSignedCA-step1.cfg}  |    5 +++++
 base/deploy/config/sampleExternalSignedCA-step2.cfg   |   13 +++++++++++++
 base/deploy/config/sampleKRA-OCSP-TKSclone.cfg        |   17 +++++++++++++++++
 base/deploy/config/sampleKRA-OCSP-TKSwithRemoteCA.cfg |   13 +++++++++++++
 base/deploy/config/sampleSubordinateCA.cfg            |   14 ++++++++++++++
 base/deploy/man/man8/pkispawn.8                       |    4 ++--
 8 files changed, 82 insertions(+), 3 deletions(-)
 create mode 100644 base/deploy/config/sampleCAclone.cfg
 copy base/deploy/config/{sample.cfg => sampleExternalSignedCA-step1.cfg} (63%)
 create mode 100644 base/deploy/config/sampleExternalSignedCA-step2.cfg
 create mode 100644 base/deploy/config/sampleKRA-OCSP-TKSclone.cfg
 create mode 100644 base/deploy/config/sampleKRA-OCSP-TKSwithRemoteCA.cfg
 create mode 100644 base/deploy/config/sampleSubordinateCA.cfg

diff --git a/base/deploy/config/sample.cfg b/base/deploy/config/sample.cfg
index a4a6f68c279be87fba180a336ebcd9c5c3c7698f..c535c279d84ffe9edbe0189541a9922e82366386 100644
--- a/base/deploy/config/sample.cfg
+++ b/base/deploy/config/sample.cfg
@@ -3,4 +3,5 @@ pki_admin_password=
 pki_backup_password=
 pki_client_pkcs12_password=
 pki_ds_password=
-pki_security_domain_password=
+##Required only in default KRA or OCSP or TKS subsystem installation
+#pki_security_domain_password=
diff --git a/base/deploy/config/sampleCAclone.cfg b/base/deploy/config/sampleCAclone.cfg
new file mode 100644
index 0000000000000000000000000000000000000000..afacc64a20680b811603a9dbc4374f2094881d47
--- /dev/null
+++ b/base/deploy/config/sampleCAclone.cfg
@@ -0,0 +1,16 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+
+[CA]
+pki_clone=True
+pki_clone_pkcs12_password=
+pki_clone_pkcs12_path=
+pki_clone_replicate_schema=
+pki_clone_uri=
\ No newline at end of file
diff --git a/base/deploy/config/sample.cfg b/base/deploy/config/sampleExternalSignedCA-step1.cfg
similarity index 63%
copy from base/deploy/config/sample.cfg
copy to base/deploy/config/sampleExternalSignedCA-step1.cfg
index a4a6f68c279be87fba180a336ebcd9c5c3c7698f..7b72e5f839a522261d76220fc865d5d53cc26d27 100644
--- a/base/deploy/config/sample.cfg
+++ b/base/deploy/config/sampleExternalSignedCA-step1.cfg
@@ -4,3 +4,8 @@ pki_backup_password=
 pki_client_pkcs12_password=
 pki_ds_password=
 pki_security_domain_password=
+
+[CA]
+pki_external=True
+pki_external_csr_path=
+pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/deploy/config/sampleExternalSignedCA-step2.cfg b/base/deploy/config/sampleExternalSignedCA-step2.cfg
new file mode 100644
index 0000000000000000000000000000000000000000..b90d301c3096b4d213163a99c816ebb0a42a56d7
--- /dev/null
+++ b/base/deploy/config/sampleExternalSignedCA-step2.cfg
@@ -0,0 +1,13 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+
+[CA]
+pki_external=True
+pki_external_ca_cert_chain_path=
+pki_external_ca_cert_path=
+pki_external_step_two=True
+pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/deploy/config/sampleKRA-OCSP-TKSclone.cfg b/base/deploy/config/sampleKRA-OCSP-TKSclone.cfg
new file mode 100644
index 0000000000000000000000000000000000000000..683e508c798d76d48be5030e3c7788d4ba6e2d7b
--- /dev/null
+++ b/base/deploy/config/sampleKRA-OCSP-TKSclone.cfg
@@ -0,0 +1,17 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+
+[KRA/OCSP/TKS]
+pki_clone=True
+pki_clone_pkcs12_password=
+pki_clone_pkcs12_path=
+pki_clone_replicate_schema=
+pki_clone_uri=
+pki_issuing_ca=
\ No newline at end of file
diff --git a/base/deploy/config/sampleKRA-OCSP-TKSwithRemoteCA.cfg b/base/deploy/config/sampleKRA-OCSP-TKSwithRemoteCA.cfg
new file mode 100644
index 0000000000000000000000000000000000000000..fe56bd250f53cd3d6566d6c35342afb65991585f
--- /dev/null
+++ b/base/deploy/config/sampleKRA-OCSP-TKSwithRemoteCA.cfg
@@ -0,0 +1,13 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+pki_issuing_ca_uri=
+
+[KRA/OCSP/TKS]
+pki_import_admin_cert=
\ No newline at end of file
diff --git a/base/deploy/config/sampleSubordinateCA.cfg b/base/deploy/config/sampleSubordinateCA.cfg
new file mode 100644
index 0000000000000000000000000000000000000000..e42a42ff8b48cb8b28ade80e0c394335a4858c47
--- /dev/null
+++ b/base/deploy/config/sampleSubordinateCA.cfg
@@ -0,0 +1,14 @@
+[DEFAULT]
+pki_admin_password=
+pki_backup_password=
+pki_client_pkcs12_password=
+pki_ds_password=
+pki_security_domain_password=
+pki_security_domain_hostname=
+pki_security_domain_https_port=
+pki_security_domain_user=
+
+[CA]
+pki_subordinate=True
+pki_issuing_ca=
+pki_ca_signing_subject_dn=
\ No newline at end of file
diff --git a/base/deploy/man/man8/pkispawn.8 b/base/deploy/man/man8/pkispawn.8
index c5361c3b0a31aefc884e23a71f5feff96474013d..042ca4f9e2ef711856512b1beae9f6775a7f97c6 100644
--- a/base/deploy/man/man8/pkispawn.8
+++ b/base/deploy/man/man8/pkispawn.8
@@ -94,7 +94,6 @@ pki_admin_password=\fIpassword123\fP
 pki_backup_password=\fIpassword123\fP
 pki_client_pkcs12_password=\fIpassword123\fP
 pki_ds_password=\fIpassword123\fP
-pki_security_domain_password=\fIpassword123\fP
 .fi
 .PP
 Prior to running this command, a Directory Server instance should be created and running. This command assumes that the Directory Server instance is using its default configuration:
@@ -115,7 +114,7 @@ To access the agent pages, first import the CA certificate by accessing the CA E
 .SS KRA, OCSP, or TKS using default configuration
 \x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
 .PP
-where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP is the same as the one used for the default CA example.  This command should be run after a CA is installed.  This installs another subsystem within the same default instance using the certificate generated for the CA administrator for the subsystem's administrator.  This allows a user to access both subsystems on the browser with a single administrator certificate.  To access the new subsystem's functionality, simply point the browser to https://<hostname>:8443 and click the relevant top-level links.
+where subsystem is KRA, OCSP, or TKS, and \fImyconfig.txt\fP is the same as the one used for the default CA example with an additional entry, \fBpki_security_domain_password\fP whick is the administrator password of the CA in the same default instance, in the [DEFAULT] section.  This command should be run after a CA is installed.  This installs another subsystem within the same default instance using the certificate generated for the CA administrator for the subsystem's administrator.  This allows a user to access both subsystems on the browser with a single administrator certificate.  To access the new subsystem's functionality, simply point the browser to https://<hostname>:8443 and click the relevant top-level links.
 .SS KRA, OCSP, or TKS connecting to a remote CA
 \x'-1'\fBpkispawn -s <subsystem> -f myconfig.txt\fR
 .PP
@@ -217,6 +216,7 @@ pki_security_domain_user=caadmin
 [CA]
 pki_subordinate=True
 pki_issuing_ca=https://<master_ca_hostname>:<master_ca_https_port>
+pki_ca_signing_subject_dn=pki_ca_signing_subject_dn=cn=CA Signing Certificate,ou=Subordinate,o=example.com
 .fi
 .PP
 A sub-CA derives its certificate configuration -- such as allowed extensions and validity periods -- from a superior or root CA. Otherwise, the configuration of the CA is independent of the root CA, so it is its own instance rather than a clone. A sub-CA is configured using the pki_subordinate parameter and a pointer to the CA which issues the sub-CA's certificates.
-- 
1.7.10.2

