Re: [Pki-devel] [PATCH] 778 Fixed KRA cloning issue.
On 06/21/2016 01:03 PM, Endi Sukma Dewata wrote:
The pki pkcs12-import CLI has been modified not to import
certificates that already exist in the NSS database unless
specifically requested with the --overwrite parameter. This
will avoid changing the trust flags of the CA signing
certificate during KRA cloning.
The some other classes have been modified to provide better
debugging information.
https://fedorahosted.org/pki/ticket/2374
_______________________________________________
Pki-devel mailing list
Pki-devel(a)redhat.com
https://www.redhat.com/mailman/listinfo/pki-devel
Ran the following test:
Steps to reproduce:
1. Install CA and KRA on master:
$ ipa-server-install -U -r EXAMPLE.COM -p Secret123 -a Secret123
$ ipa-kra-install -p Secret123
2. Install CA and KRA on replica:
$ ipa-client-install -U --server server.example.com --domain example.com \
--realm EXAMPLE.COM -p admin -w Secret123
$ echo Secret123 | kinit admin
$ ipa-replica-install -U --setup-ca -p Secret123 -w Secret123
$ ipa-kra-install -p Secret123
Actual result: Success! The KRA installation on replica succeeded!
ACK
Attachments:
- attachment.html (text/html — 2.7 KB)