>From fd78b7a37d506e98e63111999e3a0dca5ec5ee83 Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Mon, 18 Mar 2013 11:29:52 -0400
Subject: [PATCH] Refactor installation code to remove dependency on jython

Connection is now made to the installation servlet through a python
client using JSON.  The code to construct the ConfgurationRequest and
parse the results has been moved to pkihelper.py, and configuration.py
no longer calls a separate jython process to create the Configuration
object and parse the results.  The jython code has therefore been removed.

Trac Ticket 532
---
 .../cms/servlet/test/ConfigurationTest.java        |  17 +-
 base/common/python/pki/client.py                   |  11 +-
 base/common/python/pki/encoder.py                  |  32 +
 base/common/python/pki/system.py                   |  32 +
 .../certsrv/system/ConfigurationRequest.java       |  11 +-
 .../certsrv/system/ConfigurationResponse.java      |   8 +-
 .../cms/servlet/csadmin/SystemCertDataFactory.java |   5 +-
 base/deploy/CMakeLists.txt                         |   2 -
 base/deploy/etc/default.cfg                        |   2 +-
 base/deploy/src/scriptlets/configuration.jy        | 111 ----
 base/deploy/src/scriptlets/configuration.py        |  36 +-
 base/deploy/src/scriptlets/finalization.py         |   2 +-
 base/deploy/src/scriptlets/instance_layout.py      |   2 +-
 base/deploy/src/scriptlets/pkiconfig.py            |  10 -
 base/deploy/src/scriptlets/pkihelper.py            | 681 ++++++++++++++++++---
 base/deploy/src/scriptlets/pkijython.py            | 667 --------------------
 base/deploy/src/scriptlets/pkimessages.py          |  67 +-
 base/deploy/src/scriptlets/pkiparser.py            |  24 +-
 base/deploy/src/scriptlets/security_databases.py   |   4 +-
 base/deploy/src/scriptlets/selinux_setup.py        |   4 +-
 specs/pki-core.spec                                |   6 +-
 21 files changed, 775 insertions(+), 959 deletions(-)
 create mode 100644 base/common/python/pki/encoder.py
 delete mode 100644 base/deploy/src/scriptlets/configuration.jy
 delete mode 100644 base/deploy/src/scriptlets/pkijython.py

diff --git a/base/common/functional/src/com/netscape/cms/servlet/test/ConfigurationTest.java b/base/common/functional/src/com/netscape/cms/servlet/test/ConfigurationTest.java
index c230815133e006cb85af17885a586a377f4119ac..25840cb3fbbfee0aefeb1eb6491b572b4bbc22a2 100644
--- a/base/common/functional/src/com/netscape/cms/servlet/test/ConfigurationTest.java
+++ b/base/common/functional/src/com/netscape/cms/servlet/test/ConfigurationTest.java
@@ -27,6 +27,7 @@ import java.security.NoSuchAlgorithmException;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Iterator;
+import java.util.List;
 
 import netscape.security.x509.X500Name;
 
@@ -279,7 +280,7 @@ public class ConfigurationTest {
         data.setAdminCertRequestType("crmf");
 
         // create system certs
-        Collection<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
+        List<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
         SystemCertData cert1 = new SystemCertData();
         cert1.setTag("signing");
         cert1.setKeyAlgorithm("SHA256withRSA");
@@ -383,7 +384,7 @@ public class ConfigurationTest {
         data.setIssuingCA("https://" + host + ":9224");
 
         // create system certs
-        Collection<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
+        List<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
         SystemCertData cert1 = new SystemCertData();
         cert1.setTag("signing");
         cert1.setKeyAlgorithm("SHA256withRSA");
@@ -485,7 +486,7 @@ public class ConfigurationTest {
         data.setIssuingCA("External CA");
 
         // create system certs
-        Collection<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
+        List<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
         SystemCertData cert1 = new SystemCertData();
         cert1.setTag("signing");
         cert1.setKeyAlgorithm("SHA256withRSA");
@@ -588,7 +589,7 @@ public class ConfigurationTest {
         data.setStepTwo("true");
 
         // create system certs
-        Collection<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
+        List<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
         SystemCertData cert1 = new SystemCertData();
         cert1.setTag("signing");
         cert1.setKeyAlgorithm("SHA256withRSA");
@@ -695,7 +696,7 @@ public class ConfigurationTest {
         data.setBackupKeys("false");
 
         // create system certs
-        Collection<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
+        List<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
         SystemCertData cert3 = new SystemCertData();
         cert3.setTag("sslserver");
         cert3.setKeyAlgorithm("SHA256withRSA");
@@ -754,7 +755,7 @@ public class ConfigurationTest {
         data.setIssuingCA("https://" + host + ":9224");
 
         // create system certs
-        Collection<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
+        List<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
         SystemCertData cert1 = new SystemCertData();
         cert1.setTag("transport");
         cert1.setKeyAlgorithm("SHA256withRSA");
@@ -857,7 +858,7 @@ public class ConfigurationTest {
         data.setIssuingCA("https://" + host + ":9224");
 
         // create system certs
-        Collection<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
+        List<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
         SystemCertData cert1 = new SystemCertData();
         cert1.setTag("signing");
         cert1.setKeyAlgorithm("SHA256withRSA");
@@ -949,7 +950,7 @@ public class ConfigurationTest {
         data.setIssuingCA("https://" + host + ":9224");
 
         // create system certs
-        Collection<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
+        List<SystemCertData> systemCerts = new ArrayList<SystemCertData>();
 
         SystemCertData cert3 = new SystemCertData();
         cert3.setTag("sslserver");
diff --git a/base/common/python/pki/client.py b/base/common/python/pki/client.py
index 7635fe8797b422f5fbc36b244435a06e74b2852b..43b78e1af2760b62e8567a6beb2230701bb61db9 100644
--- a/base/common/python/pki/client.py
+++ b/base/common/python/pki/client.py
@@ -50,4 +50,13 @@ class PKIConnection:
             self.serverURI + '/rest/' + path,
             verify=False)
         r.raise_for_status()
-        return r
\ No newline at end of file
+        return r
+
+    def post(self, path, payload, headers):
+        r = self.session.post(
+                self.serverURI + '/rest/' + path,
+                verify=False,
+                data=payload,
+                headers=headers)
+        r.raise_for_status()
+        return r
diff --git a/base/common/python/pki/encoder.py b/base/common/python/pki/encoder.py
new file mode 100644
index 0000000000000000000000000000000000000000..56e0b0222a7d291b38a98fd48f4317c5ffcee72e
--- /dev/null
+++ b/base/common/python/pki/encoder.py
@@ -0,0 +1,32 @@
+import json
+import pki.system
+
+TYPES = { 'ConfigurationRequest': pki.system.ConfigurationRequest,
+          'ConfigurationResponse': pki.system.ConfigurationResponse }
+NOTYPES = { 'SystemCertData': pki.system.SystemCertData }
+
+class CustomTypeEncoder(json.JSONEncoder):
+    """A custom JSONEncoder class that knows how to encode core custom
+    objects.
+
+    Custom objects are encoded as JSON object literals (ie, dicts) with
+    one key, 'TypeName' where 'TypeName' is the actual name of the
+    type to which the object belongs.  That single key maps to another
+    object literal which is just the __dict__ of the object encoded."""
+
+    def default(self, obj):
+        for k, v in TYPES.items():
+            if isinstance(obj, v):
+                return { k: obj.__dict__ }
+        for k, v in NOTYPES.items():
+            if isinstance(obj, v):
+                return obj.__dict__
+        return json.JSONEncoder.default(self, obj)
+
+
+def CustomTypeDecoder(dct):
+    if len(dct) == 1:
+        type_name, value = dct.items()[0]
+        if type_name in TYPES:
+            return TYPES[type_name].from_dict(value)
+    return dct
diff --git a/base/common/python/pki/system.py b/base/common/python/pki/system.py
index f49cc402e7f7084210be6ba7c6990e6e0b50a177..51e899f98cfe828fb627450710d6d441611708b4 100644
--- a/base/common/python/pki/system.py
+++ b/base/common/python/pki/system.py
@@ -37,3 +37,35 @@ class SecurityDomainClient:
         info.name = j['DomainInfo']['@id']
 
         return info
+
+class ConfigurationRequest:
+
+    def __init__(self):
+        self.token = "Internal Key Storage Token"
+        self.isClone = "false"
+        self.secureConn = "off"
+        self.importAdminCert = "false"
+        self.generateServerCert = "true"
+        pass
+
+class ConfigurationResponse:
+
+    def __init__(self):
+        pass
+
+class SystemCertData:
+
+    def __init__(self):
+        pass
+
+class SystemConfigClient:
+
+    def __init__(self, connection):
+        self.connection = connection
+
+    def configure(self, data):
+        headers = {'Content-type': 'application/json',
+                   'Accept': 'application/json'}
+        r = self.connection.post('installer/configure', data, headers)
+        info = r.json()['ConfigurationResponse']
+        return info
diff --git a/base/common/src/com/netscape/certsrv/system/ConfigurationRequest.java b/base/common/src/com/netscape/certsrv/system/ConfigurationRequest.java
index 217f84b903f7890b02fe547f3bb37ec5e9848d70..170e1c031f042f6ae483c53d2382672b2d151c28 100644
--- a/base/common/src/com/netscape/certsrv/system/ConfigurationRequest.java
+++ b/base/common/src/com/netscape/certsrv/system/ConfigurationRequest.java
@@ -17,13 +17,12 @@
 // --- END COPYRIGHT BLOCK ---
 package com.netscape.certsrv.system;
 
-import java.util.Collection;
+import java.util.List;
 
 import javax.ws.rs.core.MultivaluedMap;
 import javax.xml.bind.annotation.XmlAccessType;
 import javax.xml.bind.annotation.XmlAccessorType;
 import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlElementRef;
 import javax.xml.bind.annotation.XmlRootElement;
 
 /**
@@ -158,8 +157,8 @@ public class ConfigurationRequest {
     @XmlElement
     protected String replicationSecurity;
 
-    @XmlElementRef
-    protected Collection<SystemCertData> systemCerts;
+    @XmlElement
+    protected List<SystemCertData> systemCerts;
 
     @XmlElement
     protected String issuingCA;
@@ -553,7 +552,7 @@ public class ConfigurationRequest {
      *
      * @return systemCerts
      */
-    public Collection<SystemCertData> getSystemCerts() {
+    public List<SystemCertData> getSystemCerts() {
         return systemCerts;
     }
 
@@ -561,7 +560,7 @@ public class ConfigurationRequest {
      *
      * @param systemCerts
      */
-    public void setSystemCerts(Collection<SystemCertData> systemCerts) {
+    public void setSystemCerts(List<SystemCertData> systemCerts) {
         this.systemCerts = systemCerts;
     }
 
diff --git a/base/common/src/com/netscape/certsrv/system/ConfigurationResponse.java b/base/common/src/com/netscape/certsrv/system/ConfigurationResponse.java
index 6d3275a518af9d6510667b612131a74bfce9e574..cdd9de205edbfaa1d8de8bcfbf8d8d1482743096 100644
--- a/base/common/src/com/netscape/certsrv/system/ConfigurationResponse.java
+++ b/base/common/src/com/netscape/certsrv/system/ConfigurationResponse.java
@@ -20,11 +20,11 @@ package com.netscape.certsrv.system;
 import java.security.cert.CertificateEncodingException;
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.List;
 
 import javax.xml.bind.annotation.XmlAccessType;
 import javax.xml.bind.annotation.XmlAccessorType;
 import javax.xml.bind.annotation.XmlElement;
-import javax.xml.bind.annotation.XmlElementRef;
 import javax.xml.bind.annotation.XmlRootElement;
 
 import netscape.security.x509.X509CertImpl;
@@ -39,8 +39,8 @@ import com.netscape.certsrv.apps.CMS;
 @XmlAccessorType(XmlAccessType.FIELD)
 public class ConfigurationResponse {
 
-    @XmlElementRef
-    protected Collection<SystemCertData> systemCerts;
+    @XmlElement
+    protected List<SystemCertData> systemCerts;
 
     @XmlElement
     protected SystemCertData adminCert;
@@ -63,7 +63,7 @@ public class ConfigurationResponse {
     /**
      * @param systemCerts the systemCerts to set
      */
-    public void setSystemCerts(Collection<SystemCertData> systemCerts) {
+    public void setSystemCerts(List<SystemCertData> systemCerts) {
         this.systemCerts = systemCerts;
     }
 
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/SystemCertDataFactory.java b/base/common/src/com/netscape/cms/servlet/csadmin/SystemCertDataFactory.java
index bd23c8f16bf6662d0567b50b1e42a812709a786b..aaaf17163bc32f9555c3cf258b86f36e1666415e 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/SystemCertDataFactory.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/SystemCertDataFactory.java
@@ -20,6 +20,7 @@ package com.netscape.cms.servlet.csadmin;
 
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.List;
 
 import com.netscape.certsrv.system.SystemCertData;
 
@@ -37,8 +38,8 @@ public class SystemCertDataFactory {
         return data;
     }
 
-    public static Collection<SystemCertData> create(Collection<Cert> certs) {
-        Collection<SystemCertData> result = new ArrayList<SystemCertData>();
+    public static List<SystemCertData> create(Collection<Cert> certs) {
+        List<SystemCertData> result = new ArrayList<SystemCertData>();
         for (Cert cert : certs) {
             result.add(create(cert));
         }
diff --git a/base/deploy/CMakeLists.txt b/base/deploy/CMakeLists.txt
index ff9d64545e650fd722273e4e7c5ab1355e9bf18b..8483482c29af44503a88850664b9886d74c4d90a 100644
--- a/base/deploy/CMakeLists.txt
+++ b/base/deploy/CMakeLists.txt
@@ -107,7 +107,6 @@ install(
 
 install(
     FILES
-        src/scriptlets/configuration.jy
         src/scriptlets/configuration.py
         src/scriptlets/finalization.py
         src/scriptlets/infrastructure_layout.py
@@ -115,7 +114,6 @@ install(
         src/scriptlets/instance_layout.py
         src/scriptlets/pkiconfig.py
         src/scriptlets/pkihelper.py
-        src/scriptlets/pkijython.py
         src/scriptlets/pkilogging.py
         src/scriptlets/pkimanifest.py
         src/scriptlets/pkimessages.py
diff --git a/base/deploy/etc/default.cfg b/base/deploy/etc/default.cfg
index 32e744762e7b66a34164d83fe874c7385448633d..e848363ab138653bb5fe627de8c3eb765dade264 100644
--- a/base/deploy/etc/default.cfg
+++ b/base/deploy/etc/default.cfg
@@ -67,7 +67,7 @@ destroy_scriplets=
 # pki_http_port=80
 
 pki_admin_cert_file=%(pki_client_dir)s/ca_admin.cert
-pki_admin_cert_request_type=crmf
+pki_admin_cert_request_type=pkcs10
 pki_admin_dualkey=False
 pki_admin_keysize=2048
 pki_admin_password=
diff --git a/base/deploy/src/scriptlets/configuration.jy b/base/deploy/src/scriptlets/configuration.jy
deleted file mode 100644
index d6af9b1ca83cad1627b250e1253a81a7060d84c1..0000000000000000000000000000000000000000
--- a/base/deploy/src/scriptlets/configuration.jy
+++ /dev/null
@@ -1,111 +0,0 @@
-#!/usr/bin/jython
-
-# System Python Imports
-import os
-import pickle
-import sys
-
-
-# PKI Python Imports
-import pkijython as jyutil
-import pkiconfig as config
-import pkimessages as log
-
-
-# System Java Imports
-from java.lang import System as javasystem
-
-
-# PKI Java Imports
-from com.netscape.certsrv.client import ClientConfig
-
-
-def main(argv):
-    rv = 0
-
-    # Import the master dictionary from 'pkispawn'
-    master = pickle.loads(argv[1])
-    sensitive_parameters = master['sensitive_parameters'].split()
-
-    # Optionally enable a java debugger (e. g. - 'eclipse'):
-    if config.str2bool(master['pki_enable_java_debugger']):
-        config.wait_to_attach_an_external_java_debugger()
-
-
-    # IMPORTANT:  Unfortunately, 'jython 2.2' does NOT support logging!
-    #
-    #             Until, and unless, 'jython 2.5' or later is used,
-    #             debugging will basically be limited to using 'print'
-    #             since creating a logging mechanism for 'jython 2.2'
-    #             would not make sense at this point in time, although
-    #             a 'customized' manual log process could be created.
-    #
-    #             Regardless of 'jython' version, the log file generated
-    #             by this standalone 'jython' process would be unique and
-    #             separate to the log file generated for the PKI
-    #             deployment scriptlets 'python' process, as they exist
-    #             as two separate processes (until and unless 'jython 2.7'
-    #             could be used to completely replace 'python 2.7',
-    #             in which case a single process could be executed
-    #             end-to-end from installation through configuration).
-    #
-    if master['pki_jython_log_level'] >= config.PKI_JYTHON_DEBUG_LOG_LEVEL:
-        # javasystem.out.println("Hello")
-        print "%s %s" %\
-              (log.PKI_JYTHON_INDENTATION_2, sys.path)
-        print "%s %s" %\
-              (log.PKI_JYTHON_INDENTATION_2,
-               javasystem.getProperties()['java.class.path'])
-        for key in master:
-            if key in sensitive_parameters:
-                value = 'XXXXXXXX'
-            else:
-                value = master[key]
-            print "%s '%s' = '%s'" %\
-                  (log.PKI_JYTHON_INDENTATION_2, key, value)
-
-    # Initialize token
-    jyutil.security_databases.initialize_token(
-        master['pki_client_database_dir'],
-        master['pki_jython_log_level'])
-
-    # Log into token
-    token = jyutil.security_databases.log_into_token(
-                master['pki_client_database_dir'],
-                master['pki_client_password_conf'],
-                master['pki_jython_log_level'])
-
-    # Setup connection parameters
-    client_config = ClientConfig()
-    client_config.setInstanceCreationMode(True)
-    client_config.setServerURI(master['pki_jython_base_uri'])
-
-    # Establish REST Client
-    client = jyutil.rest_client.initialize(
-                 client_config,
-                 master)
-
-    # Construct PKI Subsystem Configuration Data
-    data = None
-    if master['pki_instance_type'] == "Apache":
-        if master['pki_subsystem'] == "RA":
-            print "%s '%s' %s" %\
-                  (log.PKI_JYTHON_INDENTATION_2,
-                   master['pki_subsystem'],
-                   log.PKI_JYTHON_NOT_YET_IMPLEMENTED)
-            return rv
-        elif master['pki_subsystem'] == "TPS":
-            print "%s '%s' %s" %\
-                  (log.PKI_JYTHON_INDENTATION_2,
-                   master['pki_subsystem'],
-                   log.PKI_JYTHON_NOT_YET_IMPLEMENTED)
-            return rv
-    elif master['pki_instance_type'] == "Tomcat":
-        # PKI or Cloned CA, KRA, OCSP, or TKS, Subordinate CA, or External CA
-        data = jyutil.rest_client.construct_pki_configuration_data(token)
-
-    # Formulate PKI Subsystem Configuration Data Response
-    jyutil.rest_client.configure_pki_data(data)
-
-if __name__ == "__main__":
-    main(sys.argv)
diff --git a/base/deploy/src/scriptlets/configuration.py b/base/deploy/src/scriptlets/configuration.py
index 248a43cf75486ff08e49305af535c60a959ce217..05016d7878f34372ddccd0b7685ab146b88a9312 100644
--- a/base/deploy/src/scriptlets/configuration.py
+++ b/base/deploy/src/scriptlets/configuration.py
@@ -25,6 +25,9 @@ from pkiconfig import pki_master_dict as master
 import pkihelper as util
 import pkimessages as log
 import pkiscriptlet
+import json
+import pki.system
+import pki.encoder
 
 
 # PKI Deployment Configuration Scriptlet
@@ -85,16 +88,37 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 config.prepare_for_an_external_java_debugger(
                     master['pki_target_tomcat_conf_instance_id'])
             tomcat_instance_subsystems =\
-                util.instance.tomcat_instance_subsystems()
+                len(util.instance.tomcat_instance_subsystems())
             if tomcat_instance_subsystems == 1:
                 util.systemd.start()
             elif tomcat_instance_subsystems > 1:
                 util.systemd.restart()
 
-        # Pass control to the Java servlet via Jython 2.2 'configuration.jy'
-        util.jython.invoke(
-            master['pki_jython_configuration_scriptlet'],
-            master['resteasy_lib'])
+        # Optionally wait for debugger to attach (e. g. - 'eclipse'):
+        if config.str2bool(master['pki_enable_java_debugger']):
+            config.wait_to_attach_an_external_java_debugger()
+
+        # Construct PKI Subsystem Configuration Data
+        data = None
+        if master['pki_instance_type'] == "Apache":
+            if master['pki_subsystem'] == "RA":
+                config.pki_log.info(log.PKI_CONFIG_NOT_YET_IMPLEMENTED_1,
+                    master['pki_subsystem'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                return rv
+        elif master['pki_subsystem'] == "TPS":
+                config.pki_log.info(log.PKI_CONFIG_NOT_YET_IMPLEMENTED_1,
+                    master['pki_subsystem'],
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                return rv
+        elif master['pki_instance_type'] == "Tomcat":
+            # CA, KRA, OCSP, or TKS
+            data = util.config_client.construct_pki_configuration_data()
+        
+        # Configure the substem
+        util.config_client.configure_pki_data(
+            json.dumps(data, cls=pki.encoder.CustomTypeEncoder))
+
         return self.rv
 
     def respawn(self):
@@ -111,7 +135,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 util.directory.delete(master['pki_client_dir'])
             util.symlink.delete(master['pki_systemd_service_link'])
         elif master['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS and\
-             util.instance.tomcat_instance_subsystems() == 1:
+             len(util.instance.tomcat_instance_subsystems()) == 1:
             if util.directory.exists(master['pki_client_dir']):
                 util.directory.delete(master['pki_client_dir'])
             util.symlink.delete(master['pki_systemd_service_link'])
diff --git a/base/deploy/src/scriptlets/finalization.py b/base/deploy/src/scriptlets/finalization.py
index 8fe643e15f6c251e5be2fc128d402a13b361ce06..6ddc98d0361f6c2a978dba50081ae5e0fabceb95 100644
--- a/base/deploy/src/scriptlets/finalization.py
+++ b/base/deploy/src/scriptlets/finalization.py
@@ -105,7 +105,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
            util.instance.apache_instance_subsystems() >= 1:
             util.systemd.start()
         elif master['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS and\
-           util.instance.tomcat_instance_subsystems() >= 1:
+           len(util.instance.tomcat_instance_subsystems()) >= 1:
             util.systemd.start()
         config.pki_log.info(log.PKIDESTROY_END_MESSAGE_2,
                             master['pki_subsystem'],
diff --git a/base/deploy/src/scriptlets/instance_layout.py b/base/deploy/src/scriptlets/instance_layout.py
index 773305c139f4b62f73c17969e90ef097337a12b4..843227a84e981ac109890a8c3410ae4bec4b739e 100644
--- a/base/deploy/src/scriptlets/instance_layout.py
+++ b/base/deploy/src/scriptlets/instance_layout.py
@@ -170,7 +170,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
                 util.directory.delete(
                     master['pki_instance_type_registry_path'])
         elif master['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS and\
-             util.instance.tomcat_instance_subsystems() == 0:
+             len(util.instance.tomcat_instance_subsystems()) == 0:
             # remove Tomcat instance base
             util.directory.delete(master['pki_instance_path'])
             # remove Tomcat instance logs
diff --git a/base/deploy/src/scriptlets/pkiconfig.py b/base/deploy/src/scriptlets/pkiconfig.py
index 1a4c77cb1defed1b541f94c9d5d978d21caf54f8..ad6c2225116d6f95d85ceaa1b94e0a7a2cccd0fe 100644
--- a/base/deploy/src/scriptlets/pkiconfig.py
+++ b/base/deploy/src/scriptlets/pkiconfig.py
@@ -94,14 +94,6 @@ PKI_DEPLOYMENT_DEFAULT_TOMCAT_HTTPS_PORT = 8443
 PKI_DEPLOYMENT_DEFAULT_TOMCAT_SERVER_PORT = 8005
 PKI_DEPLOYMENT_DEFAULT_TOMCAT_AJP_PORT = 8009
 
-# PKI Deployment Jython 2.2 Constants
-PKI_JYTHON_CRITICAL_LOG_LEVEL = 1
-PKI_JYTHON_ERROR_LOG_LEVEL = 2
-PKI_JYTHON_WARNING_LOG_LEVEL = 3
-PKI_JYTHON_INFO_LOG_LEVEL = 4
-PKI_JYTHON_DEBUG_LOG_LEVEL = 5
-
-
 # PKI Deployment Global Variables
 pki_install_time = None
 pki_timestamp = None
@@ -173,7 +165,6 @@ def wait_to_attach_an_external_java_debugger():
 
 
 # PKI Deployment Logger Variables
-pki_jython_log_level = None
 pki_log = None
 pki_log_dir = None
 pki_log_name = None
@@ -184,7 +175,6 @@ pki_console_log_level = None
 # PKI Deployment Global Dictionaries
 pki_master_dict = {}
 pki_slots_dict = None
-pki_master_jython_dict = None
 
 # PKI Selinux Constants and parameters
 PKI_INSTANCE_SELINUX_CONTEXT = "pki_tomcat_var_lib_t"
diff --git a/base/deploy/src/scriptlets/pkihelper.py b/base/deploy/src/scriptlets/pkihelper.py
index 7eae9324d3e96521a914644bed94f5810fd5eeec..d663859f436692256f5dfaa214e03ef9a7966267 100644
--- a/base/deploy/src/scriptlets/pkihelper.py
+++ b/base/deploy/src/scriptlets/pkihelper.py
@@ -49,7 +49,9 @@ from pkiconfig import pki_selinux_config_ports as ports
 import pkimanifest as manifest
 import pkimessages as log
 from pkiparser import PKIConfigParser
-
+import pki.account
+import pki.client
+import pki.system
 
 # PKI Deployment Helper Functions
 def pki_copytree(src, dst, symlinks=False, ignore=None):
@@ -921,19 +923,15 @@ class instance:
         return rv
 
     def tomcat_instance_subsystems(self):
-        rv = 0
+        # Return list of PKI subsystems in the specified tomcat instance
+        rv = []
         try:
-            # count number of PKI subsystems present
-            # within the specified Tomcat instance
             for subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
                 path = master['pki_instance_path'] + "/" + subsystem.lower()
                 if os.path.exists(path) and os.path.isdir(path):
-                    rv = rv + 1
-            config.pki_log.debug(log.PKIHELPER_TOMCAT_INSTANCE_SUBSYSTEMS_2,
-                                 master['pki_instance_path'],
-                                 rv, extra=config.PKI_INDENTATION_LEVEL_2)
-        except OSError as exc:
-            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                    rv.append(subsystem)
+        except OSErr as e:
+            config.pki_log.error(log.PKI_OSERROR_1, str(e),
                                  extra=config.PKI_INDENTATION_LEVEL_2)
             sys.exit(1)
         return rv
@@ -2282,6 +2280,199 @@ class certutil:
                 sys.exit(1)
         return
 
+    def import_cert(self, nickname, trust, input_file, password_file,
+                    path=None, token=None, critical_failure=True):
+        try:
+            command = "certutil -A "
+            if path:
+                command = command + " -d " + path
+
+            if token:
+                command = command + " -h '" + token + "'"
+
+            if nickname:
+                command = command + " -n '" + nickname + "'"
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_NICKNAME,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+
+            if trust:
+                command = command + " -t '" + trust + "'"
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_TRUSTARGS,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+
+            if input_file:
+                command = command + " -i " + input_file
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_INPUT_FILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+
+            if password_file:
+                command = command + " -f " + password_file
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+
+            config.pki_log.debug("Executing: " + command, 
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            subprocess.call(command, shell=True)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure == True:
+                sys.exit(1)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure == True:
+                sys.exit(1)
+        return
+
+    def generate_certificate_request(self, subject, key_size,
+                                     password_file, noise_file,
+                                     output_file = None, path = None,
+                                     ascii_format = None, token = None,
+                                     critical_failure=True):
+        try:
+            command = "certutil -R"
+            if path:
+                command = command + " -d " + path
+            else:
+                command = command + " -d ."
+
+            if token:
+                command = command + " -h '" + token + "'"
+
+            if subject:
+                command = command + " -s '" + subject + "'"
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_SUBJECT,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+
+            if key_size:
+                command = command + " -g " + str(key_size)
+
+            if noise_file:
+                command = command + " -z " + noise_file
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_NOISE_FILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+
+            if password_file:
+                command = command + " -f " + password_file
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+
+            if output_file:
+                command = command + " -o " + output_file
+
+            # set acsii output
+            if ascii_format:
+                command = command + " -a"
+
+            # mask the command-line output of this command
+            command = command + " " + "> /dev/null 2>&1"
+
+            # Display this "certutil" command
+            config.pki_log.info(
+                log.PKIHELPER_CERTUTIL_GENERATE_CSR_1, command,
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            if not os.path.exists(noise_file):
+                config.pki_log.error(
+                    log.PKI_DIRECTORY_MISSING_OR_NOT_A_DIRECTORY_1,
+                    noise_file,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+            if not os.path.exists(password_file) or\
+               not os.path.isfile(password_file):
+                config.pki_log.error(
+                    log.PKI_FILE_MISSING_OR_NOT_A_FILE_1,
+                    password_file,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+            # Execute this "certutil" command
+            subprocess.call(command, shell=True)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure == True:
+                sys.exit(1)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure == True:
+                sys.exit(1)
+        return
+
+# pk12util class
+class pk12util:
+    def create_file(self, out_file, nickname, out_pwfile,
+                    db_pwfile, path=None):
+        try:
+            command = "pk12util "
+            if path:
+                command = command + " -d " + path
+            if out_file:
+                command = command + " -o " + out_file
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_PK12UTIL_MISSING_OUTFILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+            if nickname:
+                command = command + " -n \"" + nickname + "\""
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_PK12UTIL_MISSING_NICKNAME,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+            if out_pwfile:
+                command = command + " -w " + out_pwfile
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_PK12UTIL_MISSING_OUTPWFILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+            if db_pwfile:
+                command = command + " -k " + db_pwfile
+            else:
+                config.pki_log.error(
+                    log.PKIHELPER_PK12UTIL_MISSING_DBPWFILE,
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+                sys.exit(1)
+
+            config.pki_log.debug("Executing: " + command, 
+                    extra=config.PKI_INDENTATION_LEVEL_2)
+            subprocess.call(command, shell=True)
+        except subprocess.CalledProcessError as exc:
+            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure == True:
+                sys.exit(1)
+        except OSError as exc:
+            config.pki_log.error(log.PKI_OSERROR_1, exc,
+                                 extra=config.PKI_INDENTATION_LEVEL_2)
+            if critical_failure == True:
+                sys.exit(1)
+        return
+
+
 # KRA Connector Class
 class kra_connector:
     def deregister(self, critical_failure=False):
@@ -2748,73 +2939,418 @@ class systemd:
         return
 
 
-# PKI Deployment 'jython' Class
-class jython:
-    def invoke(self, scriptlet, resteasy_lib, critical_failure=True):
+class config_client:
+
+    def configure_pki_data(self, data):
+        config.pki_log.info(log.PKI_CONFIG_CONFIGURING_PKI_DATA,
+                             extra=config.PKI_INDENTATION_LEVEL_2)
+
+        self.connection = pki.client.PKIConnection(
+            protocol='https',
+            hostname=master['pki_hostname'],
+            port=master['pki_https_port'],
+            subsystem=master['pki_subsystem_type'])
+
         try:
-            # JSS JNI Jars
-            #
-            # NOTE:  Always load 64-bit JNI 'jss4.jar'
-            #        PRIOR to 32-bit JNI 'jss4.jar'
-            #
-            classpath = "/usr/lib64/java/jss4.jar" +\
-                ":/usr/lib/java/jss4.jar" +\
-                ":/usr/share/java/httpcomponents/httpclient.jar" +\
-                ":/usr/share/java/httpcomponents/httpcore.jar" +\
-                ":/usr/share/java/apache-commons-cli.jar" +\
-                ":/usr/share/java/apache-commons-codec.jar" +\
-                ":/usr/share/java/apache-commons-logging.jar" +\
-                ":/usr/share/java/istack-commons-runtime.jar" +\
-                ":/usr/share/java/glassfish-jaxb/jaxb-impl.jar" +\
-                ":/usr/share/java/scannotation.jar"
+            client = pki.system.SystemConfigClient(self.connection)
+            response = client.configure(data)
 
-            # RESTEasy Jars
-            classpath = classpath +\
-                ":" + resteasy_lib + "/jaxrs-api.jar" +\
-                ":" + resteasy_lib + "/resteasy-atom-provider.jar" +\
-                ":" + resteasy_lib + "/resteasy-jaxb-provider.jar" +\
-                ":" + resteasy_lib + "/resteasy-jaxrs.jar" +\
-                ":" + resteasy_lib + "/resteasy-jettison-provider.jar"
-
-            # PKI Jars
-            classpath = classpath +\
-                ":/usr/share/java/pki/pki-certsrv.jar" +\
-                ":/usr/share/java/pki/pki-client.jar" +\
-                ":/usr/share/java/pki/pki-cmsutil.jar" +\
-                ":/usr/share/java/pki/pki-nsutil.jar"
-
-            properties = ""
-
-            # From 'http://www.jython.org/archive/22/userfaq.html':
-            # Setting this to false will allow Jython to provide access to
-            # non-public fields, methods, and constructors of Java objects.
-            # properties = properties + " -Dpython.security.respectJavaAccessibility=false"
-
-            # Compose this "jython" command
-            data = pickle.dumps(master)
-            if master['pki_architecture'] == 64:
-                ld_library_path = "/usr/lib64/jss:/usr/lib64:/lib64:" +\
-                                  "/usr/lib/jss:/usr/lib:/lib"
-            else:
-                ld_library_path = "/usr/lib/jss:/usr/lib:/lib"
-            command = "export LD_LIBRARY_PATH=" + ld_library_path +\
-                ";export CLASSPATH=" + classpath +\
-                ";jython " + properties + " " + scriptlet
-            # Display this "jython" command
-            config.pki_log.info(
-                log.PKIHELPER_INVOKE_JYTHON_1,
-                command,
-                extra=config.PKI_INDENTATION_LEVEL_2)
-            # Invoke this "jython" command
-            subprocess.call(command + " \"" + data + "\"", shell=True)
-        except subprocess.CalledProcessError as exc:
-            config.pki_log.error(log.PKI_SUBPROCESS_ERROR_1, exc,
+            config.pki_log.debug(log.PKI_CONFIG_RESPONSE_STATUS +\
+                                   " " + str(response['status']),
                                  extra=config.PKI_INDENTATION_LEVEL_2)
-            if critical_failure == True:
-                sys.exit(1)
+            certs = response['systemCerts']
+            for cdata in certs:
+                if master['pki_subsystem'] == "CA" and\
+                   config.str2bool(master['pki_external']) and\
+                   not config.str2bool(master['pki_external_step_two']):
+                    # External CA Step 1
+                    if cdata['tag'].lower() == "signing":
+                        config.pki_log.info(log.PKI_CONFIG_CDATA_REQUEST +\
+                            " " + cdata['request'],
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+
+                        # Save 'External CA Signing Certificate' CSR (Step 1)
+                        config.pki_log.info(log.PKI_CONFIG_EXTERNAL_CSR_SAVE +\
+                            " '" + master['pki_external_csr_path'] + "'",
+                            extra=config.PKI_INDENTATION_LEVEL_2)
+                        directory.create(
+                            os.path.dirname(master['pki_external_csr_path']))
+                        f =  open(master['pki_external_csr_path'], "w")
+                        f.write(cdata['request'])
+                        f.close()
+                        return
+                else:
+                    config.pki_log.debug(log.PKI_CONFIG_CDATA_TAG +\
+                                           " " + cdata['tag'],
+                                         extra=config.PKI_INDENTATION_LEVEL_2)
+                    config.pki_log.debug(log.PKI_CONFIG_CDATA_CERT +\
+                                           " " + cdata['cert'],
+                                         extra=config.PKI_INDENTATION_LEVEL_2)
+                    config.pki_log.debug(log.PKI_CONFIG_CDATA_REQUEST +\
+                                           " " + cdata['request'],
+                                         extra=config.PKI_INDENTATION_LEVEL_2)
+
+            # Cloned PKI subsystems do not return an Admin Certificate
+            if not config.str2bool(master['pki_clone']) and \
+               not config.str2bool(master['pki_import_admin_cert']):
+                admin_cert = response['adminCert']['cert']
+                self.process_admin_cert(admin_cert)
+        except Exception, e:
+            config.pki_log.error(
+                log.PKI_CONFIG_JAVA_CONFIGURATION_EXCEPTION + " " + str(e),
+                extra=config.PKI_INDENTATION_LEVEL_2)
+            sys.exit(1)
         return
 
+    def process_admin_cert(self, admin_cert):
+        config.pki_log.debug(log.PKI_CONFIG_RESPONSE_ADMIN_CERT +\
+                             " " + admin_cert,
+                             extra=config.PKI_INDENTATION_LEVEL_2)
 
+        # Store the Administration Certificate in a file
+        admin_cert_file = master['pki_client_admin_cert']
+        admin_cert_bin_file = admin_cert_file + ".der"
+        config.pki_log.debug(log.PKI_CONFIG_ADMIN_CERT_SAVE +\
+                               " '" + admin_cert_file + "'",
+                             extra=config.PKI_INDENTATION_LEVEL_2)
+        f = open(admin_cert_file, "w")
+        f.write(admin_cert)
+        f.close()
+
+        # convert the cert file to binary
+        command = "AtoB "+ admin_cert_file + " " + admin_cert_bin_file
+        config.pki_log.debug(log.PKI_CONFIG_ADMIN_CERT_ATOB +\
+            " '" + command + "'",
+            extra=config.PKI_INDENTATION_LEVEL_2)
+        os.system(command)
+
+        os.chmod(admin_cert_file,
+                 config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS)
+
+        os.chmod(admin_cert_bin_file,
+                 config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS)
+
+        # Import the Administration Certificate
+        # into the client NSS security database
+        certutil.import_cert(
+            re.sub("&#39;", "'", master['pki_admin_nickname']),
+            "u,u,u",
+            admin_cert_bin_file,
+            master['pki_client_password_conf'],
+            master['pki_client_database_dir'],
+            None,
+            True)
+
+        # create directory for p12 file if it does not exist
+        directory.create(os.path.dirname(
+            master['pki_client_admin_cert_p12']))
+
+        # Export the Administration Certificate from the
+        # client NSS security database into a PKCS #12 file
+        pk12util.create_file(
+            master['pki_client_admin_cert_p12'],
+            re.sub("&#39;","'", master['pki_admin_nickname']),
+            master['pki_client_pkcs12_password_conf'],
+            master['pki_client_password_conf'],
+            master['pki_client_database_dir'])
+
+        os.chmod(master['pki_client_admin_cert_p12'],
+            config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
+
+        
+    def construct_pki_configuration_data(self):
+        config.pki_log.info(log.PKI_CONFIG_CONSTRUCTING_PKI_DATA,
+                             extra=config.PKI_INDENTATION_LEVEL_2)
+        
+        data = pki.system.ConfigurationRequest()
+
+        # Miscellaneous Configuration Information
+        data.pin = master['pki_one_time_pin']
+        data.subsystemName = master['pki_subsystem_name']
+
+        # Cloning parameters
+        if master['pki_instance_type'] == "Tomcat":
+            if config.str2bool(master['pki_clone']):
+                self.set_cloning_parameters(data)
+            else:
+                data.isClone = "false"
+
+        # Hierarchy
+        self.set_hierarchy_parameters(data)
+
+        # Security Domain
+        if master['pki_subsystem'] != "CA" or\
+           config.str2bool(master['pki_clone']) or\
+           config.str2bool(master['pki_subordinate']):
+            # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, or
+            # Subordinate CA
+            self.set_existing_security_domain(data)
+        else:
+            # PKI CA or External CA
+            self.set_new_security_domain(data)
+
+        # database 
+        if master['pki_subsystem'] != "RA":
+            self.set_database_parameters(data)
+
+        # backup
+        if master['pki_instance_type'] == "Tomcat":
+            self.set_backup_parameters(data)
+
+        # admin user 
+        if not config.str2bool(master['pki_clone']):
+            self.set_admin_parameters(data)
+
+        # Issuing CA Information
+        self.set_issuing_ca_parameters(data)
+
+        # Create system certs
+        self.set_system_certs(data)
+
+        return data
+
+    def set_system_certs(self, data):
+        systemCerts = []
+
+        # Create 'CA Signing Certificate'
+        if master['pki_subsystem'] == "CA":
+            if not config.str2bool(master['pki_clone']):
+                cert1 = self.create_system_cert("ca_signing")
+                cert1.signingAlgorithm =\
+                    master['pki_ca_signing_signing_algorithm']
+                if config.str2bool(master['pki_external_step_two']):
+                    # Load the 'External CA Signing Certificate' (Step 2)
+                    print(
+                        log.PKI_CONFIG_EXTERNAL_CA_LOAD + " " +\
+                        "'" + master['pki_external_ca_cert_path'] + "'")
+                    f = open(master['pki_external_ca_cert_path'])
+                    external_cert = f.read()
+                    f.close()
+                    cert1.cert = external_cert
+
+                    # Load the 'External CA Signing Certificate Chain' (Step 2)
+                    print(
+                        log.PKI_CONFIG_EXTERNAL_CA_CHAIN_LOAD + " " +\
+                        "'" + master['pki_external_ca_cert_chain_path'] +\
+                        "'")
+                    f = open(master['pki_external_ca_cert_chain_path'])
+                    external_cert_chain = f.read()
+                    f.close()
+
+                    cert1.certChain = external_cert_chain
+                systemCerts.append(cert1)
+
+        # Create 'OCSP Signing Certificate'
+        if not config.str2bool(master['pki_clone']):
+            if master['pki_subsystem'] == "CA" or\
+               master['pki_subsystem'] == "OCSP":
+                # External CA, Subordinate CA, PKI CA, or PKI OCSP
+                cert2 = self.create_system_cert("ocsp_signing")
+                cert2.signingAlgorithm =\
+                    master['pki_ocsp_signing_signing_algorithm']
+                systemCerts.append(cert2)
+
+        # Create 'SSL Server Certificate'
+        # all subsystems
+
+        # create new sslserver cert only if this is a new instance
+        cert3 = None
+        system_list = instance.tomcat_instance_subsystems()
+        if len(system_list) >= 2:
+            data.generateServerCert = "false"
+            for subsystem in system_list:
+                dst = master['pki_instance_path'] + '/conf/' +\
+                    subsystem.lower() + '/CS.cfg'
+                if subsystem != master['pki_subsystem'] and \
+                   os.path.exists(dst):
+                    cert3 = self.retrieve_existing_server_cert(dst)
+                    break
+        else:
+            cert3 = self.create_system_cert("ssl_server")
+        systemCerts.append(cert3)
+
+        # Create 'Subsystem Certificate'
+        if not config.str2bool(master['pki_clone']):
+            cert4 = self.create_system_cert("subsystem")
+            systemCerts.append(cert4)
+
+        # Create 'Audit Signing Certificate'
+        if not config.str2bool(master['pki_clone']):
+            if master['pki_subsystem'] != "RA":
+                cert5 = self.create_system_cert("audit_signing")
+                cert5.signingAlgorithm =\
+                    master['pki_audit_signing_signing_algorithm']
+                systemCerts.append(cert5)
+
+        # Create DRM Transport and storage Certificates
+        if not config.str2bool(master['pki_clone']):
+            if master['pki_subsystem'] == "KRA":
+                cert6 = self.create_system_cert("transport")
+                systemCerts.append(cert6)
+
+                cert7 = self.create_system_cert("storage")
+                systemCerts.append(cert7)
+
+        data.systemCerts = systemCerts
+
+    def set_cloning_parameters(self, data):
+        data.isClone = "true"
+        data.cloneUri = master['pki_clone_uri']
+        data.p12File = master['pki_clone_pkcs12_path']
+        data.p12Password = master['pki_clone_pkcs12_password']
+        data.replicateSchema = master['pki_clone_replicate_schema']
+        data.replicationSecurity =\
+            master['pki_clone_replication_security']
+        if master['pki_clone_replication_master_port']:
+            data.masterReplicationPort =\
+                master['pki_clone_replication_master_port']
+        if master['pki_clone_replication_clone_port']:
+            data.cloneReplicationPort =\
+                master['pki_clone_replication_clone_port']
+
+    def set_hierarchy_parameters(self, data):
+        if master['pki_subsystem'] == "CA":
+            if config.str2bool(master['pki_clone']):
+                # Cloned CA
+                data.hierarchy = "root"
+            elif config.str2bool(master['pki_external']):
+                # External CA
+                data.hierarchy = "join"
+            elif config.str2bool(master['pki_subordinate']):
+                # Subordinate CA
+                data.hierarchy = "join"
+            else:
+                # PKI CA
+                data.hierarchy = "root"
+
+    def set_existing_security_domain(self, data):
+        data.securityDomainType = "existingdomain"
+        data.securityDomainUri = master['pki_security_domain_uri']
+        data.securityDomainUser = master['pki_security_domain_user']
+        data.securityDomainPassword = master['pki_security_domain_password']
+
+    def set_new_security_domain(self, data):
+        data.securityDomainType = "newdomain"
+        data.securityDomainName = master['pki_security_domain_name']
+
+    def set_database_parameters(self, data):
+        data.dsHost = master['pki_ds_hostname']
+        data.dsPort = master['pki_ds_ldap_port']
+        data.baseDN = master['pki_ds_base_dn']
+        data.bindDN = master['pki_ds_bind_dn']
+        data.database = master['pki_ds_database']
+        data.bindpwd = master['pki_ds_password']
+        if config.str2bool(master['pki_ds_remove_data']):
+            data.removeData = "true"
+        else:
+            data.removeData = "false"
+        if config.str2bool(master['pki_ds_secure_connection']):
+            data.secureConn = "true"
+        else:
+            data.secureConn = "false"
+
+    def set_backup_parameters(self, data):
+        if config.str2bool(master['pki_backup_keys']):
+            data.backupKeys = "true"
+            data.backupFile = master['pki_backup_keys_p12']
+            data.backupPassword = master['pki_backup_password']
+        else:
+            data.backupKeys = "false"
+
+    def set_admin_parameters(self, data):
+        data.adminEmail = master['pki_admin_email']
+        data.adminName = master['pki_admin_name']
+        data.adminPassword = master['pki_admin_password']
+        data.adminProfileID = master['pki_admin_profile_id']
+        data.adminUID = master['pki_admin_uid']
+        data.adminSubjectDN = master['pki_admin_subject_dn']
+        if config.str2bool(master['pki_import_admin_cert']):
+            data.importAdminCert = "true"
+            # read config from file
+            f = open(master['pki_admin_cert_file'])
+            b64 = f.read().replace('\n','')
+            f.close()
+            data.adminCert = b64
+        else:
+            data.importAdminCert = "false"
+            data.adminSubjectDN = master['pki_admin_subject_dn']
+            if master['pki_admin_cert_request_type'] == "pkcs10":
+                data.adminCertRequestType = "pkcs10"
+
+                noise_file = os.path.join(
+                    master['pki_client_database_dir'], "noise")
+
+                output_file = os.path.join(
+                    master['pki_client_database_dir'], "admin_pkcs10.bin")
+
+                file.generate_noise_file(
+                    noise_file, int(master['pki_admin_keysize']))
+
+                certutil.generate_certificate_request(
+                                     master['pki_admin_subject_dn'],
+                                     master['pki_admin_keysize'],
+                                     master['pki_client_password_conf'], 
+                                     noise_file,
+                                     output_file, 
+                                     master['pki_client_database_dir'], 
+                                     None, None, True)
+
+                # convert output to ascii
+                command = "BtoA " + output_file + " " + output_file + ".asc"
+                config.pki_log.debug(command, 
+                                     extra=config.PKI_INDENTATION_LEVEL_2)
+                os.system(command)
+                
+                f = open(output_file + ".asc")
+                b64 = f.read().replace('\n','')
+                f.close()
+
+                data.adminCertRequest = b64
+            else:
+                print "log.PKI_CONFIG_PKCS10_SUPPORT_ONLY"
+                sys.exit(1)
+
+    def set_issuing_ca_parameters(self, data):
+        if master['pki_subsystem'] != "CA" or\
+           config.str2bool(master['pki_clone']) or\
+           config.str2bool(master['pki_subordinate']) or\
+           config.str2bool(master['pki_external']):
+            # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
+            # CA Clone, KRA Clone, OCSP Clone, TKS Clone,
+            # Subordinate CA, or External CA
+            data.issuingCA = master['pki_issuing_ca']
+            if master['pki_subsystem'] == "CA"  and\
+               config.str2bool(master['pki_external_step_two']):
+                # External CA Step 2
+                data.stepTwo = "true";
+
+    def create_system_cert(self, tag):
+        cert = pki.system.SystemCertData()
+        cert.tag = master["pki_%s_tag" % tag]
+        cert.keyAlgorithm = master["pki_%s_key_algorithm" % tag]
+        cert.keySize = master["pki_%s_key_size" % tag]
+        cert.keyType = master["pki_%s_key_type" % tag]
+        cert.nickname = master["pki_%s_nickname" % tag]
+        cert.subjectDN = master["pki_%s_subject_dn" % tag]
+        cert.token = master["pki_%s_token" % tag]
+        return cert
+
+    def retrieve_existing_server_cert(self, cfg_file):
+        cs_cfg = PKIConfigParser.read_simple_configuration_file(cfg_file)
+        cstype = cs_cfg.get('cs.type').lower()
+        cert = pki.system.SystemCertData()
+        cert.tag = master["pki_ssl_server_tag"]
+        cert.keyAlgorithm = master["pki_ssl_server_key_algorithm"]
+        cert.keySize = master["pki_ssl_server_key_size"]
+        cert.keyType = master["pki_ssl_server_key_type"]
+        cert.nickname = cs_cfg.get(cstype + ".sslserver.nickname")
+        cert.cert = cs_cfg.get(cstype + ".sslserver.cert")
+        cert.request = cs_cfg.get(cstype + ".sslserver.certreq")
+        cert.subjectDN = master["pki_ssl_server_subject_dn"]
+        cert.token = cs_cfg.get(cstype + ".sslserver.tokenname")
+        return cert
+  
 # PKI Deployment Helper Class Instances
 identity = identity()
 namespace = namespace()
@@ -2827,7 +3363,8 @@ symlink = symlink()
 war = war()
 password = password()
 certutil = certutil()
+pk12util = pk12util()
 security_domain = security_domain()
 kra_connector = kra_connector()
 systemd = systemd()
-jython = jython()
+config_client = config_client()
diff --git a/base/deploy/src/scriptlets/pkijython.py b/base/deploy/src/scriptlets/pkijython.py
deleted file mode 100644
index 4768d8af9d2307542fcd72237a0a0e6eaf3ce6ee..0000000000000000000000000000000000000000
--- a/base/deploy/src/scriptlets/pkijython.py
+++ /dev/null
@@ -1,667 +0,0 @@
-#!/usr/bin/jython
-
-# System Java Imports
-from java.io import BufferedReader
-from java.io import ByteArrayInputStream
-from java.io import FileReader
-from java.io import IOException
-from java.lang import Integer
-from java.lang import String as javastring
-from java.lang import System as javasystem
-from java.net import URISyntaxException
-from java.security import KeyPair
-from java.security import NoSuchAlgorithmException
-from java.util import ArrayList
-from java.util import Collection
-from java.util import Iterator
-from org.python.core import PyDictionary
-import jarray
-
-
-# System Python Imports
-import ConfigParser
-import errno
-import os
-import re
-import sys
-pki_python_module_path = os.path.join(sys.prefix,
-                                      "lib",
-                                      "python" + str(sys.version_info[0]) +
-                                      "." + str(sys.version_info[1]),
-                                      "site-packages",
-                                      "pki",
-                                      "deployment",
-                                      "configuration.jy")
-sys.path.append(pki_python_module_path)
-
-
-# PKI Python Imports
-import pkiconfig as config
-import pkimessages as log
-
-# Apache Commons Java Imports
-from org.apache.commons.cli import CommandLine
-from org.apache.commons.cli import CommandLineParser
-from org.apache.commons.cli import HelpFormatter
-from org.apache.commons.cli import Options
-from org.apache.commons.cli import ParseException
-from org.apache.commons.cli import PosixParser
-
-# JSS Java Imports
-from org.mozilla.jss import CryptoManager
-from org.mozilla.jss.asn1 import ASN1Util
-from org.mozilla.jss.asn1 import BIT_STRING
-from org.mozilla.jss.asn1 import INTEGER
-from org.mozilla.jss.asn1 import InvalidBERException
-from org.mozilla.jss.asn1 import SEQUENCE
-from org.mozilla.jss.crypto import AlreadyInitializedException
-from org.mozilla.jss.crypto import CryptoToken
-from org.mozilla.jss.crypto import KeyPairAlgorithm
-from org.mozilla.jss.crypto import KeyPairGenerator
-from org.mozilla.jss.crypto import TokenException
-from org.mozilla.jss.pkix.crmf import CertReqMsg
-from org.mozilla.jss.pkix.crmf import CertRequest
-from org.mozilla.jss.pkix.crmf import CertTemplate
-from org.mozilla.jss.pkix.crmf import POPOPrivKey
-from org.mozilla.jss.pkix.crmf import ProofOfPossession
-from org.mozilla.jss.pkix.primitive import Name
-from org.mozilla.jss.pkix.primitive import SubjectPublicKeyInfo
-from org.mozilla.jss.util import Password
-
-# PKI Java Imports
-from com.netscape.certsrv.system import SystemConfigClient
-from com.netscape.certsrv.system import SystemCertData
-from com.netscape.certsrv.system import ConfigurationRequest
-from com.netscape.certsrv.system import ConfigurationResponse
-from com.netscape.cmsutil.util import Utils
-from netscape.security.x509 import X500Name
-
-# PKI Deployment Jython Helper Functions
-def generateCRMFRequest(token, keysize, subjectdn, dualkey):
-        kg = token.getKeyPairGenerator(KeyPairAlgorithm.RSA)
-        x = Integer(keysize)
-        key_len = x.intValue()
-        kg.initialize(key_len)
-        # 1st key pair
-        pair = kg.genKeyPair()
-        # create CRMF
-        certTemplate = CertTemplate()
-        certTemplate.setVersion(INTEGER(2))
-        if not subjectdn is None:
-            name = X500Name(subjectdn)
-            cs = ByteArrayInputStream(name.getEncoded())
-            n = Name.getTemplate().decode(cs)
-            certTemplate.setSubject(n)
-        certTemplate.setPublicKey(SubjectPublicKeyInfo(pair.getPublic()))
-        seq = SEQUENCE()
-        certReq = CertRequest(INTEGER(1), certTemplate, seq)
-        popdata = jarray.array([0x0,0x3,0x0], 'b')
-        pop = ProofOfPossession.createKeyEncipherment(
-                  POPOPrivKey.createThisMessage(BIT_STRING(popdata, 3)))
-        crmfMsg = CertReqMsg(certReq, pop, None)
-        s1 = SEQUENCE()
-        # 1st : Encryption key
-        s1.addElement(crmfMsg)
-        # 2nd : Signing Key
-        if config.str2bool(dualkey):
-            javasystem.out.println(log.PKI_JYTHON_IS_DUALKEY)
-            seq1 = SEQUENCE()
-            certReqSigning = CertRequest(INTEGER(1), certTemplate, seq1)
-            signingMsg = CertReqMsg(certReqSigning, pop, None)
-            s1.addElement(signingMsg)
-        encoded = jarray.array(ASN1Util.encode(s1), 'b')
-        # encoder = BASE64Encoder()
-        # Req1 = encoder.encodeBuffer(encoded)
-        Req1 = Utils.base64encode(encoded)
-        return Req1
-
-COMMENT_CHAR = '#'
-OPTION_CHAR =  '='
-def read_simple_configuration_file(filename):
-    values = {}
-    f = open(filename)
-    for line in f:
-        # First, remove comments:
-        if COMMENT_CHAR in line:
-            # split on comment char, keep only the part before
-            line, comment = line.split(COMMENT_CHAR, 1)
-        # Second, find lines with an name=value:
-        if OPTION_CHAR in line:
-            # split on name char:
-            name, value = line.split(OPTION_CHAR, 1)
-            # strip spaces:
-            name = name.strip()
-            value = value.strip()
-            # store in dictionary:
-            values[name] = value
-    f.close()
-    return values
-
-
-# PKI Deployment 'security databases' Class
-class security_databases:
-    def initialize_token(self, pki_database_path, log_level):
-        try:
-            if log_level >= config.PKI_JYTHON_INFO_LOG_LEVEL:
-                print "%s %s '%s'" %\
-                      (log.PKI_JYTHON_INDENTATION_2,
-                       log.PKI_JYTHON_INITIALIZING_TOKEN,
-                       pki_database_path)
-            CryptoManager.initialize(pki_database_path)
-        except AlreadyInitializedException, e:
-            # it is ok if it is already initialized
-            pass
-        except Exception, e:
-            javasystem.out.println(log.PKI_JYTHON_INITIALIZATION_ERROR +\
-                                   " " + str(e))
-            javasystem.exit(1)
-
-    def log_into_token(self, pki_database_path, password_conf, log_level):
-        token = None
-        try:
-            if log_level >= config.PKI_JYTHON_INFO_LOG_LEVEL:
-                print "%s %s '%s'" %\
-                      (log.PKI_JYTHON_INDENTATION_2,
-                       log.PKI_JYTHON_LOG_INTO_TOKEN,
-                       pki_database_path)
-            manager = CryptoManager.getInstance()
-            token = manager.getInternalKeyStorageToken()
-            # Retrieve 'password' from client-side 'password_conf'
-            #
-            #     NOTE:  For now, ONLY read the first line
-            #            (which contains "password")
-            #
-            fd = open(password_conf, "r")
-            token_pwd = fd.readline()
-            fd.close
-            # Convert 'token_pwd' into a 'java char[]'
-            jtoken_pwd = jarray.array(token_pwd, 'c')
-            password = Password(jtoken_pwd)
-            try:
-                token.login(password)
-            except Exception, e:
-                javasystem.out.println(log.PKI_JYTHON_LOGIN_EXCEPTION +\
-                                       " " + str(e))
-                if not token.isLoggedIn():
-                    token.initPassword(password, password)
-                javasystem.exit(1)
-        except Exception, e:
-            javasystem.out.println(log.PKI_JYTHON_TOKEN_LOGIN_EXCEPTION +\
-                                   " " + str(e))
-            javasystem.exit(1)
-        return token
-
-
-# PKI Deployment 'REST Client' Class
-class rest_client:
-    client = None
-    master = None
-
-    def initialize(self, client_config, master):
-        try:
-            self.master = master
-            log_level = master['pki_jython_log_level']
-            if log_level >= config.PKI_JYTHON_INFO_LOG_LEVEL:
-                print "%s %s '%s'" %\
-                      (log.PKI_JYTHON_INDENTATION_2,
-                       log.PKI_JYTHON_INITIALIZING_REST_CLIENT,
-                       client_config.serverURI)
-            self.client = SystemConfigClient(client_config)
-            return self.client
-        except URISyntaxException, e:
-            e.printStackTrace()
-            javasystem.exit(1)
-
-    def set_existing_security_domain(self, data):
-        data.setSecurityDomainType(ConfigurationRequest.EXISTING_DOMAIN)
-        data.setSecurityDomainUri(self.master['pki_security_domain_uri'])
-        data.setSecurityDomainUser(self.master['pki_security_domain_user'])
-        data.setSecurityDomainPassword(
-            self.master['pki_security_domain_password'])
-
-    def set_new_security_domain(self, data):
-        data.setSecurityDomainType(ConfigurationRequest.NEW_DOMAIN)
-        data.setSecurityDomainName(self.master['pki_security_domain_name'])
-
-    def set_cloning_parameters(self, data):
-        data.setIsClone("true")
-        data.setCloneUri(self.master['pki_clone_uri'])
-        data.setP12File(self.master['pki_clone_pkcs12_path'])
-        data.setP12Password(self.master['pki_clone_pkcs12_password'])
-        data.setReplicateSchema(self.master['pki_clone_replicate_schema'])
-        data.setReplicationSecurity(
-            self.master['pki_clone_replication_security'])
-        if self.master['pki_clone_replication_master_port']:
-            data.setMasterReplicationPort(
-                self.master['pki_clone_replication_master_port'])
-        if self.master['pki_clone_replication_clone_port']:
-            data.setCloneReplicationPort(
-                self.master['pki_clone_replication_clone_port'])
-
-    def set_database_parameters(self, data):
-        data.setDsHost(self.master['pki_ds_hostname'])
-        data.setDsPort(self.master['pki_ds_ldap_port'])
-        data.setBaseDN(self.master['pki_ds_base_dn'])
-        data.setBindDN(self.master['pki_ds_bind_dn'])
-        data.setDatabase(self.master['pki_ds_database'])
-        data.setBindpwd(self.master['pki_ds_password'])
-        if config.str2bool(self.master['pki_ds_remove_data']):
-            data.setRemoveData("true")
-        else:
-            data.setRemoveData("false")
-        if config.str2bool(self.master['pki_ds_secure_connection']):
-            data.setSecureConn("true")
-        else:
-            data.setSecureConn("false")
-
-    def set_backup_parameters(self, data):
-        if config.str2bool(self.master['pki_backup_keys']):
-            data.setBackupKeys("true")
-            data.setBackupFile(self.master['pki_backup_keys_p12'])
-            data.setBackupPassword(self.master['pki_backup_password'])
-        else:
-            data.setBackupKeys("false")
-
-    def set_admin_parameters(self, token, data):
-        data.setAdminEmail(self.master['pki_admin_email'])
-        data.setAdminName(self.master['pki_admin_name'])
-        data.setAdminPassword(self.master['pki_admin_password'])
-        data.setAdminProfileID(self.master['pki_admin_profile_id'])
-        data.setAdminUID(self.master['pki_admin_uid'])
-        data.setAdminSubjectDN(self.master['pki_admin_subject_dn'])
-        if config.str2bool(self.master['pki_import_admin_cert']):
-            data.setImportAdminCert("true")
-            # read config from file
-            f = open(self.master['pki_admin_cert_file'])
-            b64 = f.read().replace('\n','')
-            f.close()
-            data.setAdminCert(b64)
-        else:
-            data.setImportAdminCert("false")
-            data.setAdminSubjectDN(self.master['pki_admin_subject_dn'])
-            if self.master['pki_admin_cert_request_type'] == "crmf":
-                data.setAdminCertRequestType("crmf")
-                if config.str2bool(self.master['pki_admin_dualkey']):
-                    crmf_request = generateCRMFRequest(
-                                       token,
-                                       self.master['pki_admin_keysize'],
-                                       self.master['pki_admin_subject_dn'],
-                                       "true")
-                else:
-                    crmf_request = generateCRMFRequest(
-                                       token,
-                                       self.master['pki_admin_keysize'],
-                                       self.master['pki_admin_subject_dn'],
-                                       "false")
-                data.setAdminCertRequest(crmf_request)
-            else:
-                javasystem.out.println(log.PKI_JYTHON_CRMF_SUPPORT_ONLY)
-                javasystem.exit(1)
-
-    def create_system_cert(self, tag):
-        cert = SystemCertData()
-        cert.setTag(self.master["pki_%s_tag" % tag])
-        cert.setKeyAlgorithm(self.master["pki_%s_key_algorithm" % tag])
-        cert.setKeySize(self.master["pki_%s_key_size" % tag])
-        cert.setKeyType(self.master["pki_%s_key_type" % tag])
-        cert.setNickname(self.master["pki_%s_nickname" % tag])
-        cert.setSubjectDN(self.master["pki_%s_subject_dn" % tag])
-        cert.setToken(self.master["pki_%s_token" % tag])
-        return cert
-
-    def mkdirs(self, path):
-        try:
-            os.makedirs(path)
-        except OSError, e:
-            if e.errno == 0:
-                # Avoid the following weird python/jython exception:
-                #
-                #     [Errno 0] couldn't make directories: <path>
-                #
-                pass
-            elif e.errno == errno.EEXIST and os.path.isdir(path):
-                pass
-            else:
-                raise
-
-    def write_data_to_file(self, filename, data):
-        FILE = open(filename, "w")
-        FILE.write(data)
-        FILE.close()
-
-    def read_data_from_file(self, filename):
-        FILE = open(filename, "r")
-        data = FILE.read()
-        FILE.close()
-        return data
-
-    def retrieve_existing_server_cert(self, cfg_file):
-        cs_cfg = read_simple_configuration_file(cfg_file)
-        cstype = cs_cfg.get('cs.type').lower()
-        cert = SystemCertData()
-        cert.setTag(self.master["pki_ssl_server_tag"])
-        cert.setKeyAlgorithm(self.master["pki_ssl_server_key_algorithm"])
-        cert.setKeySize(self.master["pki_ssl_server_key_size"])
-        cert.setKeyType(self.master["pki_ssl_server_key_type"])
-        cert.setNickname(cs_cfg.get(cstype + ".sslserver.nickname"))
-        cert.setCert(cs_cfg.get(cstype + ".sslserver.cert"))
-        cert.setRequest(cs_cfg.get(cstype + ".sslserver.certreq"))
-        cert.setSubjectDN(self.master["pki_ssl_server_subject_dn"])
-        cert.setToken(cs_cfg.get(cstype + ".sslserver.tokenname"))
-        return cert
-
-    def tomcat_instance_subsystems(self):
-        # Return list of PKI subsystems in the specified tomcat instance
-        rv = []
-        try:
-            for subsystem in config.PKI_TOMCAT_SUBSYSTEMS:
-                path = self.master['pki_instance_path'] + "/" + subsystem.lower()
-                if os.path.exists(path) and os.path.isdir(path):
-                    rv.append(subsystem)
-        except Exception, e:
-            javasystem.out.println(
-                log.PKI_JYTHON_JAVA_CONFIGURATION_EXCEPTION + " " + str(e))
-            javasystem.exit(1)
-        return rv
-
-
-    def construct_pki_configuration_data(self, token):
-        data = None
-        master = self.master
-        if master['pki_jython_log_level'] >= config.PKI_JYTHON_INFO_LOG_LEVEL:
-            print "%s %s '%s'" %\
-                  (log.PKI_JYTHON_INDENTATION_2,
-                   log.PKI_JYTHON_CONSTRUCTING_PKI_DATA,
-                   master['pki_subsystem'])
-        data = ConfigurationRequest()
-
-        # Miscellaneous Configuration Information
-        data.setPin(master['pki_one_time_pin'])
-        data.setToken(ConfigurationRequest.TOKEN_DEFAULT)
-        data.setSubsystemName(master['pki_subsystem_name'])
-
-        # Hierarchy
-        if master['pki_instance_type'] == "Tomcat":
-            if master['pki_subsystem'] == "CA":
-                if config.str2bool(master['pki_clone']):
-                    # Cloned CA
-                    data.setHierarchy("root")
-                elif config.str2bool(master['pki_external']):
-                    # External CA
-                    data.setHierarchy("join")
-                elif config.str2bool(master['pki_subordinate']):
-                    # Subordinate CA
-                    data.setHierarchy("join")
-                else:
-                    # PKI CA
-                    data.setHierarchy("root")
-
-        # Cloning parameters
-        if master['pki_instance_type'] == "Tomcat":
-            if config.str2bool(master['pki_clone']):
-                self.set_cloning_parameters(data)
-            else:
-                data.setIsClone("false")
-
-        # Security Domain
-        if master['pki_subsystem'] != "CA" or\
-           config.str2bool(master['pki_clone']) or\
-           config.str2bool(master['pki_subordinate']):
-            # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
-            # CA Clone, KRA Clone, OCSP Clone, TKS Clone, or
-            # Subordinate CA
-            self.set_existing_security_domain(data)
-        else:
-            # PKI CA or External CA
-            self.set_new_security_domain(data)
-
-        if master['pki_subsystem'] != "RA":
-            self.set_database_parameters(data)
-
-        if master['pki_instance_type'] == "Tomcat":
-            self.set_backup_parameters(data)
-
-        if not config.str2bool(master['pki_clone']):
-            self.set_admin_parameters(token, data)
-
-        # Issuing CA Information
-        if master['pki_subsystem'] != "CA" or\
-           config.str2bool(master['pki_clone']) or\
-           config.str2bool(master['pki_subordinate']) or\
-           config.str2bool(master['pki_external']):
-            # PKI KRA, PKI OCSP, PKI RA, PKI TKS, PKI TPS,
-            # CA Clone, KRA Clone, OCSP Clone, TKS Clone,
-            # Subordinate CA, or External CA
-            data.setIssuingCA(master['pki_issuing_ca'])
-            if master['pki_subsystem'] == "CA"  and\
-               config.str2bool(master['pki_external_step_two']):
-                # External CA Step 2
-                data.setStepTwo("true");
-
-        # Create system certs
-        systemCerts = ArrayList()
-
-        # Create 'CA Signing Certificate'
-        if master['pki_subsystem'] == "CA":
-            if not config.str2bool(master['pki_clone']):
-                cert1 = self.create_system_cert("ca_signing")
-                cert1.setSigningAlgorithm(
-                    master['pki_ca_signing_signing_algorithm'])
-                if config.str2bool(master['pki_external_step_two']):
-                    # Load the 'External CA Signing Certificate' (Step 2)
-                    javasystem.out.println(
-                        log.PKI_JYTHON_EXTERNAL_CA_LOAD + " " +\
-                        "'" + master['pki_external_ca_cert_path'] + "'")
-                    external_cert = self.read_data_from_file(
-                        master['pki_external_ca_cert_path'])
-                    cert1.setCert(external_cert);
-                    # Load the 'External CA Signing Certificate Chain' (Step 2)
-                    javasystem.out.println(
-                        log.PKI_JYTHON_EXTERNAL_CA_CHAIN_LOAD + " " +\
-                        "'" + master['pki_external_ca_cert_chain_path'] +\
-                        "'")
-                    external_cert_chain = self.read_data_from_file(
-                        master['pki_external_ca_cert_chain_path'])
-                    cert1.setCertChain(external_cert_chain);
-                systemCerts.add(cert1)
-
-        # Create 'OCSP Signing Certificate'
-        if not config.str2bool(master['pki_clone']):
-            if master['pki_subsystem'] == "CA" or\
-               master['pki_subsystem'] == "OCSP":
-                # External CA, Subordinate CA, PKI CA, or PKI OCSP
-                cert2 = self.create_system_cert("ocsp_signing")
-                cert2.setSigningAlgorithm(
-                    master['pki_ocsp_signing_signing_algorithm'])
-                systemCerts.add(cert2)
-
-        # Create 'SSL Server Certificate'
-        # all subsystems
-
-        # create new sslserver cert only if this is a new instance
-        cert3 = None
-        system_list = self.tomcat_instance_subsystems()
-        if len(system_list) >= 2:
-            data.setGenerateServerCert("false")
-            for subsystem in system_list:
-                dst = master['pki_instance_path'] + '/conf/' +\
-                    subsystem.lower() + '/CS.cfg' 
-                if subsystem != master['pki_subsystem'] and \
-                   os.path.exists(dst):
-                    cert3 = self.retrieve_existing_server_cert(dst)
-                    break
-        else:
-            cert3 = self.create_system_cert("ssl_server")
-        systemCerts.add(cert3)
-
-        # Create 'Subsystem Certificate'
-        if not config.str2bool(master['pki_clone']):
-            cert4 = self.create_system_cert("subsystem")
-            systemCerts.add(cert4)
-
-        # Create 'Audit Signing Certificate'
-        if not config.str2bool(master['pki_clone']):
-            if master['pki_subsystem'] != "RA":
-                cert5 = self.create_system_cert("audit_signing")
-                cert5.setSigningAlgorithm(
-                    master['pki_audit_signing_signing_algorithm'])
-                systemCerts.add(cert5)
-
-        # Create DRM Transport and storage Certificates
-        if not config.str2bool(master['pki_clone']):
-            if master['pki_subsystem'] == "KRA":
-                cert6 = self.create_system_cert("transport")
-                systemCerts.add(cert6)
-
-                cert7 = self.create_system_cert("storage")
-                systemCerts.add(cert7)
-
-        data.setSystemCerts(systemCerts)
-
-        return data
-
-    def configure_pki_data(self, data):
-        master = self.master
-        if master['pki_jython_log_level'] >= config.PKI_JYTHON_INFO_LOG_LEVEL:
-            print "%s %s '%s'" %\
-                  (log.PKI_JYTHON_INDENTATION_2,
-                   log.PKI_JYTHON_CONFIGURING_PKI_DATA,
-                   master['pki_subsystem'])
-        try:
-            response = self.client.configure(data)
-            javasystem.out.println(log.PKI_JYTHON_RESPONSE_STATUS +\
-                                   " " + response.getStatus())
-            certs = response.getSystemCerts()
-            iterator = certs.iterator()
-            while iterator.hasNext():
-                cdata = iterator.next()
-                if master['pki_subsystem'] == "CA" and\
-                   config.str2bool(master['pki_external']) and\
-                   not config.str2bool(master['pki_external_step_two']):
-                    # External CA Step 1
-                    if cdata.getTag().lower() == "signing":
-                        javasystem.out.println(log.PKI_JYTHON_CDATA_REQUEST +\
-                                               " " + cdata.getRequest())
-                        # Save 'External CA Signing Certificate' CSR (Step 1)
-                        javasystem.out.println(log.PKI_JYTHON_EXTERNAL_CSR_SAVE\
-                                               + " " + "'" +\
-                                               master['pki_external_csr_path']\
-                                               + "'")
-                        self.mkdirs(
-                            os.path.dirname(master['pki_external_csr_path']))
-                        self.write_data_to_file(master['pki_external_csr_path'],
-                                                cdata.getRequest())
-                        return
-                else:
-                    javasystem.out.println(log.PKI_JYTHON_CDATA_TAG +\
-                                           " " + cdata.getTag())
-                    javasystem.out.println(log.PKI_JYTHON_CDATA_CERT +\
-                                           " " + cdata.getCert())
-                    javasystem.out.println(log.PKI_JYTHON_CDATA_REQUEST +\
-                                           " " + cdata.getRequest())
-            # Cloned PKI subsystems do not return an Admin Certificate
-            if not config.str2bool(master['pki_clone']) and \
-               not config.str2bool(master['pki_import_admin_cert']):
-                admin_cert = response.getAdminCert().getCert()
-                javasystem.out.println(log.PKI_JYTHON_RESPONSE_ADMIN_CERT +\
-                                       " " + admin_cert)
-                # Store the Administration Certificate in a file
-                admin_cert_file = master['pki_client_admin_cert']
-                admin_cert_bin_file = admin_cert_file + ".der"
-                javasystem.out.println(log.PKI_JYTHON_ADMIN_CERT_SAVE +\
-                                       " " + "'" + admin_cert_file + "'")
-                self.write_data_to_file(admin_cert_file, admin_cert)
-                # convert the cert file to binary
-                command = "AtoB "+ admin_cert_file + " " + admin_cert_bin_file
-                javasystem.out.println(log.PKI_JYTHON_ADMIN_CERT_ATOB +\
-                    " " + "'" + command + "'")
-                os.system(command)
-
-                # Since Jython runs under Java, it does NOT support the
-                # following operating system specific command:
-                #
-                #     os.chmod(
-                #         admin_cert_file,
-                #         config.PKI_DEPLOYMENT_DEFAULT_FILE_PERMISSIONS)
-                #
-                # Emulate it with a system call.
-                command = "chmod" + " 660 " + admin_cert_file
-                javasystem.out.println(
-                    log.PKI_JYTHON_CHMOD +\
-                    " " + "'" + command + "'")
-                os.system(command)
-
-                command = "chmod" + " 660 " + admin_cert_bin_file
-                javasystem.out.println(
-                    log.PKI_JYTHON_CHMOD +\
-                    " " + "'" + command + "'")
-                os.system(command)
-
-                # Import the Administration Certificate
-                # into the client NSS security database
-                command = "certutil" + " " +\
-                          "-A" + " " +\
-                          "-n" + " " + "\"" +\
-                          re.sub("&#39;",
-                                 "'", master['pki_admin_nickname']) +\
-                          "\"" + " " +\
-                          "-t" + " " +\
-                          "\"" + "u,u,u" + "\"" + " " +\
-                          "-f" + " " +\
-                          master['pki_client_password_conf'] + " " +\
-                          "-d" + " " +\
-                          master['pki_client_database_dir'] + " " +\
-                          "-i" + " " +\
-                          admin_cert_bin_file
-                javasystem.out.println(
-                    log.PKI_JYTHON_ADMIN_CERT_IMPORT +\
-                    " " + "'" + command + "'")
-                os.system(command)
-
-                # create directory for p12 file if it does not exist
-                self.mkdirs(os.path.dirname(
-                    master['pki_client_admin_cert_p12']))
-
-                # Export the Administration Certificate from the
-                # client NSS security database into a PKCS #12 file
-                command = "pk12util" + " " +\
-                          "-o" + " " +\
-                          master['pki_client_admin_cert_p12'] + " " +\
-                          "-n" + " " + "\"" +\
-                          re.sub("&#39;",
-                                 "'", master['pki_admin_nickname']) +\
-                          "\"" + " " +\
-                          "-d" + " " +\
-                          master['pki_client_database_dir'] + " " +\
-                          "-k" + " " +\
-                          master['pki_client_password_conf'] + " " +\
-                          "-w" + " " +\
-                          master['pki_client_pkcs12_password_conf']
-                javasystem.out.println(
-                    log.PKI_JYTHON_ADMIN_CERT_EXPORT +\
-                    " " + "'" + command + "'")
-                os.system(command)
-                # Since Jython runs under Java, it does NOT support the
-                # following operating system specific command:
-                #
-                # os.chmod(master['pki_client_admin_cert_p12'],
-                #     config.\
-                #     PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
-                #
-                # Emulate it with a system call.
-                command = "chmod" + " " + "664" + " " +\
-                          master['pki_client_admin_cert_p12']
-                javasystem.out.println(
-                    log.PKI_JYTHON_CHMOD +\
-                    " " + "'" + command + "'")
-                os.system(command)
-        except Exception, e:
-            javasystem.out.println(
-                log.PKI_JYTHON_JAVA_CONFIGURATION_EXCEPTION + " " + str(e))
-            javasystem.exit(1)
-        return
-
-
-# PKI Deployment Jython Class Instances
-security_databases = security_databases()
-rest_client = rest_client()
diff --git a/base/deploy/src/scriptlets/pkimessages.py b/base/deploy/src/scriptlets/pkimessages.py
index c16d3ce46618acb968f91314048331d2269bd6ec..a6361dc8bf3d588dd4509a33f04e1511ecb786ad 100644
--- a/base/deploy/src/scriptlets/pkimessages.py
+++ b/base/deploy/src/scriptlets/pkimessages.py
@@ -149,12 +149,17 @@ PKIHELPER_APACHE_INSTANCES_2 = "PKI Apache registry '%s' contains '%d' "\
                                "Apache PKI instances"
 PKIHELPER_APPLY_SLOT_SUBSTITUTION_1 = "applying in-place "\
                                       "slot substitutions on '%s'"
+PKIHELPER_CERTUTIL_GENERATE_CSR_1 = "executing '%s'"
+PKIHELPER_CERTUTIL_MISSING_INPUT_FILE = "certutil: Missing "\
+                                        "'-i input-file' option!"
 PKIHELPER_CERTUTIL_MISSING_ISSUER_NAME = "certutil:  Missing "\
                                          "'-c issuer-name' option!"
 PKIHELPER_CERTUTIL_MISSING_NICKNAME = "certutil:  Missing "\
                                       "'-n nickname' option!"
 PKIHELPER_CERTUTIL_MISSING_NOISE_FILE = "certutil:  Missing "\
                                         "'-z noise-file' option!"
+PKIHELPER_CERTUTIL_MISSING_PASSWORD_FILE = "certutil:  Missing "\
+                                        "'-f password-file' option!"
 PKIHELPER_CERTUTIL_MISSING_PATH = "certutil:  Missing '-d path' option!"
 PKIHELPER_CERTUTIL_MISSING_SERIAL_NUMBER = "certutil:  Missing "\
                                            "'-m serial-number' option!"
@@ -189,7 +194,6 @@ PKIHELPER_GROUP_ADD_GID_KEYERROR_1 = "KeyError:  pki_gid %s"
 PKIHELPER_GROUP_ADD_KEYERROR_1 = "KeyError:  pki_group %s"
 PKIHELPER_INVALID_SELINUX_CONTEXT_FOR_PORT = "port %s has invalid selinux "\
                                              "context %s"
-PKIHELPER_INVOKE_JYTHON_1 = "executing '%s'"
 PKIHELPER_IS_A_DIRECTORY_1 = "'%s' is a directory"
 PKIHELPER_IS_A_FILE_1 = "'%s' is a file"
 PKIHELPER_IS_A_SYMLINK_1 = "'%s' is a symlink"
@@ -224,6 +228,15 @@ PKIHELPER_NOISE_FILE_2 = "generating noise file called '%s' and "\
                          "filling it with '%d' random bytes"
 PKIHELPER_PASSWORD_CONF_1 = "generating '%s'"
 PKIHELPER_PASSWORD_NOT_FOUND_1 = "no password found for '%s'!"
+PKIHELPER_PK12UTIL_MISSING_DBPWFILE = "pk12util missing "\
+                                     "-k db-password-file option!"
+PKIHELPER_PK12UTIL_MISSING_NICKNAME = "pk12util missing "\
+                                     "-n nickname option!"
+PKIHELPER_PK12UTIL_MISSING_OUTFILE = "pk12util missing "\
+                                     "-o output-file option!"
+PKIHELPER_PK12UTIL_MISSING_PWFILE = "pk12util missing "\
+                                     "-w pw-file option!"
+
 PKIHELPER_PKI_INSTANCE_SUBSYSTEMS_2 = "instance '%s' contains '%d' "\
                                       "PKI subsystems"
 PKIHELPER_REMOVE_FILTER_SECTION_1 = "removing filter section from '%s'"
@@ -279,47 +292,25 @@ PKIHELPER_USER_ADD_DEFAULT_2 = "adding default UID '%s' for user '%s' . . ."
 PKIHELPER_USER_ADD_KEYERROR_1 = "KeyError:  pki_user %s"
 PKIHELPER_USER_ADD_UID_KEYERROR_1 = "KeyError:  pki_uid %s"
 
-
-# PKI Deployment Jython "Scriptlet" Messages
-# (MUST contain NO embedded formats since Jython 2.2 does not support logging!)
-PKI_JYTHON_ADMIN_CERT_EXPORT = "exporting Admin Certificate from "\
-                               "NSS client security database:"
-PKI_JYTHON_ADMIN_CERT_IMPORT = "importing Admin Certificate into "\
-                               "NSS client security database:"
-PKI_JYTHON_ADMIN_CERT_SAVE = "saving Admin Certificate to file:"
-PKI_JYTHON_ADMIN_CERT_ATOB = "converting Admin Certificate to binary:"
-PKI_JYTHON_CDATA_TAG = "tag:"
-PKI_JYTHON_CDATA_CERT = "cert:"
-PKI_JYTHON_CDATA_REQUEST = "request:"
-PKI_JYTHON_CHMOD = "performing chmod:"
-PKI_JYTHON_CONFIGURING_PKI_DATA = "configuring PKI configuration data for"
-PKI_JYTHON_CONSTRUCTING_PKI_DATA = "constructing PKI configuration data for"
-PKI_JYTHON_CRMF_SUPPORT_ONLY = "only the 'crmf' certificate request type "\
+PKI_CONFIG_ADMIN_CERT_SAVE = "saving Admin Certificate to file:"
+PKI_CONFIG_ADMIN_CERT_ATOB = "converting Admin Certificate to binary:"
+PKI_CONFIG_CDATA_TAG = "tag:"
+PKI_CONFIG_CDATA_CERT = "cert:"
+PKI_CONFIG_CDATA_REQUEST = "request:"
+PKI_CONFIG_CONFIGURING_PKI_DATA = "configuring PKI configuration data."
+PKI_CONFIG_CONSTRUCTING_PKI_DATA = "constructing PKI configuration data."
+PKI_CONFIG_PKCS10_SUPPORT_ONLY = "only the 'pkcs10' certificate request type "\
                                "is currently supported"
-PKI_JYTHON_IS_DUALKEY = "dualkey = true"
-PKI_JYTHON_EXCEPTION_PARSER = "Problem parsing"
-PKI_JYTHON_EXTERNAL_CA_LOAD = "loading external CA signing certificate "\
+PKI_CONFIG_EXTERNAL_CA_LOAD = "loading external CA signing certificate "\
                               "from file:"
-PKI_JYTHON_EXTERNAL_CA_CHAIN_LOAD = "loading external CA signing certificate "\
+PKI_CONFIG_EXTERNAL_CA_CHAIN_LOAD = "loading external CA signing certificate "\
                                     "chain from file:"
-PKI_JYTHON_EXTERNAL_CSR_SAVE = "saving CA Signing CSR to file:"
-PKI_JYTHON_INDENTATION_0 = "pkispawn    : JYTHON  "
-PKI_JYTHON_INDENTATION_1 = "pkispawn    : JYTHON   ..."
-PKI_JYTHON_INDENTATION_2 = "pkispawn    : JYTHON   ......."
-PKI_JYTHON_INDENTATION_3 = "pkispawn    : JYTHON   ..........."
-PKI_JYTHON_INDENTATION_4 = "pkispawn    : JYTHON   ..............."
-PKI_JYTHON_INITIALIZATION_ERROR = "INITIALIZATION ERROR:"
-PKI_JYTHON_INITIALIZING_REST_CLIENT = "initializing REST client via"
-PKI_JYTHON_INITIALIZING_TOKEN = "initializing token located in"
-PKI_JYTHON_JAVA_CONFIGURATION_EXCEPTION =\
+PKI_CONFIG_EXTERNAL_CSR_SAVE = "saving CA Signing CSR to file:"
+PKI_CONFIG_JAVA_CONFIGURATION_EXCEPTION =\
     "Exception from Java Configuration Servlet:"
-PKI_JYTHON_LOG_INTO_TOKEN = "logging into token located in"
-PKI_JYTHON_LOGIN_EXCEPTION = "login Exception:"
-PKI_JYTHON_RESPONSE_ADMIN_CERT = "adminCert:"
-PKI_JYTHON_RESPONSE_STATUS = "status:"
-PKI_JYTHON_TOKEN_LOGIN_EXCEPTION = "Exception in logging into token:"
-PKI_JYTHON_NOT_YET_IMPLEMENTED = "NOT YET IMPLEMENTED"
-
+PKI_CONFIG_RESPONSE_ADMIN_CERT = "adminCert:"
+PKI_CONFIG_RESPONSE_STATUS = "status:"
+PKI_CONFIG_NOT_YET_IMPLEMENTED_1 = " %s NOT YET IMPLEMENTED"
 
 # PKI Deployment "Scriptlet" Messages
 ADMIN_DOMAIN_DESTROY_1 = "depopulating '%s'"
diff --git a/base/deploy/src/scriptlets/pkiparser.py b/base/deploy/src/scriptlets/pkiparser.py
index 639b1182084669bd01b6d03e1c9c8977c8136cb1..c4bf9b886ee3bd77ed11a6955c57efbf0188d41a 100644
--- a/base/deploy/src/scriptlets/pkiparser.py
+++ b/base/deploy/src/scriptlets/pkiparser.py
@@ -96,15 +96,12 @@ class PKIConfigParser:
         # Process 'Optional' command-line options
         #    '-v'
         if args.pki_verbosity == 1:
-            config.pki_jython_log_level = config.PKI_JYTHON_INFO_LOG_LEVEL
             config.pki_console_log_level = logging.INFO
             config.pki_log_level = logging.INFO
         elif args.pki_verbosity == 2:
-            config.pki_jython_log_level = config.PKI_JYTHON_INFO_LOG_LEVEL
             config.pki_console_log_level = logging.INFO
             config.pki_log_level = logging.DEBUG
         elif args.pki_verbosity == 3:
-            config.pki_jython_log_level = config.PKI_JYTHON_DEBUG_LOG_LEVEL
             config.pki_console_log_level = logging.DEBUG
             config.pki_log_level = logging.DEBUG
         elif args.pki_verbosity > 3:
@@ -114,7 +111,6 @@ class PKIConfigParser:
             self.arg_parser.exit(-1);
         else:
             # Set default log levels
-            config.pki_jython_log_level = config.PKI_JYTHON_WARNING_LOG_LEVEL
             config.pki_console_log_level = logging.WARNING
             config.pki_log_level = logging.INFO
 
@@ -424,8 +420,6 @@ class PKIConfigParser:
             config.pki_master_dict['pki_certificate_timestamp'] =\
                 config.pki_certificate_timestamp
             config.pki_master_dict['pki_architecture'] = config.pki_architecture
-            config.pki_master_dict['pki_jython_log_level'] =\
-                config.pki_jython_log_level
             config.pki_master_dict['pki_default_deployment_cfg'] = config.default_deployment_cfg
             config.pki_master_dict['pki_user_deployment_cfg'] = config.user_deployment_cfg
             config.pki_master_dict['pki_deployed_instance_name'] =\
@@ -857,21 +851,7 @@ class PKIConfigParser:
                 config.pki_master_dict['pki_client_database_password'] =\
                     str(config.pki_master_dict['pki_client_pin'])
 
-            # Jython scriptlet name/value pairs
-            config.pki_master_dict['pki_jython_configuration_scriptlet'] =\
-                os.path.join(sys.prefix,
-                             "lib",
-                             "python" + str(sys.version_info[0]) + "." +
-                             str(sys.version_info[1]),
-                             "site-packages",
-                             "pki",
-                             "deployment",
-                             "configuration.jy")
-            config.pki_master_dict['pki_jython_base_uri'] =\
-                "https" + "://" + config.pki_master_dict['pki_hostname'] + ":" +\
-                config.pki_master_dict['pki_https_port'] + "/" +\
-                config.pki_master_dict['pki_subsystem'].lower()
-            # Jython scriptlet
+            # Configuration scriptlet
             # 'Security Domain' Configuration name/value pairs
             # 'Subsystem Name'  Configuration name/value pairs
             # 'Token'           Configuration name/value pairs
@@ -945,7 +925,6 @@ class PKIConfigParser:
                 # PKI CA
                 config.pki_master_dict['pki_security_domain_type'] = "new"
 
-            # Jython scriptlet
             # 'External CA' Configuration name/value pairs
             #
             #     Tomcat - [External CA]
@@ -959,7 +938,6 @@ class PKIConfigParser:
             #        config.pki_master_dict['pki_external_step_two']
             #
 
-            # Jython scriptlet
             # 'Backup' Configuration name/value pairs
             #
             #     Apache - [RA], [TPS]
diff --git a/base/deploy/src/scriptlets/security_databases.py b/base/deploy/src/scriptlets/security_databases.py
index a74a4c1576e543ff4a6f95c86d2435002733b71f..9ac4784e5933ce148961669100416a9f767a47bd 100644
--- a/base/deploy/src/scriptlets/security_databases.py
+++ b/base/deploy/src/scriptlets/security_databases.py
@@ -62,7 +62,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
         util.file.modify(master['pki_secmod_database'], perms=\
             config.PKI_DEPLOYMENT_DEFAULT_SECURITY_DATABASE_PERMISSIONS)
 
-        if util.instance.tomcat_instance_subsystems() < 2:
+        if len(util.instance.tomcat_instance_subsystems()) < 2:
             # only create a self signed cert for a new instance  
             rv = util.certutil.verify_certificate_exists(
                  master['pki_database_path'],
@@ -111,7 +111,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
             util.file.delete(master['pki_secmod_database'])
             util.file.delete(master['pki_shared_password_conf'])
         elif master['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS and\
-             util.instance.tomcat_instance_subsystems() == 0:
+             len(util.instance.tomcat_instance_subsystems()) == 0:
             util.file.delete(master['pki_cert_database'])
             util.file.delete(master['pki_key_database'])
             util.file.delete(master['pki_secmod_database'])
diff --git a/base/deploy/src/scriptlets/selinux_setup.py b/base/deploy/src/scriptlets/selinux_setup.py
index f3b7d1273c8f4a832d9e06f40aa2726e5ac68b3a..552ab3f41572e51e599daf9ce2d7e0c7b46e2a1b 100644
--- a/base/deploy/src/scriptlets/selinux_setup.py
+++ b/base/deploy/src/scriptlets/selinux_setup.py
@@ -66,7 +66,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
         if master['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS and\
             util.instance.apache_instance_subsystems() == 1 or\
             master['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS and\
-            util.instance.tomcat_instance_subsystems() == 1:
+            len(util.instance.tomcat_instance_subsystems()) == 1:
 
             trans = seobject.semanageRecords("targeted")
             trans.start()
@@ -133,7 +133,7 @@ class PkiScriptlet(pkiscriptlet.AbstractBasePkiScriptlet):
         if master['pki_subsystem'] in config.PKI_APACHE_SUBSYSTEMS and\
             util.instance.apache_instance_subsystems() == 0 or\
             master['pki_subsystem'] in config.PKI_TOMCAT_SUBSYSTEMS and\
-            util.instance.tomcat_instance_subsystems() == 0:
+            len(util.instance.tomcat_instance_subsystems()) == 0:
 
             trans = seobject.semanageRecords("targeted")
             trans.start()
diff --git a/specs/pki-core.spec b/specs/pki-core.spec
index e2144fc342cff84fc65d66a78346ece9678c3fac..c33ff12de596467c40ae991c662b1a487c465c91 100644
--- a/specs/pki-core.spec
+++ b/specs/pki-core.spec
@@ -5,7 +5,7 @@ distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
 
 Name:             pki-core
 Version:          10.0.1
-Release:          7%{?dist}
+Release:          8%{?dist}
 Summary:          Certificate System - PKI Core Components
 URL:              http://pki.fedoraproject.org/
 License:          GPLv2
@@ -263,7 +263,6 @@ Requires:         perl(XML::LibXML)
 Requires:         perl-Crypt-SSLeay
 Requires:         policycoreutils
 Requires:         openldap-clients
-Requires:         jython >= 2.2.1
 Requires:         pki-base = %{version}-%{release}
 Requires:         pki-tools = %{version}-%{release}
 
@@ -1006,6 +1005,9 @@ fi
 
 
 %changelog
+* Tue Mar 19 2013 Ade Lee <alee@redhat.com> 10.0.1-8
+- Removed jython dependency
+
 * Mon Mar 11 2013 Endi S. Dewata <edewata@redhat.com> 10.0.1-7
 - Added minimum python-requests version.
 
-- 
1.8.1.4

