Add test for CA system certs renewal #4595
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A new test has been added to validate the renewal procedure for system certs in CA (except the CA signing cert itself) and the admin cert as well. The test will call pki-server cert-create sslserver --temp command which will create a temporary SSL server cert using the existing CSR. The code that exports the CSR from CS.cfg into a file in PKISubsystem.setup_temp_renewal() has been removed since the CSR is now stored in <instance>/conf/certs/<cert ID>.csr so it can be used directly. The test will also call pki-server cert-import command which will import the new cert into NSS database. The PKIInstance.cert_import() has been modified to no longer call cert_update_config() since the cert will no longer be stored in CS.cfg. https://github.com/dogtagpki/pki/wiki/Renewing-System-Certificates https://github.com/dogtagpki/pki/wiki/Renewing-Admin-Certificate
|
Kudos, SonarCloud Quality Gate passed!
|
|
@fmarco76 Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A new test has been added to validate the renewal procedure for system certs in CA (except the CA signing cert itself) and the admin cert as well.
The test will call
pki-server cert-create sslserver --tempcommand which will create a temporary SSL server cert using the existing CSR.The code that exports the CSR from
CS.cfginto a file inPKISubsystem.setup_temp_renewal()has been removed since the CSR is now stored in<instance>/conf/certs/<cert ID>.csrso it can be used directly.The test will also call
pki-server cert-importcommand which will import the new cert into NSS database.The
PKIInstance.cert_import()has been modified to no longer callcert_update_config()since the cert will no longer be stored inCS.cfg.https://github.com/dogtagpki/pki/wiki/Renewing-System-Certificates
https://github.com/dogtagpki/pki/wiki/Renewing-Admin-Certificate