From d214765932c9c701ea03e6663b03419b96426337 Mon Sep 17 00:00:00 2001
From: Matúš Honěk <mhonek@redhat.com>
Date: Apr 26 2018 10:42:05 +0000
Subject: Ticket 49650 - lib389 enable_tls doesn't work on F28


Bug Description: In the lib389 we have the method inst.enable_tls().
It creates certificates and sets up the server for TLS communication.
It works on F27 built from master branch and doesn't work on F28.
It happens because on F28 openssl fails to verify the certificate.

Fix Description: We should create CA with an appropriate flag.
It can be done by setting an X.509 V3 Certificate Type Extension
in the certificate to 'certSigning' value.

https://pagure.io/389-ds-base/issue/49650

Author: mhonek

Review by: spichugi, wibrown (Thanks!)

---

diff --git a/src/lib389/lib389/nss_ssl.py b/src/lib389/lib389/nss_ssl.py
index 7c78d49..26c8f70 100644
--- a/src/lib389/lib389/nss_ssl.py
+++ b/src/lib389/lib389/nss_ssl.py
@@ -176,6 +176,8 @@ class NssSsl(object):
             'CT,,',
             '-v',
             '%s' % VALID,
+            '--keyUsage',
+            'certSigning',
             '-d',
             self._certdb,
             '-z',