389-ds-base

#50846 Ticket 50694 - import PEM certs on startup
Closed by spichugi. Opened by firstyear.
firstyear/389-ds-base 50694-setup-pem-docker  into  master

Download 50846.patch

Bug Description: To make container setup easier, given TLS
material in defined locations we should convert these into
a functional nssdb

Fix Description: Provided that we have:

  • /data/config/pwdfile.txt
  • /data/tls/server.key
  • /data/tls/server.crt
  • /data/tls/ca/*.crt

There are imported into the nssdb as such:

/data/tls/ca/ca.crt C,,
Server-Cert u,u,u

This works on restarts, changes of keys, etc. IE to replace these,
just change out the pem files, and restart, and we "do the right
thing". Importantly, this will allow a much easier deployment of
containerised 389-ds with let's encrypt!

https://pagure.io/389-ds-base/issue/50694

Author: William Brown william@blackhats.net.au

Review by: ???

Minor issue, must this line is a bit long, even on my monitor. Can we indent them inside a ()

Initial code review looks good, maybe @mhonek can give it a look over too?

rebased onto a678abcb23850abcb476ab5a7cae4e642b346b9c

@mreynolds Changed and tested :)

PEP8: A [ should be just [ (unnecessary space). Otherwise the function is passing flake8. :)

What does client_ca refer to? It isn't in the code AFAICT.

Sorry, I just cannot neither docker nor podman these days, so I couldn't actually check. :(
Thus, I trust you this is idempotent. :) (I believe since NssTls calls are idempotent, right...?)
Other than that, ACK.

I didn't add the client_ca functions yet, that's why it's confusidng. I'll remove that comment. I'll also fix that brace and that's it, so I'll merge after that :)

rebased onto 7120ecb30f6cefa30e4e9514a789d4e64ab12b68

Pull-Request has been merged by firstyear

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3900

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.