Tags: freeipa-pr-ci2/pki
Tags
Bug 1805541-refactor:[RFE] CA Certificate Transparency with Embedded … …Signed Certificate Time stamp This patch reafactors the Certificate Transparency code. More refinement to come, but for this patche: - the majority of the CT v1 code originally in CAService.java now goes into CTEngine.java; - some utility methods go into CertUtils.java - new CT enablement logic is introduced to replace the original one: The logic of whether SCT extension is to be added to the issued cert or not now goes like this: IN CS.cfg * CT mode is controlled by ca.certTransparency.mode * There are three CT modes: * disabled: issued certs will not carry SCT extension * enabled: issued certs will carry SCT extension * perProfile: certs enrolled through those profiles * that contain the following policyset * will carry SCT extension * SignedCertificateTimestampListExtDefaultImpl * default is true * if unknow mode then error will be thrown. https://bugzilla.redhat.com/show_bug.cgi?id=1805541
acme: remove redundant schema file ACME LDAP schema has been extracted as a modify LDIF. I tested the FreeIPA schema update machinery and it works fine with a modify LDIF. So the other schema LDIF, which is not an update object but a plain entry, can be removed. We could do likewise for LWCA and profile schema, but that is for another day.
PreviousNext