[freeipa PR#3180][opened] [ipa-4-6] ipa-cert-fix fixes
by frasertweedale
URL: https://github.com/freeipa/freeipa/pull/3180
Author: frasertweedale
Title: #3180: [ipa-4-6] ipa-cert-fix fixes
Action: opened
PR body:
"""
Cherry-pick a couple of fixes from master-bound PR #3136.
```
2ff6e1ac5 (Fraser Tweedale, 67 minutes ago)
ipa-cert-fix: fix spurious renewal master change
We only want to become the renewal master if we actually renewed a shared
certificate. But there is a bug in the logic; even if the only Dogtag
certificate to be renewed is the 'sslserver' (a non-shared certificate),
the renewal master will be reset. Fix the bug.
A static type system would have excluded this bug.
Part of: https://pagure.io/freeipa/issue/7885
ee889d2d7 (Fraser Tweedale, 2 days ago)
ipa-cert-fix: handle 'pki-server cert-fix' failure
When DS cert is expired, 'pki-server cert-fix' will fail at the final step
(restart). When this case arises, ignore the CalledProcessError and
continue.
We can't know for sure if the error was due to failure of final restart, or
something going wrong earlier. But if it was a more serious failure, the
next step (installing the renewed IPA-specific certificates) will fail.
Part of: https://pagure.io/freeipa/issue/7885
```
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3180/head:pr3180
git checkout pr3180
4 years, 4 months