[Freeipa-devel] [freeipa PR#3136][opened] Add ipa-cert-fix tool

[frasertweedale]

   URL: https://github.com/freeipa/freeipa/pull/3136
Author: frasertweedale
 Title: #3136: Add ipa-cert-fix tool
Action: opened

PR body:
"""
Forward-port of https://github.com/freeipa/freeipa/pull/2919 to `master`
branch.

```
da189c9cc (Fraser Tweedale, 3 days ago)
   require Dogtag 10.7.0-1

   Dogtag 10.7 includes the 'pki-server cert-fix' enhancements required by
   ipa-cert-fix.  Bump the dep min bound.

   Part of: https://pagure.io/freeipa/issue/7885

54e967095 (Fraser Tweedale, 6 weeks ago)
   ipa-cert-fix: use customary exit statuses

   It is customary to return 2 when IPA is not configured, and 1 when other
   required bits are not installed or configured.  Update ipa-cert-fix exit
   statuses accordingly.

   Part of: https://pagure.io/freeipa/issue/7885

7a836fb8c (Fraser Tweedale, 7 weeks ago)
   ipa-cert-fix: add man page

   Part of: https://pagure.io/freeipa/issue/7885

6c023f265 (Fraser Tweedale, 7 weeks ago)
   Add ipa-cert-fix tool

   The ipa-cert-fix tool wraps `pki-server cert-fix`, performing additional
   certificate requests for non-Dogtag IPA certificates and performing
   additional actions.  In particular:

   - Run cert-fix with arguments particular to the IPA deployment.

   - Update IPA RA certificate in the ipara user entry (if renewed).

   - Add shared certificates (if renewed) to the ca_renewal LDAP
    container for replication.

   - Become the CA renewal master if shared certificates were renewed.
    This ensures other CA replicas, including the previous CA renewal
    master if not the current host, pick up those new certificates
    when Certmonger attempts to renew them.

   Fixes: https://pagure.io/freeipa/issue/7885

3d1ff725e (Fraser Tweedale, 7 weeks ago)
   constants: add ca_renewal container

   Part of: https://pagure.io/freeipa/issue/7885

c956bc658 (Fraser Tweedale, 7 weeks ago)
   cainstance: add function to determine ca_renewal nickname

   The ipa-cert-fix program needs to know where to put shared certificates. 
   Extract the logic that computes the nickname from dogtag-ipa-ca-renew-agent
   to new subroutine cainstance.get_ca_renewal_nickname().

   Part of: https://pagure.io/freeipa/issue/7885

4f4c32cc6 (Fraser Tweedale, 7 weeks ago)
   Extract ca_renewal cert update subroutine

   When the CA renewal master renews certificates that are shared across CA
   replicas, it puts them in LDAP for the other CA replicas to see.  The code
   to create/update these entries lives in the dogtag-ipa-ca-renew-agent
   renewal helper, but it will be useful for the ipa-cert-fix program too. 
   Extract it to a subroutine in the cainstance module.

   Part of: https://pagure.io/freeipa/issue/7885
```
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3136/head:pr3136
git checkout pr3136