Update tests to use pki nss-cert-import

dogtagpki · Jun 20, 2024 · 2f6d70f · 2f6d70f
1 parent 85255be
commit 2f6d70f
Show file tree

Hide file tree

Showing 102 changed files with 731 additions and 177 deletions.
diff --git a/.github/workflows/acme-certbot-test.yml b/.github/workflows/acme-certbot-test.yml
@@ -60,7 +60,12 @@ jobs:
       - name: Install CA admin cert
         run: |
           docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
-          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
+
+          docker exec pki pki nss-cert-import \
+              --cert ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec pki pki pkcs12-import \
               --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
               --pkcs12-password Secret.123

diff --git a/.github/workflows/acme-container-test.yml b/.github/workflows/acme-container-test.yml
@@ -166,8 +166,7 @@ jobs:
               --output-file /conf/certs/ca_signing.crt \
               ca_signing
 
-          docker exec client pki \
-              nss-cert-import \
+          docker exec client pki nss-cert-import \
               --cert $SHARED/conf/certs/ca_signing.crt \
               --trust CT,C,C \
               ca_signing

diff --git a/.github/workflows/acme-postgresql-test.yml b/.github/workflows/acme-postgresql-test.yml
@@ -59,7 +59,12 @@ jobs:
       - name: Install CA admin cert
         run: |
           docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
-          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
+
+          docker exec pki pki nss-cert-import \
+              --cert ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec pki pki pkcs12-import \
               --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
               --pkcs12-password Secret.123
@@ -87,7 +92,11 @@ jobs:
           CERT_ID=$(docker exec pki pki -n caadmin ca-cert-request-approve ${REC_ID:14} --force | \
               grep "Certificate ID")
           docker exec pki pki ca-cert-export ${CERT_ID:18} --output-file sslserver.crt
-          docker exec pki pki nss-cert-import --cert sslserver.crt postgresql
+
+          docker exec pki pki nss-cert-import \
+              --cert sslserver.crt \
+              postgresql
+
           docker exec pki pk12util -o sslserver.p12 -n postgresql -d /root/.dogtag/nssdb -W secret
           docker cp pki:sslserver.p12 .
           openssl pkcs12 -in sslserver.p12 -nocerts -out sslserver.key -noenc -password  pass:secret

diff --git a/.github/workflows/ca-admin-user-test.yml b/.github/workflows/ca-admin-user-test.yml
@@ -75,7 +75,11 @@ jobs:
         run: |
           # import CA signing cert
           docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
-          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
+
+          docker exec pki pki nss-cert-import \
+              --cert ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
 
           # correct password should work
           docker exec pki pki -u caadmin -w Secret.123 ca-user-find

diff --git a/.github/workflows/ca-basic-test.yml b/.github/workflows/ca-basic-test.yml
@@ -310,7 +310,12 @@ jobs:
       - name: Initialize PKI client
         run: |
           docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
-          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
+
+          docker exec pki pki nss-cert-import \
+              --cert ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec pki pki info
 
       - name: Test CA certs

diff --git a/.github/workflows/ca-cert-revocation-test.yml b/.github/workflows/ca-cert-revocation-test.yml
@@ -68,9 +68,12 @@ jobs:
           docker exec pki pki-server cert-export \
               --cert-file ca_signing.crt \
                ca_signing
-          docker exec pki pki client-cert-import \
-              --ca-cert ca_signing.crt \
-               ca_signing
+
+          docker exec pki pki nss-cert-import \
+              --cert ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec pki pki pkcs12-import \
               --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
               --pkcs12-password Secret.123

diff --git a/.github/workflows/ca-clone-replicated-ds-test.yml b/.github/workflows/ca-clone-replicated-ds-test.yml
@@ -62,8 +62,12 @@ jobs:
         run: |
           docker exec primary pki-server cert-export ca_signing \
               --cert-file $SHARED/ca_signing.crt
-          docker exec primary pki client-cert-import ca_signing \
-              --ca-cert $SHARED/ca_signing.crt
+
+          docker exec primary pki nss-cert-import \
+              --cert $SHARED/ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec primary pki pkcs12-import \
               --pkcs12 $SHARED/caadmin.p12 \
               --pkcs12-password Secret.123
@@ -417,8 +421,11 @@ jobs:
 
       - name: Check secondary CA admin user
         run: |
-          docker exec secondary pki client-cert-import ca_signing \
-              --ca-cert $SHARED/ca_signing.crt
+          docker exec secondary pki nss-cert-import \
+              --cert $SHARED/ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec secondary pki pkcs12-import \
               --pkcs12 $SHARED/caadmin.p12 \
               --pkcs12-password Secret.123

diff --git a/.github/workflows/ca-clone-secure-ds-test.yml b/.github/workflows/ca-clone-secure-ds-test.yml
@@ -61,11 +61,12 @@ jobs:
               --csr ds_signing.csr \
               --ext /usr/share/pki/server/certs/ca_signing.conf \
               --cert ds_signing.crt
-          docker exec primary pki \
-              nss-cert-import \
+
+          docker exec primary pki nss-cert-import \
               --cert ds_signing.crt \
               --trust CT,C,C \
               Self-Signed-CA
+
           docker exec primary certutil -L -d /root/.dogtag/nssdb
 
       - name: Create DS server cert in primary PKI container
@@ -81,10 +82,11 @@ jobs:
               --csr ds_server.csr \
               --ext /usr/share/pki/server/certs/sslserver.conf \
               --cert ds_server.crt
-          docker exec primary pki \
-              nss-cert-import \
+
+          docker exec primary pki nss-cert-import \
               --cert ds_server.crt \
               Server-Cert
+
           docker exec primary certutil -L -d /root/.dogtag/nssdb
 
       - name: Import certs into primary DS container
@@ -126,7 +128,12 @@ jobs:
       - name: Verify users and DS hosts in primary PKI container
         run: |
           docker exec primary pki-server cert-export ca_signing --cert-file ca_signing.crt
-          docker exec primary pki client-cert-import ca_signing --ca-cert ca_signing.crt
+
+          docker exec primary pki nss-cert-import \
+              --cert ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec primary pki pkcs12-import \
               --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
               --pkcs12-password Secret.123
@@ -187,10 +194,11 @@ jobs:
               --csr ds_server.csr \
               --ext /usr/share/pki/server/certs/sslserver.conf \
               --cert ds_server.crt
-          docker exec secondary pki \
-              nss-cert-import \
+
+          docker exec secondary pki nss-cert-import \
               --cert ds_server.crt \
               Server-Cert
+
           docker exec secondary certutil -L -d /root/.dogtag/nssdb
 
       - name: Import certs into secondary DS container
@@ -243,7 +251,12 @@ jobs:
         run: |
           docker exec primary cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${SHARED}/ca_admin_cert.p12
           docker exec secondary pki-server cert-export ca_signing --cert-file ca_signing.crt
-          docker exec secondary pki client-cert-import ca_signing --ca-cert ca_signing.crt
+
+          docker exec secondary pki nss-cert-import \
+              --cert ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec secondary pki pkcs12-import \
               --pkcs12 ${SHARED}/ca_admin_cert.p12 \
               --pkcs12-password Secret.123

diff --git a/.github/workflows/ca-clone-shared-ds-test.yml b/.github/workflows/ca-clone-shared-ds-test.yml
@@ -184,16 +184,23 @@ jobs:
           # get users from primary CA
           docker exec primary pki-server cert-export ca_signing \
               --cert-file ${SHARED}/ca_signing.crt
-          docker exec primary pki client-cert-import ca_signing \
-              --ca-cert ${SHARED}/ca_signing.crt
+
+          docker exec primary pki nss-cert-import \
+              --cert $SHARED/ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec primary pki pkcs12-import \
               --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
               --pkcs12-password Secret.123
           docker exec primary pki -n caadmin ca-user-find | tee ca-users.primary
 
           # get users from secondary CA
-          docker exec secondary pki client-cert-import ca_signing \
-              --ca-cert ${SHARED}/ca_signing.crt
+          docker exec secondary pki nss-cert-import \
+              --cert $SHARED/ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec primary cp \
               /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
               ${SHARED}/ca_admin_cert.p12

diff --git a/.github/workflows/ca-clone-test.yml b/.github/workflows/ca-clone-test.yml
@@ -72,7 +72,12 @@ jobs:
       - name: Verify users and SD hosts in primary PKI container
         run: |
           docker exec primary pki-server cert-export ca_signing --cert-file ${SHARED}/ca_signing.crt
-          docker exec primary pki client-cert-import ca_signing --ca-cert ${SHARED}/ca_signing.crt
+
+          docker exec primary pki nss-cert-import \
+              --cert $SHARED/ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec primary pki pkcs12-import \
               --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
               --pkcs12-password Secret.123
@@ -314,7 +319,12 @@ jobs:
       - name: Verify users and SD hosts in secondary PKI container
         run: |
           docker exec primary cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${SHARED}/ca_admin_cert.p12
-          docker exec secondary pki client-cert-import ca_signing --ca-cert ${SHARED}/ca_signing.crt
+
+          docker exec secondary pki nss-cert-import \
+              --cert $SHARED/ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec secondary pki pkcs12-import \
               --pkcs12 ${SHARED}/ca_admin_cert.p12 \
               --pkcs12-password Secret.123
@@ -451,7 +461,11 @@ jobs:
 
       - name: Verify users and SD hosts in tertiary PKI container
         run: |
-          docker exec tertiary pki client-cert-import ca_signing --ca-cert ${SHARED}/ca_signing.crt
+          docker exec tertiary pki nss-cert-import \
+              --cert $SHARED/ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec tertiary pki pkcs12-import \
               --pkcs12 ${SHARED}/ca_admin_cert.p12 \
               --pkcs12-password Secret.123

diff --git a/.github/workflows/ca-cmc-shared-token-test.yml b/.github/workflows/ca-cmc-shared-token-test.yml
@@ -62,7 +62,12 @@ jobs:
       - name: Install CA admin cert
         run: |
           docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
-          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
+
+          docker exec pki pki nss-cert-import \
+              --cert ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
           docker exec pki pki pkcs12-import \
               --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
               --pkcs12-password Secret.123

diff --git a/.github/workflows/ca-container-existing-certs-test.yml b/.github/workflows/ca-container-existing-certs-test.yml
@@ -63,11 +63,12 @@ jobs:
               --validity-length 1 \
               --validity-unit year \
               --cert $SHARED/certs/ca_signing.crt
-          docker exec client pki \
-              nss-cert-import \
+
+          docker exec client pki nss-cert-import \
               --cert $SHARED/certs/ca_signing.crt \
               --trust CT,C,C \
               ca_signing
+
           docker exec client pki \
               nss-cert-show \
               ca_signing
@@ -85,10 +86,11 @@ jobs:
               --csr $SHARED/certs/ca_ocsp_signing.csr \
               --ext /usr/share/pki/server/certs/ocsp_signing.conf \
               --cert $SHARED/certs/ca_ocsp_signing.crt
-          docker exec client pki \
-              nss-cert-import \
+
+          docker exec client pki nss-cert-import \
               --cert $SHARED/certs/ca_ocsp_signing.crt \
               ca_ocsp_signing
+
           docker exec client pki \
               nss-cert-show \
               ca_ocsp_signing
@@ -106,11 +108,12 @@ jobs:
               --csr $SHARED/certs/ca_audit_signing.csr \
               --ext /usr/share/pki/server/certs/audit_signing.conf \
               --cert $SHARED/certs/ca_audit_signing.crt
-          docker exec client pki \
-              nss-cert-import \
+
+          docker exec client pki nss-cert-import \
               --cert $SHARED/certs/ca_audit_signing.crt \
               --trust ,,P \
               ca_audit_signing
+
           docker exec client pki \
               nss-cert-show \
               ca_audit_signing
@@ -128,10 +131,11 @@ jobs:
               --csr $SHARED/certs/subsystem.csr \
               --ext /usr/share/pki/server/certs/subsystem.conf \
               --cert $SHARED/certs/subsystem.crt
-          docker exec client pki \
-              nss-cert-import \
+
+          docker exec client pki nss-cert-import \
               --cert $SHARED/certs/subsystem.crt \
               subsystem
+
           docker exec client pki \
               nss-cert-show \
               subsystem
@@ -149,10 +153,11 @@ jobs:
               --csr $SHARED/certs/sslserver.csr \
               --ext /usr/share/pki/server/certs/sslserver.conf \
               --cert $SHARED/certs/sslserver.crt
-          docker exec client pki \
-              nss-cert-import \
+
+          docker exec client pki nss-cert-import \
               --cert $SHARED/certs/sslserver.crt \
               sslserver
+
           docker exec client pki \
               nss-cert-show \
               sslserver
@@ -170,10 +175,11 @@ jobs:
               --csr $SHARED/certs/admin.csr \
               --ext /usr/share/pki/server/certs/admin.conf \
               --cert $SHARED/certs/admin.crt
-          docker exec client pki \
-              nss-cert-import \
+
+          docker exec client pki nss-cert-import \
               --cert $SHARED/certs/admin.crt \
               admin
+
           docker exec client pki \
               nss-cert-show \
               admin

diff --git a/.github/workflows/ca-container-existing-config-test.yml b/.github/workflows/ca-container-existing-config-test.yml
@@ -79,6 +79,7 @@ jobs:
           docker exec pki pki-server cert-export \
               --cert-file $SHARED/certs/ca_signing.crt \
               ca_signing
+
           docker exec client pki nss-cert-import \
               --cert $SHARED/certs/ca_signing.crt \
               --trust CT,C,C \

diff --git a/.github/workflows/ca-container-migration-test.yml b/.github/workflows/ca-container-migration-test.yml
@@ -68,6 +68,7 @@ jobs:
           docker exec pki pki-server cert-export \
               --cert-file $SHARED/ca_signing.crt \
               ca_signing
+
           docker exec client pki nss-cert-import \
               --cert $SHARED/ca_signing.crt \
               --trust CT,C,C \

diff --git a/.github/workflows/ca-container-user-service-test.yml b/.github/workflows/ca-container-user-service-test.yml
@@ -312,8 +312,7 @@ jobs:
               --ext /usr/share/pki/server/certs/admin.conf \
               --cert /conf/certs/admin.crt
 
-          docker exec -u pkiuser pki pki \
-              nss-cert-import \
+          docker exec -u pkiuser pki pki nss-cert-import \
               --cert /home/pkiuser/.dogtag/pki-ca/conf/certs/admin.crt \
               admin