Skip to content

Commit

Permalink
Remove the option stop_certmonger from stop_tracking_*
Browse files Browse the repository at this point in the history
This option was inconsistent between invocations and there is
no need to stop certmonger after stopping tracking. It was also
apparently causing dbus timeout errors, probably due to the amount
of work that certmonger does at startup.

https://pagure.io/freeipa/issue/8506
https://pagure.io/freeipa/issue/8533

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
  • Loading branch information
rcritten committed Feb 15, 2021
1 parent 137b39c commit f45e154
Show file tree
Hide file tree
Showing 4 changed files with 7 additions and 13 deletions.
2 changes: 1 addition & 1 deletion ipaserver/install/ca.py
Expand Up @@ -425,7 +425,7 @@ def install_step_1(standalone, replica_config, options, custodia):

def uninstall():
ca_instance = cainstance.CAInstance(api.env.realm)
ca_instance.stop_tracking_certificates(stop_certmonger=False)
ca_instance.stop_tracking_certificates()
ipautil.remove_file(paths.RA_AGENT_PEM)
ipautil.remove_file(paths.RA_AGENT_KEY)
if ca_instance.is_configured():
Expand Down
7 changes: 2 additions & 5 deletions ipaserver/install/cainstance.py
Expand Up @@ -1075,13 +1075,13 @@ def configure_agent_renewal():
logger.error(
"certmonger failed to start tracking certificate: %s", e)

def stop_tracking_certificates(self, stop_certmonger=True):
def stop_tracking_certificates(self):
"""
Stop tracking our certificates. Called on uninstall. Also called
during upgrade to fix discrepancies.
"""
super(CAInstance, self).stop_tracking_certificates(False)
super(CAInstance, self).stop_tracking_certificates()

# stop tracking lightweight CA signing certs
for request_id in certmonger.get_requests_for_dir(self.nss_db):
Expand All @@ -1095,9 +1095,6 @@ def stop_tracking_certificates(self, stop_certmonger=True):
logger.error(
"certmonger failed to stop tracking certificate: %s", e)

if stop_certmonger:
services.knownservices.certmonger.stop()

def is_renewal_master(self, fqdn=None):
if fqdn is None:
fqdn = api.env.host
Expand Down
5 changes: 1 addition & 4 deletions ipaserver/install/dogtaginstance.py
Expand Up @@ -453,7 +453,7 @@ def configure_renewal(self):
logger.error(
"certmonger failed to start tracking certificate: %s", e)

def stop_tracking_certificates(self, stop_certmonger=True):
def stop_tracking_certificates(self):
"""
Stop tracking our certificates. Called on uninstall. Also called
during upgrade to fix discrepancies.
Expand All @@ -477,9 +477,6 @@ def stop_tracking_certificates(self, stop_certmonger=True):
logger.error(
"certmonger failed to stop tracking certificate: %s", e)

if stop_certmonger:
cmonger.stop()

def update_cert_cs_cfg(self, directive, cert):
"""
When renewing a Dogtag subsystem certificate the configuration file
Expand Down
6 changes: 3 additions & 3 deletions ipaserver/install/server/upgrade.py
Expand Up @@ -648,9 +648,9 @@ def certificate_renewal_update(ca, kra, ds, http):

# Ok, now we need to stop tracking, then we can start tracking them
# again with new configuration:
ca.stop_tracking_certificates(stop_certmonger=False)
ca.stop_tracking_certificates()
if kra.is_installed():
kra.stop_tracking_certificates(stop_certmonger=False)
kra.stop_tracking_certificates()
ds.stop_tracking_certificates(serverid)
http.stop_tracking_certificates()

Expand Down Expand Up @@ -920,7 +920,7 @@ def uninstall_dogtag_9(ds, http):
ca = dogtaginstance.DogtagInstance(
api.env.realm, "CA", "certificate server",
nss_db=paths.VAR_LIB_PKI_CA_ALIAS_DIR)
ca.stop_tracking_certificates(False)
ca.stop_tracking_certificates()

if serverid is not None:
# drop the trailing / off the config_dirname so the directory
Expand Down

0 comments on commit f45e154

Please sign in to comment.