Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump pki min version and add commentary about sub-CA revocation on delete #108

Closed
wants to merge 2 commits into from
Closed

Bump pki min version and add commentary about sub-CA revocation on delete #108

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b97b8c9
spec: require Dogtag >= 10.3.5-6
frasertweedale Sep 23, 2016
42a2db9
Add commentary about CA deletion to plugin doc
frasertweedale Sep 23, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions freeipa.spec.in
View file
Open in desktop
Expand Up @@ -161,8 +161,8 @@ Requires(post): systemd-units
Requires: selinux-policy >= %{selinux_policy_version}
Requires(post): selinux-policy-base >= %{selinux_policy_version}
Requires: slapi-nis >= %{slapi_nis_version}
Requires: pki-ca >= 10.3.3-3
Requires: pki-kra >= 10.3.3-3
Requires: pki-ca >= 10.3.5-6
Requires: pki-kra >= 10.3.5-6
Requires(preun): python systemd-units
Requires(postun): python systemd-units
Requires: zip
Expand Down
21 changes: 13 additions & 8 deletions ipaserver/plugins/ca.py
View file
Open in desktop
Expand Up @@ -14,33 +14,38 @@

__doc__ = _("""
Manage Certificate Authorities

""") + _("""
Subordinate Certificate Authorities (Sub-CAs) can be added for scoped issuance
of X.509 certificates.

""") + _("""
CAs are enabled on creation, but their use is subject to CA ACLs unless the
operator has permission to bypass CA ACLs.

""") + _("""
All CAs except the 'IPA' CA can be disabled or re-enabled. Disabling a CA
prevents it from issuing certificates but does not affect the validity of its
certificate.


""") + _("""
CAs (all except the 'IPA' CA) can be deleted. Deleting a CA causes its signing
certificate to be revoked and its private key deleted.
""") + _("""
EXAMPLES:

""") + _("""
Create new CA, subordinate to the IPA CA.

ipa ca-add puppet --desc "Puppet" \\
--subject "CN=Puppet CA,O=EXAMPLE.COM"

""") + _("""
Disable a CA.

ipa ca-disable puppet

""") + _("""
Re-enable a CA.

ipa ca-enable puppet
""") + _("""
Delete a CA.

ipa ca-del puppet
""")


Expand Down