def check(self):
expected_trust = {
'ocspSigningCert cert-pki-ca': 'u,u,u',
'subsystemCert cert-pki-ca': 'u,u,u',
'auditSigningCert cert-pki-ca': 'u,u,Pu',
'Server-Cert cert-pki-ca': 'u,u,u',
}
kra = krainstance.KRAInstance(api.env.realm)
if kra.is_installed():
kra_trust = {
'transportCert cert-pki-kra': 'u,u,u',
'storageCert cert-pki-kra': 'u,u,u',
'auditSigningCert cert-pki-kra': 'u,u,Pu',
}
expected_trust.update(kra_trust)
if not self.ca.is_configured():
logger.debug('CA is not configured, skipping NSS trust check')
return
db = certs.CertDB(api.env.realm, paths.PKI_TOMCAT_ALIAS_DIR)
for nickname, _trust_flags in db.list_certs():
flags = certdb.unparse_trust_flags(_trust_flags)
if nickname.startswith('caSigningCert cert-pki-ca'):
expected = 'CTu,Cu,Cu'
else:
try:
expected = expected_trust[nickname]
except KeyError:
logger.debug("%s not found in %s, assuming 3rd party" %
(nickname, paths.PKI_TOMCAT_ALIAS_DIR))
continue
try:
expected_trust.pop(nickname)
except KeyError:
pass
if flags != expected:
yield Result(
self,
constants.ERROR,
key=nickname,
expected=expected,
got=flags,
nickname=nickname,
dbdir=paths.PKI_TOMCAT_ALIAS_DIR,
msg='Incorrect NSS trust for {nickname} in {dbdir}. '
'Got {got} expected {expected}.')
continue
else:
yield Result(self, constants.SUCCESS, key=nickname)
for nickname in expected_trust:
yield Result(
self,
constants.ERROR,
key=nickname,
nickname=nickname,
dbdir=paths.PKI_TOMCAT_ALIAS_DIR,
msg='Certificate {nickname} missing from {dbdir} while '
'verifying trust')
def check_trust(self):
"""Check the NSS trust flags"""
expected_trust = {
'ocspSigningCert cert-pki-ca': 'u,u,u',
'subsystemCert cert-pki-ca': 'u,u,u',
'auditSigningCert cert-pki-ca': 'u,u,Pu',
'Server-Cert cert-pki-ca': 'u,u,u'
}
# TODO: external CA certs
# TODO: unexpected certs
if not self.ca.is_configured():
logger.debug("No CA configured, skipping trust check")
return
db = certs.CertDB(api.env.realm, paths.PKI_TOMCAT_ALIAS_DIR)
for nickname, _trust_flags in db.list_certs():
flags = unparse_trust_flags(_trust_flags)
if nickname.startswith('caSigningCert cert-pki-ca'):
expected = 'CTu,Cu,Cu'
else:
expected = expected_trust[nickname]
if flags != expected:
self.failure('Incorrect NSS trust for %s. Got %s expected %s' %
(nickname, flags, expected))
