NAME

NCM::Component::FreeIPA::NSS handles the certificates using NSS.

Public methods

• new

  Returns a NSS object with nssdb, accepts the following options

  • format: dbm or sql
  • realm: IPA realm, used for CA nick
  • cacrt: IPA CA crt location, default to /etc/ipa/ca.crt
  • csr_bits: key size in bits for a new csr.
  • owner, group, mode: owner, group and permissions for nssdb and/or certs

  • log

    A logger instance (compatible with CAF::Object).

• setup_nssdb

  Setup and initialise nssdb dirrectory

• setup

  Setup temporary workdir with 0700 permissions, and initialise nssdb using setup_nssdb method.

  Return SUCCESS on success, undef otherwise.

• add_cert_trusted

  Add trusted certificate with nick from file crt.

• add_cert_ca

  Add trusted CA certificate (nick and file via canick and cacrt attributes)

• add_cert

  Add untrusted certificate to NSSDB with nick from file cert.

• has_cert

  Check if certificate for nick exists in NSSDB.

  If an ipa client instance is passed, also check if the certificate is known in FreeIPA.

• get_cert

  Extract the certificate from NSSDB for nick to file cert with owner/group/mode options..

• make_cert_request

  Make a certificate request for fqdn and optional dn, return filename of the CSR. (Used DN is <CN=<fqdn,O=<realm>>>).

• ipa_request_cert

  Use NCM::Component::FreeIPA::Client instance ipa to make the certificate request using csr file. The certificate is stored in crt file.

  (The ipa instance should be usable, e.g. the correct kerberos environment is already setup).

  Return 1 on success, undef otherwise.

• get_privkey

  Retrieve the private key from certificate with nick nick and save it in the file key with owner/group/mode options.

• get_cert_or_key

  Given type, retrieve the cert of private key from certificate with nick nick and save it in the file fn with owner/group/mode options.