NCM::Component::FreeIPA::NSS

NAME

NCM::Component::FreeIPA::NSS handles the certificates using NSS.

Public methods

  • new

Returns a NSS object with nssdb, accepts the following options

  • format: dbm or sql

  • realm: IPA realm, used for CA nick

  • cacrt: IPA CA crt location, default to /etc/ipa/ca.crt

  • csr_bits: key size in bits for a new csr.

  • owner, group, mode: owner, group and permissions for nssdb and/or certs

  • log

A logger instance (compatible with CAF::Object).

  • setup_nssdb

Setup and initialise nssdb dirrectory

  • setup

Setup temporary workdir with 0700 permissions, and initialise nssdb using setup_nssdb method.

Return SUCCESS on success, undef otherwise.

  • add_cert_trusted

Add trusted certificate with nick from file crt.

  • add_cert_ca

Add trusted CA certificate (nick and file via canick and cacrt attributes)

  • add_cert

Add untrusted certificate to NSSDB with nick from file cert.

  • has_cert

Check if certificate for nick exists in NSSDB.

If an ipa client instance is passed, also check if the certificate is known in FreeIPA.

  • get_cert

Extract the certificate from NSSDB for nick to file cert with owner/group/mode options..

  • make_cert_request

Make a certificate request for fqdn and optional dn, return filename of the CSR. (Used DN is <CN=<fqdn,O=<realm>>>).

  • ipa_request_cert

Use NCM::Component::FreeIPA::Client instance ipa to make the certificate request using csr file. The certificate is stored in crt file.

(The ipa instance should be usable, e.g. the correct kerberos environment is already setup).

Return 1 on success, undef otherwise.

  • get_privkey

Retrieve the private key from certificate with nick nick and save it in the file key with owner/group/mode options.

  • get_cert_or_key

Given type, retrieve the cert of private key from certificate with nick nick and save it in the file fn with owner/group/mode options.