Revert "DBACLD-79811 always import cert in nssdb"

This reverts commit f8e3932.
DecisionsDev · Oct 17, 2023 · 8399163 · 8399163
1 parent 73c0b5a
commit 8399163
Showing 1 changed file with 11 additions and 4 deletions.
diff --git a/common/script/configureTlsSecurity.sh b/common/script/configureTlsSecurity.sh
@@ -189,7 +189,14 @@ echo "Change certificate format from JKS to P12"
 keytool -J"-Xshareclasses:none" -importkeystore -srckeystore /config/security/truststore.jks -srcstorepass $DEFAULT_TRUSTSTORE_PASSWORD -destkeystore /config/security/truststore.p12 -srcstoretype JKS -deststoretype PKCS12 -deststorepass $DEFAULT_TRUSTSTORE_PASSWORD -noprompt
 keytool -J"-Xshareclasses:none" -importkeystore -srckeystore /config/security/keystore.jks -srcstorepass $DEFAULT_KEYSTORE_PASSWORD -destkeystore /config/security/keystore.p12 -srcstoretype JKS -deststoretype PKCS12 -deststorepass $DEFAULT_KEYSTORE_PASSWORD -noprompt
 
-# In case of FIPS use nssdb keystore/trustore
-pk12util -i /config/security/keystore.p12 -W $DEFAULT_KEYSTORE_PASSWORD -d /etc/pki/nssdb
-pk12util -i /config/security/truststore.p12 -W $DEFAULT_TRUSTSTORE_PASSWORD -d /etc/pki/nssdb
-for cert in $(certutil -L -d /etc/pki/nssdb | tail -n +5 | awk '{print $1}'); do certutil -M -n ${cert} -t CT,CT,CT -d /etc/pki/nssdb; done
+
+if [ -n "$ENABLE_FIPS" ]
+then
+  if [[ $ENABLE_FIPS =~ "true" ]]
+  then
+	echo "FIPS Enabled importing certification in the nssdb"
+	pk12util -i /config/security/keystore.p12 -W $DEFAULT_KEYSTORE_PASSWORD -d /etc/pki/nssdb
+	pk12util -i /config/security/truststore.p12 -W $DEFAULT_TRUSTSTORE_PASSWORD -d /etc/pki/nssdb
+	for cert in $(certutil -L -d /etc/pki/nssdb | tail -n +5 | awk '{print $1}'); do certutil -M -n ${cert} -t CT,CT,CT -d /etc/pki/nssdb; done
+  fi
+fi