From 05db7ed7ff926927368403808c78b5922ea233f0 Mon Sep 17 00:00:00 2001
From: Fraser Tweedale <ftweedal@redhat.com>
Date: Wed, 2 May 2018 12:07:02 +1000
Subject: [PATCH] install: fix reported external CA configuration

The installer reports the CA configuration that will be used,
including whether the CA is self-signed or externally-signed.

Installation with external CA takes two steps. The first step
correctly reports the externally signed configuration (like the
above), but the second step reports a self-signed configuration.

The CA *is* externally signed, but the configuration gets reported
incorrectly at step 2.  This could confuse the administrator.  Fix
the message.

Fixes: https://pagure.io/freeipa/issue/7523
---
 ipaserver/install/ca.py | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/ipaserver/install/ca.py b/ipaserver/install/ca.py
index b82601b6d4..16d9ea2843 100644
--- a/ipaserver/install/ca.py
+++ b/ipaserver/install/ca.py
@@ -105,9 +105,13 @@ def print_ca_configuration(options):
     print("The CA will be configured with:")
     print("Subject DN:   {}".format(options.ca_subject))
     print("Subject base: {}".format(options.subject_base))
-    print("Chaining:     {}".format(
-        "externally signed (two-step installation)" if options.external_ca
-        else "self-signed"))
+    if options.external_ca:
+        chaining = "externally signed (two-step installation)"
+    elif options.external_cert_files:
+        chaining = "externally signed"
+    else:
+        chaining = "self-signed"
+    print("Chaining:     {}".format(chaining))
 
 
 def install_check(standalone, replica_config, options):
