gpo: Ensure Network Device Enrollment Service if sscep fails

Prompt the user to check that Network Device
Enrollment Service is installed and configured
if sscep fails to download the certificate root
chain.

Signed-off-by: David Mulder <dmulder@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/python/samba/gp_cert_auto_enroll_ext.py b/python/samba/gp_cert_auto_enroll_ext.py
index 556be60462170cacb462bbae71c413ff96c3aa7d..d3b0db3213d03b45bde7e2b58a06f248a4d91cbb 100644 (file)
--- a/python/samba/gp_cert_auto_enroll_ext.py
+++ b/python/samba/gp_cert_auto_enroll_ext.py
@@ -98,6 +98,8 @@ def cert_enroll(ca, trust_dir, private_dir, logger):
                      root_cert, '-u', url]).wait()
         if ret != 0:
             logger.warn('sscep failed to fetch the root certificate chain.')
+            logger.warn('Ensure you have installed and configured the' +
+                        ' Network Device Enrollment Service.')
         root_certs = glob('%s*' % root_cert)
         data['files'].extend(root_certs)
         for src in root_certs: