Bug 1041555

Summary: Pegasus should generate self-signed certificates at first startup rather than rpm %post
Product: Red Hat Enterprise Linux 7 Reporter: Stephen Gallagher <sgallagh>
Component: tog-pegasusAssignee: Stephen Gallagher <sgallagh>
Status: CLOSED CURRENTRELEASE QA Contact: Alois Mahdal <amahdal>
Severity: high Docs Contact:
Priority: unspecified    
Version: 7.0CC: jscotka, rdoty, sct, tsmetana, vcrhonek
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: tog-pegasus-2.12.1-16.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 11:45:16 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1032849    
Bug Blocks: 1041552    
Attachments:
Description Flags
Move certificate generation to service startup vcrhonek: review+

Description Stephen Gallagher 2013-12-12 17:12:52 UTC 
Description of problem:
Right now, Pegasus creates the self-signed certificates during RPM installation. However, it relies on having the system hostname set in order to create the subject name correctly. This can therefore cause issues with installing Pegasus during 

Version-Release number of selected component (if applicable):
tog-pegasus-2.12.1-10.el7.x86_64

How reproducible:
Any fresh installation of tog-pegasus

Steps to Reproduce:
1. Ensure that tog-pegasus is not installed and there are no .pem files in /etc/Pegasus/
2. Set system hostname to 'installhostname.example.com'
3. Install Pegasus
4. Change system hostname to 'deployhostname.example.com'
4. Run 'systemctl start tog-pegasus'
5. Examine the certificate installed at /etc/Pegasus/server.pem with
openssl x509 -text -noout -in /etc/Pegasus/server.pem

Actual results:
The certificate file contains the following Subject:
Subject: C=UK, ST=Berkshire, L=Reading, O=The Open Group, OU=The OpenPegasus Project, CN=installhostname.example.com

Expected results:
The certificate file should contain the following Subject:
Subject: C=UK, ST=Berkshire, L=Reading, O=The Open Group, OU=The OpenPegasus Project, CN=deployhostname.example.com

Additional info:
The recommended implementation here would be for us to perform the initial creation of the certificates in the systemd unit file on first startup (or any startup where the server.pem does not exist). This will play better with virtualization environments as well (see BZ#1041552 for how we plan to clean these certificates out when creating a base image).
Comment 1 Stephen Gallagher 2013-12-13 16:27:21 UTC 
Created attachment 836380 [details]
Move certificate generation to service startup

Instead of creating the certificates during RPM installation, we should wait until the first time the service is started. This will behave better in cases where an image is being cloned for VMs.

This patch depends on the mini-CA patch for BZ#1032849 (though it would be possible to write a patch that worked with the old self-signed approach as well, if the mini-CA approach is rejected).
Comment 2 Tomas Smetana 2014-03-07 09:03:00 UTC 
Pushed Stephen's patch together with one for the bug #1072936.
Comment 4 Alois Mahdal 2014-03-18 12:57:42 UTC 
Verified with all supported architectures.
Comment 5 Ludek Smid 2014-06-13 11:45:16 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.