Bug 1259294

Summary:	Isolated capsule/reverse proxy doesn't work when using custom certificates
Product:	Red Hat Satellite	Reporter:	Ivan Necas <inecas>
Component:	Installation	Assignee:	Ivan Necas <inecas>
Status:	CLOSED ERRATA	QA Contact:	Tazim Kolhar <tkolhar>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.1.0	CC:	bbuckingham, cdonnell, chpeters, cwelton, jswensso, mgazdik, pmoravec
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
URL:	http://projects.theforeman.org/issues/11660
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-10-15 18:20:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ivan Necas 2015-09-02 11:36:27 UTC

Description of problem:
capsule-installer sets incorrect file as a CA for client authentication.

Steps to Reproduce:
1. install satellite and isolated capsule with custom certificatses
2. try to register the host though the isolated capsule

Actual results:
Unable to verify server's identity: tlsv1 alert unknown ca

Expected results:
Everything works

Additional info:

The core issue is using katello_server_ca (used for server certificates) instead of katello_default_ca (used for client certificates)

Comment 1 Ivan Necas 2015-09-02 11:37:31 UTC

Created redmine issue http://projects.theforeman.org/issues/11660 from this bug

Comment 2 Ivan Necas 2015-09-02 11:51:25 UTC

Proposed patch https://github.com/Katello/puppet-capsule/pull/54

Comment 4 Ivan Necas 2015-09-03 12:45:52 UTC

Merged upstream

Comment 8 Tazim Kolhar 2015-10-12 09:47:22 UTC

VERIFIED:

# rpm -qa | grep foreman
ruby193-rubygem-foreman_hooks-0.3.7-2.el7sat.noarch
rubygem-hammer_cli_foreman-0.1.4.14-1.el7sat.noarch
ruby193-rubygem-foreman_bootdisk-4.0.2.13-1.el7sat.noarch
foreman-postgresql-1.7.2.41-1.el7sat.noarch
foreman-gce-1.7.2.41-1.el7sat.noarch
rubygem-hammer_cli_foreman_bootdisk-0.1.2.7-1.el7sat.noarch
foreman-debug-1.7.2.41-1.el7sat.noarch
foreman-proxy-1.7.2.6-1.el7sat.noarch
foreman-1.7.2.41-1.el7sat.noarch
foreman-vmware-1.7.2.41-1.el7sat.noarch
ruby193-rubygem-foreman-redhat_access-0.2.3-1.el7sat.noarch
rubygem-hammer_cli_foreman_discovery-0.0.1.10-1.el7sat.noarch
dell-per805-01.rhts.eng.bos.redhat.com-foreman-client-1.0-1.noarch
foreman-compute-1.7.2.41-1.el7sat.noarch
ruby193-rubygem-foreman_docker-1.2.0.22-1.el7sat.noarch
ruby193-rubygem-foreman-tasks-0.6.15.7-1.el7sat.noarch
rubygem-hammer_cli_foreman_tasks-0.0.3.5-1.el7sat.noarch
foreman-libvirt-1.7.2.41-1.el7sat.noarch
dell-per805-01.rhts.eng.bos.redhat.com-foreman-proxy-client-1.0-1.noarch
foreman-ovirt-1.7.2.41-1.el7sat.noarch
foreman-selinux-1.7.2.14-1.el7sat.noarch
dell-per805-01.rhts.eng.bos.redhat.com-foreman-proxy-1.0-2.noarch
ruby193-rubygem-foreman_discovery-2.0.0.19-1.el7sat.noarch
rubygem-hammer_cli_foreman_docker-0.0.3.9-1.el7sat.noarch
ruby193-rubygem-foreman_gutterball-0.0.1.9-1.el7sat.noarch


steps:
1. install satellite and isolated capsule with custom certificatses
2. try to register the host though the isolated capsule
3. Used separate custom certs for capsule setup
referred to : https://github.com/Katello/katello-installer#custom-server-certificates

Comment 10 errata-xmlrpc 2015-10-15 18:20:42 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2015:1911

Comment 11 Bryan Kearney 2015-10-29 12:36:04 UTC

*** Bug 1264208 has been marked as a duplicate of this bug. ***