Bug 1306964
| Summary: | Installer answer file contains wrong path to the 'server_ssl_chain' file. | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Marcel Gazdík <mgazdik> |
| Component: | Installation | Assignee: | Ivan Necas <inecas> |
| Status: | CLOSED ERRATA | QA Contact: | Evgeni Golov <egolov> |
| Severity: | low | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.1.6 | CC: | ahuchcha, bkearney, chrobert, egolov, erinn.looneytriggs, inecas, jcallaha, ktordeur, marbet, pghadge, pmoravec |
| Target Milestone: | Unspecified | Keywords: | Triaged |
| Target Release: | Unused | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| URL: | http://projects.theforeman.org/issues/13687 | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-02-21 16:54:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Created redmine issue http://projects.theforeman.org/issues/13687 from this bug Patch sent into the upstream installer https://github.com/Katello/katello-installer/pull/296 Moving 6.2 bugs out to sat-backlog. Moving 6.2 bugs out to sat-backlog. Moving to POST since upstream bug http://projects.theforeman.org/issues/13687 has been closed *** Bug 1249160 has been marked as a duplicate of this bug. *** *** Bug 1402011 has been marked as a duplicate of this bug. *** VERIFIED
Version Tested: Satellite 6.3.0 Snap 12
The answers file and the httpd config now contain the right cert file:
[root@sat63-qa-rhel7 ~]# grep SSLCertificateChainFile /etc/httpd/conf.d/05-foreman-ssl.conf -A 1 -B 1
SSLCertificateKeyFile "/etc/pki/katello/private/katello-apache.key"
SSLCertificateChainFile "/etc/pki/katello/certs/katello-server-ca.crt"
SSLCACertificateFile "/etc/pki/katello/certs/katello-default-ca.crt"
[root@sat63-qa-rhel7 ~]# grep server_ssl_chain /etc/foreman-installer/scenarios.d/katello-answers.yaml -A 1 -B 1
server_ssl_ca: /etc/pki/katello/certs/katello-default-ca.crt
server_ssl_chain: /etc/pki/katello/certs/katello-server-ca.crt
server_ssl_crl: ''
[root@sat63-qa-rhel7 ~]# grep server_ssl_chain /etc/foreman-installer/scenarios.d/satellite-answers.yaml -A 1 -B 1
server_ssl_ca: /etc/pki/katello/certs/katello-default-ca.crt
server_ssl_chain: /etc/pki/katello/certs/katello-server-ca.crt
server_ssl_cert: /etc/pki/katello/certs/katello-apache.crt
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA.
>
> For information on the advisory, and where to find the updated files, follow the link below.
>
> If the solution does not work for you, open a new bug report.
>
> https://access.redhat.com/errata/RHSA-2018:0336
|
Description of problem: Customer is trying to use custom certificate authority chain file. Despite of all the changes made in certificate files, the path to SSL chain file in apache configuration file 05-foreman-ssl.conf is wrong. Instead of pointing to the katello-default-ca.crt it should pointing to katello-server-ca.crt where the custom chain file is saved. Version-Release number of selected component (if applicable): 6.1.6 How reproducible: Install the satellite and apply custom certificates. Steps to Reproduce: 1. Install satellite 2. Run katello-installer to modify the certificates katello-installer --certs-server-cert "/root/$SAT.crt" \ --certs-server-cert-req "/root/$SAT.csr" \ --certs-server-key "/root/$SAT.key" \ --certs-server-ca-cert '/root/new_ca.crt' \ --certs-update-server \ --certs-update-server-ca 3. Check path to the SSL certificate chain file in the '/etc/httpd/conf.d/05-foreman-ssl.conf' file. Actual results: The 'SSLCertificateChainFile' option in the '/etc/httpd/conf.d/05-foreman-ssl.conf' files points to 'katello-default-ca.crt' instead of 'katello-server-ca.crt' $ grep SSLCertificateChainFile /etc/httpd/conf.d/05-foreman-ssl.conf -A 1 -B 1 SSLCertificateKeyFile "/etc/pki/katello/private/katello-apache.key" SSLCertificateChainFile "/etc/pki/katello/certs/katello-default-ca.crt" SSLCACertificatePath "/etc/pki/tls/certs" Source of this error can be found in the katello-installer answer file: $ grep server_ssl_chain /etc/katello-installer/answers.katello-installer.yaml -A 1 -B 1 server_ssl_ca: /etc/pki/katello/certs/katello-default-ca.crt server_ssl_chain: /etc/pki/katello/certs/katello-default-ca.crt server_ssl_cert: /etc/pki/katello/certs/katello-apache.crt Expected results: Modification of the '/etc/katello-installer/answers.katello-installer.yaml' file will lead to correct path to the SSL certificate chain file in the '/etc/httpd/conf.d/05-foreman-ssl.conf' $ grep server_ssl_chain /etc/katello-installer/answers.katello-installer.yaml -A 1 -B 1 server_ssl_ca: /etc/pki/katello/certs/katello-default-ca.crt server_ssl_chain: /etc/pki/katello/certs/katello-server-ca.crt server_ssl_cert: /etc/pki/katello/certs/katello-apache.crt $ grep SSLCertificateChainFile /etc/httpd/conf.d/05-foreman-ssl.conf -A 1 -B 1 SSLCertificateKeyFile "/etc/pki/katello/private/katello-apache.key" SSLCertificateChainFile "/etc/pki/katello/certs/katello-server-ca.crt" SSLCACertificatePath "/etc/pki/tls/certs" Additional info: (workaround) Modify the answer file: sed -i -e 's/server_ssl_chain: \/etc\/pki\/katello\/certs\/katello-default-ca.crt/server_ssl_chain: \/etc\/pki\/katello\/certs\/katello-server-ca.crt/' /etc/katello-installer/answers.katello-installer.yaml re-run katello-installer without parameters.