Bug 1372725

Summary: Unable to generate an entitlement certificate for custom repository
Product: Red Hat Update Infrastructure for Cloud Providers Reporter: Michal Dekan <mdekan>
Component: RHUAAssignee: RHUI Bug List <rhui-bugs>
Status: CLOSED WORKSFORME QA Contact: Irina Gulina <igulina>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 2.1.3CC: igulina, mdekan
Target Milestone: ---Flags: mdekan: needinfo-
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-01-12 14:45:01 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Comment 3 Irina Gulina 2016-11-22 10:42:44 UTC
I wasn't able to reproduce it on RHUI2 ISO 20160523:


>> rhui (repo) => c

Unique ID for the custom repository (alphanumerics, _, and - only):
custom_protected_repo1

Display name for the custom repository [custom_protected_repo1]:


Path at which the repository will be served [custom_protected_repo1]:


Algorithm to use when calculating the checksum values for repository metadata:
* Select "sha256" for RHEL6:
* Select "sha1" for either RHEL5 or RHEL6:

  1  - sha256
  2  - sha1
Enter value (1-2) or 'b' to abort: 2

Should the repository require an entitlement certificate to access? (y/n)
y

Based on the repository's relative path, the suggested entitlement path is:
  custom_protected_repo1

Path that should be used when granting an entitlement for this repository. This
may use yum variable substitutions (e.g. $basearch) to group this together with
other repositories that share the entitlement [custom_protected_repo1]:


Should the repository require clients to perform a GPG check and
verify packages are signed by a GPG key? (y/n)
n

The following repository will be created:
  ID:              custom_protected_repo1
  Name:            custom_protected_repo1
  Path:            custom_protected_repo1
  Entitlement:     custom_protected_repo1
  GPG Check        No
  Red Hat GPG Key: No
Proceed? (y/n) y

Successfully created repository custom_protected_repo1

>> rhui (cds) => s

-= RHUI Content Delivery Server Clusters =-

Select the CDS Cluster for repo association:
  1  - cluster_1
  2  - cluster_2
Enter value (1-2) or 'b' to abort: 1
Select one or more repositories to associate with the cluster_1 cluster: 

  Custom Repositories
    -  1 : custom_protected_repo1
    -  2 : custom_repo_1
    -  3 : custom_repo_2
    -  4 : protected_repo1
    -  5 : unprotected_repo1

  Red Hat Repositories
    -  6 : Red Hat Update Infrastructure 2.0 (RPMs) (6Server-i386)
    -  7 : Red Hat Update Infrastructure 2.0 (RPMs) (6Server-x86_64)
    -  8 : Red Hat Update Infrastructure 2.0 (SRPMS) (6Server-i386)
    -  9 : Red Hat Update Infrastructure 2.0 (SRPMS) (6Server-x86_64)

Enter value (1-9) to toggle selection, 'c' to confirm selections, or '?' for more commands: 1

Select one or more repositories to associate with the cluster_1 cluster: 

  Custom Repositories
    x  1 : custom_protected_repo1
    -  2 : custom_repo_1
    -  3 : custom_repo_2
    -  4 : protected_repo1
    -  5 : unprotected_repo1

  Red Hat Repositories
    -  6 : Red Hat Update Infrastructure 2.0 (RPMs) (6Server-i386)
    -  7 : Red Hat Update Infrastructure 2.0 (RPMs) (6Server-x86_64)
    -  8 : Red Hat Update Infrastructure 2.0 (SRPMS) (6Server-i386)
    -  9 : Red Hat Update Infrastructure 2.0 (SRPMS) (6Server-x86_64)

Enter value (1-9) to toggle selection, 'c' to confirm selections, or '?' for more commands: c


The following repositories will be associated with the cluster_1 cluster:

Custom Repositories
  custom_protected_repo1

Proceed? (y/n) y

Associating repository custom_protected_repo1...
  ... successfully associated repository

Content will not be downloaded to the cluster until the next cluster sync is run.


>> rhui (client) => e

Select the CDS cluster that clients using this entitlement certificate will use to download content:

  1  - cluster_1
  2  - cluster_2
Enter value (1-2) or 'b' to abort: 1

Select one or more repositories to include in the entitlement certificate:

  Custom Repositories
    -  1 : custom_protected_repo1
             custom_protected_repo1


  Red Hat Repositories

Enter value (1-1) to toggle selection, 'c' to confirm selections, or '?' for more commands: 1

Select one or more repositories to include in the entitlement certificate:

  Custom Repositories
    x  1 : custom_protected_repo1
             custom_protected_repo1


  Red Hat Repositories

Enter value (1-1) to toggle selection, 'c' to confirm selections, or '?' for more commands: c


Name of the certificate. This will be used as the name of the certificate file
(name.crt) and its associated private key (name.key). Choose something that will
help identify the products contained with it:
my_cert_rhui2_custom

Local directory in which to save the generated certificate [current directory]:
/tmp

Number of days the certificate should be valid [365]:


Repositories to be included in the entitlement certificate:

  Custom Entitlements
    custom_protected_repo1

Proceed? (y/n) y

...+++
.......................................................+++
Enter pass phrase for /etc/pki/rhui/entitlement-ca-key.pem:
Entitlement certificate created at /tmp/my_cert_rhui2_custom.crt

------------------------------------------------------------------------------

>> ls -la /tmp/my_cert_rhui2_custom.crt
-rw-r--r--. 1 root root 1354 Nov 22 05:25 /tmp/my_cert_rhui2_custom.crt




Also everything works fine on RHUI3 ISO 20161115 on RHEL6 and RHEL7:


>> rhui (repo) => c

Unique ID for the custom repository (alphanumerics, _, and - only):
protected_custom_repo1

Display name for the custom repository [protected_custom_repo1]:


Unique path at which the repository will be served [protected_custom_repo1]:


Algorithm to use when calculating the checksum values for repository metadata:

  1  - sha256 (default)
  2  - sha1 (RHEL 5)
Enter value (1-2) or 'b' to abort: 1

Should the repository require an entitlement certificate to access? (y/n)
y

Based on the repository's relative path, the suggested entitlement path is:
  protected_custom_repo1

Path that should be used when granting an entitlement for this repository. This
may use yum variable substitutions (e.g. $basearch) to group this together with
other repositories that share the entitlement [protected_custom_repo1]:


Should the repository require clients to perform a GPG check and
verify packages are signed by a GPG key? (y/n)
n

The following repository will be created:
  ID:              protected_custom_repo1
  Name:            protected_custom_repo1
  Path:            protected_custom_repo1
  Entitlement:     protected_custom_repo1
  GPG Check        No
  Red Hat GPG Key: No
Proceed? (y/n) y

Successfully created repository protected_custom_repo1

>> rhui (client) => e

Select one or more repositories to include in the entitlement certificate:

  Custom Repositories
    -  1 : protected/protected_custom_repo1
             protected_custom_repo1


  Red Hat Repositories

Enter value (1-1) to toggle selection, 'c' to confirm selections, or '?' for more commands: 1

Select one or more repositories to include in the entitlement certificate:

  Custom Repositories
    x  1 : protected/protected_custom_repo1
             protected_custom_repo1


  Red Hat Repositories

Enter value (1-1) to toggle selection, 'c' to confirm selections, or '?' for more commands: c


Name of the certificate. This will be used as the name of the certificate file
(name.crt) and its associated private key (name.key). Choose something that will
help identify the products contained with it:
my_cert

Local directory in which to save the generated certificate [current directory]:
/tmp

Number of days the certificate should be valid [365]:


Repositories to be included in the entitlement certificate:

  Custom Entitlements
    protected/protected_custom_repo1

Proceed? (y/n) y

...+++
.....+++
Entitlement certificate created at /tmp/my_cert.crt

------------------------------------------------------------------------------
>> ls -la /tmp/my_cert.crt
-rw-r--r--. 1 root root 1403 Nov 22 05:12 /tmp/my_cert.crt


Please let me know if the problem is still there or this BZ can be closed.