Bug 1383996

Summary:	Capsule does not work with certificate with key of 16384 bits
Product:	Red Hat Satellite	Reporter:	Peter Vreman <peter.vreman>
Component:	Installer	Assignee:	satellite6-bugs <satellite6-bugs>
Status:	CLOSED WONTFIX	QA Contact:	Katello QA List <katello-qa-list>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.2.2	CC:	bkearney, jcallaha, stbenjam
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-09-04 17:45:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1122832

Description Peter Vreman 2016-10-12 10:36:09 UTC

Description of problem:
Running the installer to update the certifictes fails refreshing the internal proxy features, at least when remote execution is enabled.

[ INFO 2016-10-12 10:28:27 verbose]  Class[Foreman_proxy::Register]: Scheduling refresh of Foreman_smartproxy[li-lc-1578.hag.hilti.com]
[ERROR 2016-10-12 10:28:57 verbose]  /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[li-lc-1578.hag.hilti.com]: Failed to call refresh: Proxy li-lc-1578.hag.hilti.com cannot be registered (500 Internal Server Error): N/A
[ERROR 2016-10-12 10:28:57 verbose]  /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[li-lc-1578.hag.hilti.com]: Proxy li-lc-1578.hag.hilti.com cannot be registered (500 Internal Server Error): N/A
[ INFO 2016-10-12 10:28:57 verbose] /usr/share/ruby/vendor_ruby/puppet/util/errors.rb:106:in `fail'
[ INFO 2016-10-12 10:28:57 verbose] /usr/share/foreman-installer/modules/foreman/lib/puppet/provider/foreman_smartproxy/rest_v2.rb:7:in `raise_error'
[ INFO 2016-10-12 10:28:57 verbose] /usr/share/foreman-installer/modules/foreman/lib/puppet/provider/foreman_smartproxy/rest_v2.rb:101:in `rescue in refresh_features!'
[ INFO 2016-10-12 10:28:57 verbose] /usr/share/foreman-installer/modules/foreman/lib/puppet/provider/foreman_smartproxy/rest_v2.rb:99:in `refresh_features!'
[ INFO 2016-10-12 10:28:57 verbose] /usr/share/foreman-installer/modules/foreman/lib/puppet/type/foreman_smartproxy.rb:49:in `refresh'
[ INFO 2016-10-12 10:28:57 verbose] /usr/share/ruby/vendor_ruby/puppet/transaction/event_manager.rb:101:in `process_callback'


Command user to update the certificates:

satellite-installer --scenario=satellite --verbose --certs-update-server --certs-update-server-ca --certs-server-cert sat6certA.example.com.cer --certs-server-cert-req sat6certA.example.com.req --certs-server-key sat6certA.example.com.key --certs-server-ca-cert sat6certA.example.com.ca-bundle


Fragement from the production.log that shows that the proxy wants to communciates, but fails because certifictes changed

2016-10-12 10:28:53 [app] [I] Authorized user foreman_api_admin(API Admin)
2016-10-12 10:28:53 [app] [W] Action failed
 | ProxyAPI::ProxyException: ERF12-9411 [ProxyAPI::ProxyException]: Unable to fetch public key ([OpenSSL::SSL::SSLError]: SSL_connect returned=1 errno=0 state=
SSLv3 read server session ticket A: sslv3 alert il...) for Capsule https://li-lc-1578.hag.hilti.com:9090/ssh
 | /opt/theforeman/tfm/root/usr/share/gems/gems/foreman_remote_execution-0.3.0.12/app/lib/proxy_api/remote_execution_ssh.rb:11:in `rescue in pubkey'
 | /opt/theforeman/tfm/root/usr/share/gems/gems/foreman_remote_execution-0.3.0.12/app/lib/proxy_api/remote_execution_ssh.rb:9:in `pubkey'
 | /opt/theforeman/tfm/root/usr/share/gems/gems/foreman_remote_execution-0.3.0.12/app/models/concerns/foreman_remote_execution/smart_proxy_extensions.rb:15:in
`update_pubkey'
 | /opt/theforeman/tfm/root/usr/share/gems/gems/foreman_remote_execution-0.3.0.12/app/models/concerns/foreman_remote_execution/smart_proxy_extensions.rb:22:in
`refresh_with_remote_execution'



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Isntall Sat6 without custom certificates, enable remote execution
2. Make sure internal proxy has feature remote execution
3. Update the certificates on the Sat6 server

Actual results:
Failure in installer

Expected results:
Success


Additional info:

Comment 1 Stephen Benjamin 2016-10-13 15:27:09 UTC

Created redmine issue http://projects.theforeman.org/issues/16906 from this bug

Comment 3 Peter Vreman 2016-10-14 08:15:39 UTC

The root cause was that we got a certificate with a private key of 16384 bits. This large private key is not supported by the smart proxy.

Reproduction:
1. Create a private key of 16384 bits
openssl genrsa -out $(hostname -f).key 16384
2. Createa and Sign the certificate
3. Configure Satellite 6 to use the custom certificate

Comment 5 Bryan Kearney 2018-09-04 17:45:42 UTC

Thank you for your interest in Satellite 6. We have evaluated this request, and we do not expect this to be implemented in the product in the foreseeable future. We are therefore closing this out as WONTFIX. If you have any concerns about this, please feel free to contact Rich Jerrido or Bryan Kearney. Thank you.