Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
When regenerating the CA certificates on Satellite 6 the ueber certificates should also be regenerated. Otherwise, downstream Capsules will run into issues with synchronizing content.
Version-Release number of selected component (if applicable):
satellite-installer-6.2.0.13-1.el7sat.noarch
How reproducible:
Always.
Steps to Reproduce:
1. Delete contents of /root/ssl-build and /root/ssl-build/<SAT_FQDN>
2. # satellite-installer --certs-update-all --certs-regenerate-ca --certs-regenerate
3. Generate and install new certificate bundle for Capsules
4. Observe that Capsule content synchronization fails
nectar.downloaders.threaded:ERROR: Skipping requests to <SAT_FQDN> due to repeated connection failures: [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:579)
Actual results:
- ueber certificate is still based off of old CA
- Capsule content synchronization fails
Expected results:
- ueber certificate has been refreshed against the new CA
- Capsule content synchronization is successful
Additional info:
Can be worked around by manually deleting the old ueber certificates in Candlepin.
Perhaps the installer can run this rake task in upstream that regenerates the ueber certificates:
http://projects.theforeman.org/issues/18403
Renzo,
The change made was to verify the ueber cert is still valid on a capsule sync. https://github.com/Katello/katello/pull/6728
Here is what I would do to validate:
- install capsule
- satellite-installer --certs-update-all --certs-regenerate-ca --certs-regenerate
on the main Satellite
- verify that the CA has changed
- generate new capsule certs
- reinstall capsule
- verify you can resync capsule
If this doesn't work, there is also a task to regenerate the ueber certs - foreman-rake katello:regenerate_ueber_certs to get around this issue.
Let me know if you have any questions
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2017:2803