Bug 1459569
| Summary: | RHV provider does not trust certificate authorities from the system CA database | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat CloudForms Management Engine | Reporter: | Ilanit Stein <istein> | ||||
| Component: | Providers | Assignee: | Juan Hernández <juan.hernandez> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Angelina Vasileva <anikifor> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 5.8.0 | CC: | gblomqui, istein, jfrey, jhardy, mgoldboi, obarenbo, rhrazdil | ||||
| Target Milestone: | GA | Keywords: | TestOnly, ZStream | ||||
| Target Release: | 5.9.0 | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | rhev | ||||||
| Fixed In Version: | 5.9.0.1 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 1478560 (view as bug list) | Environment: | |||||
| Last Closed: | 2018-03-06 15:22:40 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | Bug | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | RHEVM | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1478560 | ||||||
| Attachments: |
|
||||||
|
Description
Ilanit Stein
2017-06-07 13:25:55 UTC
Created attachment 1285799 [details]
evm.log
Look for ERROR from the bottom of the log.
Please assess the importance of this issue and update the priority accordingly. Somewhere it was missed in the bug triage process. Please refer to https://bugzilla.redhat.com/page.cgi?id=fields.html#priority for a reminder on each priority's definition. If it's something like a tracker bug where it doesn't matter, please set it to Low/Low. Note that the issue is that the RHV provider doesn't trust the certificate authorities that are registered in the system certificate database, it only trusts the certificate authorities provided explicitly in the form used to add the provider. If nothing is provided in that form, then the provider doesn't trust anything. So the provider is actually more strict than it should. Most RHV installations use a self-signed certificate authority, so this isn't a big issue because it is easier (for the CFME admin) to paste that self-signed certificate in the form than to add it to the system certificate database. For this reason I am lowering the severity. This issue is addressed by the following pull request: Use nil ca_certs to trust system CAs https://github.com/ManageIQ/manageiq-providers-ovirt/pull/63 See the description of that pull request for information about how to verify the issue. In particular note that the library used by the 'ovirt-engine-sdk' gem doesn't reload the system CA database. That means that in order to test this using version 4 of the RHV API the CFME appliance needs to be restarted after adding the RHV CA certificate to the system CA database. Verified that after following Steps to Reproduce, provider verification succeeds. CFME 5.0.9.2, RHV 4.1.3 |