Bug 1612977
| Summary: | katello-certs-check not showing full report | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Chris Roberts <chrobert> |
| Component: | Certificates | Assignee: | Chris Roberts <chrobert> |
| Status: | CLOSED ERRATA | QA Contact: | Nikhil Kathole <nkathole> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.4 | CC: | chrobert, gpayelka, inecas, nkathole, sghai, zhunting |
| Target Milestone: | 6.4.0 | Keywords: | Regression, Triaged |
| Target Release: | Unused | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| URL: | https://projects.theforeman.org/issues/24574 | ||
| Whiteboard: | |||
| Fixed In Version: | katello-installer-base-3.7.0.1-1 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-16 19:23:00 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1619394 | ||
*** Bug 1612975 has been marked as a duplicate of this bug. *** I'm not sure I understand the bug report. What is the expected behaviour? Since it's marked as regression, what's the different behaviour comparing to 6.3? Ivan, There was a logic flaw I had when I made it, I will make a PR so you can see the difference. Version tested:
Satellite 6.4 snap 19
When CN= hostname
Checking server certificate's encoding: [OK]
Checking expiration of certificate: [OK]
Checking expiration of CA bundle: [OK]
Checking if server cert has CA:TRUE flag[OK]
Validating the certificate subject= /C=IN/ST=Maharashtra/L=Pune/O=redhat/OU=QE/CN=<$hostname>
Checking to see if the private key matches the certificate: [OK]
Checking ca bundle against the cert file: [OK]
Checking Subject Alt Name on certificate[OK]
Checking Key Usage extension on certificate for Key Encipherment[OK]
Validation succeeded.
To install the Katello main server with the custom certificates, run:
foreman-installer --scenario katello\
--certs-server-cert "/root/server.valid.crt"\
--certs-server-key "/root/server.key"\
--certs-server-ca-cert "/root/rootCA.pem"
To update the certificates on a currently running Katello installation, run:
foreman-installer --scenario katello\
--certs-server-cert "/root/server.valid.crt"\
--certs-server-key "/root/server.key"\
--certs-server-ca-cert "/root/rootCA.pem"\
--certs-update-server --certs-update-server-ca
when CN != hostname
Checking server certificate's encoding: [OK]
Checking expiration of certificate: [OK]
Checking expiration of CA bundle: [OK]
Checking if server cert has CA:TRUE flag[OK]
Validating the certificate subject= /C=IN/ST=Maharashtra/L=Pune/O=redhat/OU=QE/CN=CAPSULE_FQDN
Checking to see if the private key matches the certificate: [OK]
Checking ca bundle against the cert file: [OK]
Checking Subject Alt Name on certificate[OK]
Checking Key Usage extension on certificate for Key Encipherment[OK]
Validation succeeded.
To use them inside a NEW $FOREMAN_PROXY, run this command:
foreman-proxy-certs-generate --foreman-proxy-fqdn "$FOREMAN_PROXY"\
--certs-tar "~/$FOREMAN_PROXY-certs.tar"\
--server-cert "/root/server.valid.crt"\
--server-key "/root/server.key"\
--server-ca-cert "/root/rootCA.pem"\
To use them inside an EXISTING $FOREMAN_PROXY, run this command INSTEAD:
foreman-proxy-certs-generate --foreman-proxy-fqdn "$FOREMAN_PROXY"\
--certs-tar "~/$FOREMAN_PROXY-certs.tar"\
--server-cert "/root/server.valid.crt"\
--server-key "/root/server.key"\
--server-ca-cert "/root/rootCA.pem"\
--certs-update-server
For branding issue, we are tracking https://bugzilla.redhat.com/show_bug.cgi?id=1600866#c4
Hi Chris, can you verify once above behaviour is correct? I feel also we need documentation issue for this as we are not showing commands for both capsule and satellite as before.
Hi, This is correct, we do not want to show both because it causes confusion for the customer. Since your hostname matches the sat we only show for the satellite installer, when not we show what to do to make capsule certs. I would mark this as verified. Thanks Chris. Marking as verified. Also raised doc bug to change expected example output. https://bugzilla.redhat.com/show_bug.cgi?id=1625255 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:2927 |
Description of problem: Katello-certs-check not showing full results if certname = hostname Version-Release number of selected component (if applicable): 6.4.0 [root vm251-153 ~]# katello-certs-check -c root_ca/vm251-153.gsslab.pnq2.redhat.com.crt -k SSL-est/server.key -b root_ca/ca-chain.crt.pem Checking server certificate's encoding: [OK] Checking expiration of certificate: [OK] Checking expiration of CA bundle: [OK] Checking if server cert has CA:TRUE flag[OK] Validating the certificate subject= /C=IN/ST=Maharashtra/L=Pune/O=redhat LTD/OU=satellite/emailAddress=root localhost/CN=vm251-153.gsslab.pnq2.redhat.com Checking to see if the private key matches the certificate: [OK] Checking ca bundle against the cert file: [OK] Checking Subject Alt Name on certificate[OK] Checking Key Usage extension on certificate for Key Encipherment[OK] Validation succeeded. To use them inside a NEW $FOREMAN_PROXY, run this command: capsule-certs-generate --foreman-proxy-fqdn "$FOREMAN_PROXY"\ --certs-tar "~/$FOREMAN_PROXY-certs.tar"\ --server-cert "/root/root_ca/vm251-153.gsslab.pnq2.redhat.com.crt"\ --server-key "/root/SSL-est/server.key"\ --server-ca-cert "/root/root_ca/ca-chain.crt.pem"\ To use them inside an EXISTING $FOREMAN_PROXY, run this command INSTEAD: capsule-certs-generate --foreman-proxy-fqdn "$FOREMAN_PROXY"\ --certs-tar "~/$FOREMAN_PROXY-certs.tar"\ --server-cert "/root/root_ca/vm251-153.gsslab.pnq2.redhat.com.crt"\ --server-key "/root/SSL-est/server.key"\ --server-ca-cert "/root/root_ca/ca-chain.crt.pem"\ --certs-update-server