Bug 1747512

Summary: [RFE] katello-certs-check should display a warning if there is a passphrase protected key file
Product: Red Hat Satellite Reporter: Ganesh Payelkar <gpayelka>
Component: CertificatesAssignee: Chris Roberts <chrobert>
Status: CLOSED ERRATA QA Contact: Stephen Wadeley <swadeley>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.6.0CC: bkearney, chrobert, pcreech, sadas, saydas
Target Milestone: 6.7.0Keywords: FutureFeature, Triaged
Target Release: Unused   
Hardware: x86_64   
OS: Linux   
URL: https://projects.theforeman.org/issues/27876
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-04-14 13:25:28 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Ganesh Payelkar 2019-08-30 16:32:34 UTC
Description of problem:

katello-certs-check should display a warning if there is a passphrase protected  

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Create a key with password protected
2. # openssl genrsa -aes128 -passout pass:foobar -out /root/sat_cert/satellite_cert_key.pem  4096
3. For verification use katello-certs-check

Actual results:

# katello-certs-check -c vm250-205.gsslab.pnq2.redhat.com.crt -k satellite_cert_key.pem -b CA-Chain.crt
Checking server certificate encoding: 

Checking expiration of certificate: 

Checking expiration of CA bundle: 

Checking if server certificate has CA:TRUE flag 

Checking to see if the private key matches the certificate: Enter pass phrase for /root/sat_cert/satellite_cert_key.pem:


Checking CA bundle against the certificate file: 

Checking Subject Alt Name on certificate 

Checking Key Usage extension on certificate for Key Encipherment 

Validation succeeded

To install the Red Hat Satellite Server with the custom certificates, run:

    satellite-installer --scenario satellite \
                        --certs-server-cert "/root/sat_cert/satellite.crt" \
                        --certs-server-key "/root/sat_cert/satellite_cert_key.pem" \
                        --certs-server-ca-cert "/root/sat_cert/CA-Chain.crt"

To update the certificates on a currently running Red Hat Satellite installation, run:

    satellite-installer --scenario satellite \
                        --certs-server-cert "/root/sat_cert/satellite.crt" \
                        --certs-server-key "/root/sat_cert/satellite_cert_key.pem" \
                        --certs-server-ca-cert "/root/sat_cert/CA-Chain.crt" \
                        --certs-update-server --certs-update-server-ca

Expected results:

It should warn us that you have a password-protected key and it will not work with satellite 

Additional info:

Comment 5 Bryan Kearney 2019-10-29 00:03:46 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/27876 has been resolved.

Comment 9 errata-xmlrpc 2020-04-14 13:25:28 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.