Bug 1874045

Document URL: 

SATELLITE --> https://access.redhat.com/documentation/en-us/red_hat_satellite/6.8-beta/html-single/installing_satellite_server_from_a_connected_network/index#configuring-satellite-custom-server-certificate_satellite 


CAPSULE --> https://access.redhat.com/documentation/en-us/red_hat_satellite/6.8-beta/html/installing_capsule_server/installing-capsule-server#configuring-capsule-custom-server-certificate_capsule


Section Number and Name: 

NA

Describe the issue: 

* We have steps provided in our product documentation about how to install custom SSL certificates on Satellite and capsule servers.

* We don't have any steps provided in case someone wants to revert back from Custom SSL to default Self-Signed certificates.


Suggestions for improvement: 

I have the steps outlined which were tested against, Satellite 6.8-beta and should be working for Satellite 6.6 and 6.7 as well.



On Satellie.

1. Reset back SSL certs for Satellite server to Self-Signed certs.
# satellite-installer --certs-reset


2. Ensure that following parameters in "/etc/foreman-installer/scenarios.d/satellite-answers.yaml" are having no values mentioned.  
~~~
  server_cert:
  server_key:
  server_cert_req:
  server_ca_cert:
~~~

3. Generate new certificate tar bundle for capsule server(s).
# capsule-certs-generate --foreman-proxy-fqdn capsule.example.com --certs-tar /root/capsule.example.com-certs.tar --certs-update-all

4. Note down the satellite-installer command provided by above command.


5. Copy the new certificate tar bundle to capsule server.
# scp /root/capsule.example.com-certs.tar root.com:/root/capsule.example.com-certs.tar



On Capsule,

1. Verify that "/root/capsule.example.com-certs.tar" is present.

2. Update the new "katello-ca-consumer-latest.noarch.rpm" package.
# yum -y localinstall http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm
# subscription-manager refresj

3. Execute the entire "satellite-installer" command provided by "capsule-certs-generate" command earlier. An example command will look like as following:
~~~
satellite-installer --scenario capsule \
     --certs-tar-file "/root/capsule.example.com-certs.tar" \
     --foreman-proxy-content-parent-fqdn "satellite.example.com" \
     --foreman-proxy-register-in-foreman "true" \ 
     --foreman-proxy-foreman-base-url "https://satellite.example.com" \                  
     --foreman-proxy-trusted-hosts "satellite.example.com" \
     --foreman-proxy-trusted-hosts "capsule.example.com" \
     --foreman-proxy-oauth-consumer-key "cjFsGy5ZFuXUJvKejrjf9SGCG4Souy5G" \
     --foreman-proxy-oauth-consumer-secret "TZRxacFCrB3TqvyArnio9ERuT9K68Vuj" \
     --puppet-server-foreman-url "https://satellite.example.com"
~~~


4. From Satellite GUI, Infrastructure --> Capsules --> Click on "capsule.example.com --> Click on "Refresh Features" .



Additional information: 

* From my point of view, it makes sense to provide this information via product documentation rather than via a solution article.

* There were scenarios where Custom SSL certificate were expired for satellite and CA was not available to provide new signed certificates which caused business outages or production delays. With above information provide, if someone wants, they can easily choose to revert back to default self-signed certificates and continue working with satellite\capsule without any issues.