Bug 1930782

Reproduction:

~~~
######################################################################## 100.0%
Generating a 2048 bit RSA private key
.................+++
........+++
writing new private key to 'private/cakey.crt'
-----
Generating RSA private key, 4096 bit long modulus
...................................++
........................................................................................................................................................................................................................................++
e is 65537 (0x10001)
Using configuration from openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'US'
stateOrProvinceName   :ASN.1 12:'State'
localityName          :ASN.1 12:'City'
organizationName      :ASN.1 12:'Organization'
organizationalUnitName:ASN.1 12:'Division'
commonName            :ASN.1 12:'satellite.example.com'
Certificate is to be certified until Feb 19 15:12:03 2022 GMT (365 days)

Write out database with 1 new entries
Data Base Updated
Checking server certificate encoding: 
[OK]

Checking expiration of certificate: 
[OK]

Checking expiration of CA bundle: 
[OK]

Checking if server certificate has CA:TRUE flag 
[OK]

Checking for private key passphrase: 
[OK]

Checking to see if the private key matches the certificate: 
[OK]

Checking CA bundle against the certificate file: 
[OK]

Checking CA bundle size: 
[OK]

Checking Subject Alt Name on certificate 
[OK]

Checking Key Usage extension on certificate for Key Encipherment 
[OK]

Validation succeeded


To install the Red Hat Satellite Server with the custom certificates, run:

    satellite-installer --scenario satellite \
                      --certs-server-cert "/tmp/tmp.MV0JwM63nw/satellite_cert.pem" \
                      --certs-server-key "/tmp/tmp.VdEfT9W0Ou/satellite_cert_key.pem" \
                      --certs-server-ca-cert "/tmp/tmp.MV0JwM63nw/cacert.crt"

To update the certificates on a currently running Red Hat Satellite installation, run:

    satellite-installer --scenario satellite \
                      --certs-server-cert "/tmp/tmp.MV0JwM63nw/satellite_cert.pem" \
                      --certs-server-key "/tmp/tmp.VdEfT9W0Ou/satellite_cert_key.pem" \
                      --certs-server-ca-cert "/tmp/tmp.MV0JwM63nw/cacert.crt" \
                      --certs-update-server --certs-update-server-ca
To use them inside a NEW $CAPSULE, rerun this command with -t capsule
Package versions are locked. Continuing with unlock.
Marking certificate /root/ssl-build/satellite.example.com/satellite.example.com-apache for update
Marking certificate /root/ssl-build/satellite.example.com/satellite.example.com-foreman-proxy for update
Marking certificate /root/ssl-build/katello-server-ca for update
Preparing installation Done                                              
  Success!
  * Satellite is running at https://satellite.example.com

  * To install an additional Capsule on separate machine continue by running:

      capsule-certs-generate --foreman-proxy-fqdn "$CAPSULE" --certs-tar "/root/$CAPSULE-certs.tar"

  * To upgrade an existing 6.7 Capsule to 6.8:
      Please see official documentation for steps and parameters to use when upgrading a 6.7 Capsule to 6.8.

  * Capsule is running at https://satellite.example.com:9090
  The full log is at /var/log/foreman-installer/satellite.log
Package versions are being locked.

[...satellite-installer omitted...]
~~~

~~~
# openssl verify -verbose -CAfile "/tmp/tmp.MV0JwM63nw/cacert.crt" "/tmp/tmp.MV0JwM63nw/satellite_cert.pem"
/tmp/tmp.MV0JwM63nw/satellite_cert.pem: OK
~~~

On RHEL 8 host:
~~~
[~]# cat /etc/redhat-release
Red Hat Enterprise Linux release 8.3 (Ootpa)

[~]# update-crypto-policies --set FUTURE
Setting system policy to FUTURE
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change of policies
to fully take place.

[~]# rpm -e $(rpm -qa 'katello-ca-consumer*'); rpm -Uvh http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm
Retrieving http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:katello-ca-consumer-satellite.exa################################# [100%]

[~]# subscription-manager register --user admin --pass redhat
Registering to: satellite.example.com:443/rhsm
Unable to verify server's identity: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)

[~]# update-crypto-policies --set DEFAULT
Setting system policy to DEFAULT
Note: System-wide crypto policies are applied on application start-up.
It is recommended to restart the system for the change of policies
to fully take place.

[~]# subscription-manager register --user admin --pass redhat
Registering to: satellite.example.com:443/rhsm
The system has been registered with ID: 11dbef61-6651-43ff-9faa-67f6ee60d3d3
The registered system name is: host.example.com
~~~

Should katello-certs-check issue an information to the user, that a 2k CA might be insufficient in some cases?
Probably doesn't deserve a warning as it's OK in *most* cases, but not if you have FUTURE-enabled clients?

As the core of this BZ has been fixed and released already, I am opting to close as current release.