Description of problem:
System Engine generates its own CA Cert during install and uses it for the Web UI and signing other certs used for communication between pulp, candlepin, and AMQP.
Issues with this, outlined at https://fedorahosted.org/katello/wiki/CertsRedesign, along with a lot more detail are:
all server certs are signed by Candlepin CA
Candlepin CA serves as both server cert and CA cert
its key is not password protected
its key is accessible by three system users
certs are not trusted
no multihome support
Version-Release number of selected component (if applicable):
System Engine 1.1 Beta
Thus far https://bugzilla.redhat.com/show_bug.cgi?id=754728 to document the process for replacing the CA with a subordinate CA signed by our CA has not been completed, and I have been told that the process will not be supported until 2.0.
How reproducible:
Always
Steps to Reproduce:
1. Install System Engine
Actual results:
See that the CA Cert created during install is used as the server cert and the CA Cert for signing other certs. Look for documentation on replacing the CA Cert with a subordinate CA signed by your organizations CA and see that there is none.
Expected results:
We should be able to replace the cert for the Web UI with a standard SSL cert signed by our CA. We should also have the option of replacing the CA Cert created during install with a subordinate CA cert signed by our CA Cert.
Additional info: