Hide Forgot
Description of problem: Right now, Pegasus creates the self-signed certificates during RPM installation. However, it relies on having the system hostname set in order to create the subject name correctly. This can therefore cause issues with installing Pegasus during Version-Release number of selected component (if applicable): tog-pegasus-2.12.1-10.el7.x86_64 How reproducible: Any fresh installation of tog-pegasus Steps to Reproduce: 1. Ensure that tog-pegasus is not installed and there are no .pem files in /etc/Pegasus/ 2. Set system hostname to 'installhostname.example.com' 3. Install Pegasus 4. Change system hostname to 'deployhostname.example.com' 4. Run 'systemctl start tog-pegasus' 5. Examine the certificate installed at /etc/Pegasus/server.pem with openssl x509 -text -noout -in /etc/Pegasus/server.pem Actual results: The certificate file contains the following Subject: Subject: C=UK, ST=Berkshire, L=Reading, O=The Open Group, OU=The OpenPegasus Project, CN=installhostname.example.com Expected results: The certificate file should contain the following Subject: Subject: C=UK, ST=Berkshire, L=Reading, O=The Open Group, OU=The OpenPegasus Project, CN=deployhostname.example.com Additional info: The recommended implementation here would be for us to perform the initial creation of the certificates in the systemd unit file on first startup (or any startup where the server.pem does not exist). This will play better with virtualization environments as well (see BZ#1041552 for how we plan to clean these certificates out when creating a base image).
Created attachment 836380 [details] Move certificate generation to service startup Instead of creating the certificates during RPM installation, we should wait until the first time the service is started. This will behave better in cases where an image is being cloned for VMs. This patch depends on the mini-CA patch for BZ#1032849 (though it would be possible to write a patch that worked with the old self-signed approach as well, if the mini-CA approach is rejected).
Pushed Stephen's patch together with one for the bug #1072936.
Verified with all supported architectures.
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.