RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1041555 - Pegasus should generate self-signed certificates at first startup rather than rpm %post
Summary: Pegasus should generate self-signed certificates at first startup rather than...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: tog-pegasus
Version: 7.0
Hardware: All
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Stephen Gallagher
QA Contact: Alois Mahdal
URL:
Whiteboard:
Depends On: 1032849
Blocks: 1041552
TreeView+ depends on / blocked
 
Reported: 2013-12-12 17:12 UTC by Stephen Gallagher
Modified: 2014-06-18 04:57 UTC (History)
5 users (show)

Fixed In Version: tog-pegasus-2.12.1-16.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 11:45:16 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
Move certificate generation to service startup (4.87 KB, patch)
2013-12-13 16:27 UTC, Stephen Gallagher 		vcrhonek: review+
Details | Diff
View All

Description Stephen Gallagher 2013-12-12 17:12:52 UTC 
Description of problem:
Right now, Pegasus creates the self-signed certificates during RPM installation. However, it relies on having the system hostname set in order to create the subject name correctly. This can therefore cause issues with installing Pegasus during 

Version-Release number of selected component (if applicable):
tog-pegasus-2.12.1-10.el7.x86_64

How reproducible:
Any fresh installation of tog-pegasus

Steps to Reproduce:
1. Ensure that tog-pegasus is not installed and there are no .pem files in /etc/Pegasus/
2. Set system hostname to 'installhostname.example.com'
3. Install Pegasus
4. Change system hostname to 'deployhostname.example.com'
4. Run 'systemctl start tog-pegasus'
5. Examine the certificate installed at /etc/Pegasus/server.pem with
openssl x509 -text -noout -in /etc/Pegasus/server.pem

Actual results:
The certificate file contains the following Subject:
Subject: C=UK, ST=Berkshire, L=Reading, O=The Open Group, OU=The OpenPegasus Project, CN=installhostname.example.com

Expected results:
The certificate file should contain the following Subject:
Subject: C=UK, ST=Berkshire, L=Reading, O=The Open Group, OU=The OpenPegasus Project, CN=deployhostname.example.com

Additional info:
The recommended implementation here would be for us to perform the initial creation of the certificates in the systemd unit file on first startup (or any startup where the server.pem does not exist). This will play better with virtualization environments as well (see BZ#1041552 for how we plan to clean these certificates out when creating a base image).
Comment 1 Stephen Gallagher 2013-12-13 16:27:21 UTC 
Created attachment 836380 [details]
Move certificate generation to service startup

Instead of creating the certificates during RPM installation, we should wait until the first time the service is started. This will behave better in cases where an image is being cloned for VMs.

This patch depends on the mini-CA patch for BZ#1032849 (though it would be possible to write a patch that worked with the old self-signed approach as well, if the mini-CA approach is rejected).
Comment 2 Tomas Smetana 2014-03-07 09:03:00 UTC 
Pushed Stephen's patch together with one for the bug #1072936.
Comment 4 Alois Mahdal 2014-03-18 12:57:42 UTC 
Verified with all supported architectures.
Comment 5 Ludek Smid 2014-06-13 11:45:16 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.