Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1132159

Summary:	CRL Support is Broken (but can be fixed in a very difficult way)
Product:	Red Hat Satellite	Reporter:	Jeremy Cline <jcline>
Component:	Installation	Assignee:	satellite6-bugs <satellite6-bugs>
Status:	CLOSED WONTFIX	QA Contact:	Katello QA List <katello-qa-list>
Severity:	high	Docs Contact:
Priority:	low
Version:	Unspecified	CC:	bkearney, jcline, jsherril, mmccune, omaciel, pulp-bugs, pulp-qe-list, stbenjam
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1129489	Environment:
Last Closed:	2017-01-13 20:43:13 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jeremy Cline 2014-08-20 20:01:47 UTC

+++ This bug was initially created as a clone of Bug #1129489 +++

Description of problem: Recently, Pulp code that provided CRL support was removed with the recommendation that users use Apache CRL functionality instead. There is not indication in the docs that the user should look to Apache for this functinality.

We should be careful not to duplicate Apache docs, but having a section in the Pulp docs that indicates that Pulp does not provide CRL functionality, and Apache is the preferred method would be good.

--- Additional comment from  on 2014-08-13 11:43:08 EDT ---

Also a note should be added to the 2.4.1 release notes as part of this documentation effort.

--- Additional comment from Jeremy Cline on 2014-08-20 15:59:38 EDT ---

This is a blocker for sat-6.0.4

Comment 2 Brian Bouterse 2014-08-21 14:29:15 UTC

As of Pulp 2.4.0, certificate revocation list support is no longer a Pulp feature, and it is recommended to configure Apache to do this. Apache does it better then Pulp ever did, and the certificates are verified by Apache anyway.

To enable this it should be as simple as configuring of these Apache directives:

SSLCARevocationFile
SSLCARevocationPath

These directives are appropriate for any Pulp component that uses httpd (server, nodes). The CRL file was already provided by the Pulp user (katello) so putting it in the right place, giving it the right permissions, and enabling these directives to use that CRL file should be all that is required.

This no longer depends on the Pulp documentation BZ. This comment already contains more than our docs will.

Comment 3 Mike McCune 2014-08-21 14:54:37 UTC

For 6.0 client systems who's subscriptions are removed will no longer have access to the RPM based content after 'subscription-manager refresh' is ran. This occurs roughly every 4 hours and depends on rhsmcertd being enabled (which by default it is). 


For 6.1 we need to add those 2 lines to our Apache configuration and test subscription removal from end systems to make sure this works.  This will add the additional feature that subscription removal will *immediately* remove access to the content and not depend on the subscription-manager refresh call.

Comment 7 Bryan Kearney 2016-05-16 14:04:24 UTC

I see this file deployed  in /etc/httpd/conf.d/05-foreman-ssl.conf

 SSLCertificateChainFile "/etc/pki/katello/certs/katello-default-ca.crt"
  SSLCACertificateFile    "/etc/pki/katello/certs/katello-default-ca.crt"


I believe this covers the bug. Does this give us SSL Revocation?

Comment 8 Jeremy Cline 2016-05-16 15:25:18 UTC

No, as Brian says in https://bugzilla.redhat.com/show_bug.cgi?id=1132159#c2 you'll need a revocation list file and configure Apache to use it.

Comment 11 Bryan Kearney 2017-01-13 20:43:13 UTC

This is an older bug which I do not envision being addressed in the near term. I am closing this out. If you believe doing so is an issue, please feel free to re-open and provide additional business information. Thank you.