Bug 1259294 - Isolated capsule/reverse proxy doesn't work when using custom certificates
Summary: Isolated capsule/reverse proxy doesn't work when using custom certificates
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Installer
Version: 6.1.0
Hardware: Unspecified
OS: Unspecified
unspecified
high vote
Target Milestone: Unspecified
Assignee: Ivan Necas
QA Contact: Tazim Kolhar
URL: http://projects.theforeman.org/issues...
Whiteboard:
: 1264208 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-09-02 11:36 UTC by Ivan Necas
Modified: 2019-08-15 05:17 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-10-15 18:20:42 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:1911 0 normal SHIPPED_LIVE Satellite 6.1.3 bug fix update 2015-10-15 22:19:19 UTC

Description Ivan Necas 2015-09-02 11:36:27 UTC
Description of problem:
capsule-installer sets incorrect file as a CA for client authentication.

Steps to Reproduce:
1. install satellite and isolated capsule with custom certificatses
2. try to register the host though the isolated capsule

Actual results:
Unable to verify server's identity: tlsv1 alert unknown ca

Expected results:
Everything works

Additional info:

The core issue is using katello_server_ca (used for server certificates) instead of katello_default_ca (used for client certificates)

Comment 1 Ivan Necas 2015-09-02 11:37:31 UTC
Created redmine issue http://projects.theforeman.org/issues/11660 from this bug

Comment 2 Ivan Necas 2015-09-02 11:51:25 UTC
Proposed patch https://github.com/Katello/puppet-capsule/pull/54

Comment 4 Ivan Necas 2015-09-03 12:45:52 UTC
Merged upstream

Comment 8 Tazim Kolhar 2015-10-12 09:47:22 UTC
VERIFIED:

# rpm -qa | grep foreman
ruby193-rubygem-foreman_hooks-0.3.7-2.el7sat.noarch
rubygem-hammer_cli_foreman-0.1.4.14-1.el7sat.noarch
ruby193-rubygem-foreman_bootdisk-4.0.2.13-1.el7sat.noarch
foreman-postgresql-1.7.2.41-1.el7sat.noarch
foreman-gce-1.7.2.41-1.el7sat.noarch
rubygem-hammer_cli_foreman_bootdisk-0.1.2.7-1.el7sat.noarch
foreman-debug-1.7.2.41-1.el7sat.noarch
foreman-proxy-1.7.2.6-1.el7sat.noarch
foreman-1.7.2.41-1.el7sat.noarch
foreman-vmware-1.7.2.41-1.el7sat.noarch
ruby193-rubygem-foreman-redhat_access-0.2.3-1.el7sat.noarch
rubygem-hammer_cli_foreman_discovery-0.0.1.10-1.el7sat.noarch
dell-per805-01.rhts.eng.bos.redhat.com-foreman-client-1.0-1.noarch
foreman-compute-1.7.2.41-1.el7sat.noarch
ruby193-rubygem-foreman_docker-1.2.0.22-1.el7sat.noarch
ruby193-rubygem-foreman-tasks-0.6.15.7-1.el7sat.noarch
rubygem-hammer_cli_foreman_tasks-0.0.3.5-1.el7sat.noarch
foreman-libvirt-1.7.2.41-1.el7sat.noarch
dell-per805-01.rhts.eng.bos.redhat.com-foreman-proxy-client-1.0-1.noarch
foreman-ovirt-1.7.2.41-1.el7sat.noarch
foreman-selinux-1.7.2.14-1.el7sat.noarch
dell-per805-01.rhts.eng.bos.redhat.com-foreman-proxy-1.0-2.noarch
ruby193-rubygem-foreman_discovery-2.0.0.19-1.el7sat.noarch
rubygem-hammer_cli_foreman_docker-0.0.3.9-1.el7sat.noarch
ruby193-rubygem-foreman_gutterball-0.0.1.9-1.el7sat.noarch


steps:
1. install satellite and isolated capsule with custom certificatses
2. try to register the host though the isolated capsule
3. Used separate custom certs for capsule setup
referred to : https://github.com/Katello/katello-installer#custom-server-certificates

Comment 10 errata-xmlrpc 2015-10-15 18:20:42 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2015:1911

Comment 11 Bryan Kearney 2015-10-29 12:36:04 UTC
*** Bug 1264208 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.