Bug 1259294 - Isolated capsule/reverse proxy doesn't work when using custom certificates
Isolated capsule/reverse proxy doesn't work when using custom certificates
Status: CLOSED ERRATA
Product: Red Hat Satellite 6
Classification: Red Hat
Component: Installer (Show other bugs)
6.1.0
Unspecified Unspecified
unspecified Severity high (vote)
: 6.1.3
: --
Assigned To: Ivan Necas
Tazim Kolhar
http://projects.theforeman.org/issues...
: Triaged
: 1264208 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-02 07:36 EDT by Ivan Necas
Modified: 2017-02-23 14:46 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-10-15 14:20:42 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:1911 normal SHIPPED_LIVE Satellite 6.1.3 bug fix update 2015-10-15 18:19:19 EDT

  None (edit)
Description Ivan Necas 2015-09-02 07:36:27 EDT
Description of problem:
capsule-installer sets incorrect file as a CA for client authentication.

Steps to Reproduce:
1. install satellite and isolated capsule with custom certificatses
2. try to register the host though the isolated capsule

Actual results:
Unable to verify server's identity: tlsv1 alert unknown ca

Expected results:
Everything works

Additional info:

The core issue is using katello_server_ca (used for server certificates) instead of katello_default_ca (used for client certificates)
Comment 1 Ivan Necas 2015-09-02 07:37:31 EDT
Created redmine issue http://projects.theforeman.org/issues/11660 from this bug
Comment 2 Ivan Necas 2015-09-02 07:51:25 EDT
Proposed patch https://github.com/Katello/puppet-capsule/pull/54
Comment 4 Ivan Necas 2015-09-03 08:45:52 EDT
Merged upstream
Comment 8 Tazim Kolhar 2015-10-12 05:47:22 EDT
VERIFIED:

# rpm -qa | grep foreman
ruby193-rubygem-foreman_hooks-0.3.7-2.el7sat.noarch
rubygem-hammer_cli_foreman-0.1.4.14-1.el7sat.noarch
ruby193-rubygem-foreman_bootdisk-4.0.2.13-1.el7sat.noarch
foreman-postgresql-1.7.2.41-1.el7sat.noarch
foreman-gce-1.7.2.41-1.el7sat.noarch
rubygem-hammer_cli_foreman_bootdisk-0.1.2.7-1.el7sat.noarch
foreman-debug-1.7.2.41-1.el7sat.noarch
foreman-proxy-1.7.2.6-1.el7sat.noarch
foreman-1.7.2.41-1.el7sat.noarch
foreman-vmware-1.7.2.41-1.el7sat.noarch
ruby193-rubygem-foreman-redhat_access-0.2.3-1.el7sat.noarch
rubygem-hammer_cli_foreman_discovery-0.0.1.10-1.el7sat.noarch
dell-per805-01.rhts.eng.bos.redhat.com-foreman-client-1.0-1.noarch
foreman-compute-1.7.2.41-1.el7sat.noarch
ruby193-rubygem-foreman_docker-1.2.0.22-1.el7sat.noarch
ruby193-rubygem-foreman-tasks-0.6.15.7-1.el7sat.noarch
rubygem-hammer_cli_foreman_tasks-0.0.3.5-1.el7sat.noarch
foreman-libvirt-1.7.2.41-1.el7sat.noarch
dell-per805-01.rhts.eng.bos.redhat.com-foreman-proxy-client-1.0-1.noarch
foreman-ovirt-1.7.2.41-1.el7sat.noarch
foreman-selinux-1.7.2.14-1.el7sat.noarch
dell-per805-01.rhts.eng.bos.redhat.com-foreman-proxy-1.0-2.noarch
ruby193-rubygem-foreman_discovery-2.0.0.19-1.el7sat.noarch
rubygem-hammer_cli_foreman_docker-0.0.3.9-1.el7sat.noarch
ruby193-rubygem-foreman_gutterball-0.0.1.9-1.el7sat.noarch


steps:
1. install satellite and isolated capsule with custom certificatses
2. try to register the host though the isolated capsule
3. Used separate custom certs for capsule setup
referred to : https://github.com/Katello/katello-installer#custom-server-certificates
Comment 10 errata-xmlrpc 2015-10-15 14:20:42 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2015:1911
Comment 11 Bryan Kearney 2015-10-29 08:36:04 EDT
*** Bug 1264208 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.