Bug 1420975

NOTE: Before making the changes proposed in the BZ ticket's description, this must be verified by an SME. It is the "katello-certs-check" command which puts "satellite_" in each parameter. If this is incorrect, then the command's output must be corrected as well as the documentation linked in this BZ ticket.

Chris/Daniel,

I need a sanity check on this BZ ticket. Below is example output of the katello-certs-check command, as per the Installation Guide, section "3.4.6.2. Validate the Satellite Server’s SSL Certificate" [1].

The part that I simply don't understand is after "To use them inside a $CAPSULE, run this command INSTEAD:". From what I can tell, this takes the Satellite Server's certificate and creates the TAR file. When this is then copied to the Capsule Server, and used as input in the "satellite-installer" command, this deploys the Satellite Server's certificate, instead of the Capsule Server's certificate.

Is this correct, or do I misunderstand? I came to the above conclusion because, after walking through the workflow detailed in the Installation Guide, I not find any mention of the Capsule Server's custom certificate being used.


--------------------
Validating the certificate subject= /C=AU/ST=Queensland/L=Brisbane/O=Example/OU=Sales/CN=satellite.example.com/emailAddress=example
Check private key matches the certificate: [OK]
Check ca bundle verifies the cert file: [OK]

Validation succeeded.

To install the Satellite main server with the custom certificates, run:

    satellite-installer --scenario satellite\
                        --certs-server-cert "/root/sat_cert/satellite_cert.pem"\
                        --certs-server-cert-req "/root/sat_cert/satellite_cert_csr.pem"\
                        --certs-server-key "/root/sat_cert/satellite_cert_key.pem"\
                        --certs-server-ca-cert "/root/sat_cert/ca_cert_bundle.pem"

To update the certificates on a currently running Satellite installation, run:

    satellite-installer --scenario satellite\
                        --certs-server-cert "/root/sat_cert/satellite_cert.pem"\
                        --certs-server-cert-req "/root/sat_cert/satellite_cert_csr.pem"\
                        --certs-server-key "/root/sat_cert/satellite_cert_key.pem"\
                        --certs-server-ca-cert "/root/sat_cert/ca_cert_bundle.pem"\
                        --certs-update-server --certs-update-server-ca

To use them inside a $CAPSULE, run this command INSTEAD:

    capsule-certs-generate --capsule-fqdn ""\
                           --certs-tar  "/root/certs.tar"\
                           --server-cert "/root/sat_cert/satellite_cert.pem"\
                           --server-cert-req "/root/sat_cert/satellite_cert_csr.pem"\
                           --server-key "/root/sat_cert/satellite_cert_key.pem"\
                           --server-ca-cert "/root/sat_cert/ca_cert_bundle.pem"\
                           --certs-update-server
--------------------



[1] https://access.redhat.com/documentation/en/red-hat-satellite/6.2/single/installation-guide#configuring_satellite_server_with_custom_server_certificate

Hi Russell,

This is correct it would do that if the customer ran that, as of right now there is no option to tell that the cert is used by satellite or capsule so the check gives out all the options. There is currently an open bz for this here:

https://bugzilla.redhat.com/show_bug.cgi?id=1265533

- Chris

This content is live on the Customer Portal.

Closing.