Red Hat Bugzilla – Bug 1434948
--certs-regenerate-ca should also regenerate ueber certificates
Last modified: 2017-09-25 14:59:44 EDT
Description of problem: When regenerating the CA certificates on Satellite 6 the ueber certificates should also be regenerated. Otherwise, downstream Capsules will run into issues with synchronizing content. Version-Release number of selected component (if applicable): satellite-installer-6.2.0.13-1.el7sat.noarch How reproducible: Always. Steps to Reproduce: 1. Delete contents of /root/ssl-build and /root/ssl-build/<SAT_FQDN> 2. # satellite-installer --certs-update-all --certs-regenerate-ca --certs-regenerate 3. Generate and install new certificate bundle for Capsules 4. Observe that Capsule content synchronization fails nectar.downloaders.threaded:ERROR: Skipping requests to <SAT_FQDN> due to repeated connection failures: [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:579) Actual results: - ueber certificate is still based off of old CA - Capsule content synchronization fails Expected results: - ueber certificate has been refreshed against the new CA - Capsule content synchronization is successful Additional info: Can be worked around by manually deleting the old ueber certificates in Candlepin. Perhaps the installer can run this rake task in upstream that regenerates the ueber certificates: http://projects.theforeman.org/issues/18403
Created redmine issue http://projects.theforeman.org/issues/18987 from this bug
Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/18987 has been resolved.
Renzo, The change made was to verify the ueber cert is still valid on a capsule sync. https://github.com/Katello/katello/pull/6728 Here is what I would do to validate: - install capsule - satellite-installer --certs-update-all --certs-regenerate-ca --certs-regenerate on the main Satellite - verify that the CA has changed - generate new capsule certs - reinstall capsule - verify you can resync capsule If this doesn't work, there is also a task to regenerate the ueber certs - foreman-rake katello:regenerate_ueber_certs to get around this issue. Let me know if you have any questions
Synchronization worked after certs regeneration on version 6.2.12. Moving this BZ to VERIFIED.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2803