Description of problem:
When regenerating the CA certificates on Satellite 6 the ueber certificates should also be regenerated. Otherwise, downstream Capsules will run into issues with synchronizing content.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Delete contents of /root/ssl-build and /root/ssl-build/<SAT_FQDN>
2. # satellite-installer --certs-update-all --certs-regenerate-ca --certs-regenerate
3. Generate and install new certificate bundle for Capsules
4. Observe that Capsule content synchronization fails
nectar.downloaders.threaded:ERROR: Skipping requests to <SAT_FQDN> due to repeated connection failures: [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:579)
- ueber certificate is still based off of old CA
- Capsule content synchronization fails
- ueber certificate has been refreshed against the new CA
- Capsule content synchronization is successful
Can be worked around by manually deleting the old ueber certificates in Candlepin.
Perhaps the installer can run this rake task in upstream that regenerates the ueber certificates:
Created redmine issue http://projects.theforeman.org/issues/18987 from this bug
Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/18987 has been resolved.
The change made was to verify the ueber cert is still valid on a capsule sync. https://github.com/Katello/katello/pull/6728
Here is what I would do to validate:
- install capsule
- satellite-installer --certs-update-all --certs-regenerate-ca --certs-regenerate
on the main Satellite
- verify that the CA has changed
- generate new capsule certs
- reinstall capsule
- verify you can resync capsule
If this doesn't work, there is also a task to regenerate the ueber certs - foreman-rake katello:regenerate_ueber_certs to get around this issue.
Let me know if you have any questions
Synchronization worked after certs regeneration on version 6.2.12. Moving this BZ to VERIFIED.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.