Bug 1434948 - --certs-regenerate-ca should also regenerate ueber certificates
Summary: --certs-regenerate-ca should also regenerate ueber certificates
Alias: None
Product: Red Hat Satellite 6
Classification: Red Hat
Component: Installer
Version: 6.2.8
Hardware: x86_64
OS: Linux
medium vote
Target Milestone: Unspecified
Assignee: John Mitsch
QA Contact: Renzo Nuccitelli
Depends On:
Blocks: 1481822
TreeView+ depends on / blocked
Reported: 2017-03-22 17:01 UTC by Neal Kim
Modified: 2019-06-13 21:25 UTC (History)
6 users (show)

Fixed In Version: tfm-rubygem-katello-, rubygem-katello-
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1481822 (view as bug list)
Last Closed: 2017-09-25 18:59:44 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2803 normal SHIPPED_LIVE Satellite 6.2.12 bug fix update 2017-10-12 19:22:49 UTC
Foreman Issue Tracker 18987 None None None 2017-03-22 17:47:27 UTC

Description Neal Kim 2017-03-22 17:01:21 UTC
Description of problem:

When regenerating the CA certificates on Satellite 6 the ueber certificates should also be regenerated. Otherwise, downstream Capsules will run into issues with synchronizing content.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:

1. Delete contents of /root/ssl-build and /root/ssl-build/<SAT_FQDN>
2. # satellite-installer --certs-update-all --certs-regenerate-ca --certs-regenerate
3. Generate and install new certificate bundle for Capsules
4. Observe that Capsule content synchronization fails

nectar.downloaders.threaded:ERROR: Skipping requests to <SAT_FQDN> due to repeated connection failures: [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:579)

Actual results:

- ueber certificate is still based off of old CA
- Capsule content synchronization fails

Expected results:

- ueber certificate has been refreshed against the new CA
- Capsule content synchronization is successful

Additional info:

Can be worked around by manually deleting the old ueber certificates in Candlepin.

Perhaps the installer can run this rake task in upstream that regenerates the ueber certificates:


Comment 1 John Mitsch 2017-03-22 17:47:26 UTC
Created redmine issue http://projects.theforeman.org/issues/18987 from this bug

Comment 3 pm-sat@redhat.com 2017-05-02 20:05:57 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue http://projects.theforeman.org/issues/18987 has been resolved.

Comment 6 John Mitsch 2017-08-29 18:50:56 UTC

The change made was to verify the ueber cert is still valid on a capsule sync. https://github.com/Katello/katello/pull/6728

Here is what I would do to validate:

- install capsule
- satellite-installer --certs-update-all --certs-regenerate-ca --certs-regenerate
  on the main Satellite
- verify that the CA has changed
- generate new capsule certs
- reinstall capsule
- verify you can resync capsule

If this doesn't work, there is also a task to regenerate the ueber certs - foreman-rake katello:regenerate_ueber_certs to get around this issue.

Let me know if you have any questions

Comment 7 Renzo Nuccitelli 2017-08-31 14:07:39 UTC
Synchronization worked after certs regeneration on version 6.2.12. Moving this BZ to VERIFIED.

Comment 9 errata-xmlrpc 2017-09-25 18:59:44 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.