Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Below is the steps that satellite-installer create the Qpid broker certficate to the katello nssdb
1) Delete the "broker" certificate from nssdb
-------------------------
Executing 'certutil -D -d /etc/pki/katello/nssdb -n 'broker''
-------------------------
2) Import broker certificate to nssdb. It looks like something strange could happen here. Certutil returns 0 exit code but the "broker" certificate was not created. I am also not able to reproduce it but it happened in a case.
-------------------------
Executing 'certutil -A -d '/etc/pki/katello/nssdb' -n 'broker' -t ',,' -a -i '/etc/pki/katello/certs/satellite.example.com-qpid-broker.crt''
-------------------------
3) Convert the broker private key and certificate to pkcs12 format. There is a problem in this command. It should pass a certname option ("-name broker") but it didn't. Therefore, a "pfx" file without nickname was created.
-------------------------
Executing 'openssl pkcs12 -in /etc/pki/katello/certs/satellite.example.com-qpid-broker.crt -inkey /etc/pki/katello/private/satellite.example.com-qpid-broker.key -export -out '/etc/pki/katello/satellite.example.com-qpid-broker.pfx' -password 'file:/etc/pki/katello/nssdb/nss_db_password-file''
-------------------------
4) Import the generated "pfx" file to nssdb using pk12util command. Since no nickname is provided by the "pfx" file, it will generate a nickname in the format of "{Common Name} - {Org}". In this case "satellite.example.com - SomeOrg".
-------------------------
Executing 'pk12util -i '/etc/pki/katello/satellite.example.com-qpid-broker.pfx' -d '/etc/pki/katello/nssdb' -w '/etc/pki/katello/nssdb/nss_db_password-file' -k '/etc/pki/katello/nssdb/nss_db_password-file''
-------------------------
To prevent the above issue, I suggest to add "-name broker" to the "openssl pkcs12" command in step (3). I also think that the "certutil -A" command in step (2) is not needed. Since we are going to import both broker private key and ssl certificate using "pk12util" command in step (4), why do we still need to run "certutil -A"?
Reproducing from terminal:
$ certutil -L -d .
-------------------------
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
amqp-client ,,
ca CT,C,c
-------------------------
$ openssl pkcs12 -in /etc/pki/katello/certs/mysatellite-example.com-qpid-broker.crt -inkey /etc/pki/katello/private/mysatellite-example.com-qpid-broker.key -export -out '/etc/pki/katello/mysatellite-example.com-qpid-broker.pfx' -password 'file:/etc/pki/katello/nssdb/nss_db_password-file'
pk12util -i '/etc/pki/katello/mysatellite-example.com-qpid-broker.pfx' -d '/etc/pki/katello/nssdb' -w '/etc/pki/katello/nssdb/nss_db_password-file' -k '/etc/pki/katello/nssdb/nss_db_password-file'
-------------------------
pk12util: no nickname for cert in PKCS12 file. <=============================== ########## Complain about missing nickname ###########
pk12util: using nickname: mysatellite-example.com - Katello <=============================== ########## "{Common Name} - {Org}" nickname is used ###########
pk12util: PKCS12 IMPORT SUCCESSFUL
-------------------------
certutil -L -d .
-------------------------
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
amqp-client ,,
ca CT,C,c
mysatellite-example.com - Katello u,u,u <===============================
-------------------------
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHSA-2019:1222
Description of problem: Below is the steps that satellite-installer create the Qpid broker certficate to the katello nssdb 1) Delete the "broker" certificate from nssdb ------------------------- Executing 'certutil -D -d /etc/pki/katello/nssdb -n 'broker'' ------------------------- 2) Import broker certificate to nssdb. It looks like something strange could happen here. Certutil returns 0 exit code but the "broker" certificate was not created. I am also not able to reproduce it but it happened in a case. ------------------------- Executing 'certutil -A -d '/etc/pki/katello/nssdb' -n 'broker' -t ',,' -a -i '/etc/pki/katello/certs/satellite.example.com-qpid-broker.crt'' ------------------------- 3) Convert the broker private key and certificate to pkcs12 format. There is a problem in this command. It should pass a certname option ("-name broker") but it didn't. Therefore, a "pfx" file without nickname was created. ------------------------- Executing 'openssl pkcs12 -in /etc/pki/katello/certs/satellite.example.com-qpid-broker.crt -inkey /etc/pki/katello/private/satellite.example.com-qpid-broker.key -export -out '/etc/pki/katello/satellite.example.com-qpid-broker.pfx' -password 'file:/etc/pki/katello/nssdb/nss_db_password-file'' ------------------------- 4) Import the generated "pfx" file to nssdb using pk12util command. Since no nickname is provided by the "pfx" file, it will generate a nickname in the format of "{Common Name} - {Org}". In this case "satellite.example.com - SomeOrg". ------------------------- Executing 'pk12util -i '/etc/pki/katello/satellite.example.com-qpid-broker.pfx' -d '/etc/pki/katello/nssdb' -w '/etc/pki/katello/nssdb/nss_db_password-file' -k '/etc/pki/katello/nssdb/nss_db_password-file'' ------------------------- To prevent the above issue, I suggest to add "-name broker" to the "openssl pkcs12" command in step (3). I also think that the "certutil -A" command in step (2) is not needed. Since we are going to import both broker private key and ssl certificate using "pk12util" command in step (4), why do we still need to run "certutil -A"? Reproducing from terminal: $ certutil -L -d . ------------------------- Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI amqp-client ,, ca CT,C,c ------------------------- $ openssl pkcs12 -in /etc/pki/katello/certs/mysatellite-example.com-qpid-broker.crt -inkey /etc/pki/katello/private/mysatellite-example.com-qpid-broker.key -export -out '/etc/pki/katello/mysatellite-example.com-qpid-broker.pfx' -password 'file:/etc/pki/katello/nssdb/nss_db_password-file' pk12util -i '/etc/pki/katello/mysatellite-example.com-qpid-broker.pfx' -d '/etc/pki/katello/nssdb' -w '/etc/pki/katello/nssdb/nss_db_password-file' -k '/etc/pki/katello/nssdb/nss_db_password-file' ------------------------- pk12util: no nickname for cert in PKCS12 file. <=============================== ########## Complain about missing nickname ########### pk12util: using nickname: mysatellite-example.com - Katello <=============================== ########## "{Common Name} - {Org}" nickname is used ########### pk12util: PKCS12 IMPORT SUCCESSFUL ------------------------- certutil -L -d . ------------------------- Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI amqp-client ,, ca CT,C,c mysatellite-example.com - Katello u,u,u <=============================== -------------------------