*** Bug 1612975 has been marked as a duplicate of this bug. ***

I'm not sure I understand the bug report. What is the expected behaviour? Since it's marked as regression, what's the different behaviour comparing to 6.3?

Ivan,

There was a logic flaw I had when I made it, I will make a PR so you can see the difference.

Version tested:

Satellite 6.4 snap 19

When CN= hostname

Checking server certificate's encoding: [OK]
Checking expiration of certificate: [OK]
Checking expiration of CA bundle: [OK]
Checking if server cert has CA:TRUE flag[OK]
Validating the certificate subject= /C=IN/ST=Maharashtra/L=Pune/O=redhat/OU=QE/CN=<$hostname>
Checking to see if the private key matches the certificate: [OK]
Checking ca bundle against the cert file: [OK]
Checking Subject Alt Name on certificate[OK]
Checking Key Usage extension on certificate for Key Encipherment[OK]

Validation succeeded.

To install the Katello main server with the custom certificates, run:

    foreman-installer --scenario katello\
                      --certs-server-cert "/root/server.valid.crt"\
                      --certs-server-key "/root/server.key"\
                      --certs-server-ca-cert "/root/rootCA.pem"

To update the certificates on a currently running Katello installation, run:

    foreman-installer --scenario katello\
                      --certs-server-cert "/root/server.valid.crt"\
                      --certs-server-key "/root/server.key"\
                      --certs-server-ca-cert "/root/rootCA.pem"\
                      --certs-update-server --certs-update-server-ca

when CN != hostname

Checking server certificate's encoding: [OK]
Checking expiration of certificate: [OK]
Checking expiration of CA bundle: [OK]
Checking if server cert has CA:TRUE flag[OK]
Validating the certificate subject= /C=IN/ST=Maharashtra/L=Pune/O=redhat/OU=QE/CN=CAPSULE_FQDN
Checking to see if the private key matches the certificate: [OK]
Checking ca bundle against the cert file: [OK]
Checking Subject Alt Name on certificate[OK]
Checking Key Usage extension on certificate for Key Encipherment[OK]

  Validation succeeded.

  To use them inside a NEW $FOREMAN_PROXY, run this command:

      foreman-proxy-certs-generate --foreman-proxy-fqdn "$FOREMAN_PROXY"\
                                   --certs-tar  "~/$FOREMAN_PROXY-certs.tar"\
                                   --server-cert "/root/server.valid.crt"\
                                   --server-key "/root/server.key"\
                                   --server-ca-cert "/root/rootCA.pem"\

  To use them inside an EXISTING $FOREMAN_PROXY, run this command INSTEAD:

      foreman-proxy-certs-generate --foreman-proxy-fqdn "$FOREMAN_PROXY"\
                                   --certs-tar  "~/$FOREMAN_PROXY-certs.tar"\
                                   --server-cert "/root/server.valid.crt"\
                                   --server-key "/root/server.key"\
                                   --server-ca-cert "/root/rootCA.pem"\
                                   --certs-update-server

For branding issue, we are tracking https://bugzilla.redhat.com/show_bug.cgi?id=1600866#c4

Hi Chris, can you verify once above behaviour is correct? I feel also we need documentation issue for this as we are not showing commands for both capsule and satellite as before.

Hi,

This is correct, we do not want to show both because it causes confusion for the customer. Since your hostname matches the sat we only show for the satellite installer, when not we show what to do to make capsule certs. I would mark this as verified.

Thanks Chris. Marking as verified.

Also raised doc bug to change expected example output.

https://bugzilla.redhat.com/show_bug.cgi?id=1625255

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2927