Bug 1747512 - [RFE] katello-certs-check should display a warning if there is a passphrase protected key file
Summary: [RFE] katello-certs-check should display a warning if there is a passphrase p...
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Certificates
Version: 6.6.0
Hardware: x86_64
OS: Linux
medium vote
Target Milestone: 6.7.0
Assignee: Chris Roberts
QA Contact: Stephen Wadeley
URL: https://projects.theforeman.org/issue...
Depends On:
TreeView+ depends on / blocked
Reported: 2019-08-30 16:32 UTC by Ganesh Payelkar
Modified: 2020-04-14 13:25 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-04-14 13:25:28 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 27876 0 Normal Closed katello-certs-check should display an error if there is a passphrase protected key file 2020-10-27 00:25:07 UTC
Github theforeman foreman-installer pull 393 0 'None' closed Fixes #27876 - Add check for passphrase on key 2020-10-27 00:25:07 UTC
Red Hat Product Errata RHSA-2020:1454 0 None None None 2020-04-14 13:25:45 UTC

Description Ganesh Payelkar 2019-08-30 16:32:34 UTC
Description of problem:

katello-certs-check should display a warning if there is a passphrase protected  

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Create a key with password protected
2. # openssl genrsa -aes128 -passout pass:foobar -out /root/sat_cert/satellite_cert_key.pem  4096
3. For verification use katello-certs-check

Actual results:

# katello-certs-check -c vm250-205.gsslab.pnq2.redhat.com.crt -k satellite_cert_key.pem -b CA-Chain.crt
Checking server certificate encoding: 

Checking expiration of certificate: 

Checking expiration of CA bundle: 

Checking if server certificate has CA:TRUE flag 

Checking to see if the private key matches the certificate: Enter pass phrase for /root/sat_cert/satellite_cert_key.pem:


Checking CA bundle against the certificate file: 

Checking Subject Alt Name on certificate 

Checking Key Usage extension on certificate for Key Encipherment 

Validation succeeded

To install the Red Hat Satellite Server with the custom certificates, run:

    satellite-installer --scenario satellite \
                        --certs-server-cert "/root/sat_cert/satellite.crt" \
                        --certs-server-key "/root/sat_cert/satellite_cert_key.pem" \
                        --certs-server-ca-cert "/root/sat_cert/CA-Chain.crt"

To update the certificates on a currently running Red Hat Satellite installation, run:

    satellite-installer --scenario satellite \
                        --certs-server-cert "/root/sat_cert/satellite.crt" \
                        --certs-server-key "/root/sat_cert/satellite_cert_key.pem" \
                        --certs-server-ca-cert "/root/sat_cert/CA-Chain.crt" \
                        --certs-update-server --certs-update-server-ca

Expected results:

It should warn us that you have a password-protected key and it will not work with satellite 

Additional info:

Comment 5 Bryan Kearney 2019-10-29 00:03:46 UTC
Moving this bug to POST for triage into Satellite 6 since the upstream issue https://projects.theforeman.org/issues/27876 has been resolved.

Comment 9 errata-xmlrpc 2020-04-14 13:25:28 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.