Bug 1792231

Cloned also for rhel8.2 client where reproduced:

virt-viewer-7.0-9.el8.x86_64
libgovirt-0.3.4-9.el8.x86_64
spice-gtk3-0.37-1.el8.x86_64

+++ This bug was initially created as a clone of Bug #1402909 +++

Description of problem:
I can't dig this old issue form BZ so I'm reposting it again: when HTTP server of ovirt-engine uses certificate not signed engine's CA, the engine's CA has to be passed to remote-viewer via --spice-ca-file in spite of the engine CA being available in the very API where libgovirt gets all the rest of connection information. The location of CA certificate in engine is (from [1]):
/ovirt-engine/services/pki-resource?resource=ca-certificate

The engine CA is available in this location since at least 3.5 so we can never mind the old location of /ca.crt

[1] https://www.ovirt.org/develop/release-management/features/infra/pki/#services

Version-Release number of selected component (if applicable):
libgovirt-0.3.3-4.el7.x86_64
virt-viewer-2.0-12.el7.x86_64
spice-gtk3-0.31-6.el7_3.2.x86_64

How reproducible:
always

Steps to Reproduce:
1. have engine with HTTP CA different to engine CA
2. connect using ovirt:// uri to some VM without specifying engine CA:
remote-viewer [--ovirt-ca-file external-ca.pem] ovirt://example.com/VM
3. 

Actual results:
* spice-gtk fails to verify TLS certificate of spice-server
* HTTP log on engine doesn't indicate access to /ovirt-engine/services/pki-resource?resource=ca-certificate

Expected results:
* certificate is downloaded
* client connects just fine

Additional info:

--- Additional comment from Christophe Fergeau on 2016-12-09 11:20:05 CET ---

Tried to improve this, hit this ovirt bug: https://bugzilla.redhat.com/show_bug.cgi?id=1403161
I believe virt-viewer would need something like

diff --git a/src/remote-viewer.c b/src/remote-viewer.c
index 6d29bf2..e029e4c 100644
--- a/src/remote-viewer.c
+++ b/src/remote-viewer.c
@@ -969,7 +969,14 @@ create_ovirt_session(VirtViewerApp *app, const char *uri, GError **err)
                      "cert-subject", host_subject,
                      "proxy", proxy_url,
                      NULL);
-        g_object_get(G_OBJECT(proxy), "ca-cert", &ca_cert, NULL);
+        g_object_get(G_OBJECT(display), "ca-cert", &ca_cert, NULL);
+        g_warning("OvirtVmDisplay::ca-cert %p", ca_cert);
+        if (ca_cert == NULL) {
+            g_object_get(G_OBJECT(proxy), "ca-cert", &ca_cert, NULL);
+                g_object_set(G_OBJECT(session),
+                    "ca", ca_cert,
+                    NULL);
+        }
         if (ca_cert != NULL) {
             g_object_set(G_OBJECT(session),
                     "ca", ca_cert,

but I've been unable to test this.

--- Additional comment from Eduardo Lima (Etrunko) on 2017-11-17 19:44:18 CET ---

Moving to 7.6

--- Additional comment from Victor Toso on 2018-12-13 16:50:20 CET ---

Doing triage, quick note is that I vote to keep this in 7.7 as virt-viewer side seems fine as per comment #1
Only needs the fix from bug 1403161 ~ feel free to correct me if I'm wrong.

--- Additional comment from Victor Toso on 2019-04-01 15:52:26 CEST ---

Bug 1403161 is fixed with ovirt-engine-4.3.2.1

--- Additional comment from Eduardo Lima (Etrunko) on 2019-10-04 20:37:11 CEST ---

Patch submitted for review. Requires changes in libgovirt as well.

https://www.redhat.com/archives/virt-tools-list/2019-October/msg00007.html

--- Additional comment from errata-xmlrpc on 2019-10-11 22:28:08 CEST ---

Bug report changed to ON_QA status by Errata System.
A QE request has been submitted for advisory RHBA-2019:47221-01
https://errata.devel.redhat.com/advisory/47221

--- Additional comment from Eduardo Lima (Etrunko) on 2019-10-11 22:53:17 CEST ---

libgovirt build https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=24021923
virt-viewer scratch build https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=24022442

Waiting for libgovirt package make to the buildroot to roll out final virt-viewer build.

David, can you help tagging the libgovirt package?

--- Additional comment from errata-xmlrpc on 2019-11-18 15:55:42 CET ---

Bug report changed from ON_QA to VERIFIED status by the Errata System: 
Advisory RHBA-2019:47221-03: 
Changed by: Radek Duda (rduda)
https://errata.devel.redhat.com/advisory/47221

Verified with libgovirt-0.3.4-4.el7
and virt-viewer-5.0-17.el7,
spice-gtk3-0.35-5.el7

using rhv43.spice.brq.redhat.com with external certificate http://spice-qe.ams2.redhat.com/misc/spice-qe-idm.pem

remote-viewer ovirt://$USERNAME%40$DOMAIN.brq.redhat.com/$VM_NAME does the job