Description of problem: No automatic renew of vmconsole-proxy-user or vmconsole-proxy-host certs on RHV Manager machine Version-Release number of selected component (if applicable): RHV 4.x How reproducible: Always Steps to Reproduce: 1. Run # engine-setup --offline 2. Check certs on RHV Manager machine # cd /etc/pki/ovirt-vmconsole/ # ssh-keygen -L -f vmconsole-proxy-user-cert.pub # ssh-keygen -L -f proxy-ssh_host_rsa-cert.pub Actual results: Certs not getting renew Expected results: All Certs should get renew while running # engine-setup --offline Additional info: Helper certs also not updating refer: https://bugzilla.redhat.com/show_bug.cgi?id=1988496
Most probably a duplicate of bz 1988496
The current fix only renews vmconsole cert when the engine CA cert is newer than the vmconsole cert. Moving back to assigned for also renewing vmconsole cert when engine CA cert has longer expiration than vmconsole cert and the vmconsole cert has expired.
This is different from Bug 1988496, because the problem here is that other certificates, such as vmconsole-proxy-user-cert.pub and proxy-ssh_host_rsa-cert.pub, are not checked and renewed.
(In reply to Milan Zamazal from comment #8) > This is different from Bug 1988496, because the problem here is that other > certificates, such as vmconsole-proxy-user-cert.pub and > proxy-ssh_host_rsa-cert.pub, are not checked and renewed. Ack, you're right, so moving to 4.5.1
Verified with: ovirt-engine-4.5.0.7-0.9.el8ev.noarch Steps: 1. Update engine CA cert to make it newer than vmconsole-proxy-user cert, run `engine-setup --offline`, check if all vmconsole-proxy-host/user certs and proxy-ssh_host/user certs are renewed. 2. Update system time to make vmconsole-proxy-user cert expire, but engine CA cert not expire, run `engine-setup --offline`, check if all vmconsole-proxy-host/user certs and proxy-ssh_host/user certs are renewed. Results: 1. All vmconsole-proxy-host/user certs and proxy-ssh_host/user certs are renewed during engine-setup when engine CA cert is updated. 2. All vmconsole-proxy-host/user certs and proxy-ssh_host/user certs are renewed during engine-setup when vmconsole-proxy-user cert is expired.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: RHV Manager (ovirt-engine) [ovirt-4.5.0] security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:4711