Wait, aren't we trying to move away from katello-ca-consumer rpm or am I confusing things? On my clients registered through global registration I don't have this package at all

(In reply to Adam Ruzicka from comment #1)
> Wait, aren't we trying to move away from katello-ca-consumer rpm or am I
> confusing things? On my clients registered through global registration I
> don't have this package at all

I dont know :) But if so, we must clearly state it in docs. Since a customer migrating from katello-agent to REX pull would hit this, otherwise.

(where is global registration described to let me play with it?)

Hello Adam,

I will add one point here [ considering capsule itself as a client of satellite server and custom certs are in question ]:

* I updated certs on my satellite.

* Now I am creating new cert bundle for my capsule using capsule-certs-generate:

# capsule-certs-generate --foreman-proxy-fqdn "$CAPSULE" --certs-tar  "~/$CAPSULE-certs.tar" 


This command itself will generate the new katello-ca-consumer-latest.noarch.rpm and instruct us to install the same on the target capsule in it's output.

###################

Preparing installation Done                                              
  Success!

  To finish the installation, follow these steps:

  If you do not have the Capsule registered to the Satellite instance, then please do the following:

  1. yum -y localinstall http://<sat fqdn>/pub/katello-ca-consumer-latest.noarch.rpm
  2. subscription-manager register --org "RedHat"
###################


And since we are used to this process, we will do "yum -y localinstall http://<sat fqdn>/pub/katello-ca-consumer-latest.noarch.rpm" on the capsule as well rather than trying to re-register it.

The same goes for client systems as well as Our own Product doc suggests to do this exact step for every client system connected with satellite\capsule:

--> https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/installing_satellite_server_in_a_connected_network_environment/index#deploying-a-custom-ssl-certificate-to-hosts_satellite 


So Pavel's request makes perfect sense. We need to restart yggdrasild afterward. If it is not possible to do it automatically, then our SSL Certs installation doc needs to be updated, reflecting this requirement.


Also, about your statement :
~~
Wait, aren't we trying to move away from katello-ca-consumer rpm or am I confusing things? On my clients registered through global registration, I don't have this package at all
~~

Very true but not yet applicable for capsule-certs-generate command as it suggests doing katello-ca-consumer rpm installation or update, which is the easiest way to get the CA updated for Capsule's rhsm.

but if we don't want to use that, Then something equally quick should be suggested by the tool to use and update the RHSM CA on target capsules. 

I have raised an RFE for the same i.e. https://bugzilla.redhat.com/show_bug.cgi?id=2123352

I put the wrong RFE link earlier. It's https://bugzilla.redhat.com/show_bug.cgi?id=2124052 . I apologize for the confusion.

Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/35486 has been resolved.

Verified on satellite 6.12 snap 13, re-registration now also restarts yggdrasild

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Satellite 6.12 Release), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:8506