Description of problem: puppet_server_certname not used for defaults of foreman-proxy-puppet-ssl-key and foreman-proxy-puppet-ssl-cert. - Configure the Red Hat Satellite 6.11 to use a friendly CNAME for all URLs. - On place where we see that the defaults are not inheriting the Certificate Name server is the Foreman-Proxy-Puppet part that is not inheriting the Puppet-Server-Certname value for the keys. After setting puppet_server_certname to sat6.example.com the installer nicely generates the certificate files under that name: ~~~ # ls -l /etc/puppetlabs/puppet/ssl/certs/ total 8 -rw-r--r--. 1 puppet puppet 3866 Sep 15 07:37 ca.pem -rw-r--r--. 1 puppet puppet 2061 Sep 15 07:37 sat6.example.com ~~~ - But later in the foreman-proxy it fails to load the files because it is still using the original FQDN based file: ~~~ 2022-09-15T07:38:33 [W] Error details for Disabling all modules in the group ['puppet_proxy_puppet_api', 'puppet'] due to a failure in one of them: File at '/etc/puppetlabs/puppet/ssl/certs/satellite.example.com.pem' defined in 'puppet_ssl_cert' parameter doesn't exist or is unreadable: <Proxy::Error::ConfigurationError>: File at '/etc/puppetlabs/puppet/ssl/certs/satellite.example.com.pem' defined in 'puppet_ssl_cert' parameter doesn't exist or is unreadable ~~~ Version-Release number of selected component (if applicable): Red Hat Satellite 6.11 How reproducible: Yes. Steps to Reproduce: -Run satellite-installer --puppet_server_certname=sat6.example.com --reset-foreman-proxy-puppet-ssl-cert --reset-foreman-proxy-puppet-ssl-key Actual results: - The file '/etc/puppetlabs/puppet/ssl/certs/mysat6server.example.com.pem' is correctly created - The proxy fails (can be seen in /var/log/foreman-proxy/proxy.log) because it still tries to read /etc/puppetlabs/puppet/ssl/private_keys/<fqdn>.com.pem" - 'satellite-installer --full-help | grep proxy-puppet-ssl' still shows defaults with FQDN instead of the certname. Expected results: - The defaults for certificate file names use the configured 'certname' value for which the installer is also generating the files. Additional info: The reason is that the installer has for the puppet ssl certificates 'hardcoded' the FQDN in the name, also for the default value to reset it: ~~~~ # satellite-installer --full-help | grep proxy-puppet-ssl --foreman-proxy-puppet-ssl-ca SSL CA used to verify connections when accessing the Puppet master API (current: "/etc/puppetlabs/puppet/ssl/certs/ca.pem") --reset-foreman-proxy-puppet-ssl-ca Reset puppet_ssl_ca to the default value ("/etc/puppetlabs/puppet/ssl/certs/ca.pem") --foreman-proxy-puppet-ssl-cert SSL certificate used when accessing the Puppet master API (current: "/etc/puppetlabs/puppet/ssl/certs/satellite.example.com.pem") --reset-foreman-proxy-puppet-ssl-cert Reset puppet_ssl_cert to the default value ("/etc/puppetlabs/puppet/ssl/certs/satellite.example.com.pem") --foreman-proxy-puppet-ssl-key SSL private key used when accessing the Puppet master API (current: "/etc/puppetlabs/puppet/ssl/private_keys/satellite.example.com.pem") --reset-foreman-proxy-puppet-ssl-key Reset puppet_ssl_key to the default value ("/etc/puppetlabs/puppet/ssl/private_keys/satellite.example.com.pem") ~~~~ Workaround: - Add manually the 'foreman-proxy-puppet-ssl-key' and 'foreman-proxy-puppet-ssl-cert' to the satellite-installer to configure the correct SSL files for foreman-proxy-puppet part