The certs *can* be *generally* updated on 6.15. The above is no reproducer, I can update my certs that way.

What makes the scenario unique / failing? I *think* this bit can be relevant for..

katello-certs-check \
> -c <satellite_cert.pem> \
> -k <satellite_cert_key.pem> \
> -b <ca_cert_bundle.pem>

..:

function check-expiration () {
    CERT_EXP=$(openssl x509 -noout -enddate -in $CERT_FILE | sed -e 's/notAfter=//' | awk '{$NF="";}1')
    CA_EXP=$(openssl x509 -noout -enddate -in $CA_BUNDLE_FILE | sed -e 's/notAfter=//' | awk '{$NF="";}1')

what if <ca_cert_bundle.pem> is a CA chain and *some* intermediate CA is out of validity? The openssl prints just first (or last?) cert details.

We might need to split the CA per:

awk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print > "ca_cert." c ".pem"}' < $CA_BUNDLE_FILE

and get the soonest expiration timestamp from all the ca_cert.*.pem files.


(I should play with this reproducer more, though, but I think this is a real bug in katello-certs-check; maybe independent on the originally reported bug)

*** This bug has been marked as a duplicate of bug 2174489 ***