Bug 843494
| Summary: | SSL issues with custom client-side FQDNs and cert update | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Update Infrastructure for Cloud Providers | Reporter: | mkovacik | ||||||||
| Component: | RHUA | Assignee: | James Slagle <jslagle> | ||||||||
| Status: | CLOSED NOTABUG | QA Contact: | mkovacik | ||||||||
| Severity: | unspecified | Docs Contact: | |||||||||
| Priority: | high | ||||||||||
| Version: | 2.1 | CC: | tsanders, whayutin | ||||||||
| Target Milestone: | --- | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | Unspecified | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2012-07-27 19:51:37 UTC | Type: | Bug | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
mkovacik
2012-07-26 13:08:18 UTC
Something strange is going on here. You show the contents of /etc/pki/entitlement/ca.crt, which is the CA cert, but that has entitlement paths in it like that of an entitlement cert. What does /etc/pki/entitlement/product/content.crt look like? Created attachment 600557 [details]
content cert and ca cert screen log
Attached the requested in a screen log
I think this is a certificate misconfiguration issue. Can you attach the following files from the CDS: /etc/pki/pulp/content/rhui-2.0-6Server-x86_64/consumer-rhui-2.0-6Server-x86_64.cert /etc/pki/pulp/content/rhui-2.0-6Server-x86_64/consumer-rhui-2.0-6Server-x86_64.ca Also, did you generate a new entitlement cert and then use that in rhui-manager? Meaning, did you delete the old one from /etc/pki/rhui/entitlement-ca.crt and upload the new one on the next start with rhui-manager? (In reply to comment #5) > Also, did you generate a new entitlement cert and then use that in > rhui-manager? Meaning, did you delete the old one from > /etc/pki/rhui/entitlement-ca.crt and upload the new one on the next start > with rhui-manager? I think so, yes; I do follow steps in this paragraph: https://engineering.redhat.com/trac/IntegratedMgmtQE/wiki/RHUI_2.0_setup#ec:rh20:replacing-certificates which includes removing the file you mention. Created attachment 600841 [details] Cds-side certs Attaching what requested in comment 4. Seems the issuer CN is localhost unlike of what is present in client config rpm (CN=ip-10-80-226-7.ec2.internal CA)... The CA that signed the client configuration rpm does not match the CDS expects. Did you regenerate client config rpm's after updating the entitlement CA? Did you do a CDS sync after updating the entitlement CA? Well, I can't tell; let me try generating fresh config and sysncing CDSes... Hopefully that's the issue... Created attachment 600860 [details]
pulp-server-ca.crt vs repository ca issuer
The sync didn't help; I've noticed that /etc/pki/pulp/pulp-server-ca.crt CN is different than the repo cert issuer CN (localhost) on the CDS1; but these files aren't owned by any package, so they have to be deployed by some other mechanizm (sync probably; see the attachment)
Ended up logging onto Milan's machines and just walking through the procedure to update the entitlement CA again. Not sure why it didn't work the first time. Given we've seen it work many times, going to close this as NOTABUG. |