Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
System Engine generates its own CA Cert during install and uses it for the Web UI and signing other certs used for communication between pulp, candlepin, and AMQP.
Issues with this, outlined at https://fedorahosted.org/katello/wiki/CertsRedesign, along with a lot more detail are:
all server certs are signed by Candlepin CA
Candlepin CA serves as both server cert and CA cert
its key is not password protected
its key is accessible by three system users
certs are not trusted
no multihome support
Version-Release number of selected component (if applicable):
System Engine 1.1 Beta
Thus far https://bugzilla.redhat.com/show_bug.cgi?id=754728 to document the process for replacing the CA with a subordinate CA signed by our CA has not been completed, and I have been told that the process will not be supported until 2.0.
How reproducible:
Always
Steps to Reproduce:
1. Install System Engine
Actual results:
See that the CA Cert created during install is used as the server cert and the CA Cert for signing other certs. Look for documentation on replacing the CA Cert with a subordinate CA signed by your organizations CA and see that there is none.
Expected results:
We should be able to replace the cert for the Web UI with a standard SSL cert signed by our CA. We should also have the option of replacing the CA Cert created during install with a subordinate CA cert signed by our CA Cert.
Additional info: