Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:
katello-configure (rather, the "certs::config" class) uses /root/ssl-build as a scratch directory to store lots of SSL data.  It contains OpenSSL configs, keys, certs, serials etc., generated by install steps in the class.

This data should move to /var/lib/katello or similar, so it follows the FHS.  Under /root it's in danger of not being backed up.

Version-Release number of selected component (if applicable):
1.1, confirmed in git master.

How reproducible:
Always

Steps to Reproduce:
1. install katello
2. run katello-configure
3. check /root/ssl-build
  
Actual results:
Present

Expected results:
Absent

From LZAP in email
I think the reason why we choosen /root was:

1) There are few files which contains private keys
2) Satellite do this
3) The ultimate goal is to generate Katello ueber-cert with private key
that must be kept separetely (and backuped separately too) and then to
sign everything else. I am not sure if we want to move this one into
/var (therefore regular backups - very often unencrypted).

So I am for moving the content out of /root maybe except the most
sensitive information - like ueber-passphrase.

Created redmine issue http://projects.theforeman.org/issues/16914 from this bug

This is an older bug, which is being tracked upstream. We will not be tracking this downstream. When the upstream issue is resolved, the next rebase will pull in the fix.