Plugins » Katello

Description:

Running katello-installer --certs-server-cert ~/ssl/katello.tld.crt --certs-server-cert-req ~/ssl/katello.tld.csr --certs-server-key ~/ssl/katello.tld.key --certs-server-ca-cert ~/ssl/CABundle.pem --certs-update-server --certs-update-server-ca renders Foreman and crane unusable because of unrelated CA in cert chain.

Steps to Reproduce:
1. (Probably) Install katello as usual with no external SSL certificates;
2. Run katello-installer --certs-server-cert ~/ssl/katello.tld.crt --certs-server-cert-req ~/ssl/katello.tld.csr --certs-server-key ~/ssl/katello.tld.key --certs-server-ca-cert ~/ssl/CABundle.pem --certs-update-server --certs-update-server-ca
3. Run openssl s_client -connect katello.tld:443 from external system.

Actual results:
CONNECTED(00000003)
depth=0 C = RU, L = ***, O = ***, OU = ***, CN = katello.tld, emailAddress = ***
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = RU, L = ***, O = ***, OU = ***, CN = katello.tld, emailAddress = ***
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = RU, L = ***, O = ***, OU = ***, CN = katello.tld, emailAddress = ***
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/C=RU/L=***/O=***/OU=***/CN=katello.tld/emailAddress=***
i:/C=RU/DC=ru/... and so on (subCA info data)
1 s:/C=US/ST=North Carolina/L=Raleigh/O=Katello/OU=SomeOrgUnit/CN=katello.tld
i:/C=US/ST=North Carolina/L=Raleigh/O=Katello/OU=SomeOrgUnit/CN=katello.tld

Expected results:
[..]
Certificate chain
0 s:/C=RU/L=***/O=***/OU=***/CN=katello.tld/emailAddress=***
i:/C=RU/DC=ru/... and so on (subCA info data)
1 s:/C=RU/DC=ru/... and so on (subCA info data)
i:/C=RU/DC=ru/... and so on (CA info data)
2 s:/C=RU/DC=ru/... and so on (CA info data)
i:/C=RU/DC=ru/... and so on (CA info data)

Additional info:
Wrong certificate in chain comes from /etc/pki/katello/certs/katello-default-ca.crt, it was added in 03-crane.conf and 05-foreman-ssl.conf as SSLCertificateChainFile and SSLCACertificateFile.