Bug #15163: Use new oVirt CA cert endpoint - Foreman

Bug #15163

Use new oVirt CA cert endpoint

Added by Lukas Zapletal almost 6 years ago. Updated almost 4 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Lukas Zapletal

Category:

Compute resources - oVirt

Target version:

1.12.0

Difficulty:

Triaged:

Bugzilla link:

1370169

Pull request:

https://github.com/theforeman/foreman/pull/3548

Fixed in Releases:

Found in Releases:

Description

Until now, we are downloading /ca.crt file from RHEV/oVirt. From version 3.4+ new endpoint is available (/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA HTTP GET) and the old one will be deprecated.

Related issues

Associated revisions

Revision bf416ab2 (diff)
Added by Lukas Zapletal almost 6 years ago

Fixes #15163 - use new oVirt CA cert endpoint

History

#1 Updated by The Foreman Bot almost 6 years ago

Status changed from New to Ready For Testing
Pull request https://github.com/theforeman/foreman/pull/3548 added

#2 Updated by Lukas Zapletal almost 6 years ago

Status changed from Ready For Testing to Closed
% Done changed from 0 to 100

Applied in changeset bf416ab295d345352dbc8f8e19607d08f9e4efad.

#3 Updated by Dominic Cleal almost 6 years ago

Legacy Backlogs Release (now unused) set to 136

#4 Updated by Ohad Levy over 5 years ago

Bugzilla link set to 1370169

#5 Updated by Juan Hernández over 5 years ago

Please take into account that both the old and new endpoints return the certificate of the CA that was created when the RHV/oVirt engine was installed. But the RHV/oVirt administrator may later replace the certificates, specially the web server certificate, see [1]. If that happens the CA certificate obtained from those endpoints won't work to connect to the engine. I'd suggest that you take the certificate directly from the SSL handshake, that will always work.

[1] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.6/html/Administration_Guide/appe-Red_Hat_Enterprise_Virtualization_and_SSL.html)