Bug #34317: [Custom Certs] - Failed to install the custom certs on Katello 4.3, works on 4.1 - Installer - Foreman

Actions

Copy link

Bug #34317

closed

[Custom Certs] - Failed to install the custom certs on Katello 4.3, works on 4.1

Added by Evgeni Golov about 3 years ago. Updated about 3 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Ewoud Kohl van Wijngaarden

Category:

Foreman modules

Target version:

Foreman - 3.1.1

Difficulty:

Triaged:

Yes

Bugzilla link:

2036054

Pull request:

https://github.com/theforeman/puppet-foreman/pull/1022

Fixed in Releases:

Foreman - 3.1.1, Foreman - 3.2.0

Found in Releases:

Foreman - 3.1.0

Red Hat JIRA:

Description

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=2036054

Description of problem:
[Custom Certs] - Failed to install the custom certs on the Satellite 7.0.0 works fine in 6.10

Version-Release number of selected component (if applicable):
fails on Satellite 7.0.0
Passes on Satellite 6.10

How reproducible:
Always

Steps to Reproduce:
1. Generate the CA certs bundle and install it as follows

[root@dhcp-3-215 ~]# satellite-installer --scenario satellite \

--certs-server-cert "/root/satellite.redhat.com/satellite.redhat.com.crt" \
--certs-server-key "/root/satellite.redhat.com/satellite.redhat.com.key" \
--certs-server-ca-cert "/root/cacert.crt" \
--certs-update-server --certs-update-server-ca

Actual results:
Satellite Installer is not installing the custom certs in Satellite.

Expected results:
Satellite Installer should install the custom certs on the Satellite.

Additional info:

Updated by Evgeni Golov about 3 years ago

Subject changed from [Custom Certs] - Failed to install the custom certs on Katello 4.3, works on 4.1 to [Custom Certs] - Failed to install the custom certs on Katello 4.3, works on 4.1
Found in Releases 3.1.0 added

The problem is that puppet-certs dropped the "trusted_ca" use in the following commit:

commit 953261ffd2eb52b7176ab365fb0c4e9245435d99
Author: Eric D. Helms <ericdhelms@gmail.com>
Date:   Thu Jul 2 15:16:29 2020 -0400

    Refs #30316: Drop bootstrap RPM code

And moved it to puppet-foreman_proxy_content:

commit 7bf101dc5507c90936b9e6169b91848ef106fe0f
Author: Eric D. Helms <ericdhelms@gmail.com>
Date:   Thu Jul 2 14:09:33 2020 -0400

    Fixes #30316: Move bootstrap RPM generation from puppet-certs

but due to ordering, the fpc code is not executed before Foreman::Register/Foreman_host is called, so at that point the CA is still untrusted and everything fails.

Re-running the installer works, as now the CA is trusted.