Foreman » Installer

Description of problem:

Repository synchronization fails when custom certificates containing OpenSSL PKCS#12 metadata (Bag Attributes) are used. The certificates pass katello-certs-check and are successfully applied to Satellite, but sync operations fail with a CA certificate validation error.

How reproducible:

Always reproducible with the affected certificate set.

Is this issue a regression from an earlier version:

Unknown.

Steps to Reproduce:

• Export custom certificates from a Windows PFX/PKCS#12 bundle.
• Apply the certificates to Satellite using the documented certificate deployment procedure.
• Verify katello-certs-check completes successfully.
• Enable or sync existing repositories
• Run a repository synchronization.

Actual behavior:

Repository synchronization fails with:

Error message: the server returns an error
HTTP status code: 400
Response headers: {"Date"=>"Tue, 16 Jun 2026 05:12:40 GMT", "Server"=>"gunicorn", "Content-Type"=>"application/json", "Vary"=>"Accept,Cookie", 
"Allow"=>"GET, POST, HEAD, OPTIONS", "X-Frame-Options"=>"DENY", "Content-Length"=>"61", "X-Content-Type-Options"=>"nosniff", "Referrer-Policy"=>"same-origin", "Cross-Origin-Opener-Policy"=>"same-origin",
"Correlation-ID"=>"3f93b645-354f-42bf-xxxxxxxx", "Access-Control-Expose-Headers"=>"Correlation-ID", "Via"=>"1.1 satellite.example.com", "Connection"=>"close"}
Response body: {"ca_certificate":["Must be PEM encoded X.509 certificate."]}Error message: the server returns an error
Response body: {"ca_certificate":["Must be PEM encoded X.509 certificate."]}undefined method `pulp_href' for nil:NilClass

The certificate files contain OpenSSL PKCS#12 metadata such as:

Bag Attributes: <Empty Attributes>
subject=...
issuer=...

Successfully applied to the satellite:-

cat /etc/foreman/proxy_ca.pem
-----END CERTIFICATE-----
Bag Attributes: <Empty Attributes>
subject=DC=xx, DC=xx, DC=qr, DC=xxxxx, CN=xxxxxxx Issuer – xx
issuer=CN=xxxxxxxxxx xxx
-----BEGIN CERTIFICATE-----

Expected behavior:

Certificate validation should be consistent across Satellite components. Certificates that pass katello-certs-check and are successfully deployed should not fail during repository synchronization. Alternatively, invalid certificate content should be rejected during certificate installation.

Business Impact / Additional info:

Repository synchronization cannot be completed when affected custom certificates are used, preventing content synchronization despite successful certificate validation and deployment.