403: [('PEM routines', '', 'no start line')]

Support
1

Problem:
I have a need to access repositories via HTTPS URL, I have followed instruction to get the certificate:

https://docs.theforeman.org/2.5/Content_Management_Guide/index-foreman-deb.html#Managing_Organizations-Browsing_Repository_Content_Using_an_Organization_Debug_Certificate

However I have got the error:

403: [(‘PEM routines’, ‘’, ‘no start line’)]

We use Chrome as a browser, not Firefox as doc

I also tried curl, copied certificate and key as instructed, there I get another error:
curl -k --cert /tmp/file.pem --key /tmp/file.key https://foreman01.net/pulp/content/Org/Library/content/dist/rhel9/9/x86_64/appstream/os/

curl: (56) OpenSSL SSL_read: error:0A000418:SSL routines::tlsv1 alert unknown ca, errno 0

Expected outcome:
I expect to see the repository content

Foreman and Proxy versions:
foreman-3.13.0-1.el9.noarch
foreman-proxy-3.13.0-1.el9.noarch
katello-4.15.0-1.el9.noarch

Foreman and Proxy plugin versions:

Distribution and version:
RHEL9.5 5.14.0-503.21.1.el9_5.x86_64

Any help appreciated.

Thanks & Regards,
Jan

2

Hey there!

A short sidenote first, your are on a very old documentation version that does not match your installed version, this is the one you most likely were looking for: Managing organizations and locations in Foreman

Though this is just details, not really different information.
To get it working with Chromium based browsers (I tested it with MSEdge), you need to convert the cert like for Firefox to PKCS#12 (I just used XCA for that) and then import it as personal certificate.

image
image1180×370 29 KB

and then on the next page load it asks which certificate should be used:

image
image812×432 26.2 KB

and after that it’s able to access the ContentGuard secured paths.

Cheers, Lukas

3

Hello Lukas,
many thanks for your reply, I followed the instruction to the letter ( I hope I did), but unfortunately all what I get is:

image

I am still not sure what is wrong or what I am doing wrong.

Regards, Jan

4

The / at the end after the content is very important if you want to see your organizations :slight_smile: (or basically every sub-page that lists things)

5

Hello Lukas,

thanks a lot for the helping hand. It works now, however, the protected content I can not browse w/o knowing the complete URL of the repo, I have to enter the complete URL to get access to the repositories. Is there another trick? What am I overlooking?

Thanks and Regards!
Jan

6

Hi again!

Same for me :slight_smile:
There is at least a good option to guess it if not visible. If you look in the config details of the base repos (Products → Product → Repository), these show the link, the only once you will have to guess are, if you reach the root directory of the repo then it will show everything browsable below again.
For the paths in CVs, well yeah these you really need to guess, but it’s basically just replacing the most upper path part with what’s needed to find the repo in the CV. (like /pulp/content/<org-label>/Library/custom/<product-label>/<repo-label>/ → /pulp/content/<org-label>/<le-label>/<cv-label>/custom/custom/<product-label>/<repo-label>/)
Hope that helps!

Cheers, Lukas