Problem:
After applying the 3.11.4 update to an existing 3.11.2 install, foreman-installer is now failing.
[root@tsbmoforeman02q usr]# foreman-installer
2024-11-01 10:35:47 [NOTICE] [root] Loading installer configuration. This will take some time.
2024-11-01 10:35:50 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
2024-11-01 10:35:50 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
Checking server certificate encoding:
[OK]
Checking expiration of certificate:
[OK]
Checking expiration of CA bundle:
[OK]
Checking if server certificate has CA:TRUE flag
[OK]
Checking for private key passphrase:
[OK]
Checking to see if the private key matches the certificate:
[OK]
Checking CA bundle against the certificate file:
[FAIL]
The /root/ssl-cert/foremanqa.jkhy.com/foremanqa.jkhy.com.cacrt does not verify the /root/ssl-cert/foremanqa.jkhy.com/foremanqa.jkhy.com.crt
verify: Option unknown option -no-CAstore
verify: Use -help for summary.
Checking CA bundle size: 2
[OK]
Checking if CA bundle has trust rules: 0
[OK]
Checking Subject Alt Name on certificate
[OK]
Checking if any Subject Alt Name on certificate matches the Subject CN
[OK]
Checking Key Usage extension on certificate for Key Encipherment
[OK]
Checking for use of shortname as CN
[OK]
2024-11-01 10:35:53 [ERROR ] [root] Checking server certificate encoding:
[OK]
Checking expiration of certificate:
[OK]
Checking expiration of CA bundle:
[OK]
Checking if server certificate has CA:TRUE flag
[OK]
Checking for private key passphrase:
[OK]
Checking to see if the private key matches the certificate:
[OK]
Checking CA bundle against the certificate file:
[FAIL]
The /root/ssl-cert/foremanqa.jkhy.com/foremanqa.jkhy.com.cacrt does not verify the /root/ssl-cert/foremanqa.jkhy.com/foremanqa.jkhy.com.crt
verify: Option unknown option -no-CAstore
verify: Use -help for summary.
Checking CA bundle size: 2
[OK]
Checking if CA bundle has trust rules: 0
[OK]
Checking Subject Alt Name on certificate
[OK]
Checking if any Subject Alt Name on certificate matches the Subject CN
[OK]
Checking Key Usage extension on certificate for Key Encipherment
[OK]
Checking for use of shortname as CN
[OK]
Expected outcome:
I expect foreman-installer to execute to successful completion
Foreman and Proxy versions:
Foreman version 3.11.4
Foreman and Proxy plugin versions:
foreman-tasks 9.1.1
foreman_ansible 14.0.0
foreman_puppet 7.0.0
foreman_remote_execution 13.1.0
katello 4.13.1
Distribution and version:
AlmaLinux 8.10
Other relevant data:
Noted that line 160 in /usr/sbin/katello-certs-check changed from
CHECK=$(openssl verify -CAfile $CA_BUNDLE_FILE -purpose sslserver -verbose $CERT_FILE 2>&1)
to
CHECK=$(openssl verify -no-CApath -no-CAstore -CAfile $CA_BUNDLE_FILE -purpose sslserver -verbose $CERT_FILE 2>&1)