hello
i have imported my manifest in foreman but i cannot refresh it.
when i go to “manage manifest” page i have a message that say “server broke connection” and the refresh button is grey and say that it cannot access cdn.redhat.com
foreman access internet is made throught a corporate proxy and i can sync all my others repository without problem
the network guys say that when i try to refresh the manifest, the proxy try to access himself
to explain, on the proxy called for example my_proxy , he see access to my_proxy when foreman try to access cdn.redhat.com like a loop.
in the content/redhat repositories i can see all the repos on left but when i try to open repos it say “No repositories available.”
in the production log i have a message :
2022-05-11T10:49:48 [I|app|] CDN: Requesting path https://cdn.redhat.com:443/content/dist/rhel/server/7/listing
2022-05-11T10:49:48 [E|app|e66cf6b9] Failed at scanning for repository: SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain)
when i set CDN SSL version with SSLv23
and
2022-05-11T10:55:43 [I|app|] CDN: Requesting path https://cdn.redhat.com:443/content/dist/rhel/power-le/7/7Server/listing
2022-05-11T10:55:43 [E|app|c8a52c28] Failed at scanning for repository: SSL_connect returned=1 errno=0 state=SSLv2/v3 read server hello A: tlsv1 alert protocol version
However, from the error message I suspect that somewhere in your setup some certificates are switched so that you end up with wrong certificates.
Is your proxy trying to replace SSL connections at any point?
hello
yes the 3 url are allowed on proxy
for the certificates, i made a standart katello scenario install. how can i verify that something is wrong ?
network guys say me that ssl connections are whitelisted on the proxy for the foreman server
another thing. when i access the subscription page i have a red message that say “server broke connexion” and in production.log there is this line :
2022-05-11T14:23:36 [E|app|86471f5a] Katello::HttpErrors::BadRequest: Server broke connection
86471f5a | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.4.0.2/app/controllers/katello/api/v2/api_controller.rb:271:in rescue in check_upstream_connection' 86471f5a | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.4.0.2/app/controllers/katello/api/v2/api_controller.rb:268:in check_upstream_connection’
Did you create a SSL certificate for your server using the same CA that your Firewall/Proxy uses for it’s SSL decryption? I saw the message in your initial post mentioning a self signed cert but you are doing SSL decryption. Is the CA cert for your firewall/proxy SSL decryption added to the OS CA trust store?
In our environment we have our internal CA issue certificates for our firewalls, Katello, and smart proxy servers. Katello and the smart proxies were configured with specifying our internal CA cert and it was added to the systems CA trust store. We also added *.redhat.com to the SSL decryption bypass rule. This then allowed the use of the Red Hat supplied certs in the manifest to communicate properly with Red Hat and all other external communication to get SSL decrypted but still be trusted.
Hi,
I am currently having trouble doing this step where my proxy allows connection to cdn.redhat.com, i have looked for steps on how to go about doing this but am still unsure on how to do this step, could you please provide input on how i would go about doing this. We are currently unable to sync our repository on our red hat site and i believe it is because we havent done this step.
