Change Foreman web SSL certificate

[ekohl]

@romgo

What about ssl_ca paramater should be CA from domain.local or the one from SSLCACertificateFile ?

It’s the ssl_ca parameter I mean. That should be the CA that on the Apache 2 side is configured and matches the SSLCertificateFile.

@Stefan_Lasiewski

I’m running into the same issue. Is this article still up to date? SSLCertificateChainFile is obsolete, isn’t it?

We explicitly use it for the second paragraph:

This should be used alternatively and/or additionally to SSLCACertificatePath for explicitly constructing the server certificate chain which is sent to the browser in addition to the server certificate. It is especially useful to avoid conflicts with CA certificates when using client authentication. Because although placing a CA certificate of the server certificate chain into SSLCACertificatePath has the same effect for the certificate chain construction, it has the side-effect that client certificates issued by this same CA certificate are also accepted on client authentication.

Using this makes sure we serve the application using Letsencrypt certificates but not accepting them as client certificates, which would open up a huge security hole. We set that to a different CA (Puppet in the Foreman scenario, a custom one in the Katello scenario).

@Stefan_Lasiewski

BTW, I was able to change the webserver certificate for the Web interface with the following foreman-installer flags:

In Replacing self-signed certificates - #2 by ekohl I’ve described how to I set this up for me. Note that you missed two parameters. You are more strict in your chain file, which is probably more secure.