I verified and can confirm that the CA under /etc/foreman/proxy_ca.pem is the same as /etc/foreman-proxy/foreman_ssl_ca.pem.
The curl connected successfully using those.
Below the curl command and output using one of those certs.
[root@foremanprod02 ~]# curl https://foremanprod02.servers.vrt.be/pulp/api/v3/repositories/rpm/rpm/ --noproxy '*' --cacert /etc/foreman/proxy_ca.pem -v
* Trying 10.27.4.63...
* TCP_NODELAY set
* Connected to foremanprod02.servers.vrt.be (10.27.4.63) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/foreman/proxy_ca.pem
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: C=US; ST=North Carolina; O=FOREMAN; OU=SMART_PROXY; CN=foremanprod02.servers.vrt.be
* start date: Jun 16 13:05:30 2021 GMT
* expire date: Jan 18 13:05:30 2038 GMT
* subjectAltName: host "foremanprod02.servers.vrt.be" matched cert's "foremanprod02.servers.vrt.be"
* issuer: C=US; ST=North Carolina; L=Raleigh; O=Katello; OU=SomeOrgUnit; CN=foremanprod02.servers.vrt.be
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* Using Stream ID: 1 (easy handle 0x56307d1aa710)
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET /pulp/api/v3/repositories/rpm/rpm/ HTTP/2
> Host: foremanprod02.servers.vrt.be
> User-Agent: curl/7.61.1
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/2 403
< date: Thu, 05 Dec 2024 08:00:59 GMT
< server: gunicorn
< content-type: application/json
< vary: Accept,Cookie
< allow: GET, POST, HEAD, OPTIONS
< x-frame-options: DENY
< content-length: 58
< x-content-type-options: nosniff
< referrer-policy: same-origin
< cross-origin-opener-policy: same-origin
< correlation-id: 048ceebce00f46149ad02cff4ab451f0
< access-control-expose-headers: Correlation-ID
< via: 2.0 foremanprod02.servers.vrt.be
<
* Connection #0 to host foremanprod02.servers.vrt.be left intact
{"detail":"Authentication credentials were not provided."}[root@foremanprod02 ~]#
