Dnf update fails - cannot download repodata/repomd.xml

Support
1

Problem:
Today without any update from my site I face the following strange issue.
For one organization only (got 2) when trying to dnf update i get the message.
Curl error (60): Peer certificate cannot be authenticated with given CA certificates for https://mydomain.com/pulp/content/RHEL_8/content/dist/rhel8/8/x86_64/baseos/os/repodata/repomd.xml [SSL certificate problem: certificate has expired]
Error: Failed to download metadata for repo ‘rhel-8-for-x86_64-baseos-rpms’: Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried

Expected outcome:
No error

Foreman and Proxy versions:
Version 3.12.1

Foreman and Proxy plugin versions:

Distribution and version:

Other relevant data:

2

certificate expired

i guess if you just run foreman-installer, it will generate new one

or try this

foreman-installer --scenario katello --certs-update-all

see: Foreman :: Plugin Manuals

if you use the default selfsigned CA

3

Tried that --certs-update-all but it didnt worked :confused:

[root@# foreman-installer --scenario katello --certs-update-a ll
2025-05-25 19:00:03 [NOTICE] [root] Loading installer configuration. This will t ake some time.
2025-05-25 19:00:07 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
2025-05-25 19:00:07 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
Marking certificate -apache for update
Marking certificate -foreman-client for update
Marking certificate -foreman-proxy for update
Marking certificate -foreman-proxy-client for update
Marking certificate -puppet-client for update
2025-05-25 19:00:16 [NOTICE] [configure] Starting system configuration.
2025-05-25 19:00:42 [NOTICE] [configure] 250 configuration steps out of 1931 steps complete.
2025-05-25 19:00:48 [NOTICE] [configure] 500 configuration steps out of 1932 steps complete.
2025-05-25 19:00:53 [NOTICE] [configure] 750 configuration steps out of 1935 steps complete.
2025-05-25 19:00:53 [NOTICE] [configure] 1000 configuration steps out of 1941 steps complete.
2025-05-25 19:00:53 [NOTICE] [configure] 1250 configuration steps out of 1942 steps complete.
2025-05-25 19:00:54 [NOTICE] [configure] 1500 configuration steps out of 1942 steps complete.
2025-05-25 19:01:29 [NOTICE] [configure] 1750 configuration steps out of 1942 steps complete.
2025-05-25 19:01:49 [NOTICE] [configure] System configuration has finished.
Executing: foreman-rake upgrade:run

and on the web page I can see Expires On

Wednesday, March 4, 2026 at 2:39:44 PM

4

you might need to update all clients now with new certificate

something like

rpm -Uvh http://example.satellite.com/pub/katello-ca-consumer-latest.noarch.rpm --force

if the rpm is not recreated, try to create a new one with

/usr/bin/katello-rhsm-consumer
5

Seems that registering the clients again works… strange :S