Failed to fetch katello Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] sslv3 alert certificate expired (_ssl.c:2578)'))

Support
1

Problem:

Getting the following error:

Failed to fetch katello://capsule01/pulp/deb/ORG01/DEV/Ubuntu_22_04_Content_View/custom/Ubuntu_22_04_Linux/Ubuntu_Jammy_multiverse/dists/default/all/binary-amd64/Packages  SSLError: HTTPSConnectionPool(host='capsule01', port=443): Max retries exceeded with url: /pulp/deb/ORG01/DEV/Ubuntu_22_04_Content_View/custom/Ubuntu_22_04_Linux/Ubuntu_Jammy_multiverse/dists/default/all/binary-amd64/Packages.xz (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] sslv3 alert certificate expired (_ssl.c:2578)')))

Expected outcome:

apt upgrade -y successfully completing

Foreman and Proxy versions:

3.12.1

Foreman and Proxy plugin versions:

Distribution and version:

Ubuntu 22.04 is the client
Oracle Enterprise 8 is running the Capsule

Other relevant data:

Checked current certs:

katello-certs-check -t smart-proxy -b ./capsule01-bunlde.pem -c ./capsule01.cer -k ./capsule.key
Checking server certificate encoding:
[OK]

Checking expiration of certificate:
[OK]

Checking expiration of CA bundle:
[OK]

Checking if server certificate has CA:TRUE flag
[OK]

Checking for private key passphrase:
[OK]

Checking to see if the private key matches the certificate:
[OK]

Checking CA bundle against the certificate file:
[OK]

Checking CA bundle size: 3
[OK]

Checking if CA bundle has trust rules: 0
[OK]

Checking Subject Alt Name on certificate
[OK]

Checking if any Subject Alt Name on certificate matches the Subject CN
[OK]

Checking Key Usage extension on certificate for Key Encipherment
[OK]

Checking for use of shortname as CN
[OK]

Expicitly checked expirations:

openssl s_client -showcerts -servername capsule01.some.domain -connect capsule01.some.domain:443 | openssl x509 -noout -dates

notBefore=Feb 29 16:37:07 2024 GMT
notAfter=Feb 27 16:37:07 2029 GMT

Tried RHEL Family OS updates, and they seem to be working.

2

I found the solution to this issue:

apt install --only-upgrade python3-subscription-manager

<...SNIP...>

Do you want to continue? [Y/n] Y

<...SNIP...>

Configuration file '/etc/rhsm/rhsm.conf'
==> Modified (by you or by a script) since installation.
==> Package distributor has shipped an updated version.
   What would you like to do about it ?  Your options are:
    Y or I  : install the package maintainer's version
    N or O  : keep your currently-installed version
      D     : show the differences between the versions
      Z     : start a shell to examine the situation
The default action is to keep your current version.
*** rhsm.conf (Y/I/N/O/D/Z) [default=N] ? N

<...SNIP...>