O.K. It’s too bad that the foreman scenario doesn’t know how to handle the certs tar from katello. I think that is how it’s supposed to be. To get it working I had to get certificates by hand.
On the main foreman/katello server generate the certs tar:
[root@foreman8 ~]# foreman-proxy-certs-generate \
--foreman-proxy-fqdn "foreman8-puppet.example.com" \
--certs-tar "~/foreman8-puppet.example.com-certs.tar" \
--server-cert "/root/certs/foreman8-puppet/foreman8-puppet.cer" \
--server-key "/root/certs/foreman8-puppet/foreman8-puppet.key" \
--server-ca-cert "/root/certs/foreman8-puppet/foreman8-puppet_interm.cer"
We use certificates from a custom CA. foreman8-puppet.cer is the server certificate for the new proxy foreman8-puppet.example.com, foreman8-puppet.key is the key and foreman8-puppet_interm.cer is the full chain.
Copy the tar foreman8-puppet.example.com-certs.tar to the new proxy, /root and extract it there:
[root@foreman8-puppet ~]# tar xvf foreman8-puppet.example.com-certs.tar
This extracts everything into /root/ssl-build/
As far as I know by now, I need to configure ssl for the foreman-proxy (where the main server connects to the proxy) and the puppet client (which the proxy uses to connect to the puppet api on the main server to upload reports, facts, etc.).
foreman-proxy:
[root@foreman8-puppet ~]# cd /etc/foreman-proxy/
[root@foreman8-puppet foreman-proxy]# cp ~/ssl-build/katello-default-ca.crt ssl_ca.pem
[root@foreman8-puppet foreman-proxy]# cp ~/ssl-build/foreman8-puppet.example.com/foreman8-puppet.example.com-foreman-proxy.crt ssl_cert.pem
[root@foreman8-puppet foreman-proxy]# cp ~/ssl-build/foreman8-puppet.example.com/foreman8-puppet.example.com-foreman-proxy.key ssl_key.pem
[root@foreman8-puppet foreman-proxy]# chmod 440 ssl_ca.pem ssl_key.pem
[root@foreman8-puppet foreman-proxy]# chmod 444 ssl_cert.pem
[root@foreman8-puppet foreman-proxy]# chgrp foreman-proxy ssl_*.pem
[root@foreman8-puppet foreman-proxy]# ls -l
total 20
-rw-r--r--. 1 root root 0 Jun 9 16:46 migration_state
drwxr-xr-x. 2 root root 4096 Jul 14 15:49 settings.d
-rw-r-----. 1 root foreman-proxy 3968 Jun 9 16:46 settings.yml
-r--r-----. 1 root foreman-proxy 2524 Jul 14 12:53 ssl_ca.pem
-r--r--r--. 1 root foreman-proxy 3004 Jul 14 12:09 ssl_cert.pem
-r--r-----. 1 root foreman-proxy 3272 Jul 14 12:10 ssl_key.pem
Puppet client:
[root@foreman8-puppet ~]# mkdir -p /etc/pki/katello/puppet
[root@foreman8-puppet ~]# chmod 750 /etc/pki/katello/puppet/
[root@foreman8-puppet ~]# cd /etc/pki/katello/puppet/
[root@foreman8-puppet puppet]# cp ~/ssl-build/katello-server-ca.crt puppet_client_ca.crt
[root@foreman8-puppet puppet]# cp ~/ssl-build/foreman8-puppet.example.com/foreman8-puppet.example.com-puppet-client.crt puppet_client.crt
[root@foreman8-puppet puppet]# cp ~/ssl-build/foreman8-puppet.example.com/foreman8-puppet.example.com-puppet-client.key puppet_client.key
[root@foreman8-puppet puppet]# chmod 440 puppet_client*
[root@foreman8-puppet puppet]# chgrp -R puppet .
[root@foreman8-puppet puppet]# ls -al
total 24
drwxr-x---. 2 root puppet 84 Jul 14 18:22 .
drwxr-xr-x. 3 root root 20 Jul 14 18:17 ..
-r--r-----. 1 root puppet 6189 Jul 14 18:21 puppet_client_ca.crt
-r--r-----. 1 root puppet 8355 Jul 14 18:22 puppet_client.crt
-r--r-----. 1 root puppet 3272 Jul 14 18:22 puppet_client.key
This is the same organization files and directories like on the main server.
And point foreman-installer to the correct locations:
...
--foreman-proxy-ssl-ca=/etc/foreman-proxy/ssl_ca.pem \
--foreman-proxy-ssl-cert=/etc/foreman-proxy/ssl_cert.pem \
--foreman-proxy-ssl-key=/etc/foreman-proxy/ssl_key.pem \
--puppet-server-foreman-ssl-ca=/etc/pki/katello/puppet/puppet_client_ca.crt \
--puppet-server-foreman-ssl-cert=/etc/pki/katello/puppet/puppet_client.crt \
--puppet-server-foreman-ssl-key=/etc/pki/katello/puppet/puppet_client.key \
...
Now, basic connections seem to work. I can register the proxy in the main server and the proxy seems to forward facts and reports to the main server.
Looking at the other ssl configuration for foreman-proxy on the main server, I can see that it’s different certs here:
--foreman-proxy-foreman-ssl-ca SSL CA used to verify connections when accessing the Foreman API.
When not specified, the ssl_ca is used instead. (current: "/etc/foreman-proxy/foreman_ssl_ca.pem")
--foreman-proxy-foreman-ssl-cert SSL client certificate used when accessing the Foreman API
When not specified, the ssl_cert is used instead. (current: "/etc/foreman-proxy/foreman_ssl_cert.pem")
--foreman-proxy-foreman-ssl-key Corresponding key to a foreman_ssl_cert certificate
When not specified, the ssl_key is used instead. (current: "/etc/foreman-proxy/foreman_ssl_key.pem")
I didn’t set these on my new proxy, thus it’s using the ssl_*.pem files instead. It’s unclear to me if and where the foreman-proxy uses those…
