Since the certs will almost always be self signed, due to requesting the certs from the puppetserver, which is also the foreman server, I edited this line to ignore checking:
vim +82 /usr/share/foreman-proxy/lib/proxy/request.rb
Before:
75 if ca_file && !ca_file.to_s.empty?
76 http.ca_file = ca_file
77 http.verify_mode = OpenSSL::SSL::VERIFY_PEER
78 end
75 if ca_file && !ca_file.to_s.empty?
76 http.ca_file = ca_file
77 http.verify_mode = OpenSSL::SSL::VERIFY_NONE
78 end
Well, “Latest” doesn’t tell which version it really is nor does it say if it’s a katello server or a server without katello.
Generally, it’s best to follow the docs and use foreman-installer etc. to configure the system. Putting, replacing or editing files usually won’t really work or potentially break the next time you run foreman-installer.
So all considering, I just guess and say to look here
Ya, sorry that was lazy… Was going on like hour 50 of trying to fix this issue.
Non Katello.
Foreman:
Collecting plugin information
Foreman plugin: foreman-tasks, 9.1.1, Ivan NeÄŤas, The goal of this plugin is to unify the way of showing task statuses across the Foreman instance.
It defines Task model for keeping the information about the tasks and Lock for assigning the tasks
to resources. The locking allows dealing with preventing multiple colliding tasks to be run on the
same resource. It also optionally provides Dynflow infrastructure for using it for managing the tasks.
Foreman plugin: foreman_default_hostgroup, 7.0.0, Greg Sutcliffe, Adds the option to specify a default hostgroup for new hosts created from facts/reports
Foreman plugin: foreman_kubevirt, 0.1.9, Moti Asayag, Provision and manage Kubevirt Virtual Machines from Foreman.
Foreman plugin: foreman_puppet, 6.2.0, Ondřej Ezr and Shira Maximov, Allow assigning Puppet environments and classes to the Foreman Hosts.
Foreman plugin: foreman_remote_execution, 13.0.0, Foreman Remote Execution team, A plugin bringing remote execution to the Foreman, completing the config management functionality with remote management functionality.
Foreman plugin: foreman_salt, 16.0.2, Stephen Benjamin, Foreman Plug-in for Salt
Foreman plugin: foreman_statistics, 2.1.0, Ondrej Ezr, Statistics and Trends for Foreman gives users overview of their infrastructure.
Foreman plugin: foreman_templates, 9.4.0, Greg Sutcliffe, Engine to synchronise provisioning templates from GitHub
Foreman plugin: foreman_vault, 2.0.0, dmTECH GmbH,
Im fairly certain the certs are correct. Else I wouldnt be able to curl, or connect to the proxy, from the foreman server I assume? Something seems off in the certificate verification in the dynflow callback.
Beyond that, you didn’t even post what you did exactly before that nor the exact foreman-installer command you are running to update the cert. Nor if you are running this on the main server or a proxy like in the original post.
Error 1: Puppet Foreman_host resource 'smartproxyserver.net' failed. Logs:
/Stage[main]/Foreman_proxy::Register/Foreman_host[smartproxyserver.net]
Adding autorequire relationship with Anchor[foreman::providers::oauth]
Starting to evaluate the resource (1108 of 1123)
Could not evaluate: Exception SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain) in get request to: https://mainserver.net/api/v2/hosts?search=name%3D%22smartproxyserver.net%22
Wrapped exception:
SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain)
Evaluated in 0.01 seconds
Foreman_host[smartproxyserver.net](provider=rest_v3)
Making get request to https://smartproxyserver.net/api/v2/hosts?search=name%3D%22smartproxyserver.net%22
Error 2: Puppet Foreman_smartproxy resource 'smartproxyserver.net' failed. Logs:
/Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[smartproxyserver.net]
Adding autorequire relationship with Anchor[foreman::providers::oauth]
Starting to evaluate the resource (1110 of 1123)
Could not evaluate: Exception SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain) in get request to: https://smartproxyserver.net/api/v2/smart_proxies?search=name%3D%22smartproxyserver.net%22
Wrapped exception:
SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain)
Evaluated in 0.01 seconds
Foreman_smartproxy[smartproxyserver.net](provider=rest_v3)
Making get request to https://smartproxyserver.net/api/v2/smart_proxies?search=name%3D%22smartproxyserver.net%22
You did not run katello-certs-check to check if the files are O.K.
This is nowhere mentioned in the docs. You are using non-default paths. That’s a bad idea. Why do you use different paths? Who knows what happens when you point foreman directly to the files in /root. foreman-installer usually copies the right files into the rights places if you let it.
As I told you, the names are changed. We don’t want to show our origingal names here. The certificate is a SAN cert which include all our foreman/foreman-proxy names as alternate names.
I’m running into the same issue while trying to install a Smart Proxy w/ 3.11. We’ve been over the docs many times, trying to follow them exactly. But still this:
2024-08-16 16:14:15 [NOTICE] [root] Loading installer configuration. This will take some time.
2024-08-16 16:14:18 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
2024-08-16 16:14:18 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
2024-08-16 16:15:22 [NOTICE] [configure] Starting system configuration.
2024-08-16 16:16:01 [NOTICE] [configure] 250 configuration steps out of 1120 steps complete.
2024-08-16 16:16:34 [NOTICE] [configure] 500 configuration steps out of 1122 steps complete.
2024-08-16 16:16:43 [NOTICE] [configure] 750 configuration steps out of 1147 steps complete.
2024-08-16 16:18:09 [NOTICE] [configure] 1000 configuration steps out of 1148 steps complete.
2024-08-16 16:18:31 [ERROR ] [configure] /Stage[main]/Foreman_proxy::Register/Foreman_host[foreman-proxy-gpnixfor02.ipa.medforest.org]: Could not evaluate: Exception SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain) in get request to: https://gpnixfor01.ipa.medforest.org/api/v2/hosts?search=name%3D%22gpnixfor02.ipa.medforest.org%22
2024-08-16 16:18:31 [ERROR ] [configure] Wrapped exception:
2024-08-16 16:18:31 [ERROR ] [configure] SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain)
2024-08-16 16:18:31 [ERROR ] [configure] /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[gpnixfor02.ipa.medforest.org]: Could not evaluate: Exception SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain) in get request to: https://gpnixfor01.ipa.medforest.org/api/v2/smart_proxies?search=name%3D%22gpnixfor02.ipa.medforest.org%22
2024-08-16 16:18:31 [ERROR ] [configure] Wrapped exception:
2024-08-16 16:18:31 [ERROR ] [configure] SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain)
2024-08-16 16:18:31 [ERROR ] [configure] /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[gpnixfor02.ipa.medforest.org]: Failed to call refresh: Exception SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain) in get request to: https://gpnixfor01.ipa.medforest.org/api/v2/smart_proxies?search=name%3D%22gpnixfor02.ipa.medforest.org%22
2024-08-16 16:18:31 [ERROR ] [configure] /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[gpnixfor02.ipa.medforest.org]: Exception SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain) in get request to: https://gpnixfor01.ipa.medforest.org/api/v2/smart_proxies?search=name%3D%22gpnixfor02.ipa.medforest.org%22
2024-08-16 16:18:31 [ERROR ] [configure] Wrapped exception:
2024-08-16 16:18:31 [ERROR ] [configure] SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate in certificate chain)
2024-08-16 16:18:34 [NOTICE] [configure] System configuration has finished.
Can anyone shed any light on what the issue might be?
I did not get an answer, no. This weekend I tried for a few hours to figure it out. Still no luck. My team has all tried as well, and we’ve looked at our ca cert bundle and custom certs over and over again. We can’t find any issues with them. And we’re doing exactly the same thing we did as the last time we did a fresh install (earlier 3.x release).
I’m starting to suspect the same thing-- an issue with 3.11. I’m gong to try to set up a proxy w/ 3.10 today and see if I have the same problem.
I agree, if one of the developers could weigh in, that would be extremely helpful. I know their time is valuable, so I’d appreciate it.
