Managing `ssl_ca:` in /etc/puppetlabs/puppet/foreman.yaml using foreman-installer?

Support
1

Problem:

We discovered that the ssl_ca: parameter in /etc/puppetlabs/puppet/foreman.yaml is causing Puppet to fail with SSL errors. One of my coworkers commented it out. Now, when I run foreman-installer, the installer to put that parameter back into the file which will break Puppet:

root@foreman:/etc/foreman-installer/scenarios.d# foreman-installer --noop --dont-save-answers --verbose
...
[ WARN 2020-02-06T17:01:15 verbose]  /Stage[main]/Foreman::Puppetmaster/File[/etc/puppetlabs/puppet/foreman.yaml]/content:
[ WARN 2020-02-06T17:01:15 verbose] --- /etc/puppetlabs/puppet/foreman.yaml     2020-01-06 15:32:36.681282894 -0800
[ WARN 2020-02-06T17:01:15 verbose] +++ /tmp/puppet-file20200206-8074-7me5vo    2020-02-06 17:01:15.857371440 -0800
[ WARN 2020-02-06T17:01:15 verbose] @@ -1,6 +1,6 @@
[ WARN 2020-02-06T17:01:15 verbose]  ---
[ WARN 2020-02-06T17:01:15 verbose]  :url: "https://foreman.example.org"
[ WARN 2020-02-06T17:01:15 verbose] -#:ssl_ca: "/etc/puppetlabs/puppet/ssl/ca/ca_crt.pem"
[ WARN 2020-02-06T17:01:15 verbose] +:ssl_ca: "/etc/puppetlabs/puppet/ssl/ca/ca_crt.pem"
[ WARN 2020-02-06T17:01:15 verbose]  :ssl_cert: "/etc/puppetlabs/puppet/ssl/certs/foreman.example.org.pem"
[ WARN 2020-02-06T17:01:15 verbose]  :ssl_key: "/etc/puppetlabs/puppet/ssl/private_keys/foreman.example.org.pem"
[ WARN 2020-02-06T17:01:15 verbose]  :user: ""

We want to remove or manage that parameter using Foreman Installer:

Expected outcome:

I expect Foreman Installer to have an option to manage this file, but it does not. How can I manage this file using Foreman Installer?

oot@foreman:~# foreman-installer --help | grep /etc/puppetlabs/puppet/ssl/
                                  Defaults to client_ssl_ca (current: "/etc/puppetlabs/puppet/ssl/certs/ca.pem")
                                  Defaults to client_ssl_cert (current: "/etc/puppetlabs/puppet/ssl/certs/foreman.example.org.pem")
                                  Defaults to client_ssl_key (current: "/etc/puppetlabs/puppet/ssl/private_keys/foreman.example.org.pem")
    --foreman-proxy-puppet-ssl-ca  SSL CA used to verify connections when accessing the Puppet master API (current: "/etc/puppetlabs/puppet/ssl/certs/ca.pem")
    --foreman-proxy-puppet-ssl-cert  SSL certificate used when accessing the Puppet master API (current: "/etc/puppetlabs/puppet/ssl/certs/foreman.example.org.pem")
    --foreman-proxy-puppet-ssl-key  SSL private key used when accessing the Puppet master API (current: "/etc/puppetlabs/puppet/ssl/private_keys/foreman.example.org.pem")
    --foreman-proxy-ssl-ca        SSL CA to validate the client certificates used to access the proxy (current: "/etc/puppetlabs/puppet/ssl/certs/ca.pem")
    --foreman-proxy-ssl-cert      SSL certificate to be used to run the foreman proxy via https. (current: "/etc/puppetlabs/puppet/ssl/certs/foreman.example.org.pem")
    --foreman-proxy-ssl-key       Corresponding key to a ssl_cert certificate (current: "/etc/puppetlabs/puppet/ssl/private_keys/foreman.example.org.pem")
root@foreman:~#

Foreman and Proxy versions:

Version 1.23.1

Foreman and Proxy plugin versions:

n/a

Distribution and version:

Ubuntu 18.04.3 LTS
Puppetsever version 5.3.10

Other relevant data:

2

For the record, follow-up for this issue can be found here:

3

OK so thanks for all of the above really helped me sort it out. I think the actual solution seems to be missing. The defaults in the installer are incorrect so if like me you enabled puppet without reading the manual the n find it doesn’t work as above follow this guide which points you at the correct files to use;
https://docs.theforeman.org/3.1/Managing_Configurations_Puppet/index-katello.html#Enabling_Puppet_Integration_managing-configurations-puppet

4

For what it’s worth, once I found the correct certificate for ssl_ca_file, I never had this problem again. Make sure you are using a modern version of Foreman (Currently, that’s Foreman 3.6 & 3.7).

I agree that this foreman-installer still doesn’t have a way to disable the ssl_ca parameter. If I try to disable the parameter in /etc/puppetlabs/puppet/foreman.yaml, the installer will re-enable it.

2023-08-14 10:35:08 [INFO  ] [configure] --- /etc/puppetlabs/puppet/foreman.yaml        2023-08-14 10:34:25.892114462 -0700
2023-08-14 10:35:08 [INFO  ] [configure] +++ /tmp/puppet-file20230814-1018794-z2kfjp    2023-08-14 10:35:08.527760243 -0700
2023-08-14 10:35:08 [INFO  ] [configure] @@ -1,6 +1,6 @@
2023-08-14 10:35:08 [INFO  ] [configure] ---
2023-08-14 10:35:08 [INFO  ] [configure] :url: "https://foreman .example.org"
2023-08-14 10:35:08 [INFO  ] [configure] -#:ssl_ca: "/etc/puppetlabs/puppet/ssl/ca/ca_crt.pem"
2023-08-14 10:35:08 [INFO  ] [configure] +:ssl_ca: "/etc/puppetlabs/puppet/ssl/ca/ca_crt.pem"
5

Using –puppet-server-foreman-ssl-caoption doesn’t seem to update /etc/puppetlabs/puppet/foreman.yamlin my case.
The foreman-installer keeps resetting the value of ssl_ca back to etc/pki/katello/puppet/puppet_client_ca.crt:

[root@smart-proxy~]# foreman-installer --scenario foreman-proxy-content --puppet-server-foreman-ssl-ca “/etc/foreman-proxy/ssl_ca_combined.pem”
2026-04-15 07:21:40 [WARN  ] [boot]  [“Unsetting environment variable ‘http_proxy’ for the duration of the install.”]
2026-04-15 07:21:40 [WARN  ] [boot]  [“Unsetting environment variable ‘https_proxy’ for the duration of the install.”]
2026-04-15 07:21:41 [NOTICE] [root] Loading installer configuration. This will take some time.
2026-04-15 07:21:44 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
2026-04-15 07:21:44 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
2026-04-15 07:21:45 [NOTICE] [checks] System checks passed
2026-04-15 07:21:51 [NOTICE] [configure] Starting system configuration.
2026-04-15 07:21:56 [NOTICE] [configure] 250 configuration steps out of 1567 steps complete.
2026-04-15 07:21:57 [NOTICE] [configure] 500 configuration steps out of 1569 steps complete.
2026-04-15 07:21:57 [NOTICE] [configure] 750 configuration steps out of 1574 steps complete.
2026-04-15 07:21:57 [NOTICE] [configure] 1000 configuration steps out of 1575 steps complete.
2026-04-15 07:21:58 [NOTICE] [configure] 1250 configuration steps out of 1575 steps complete.
2026-04-15 07:22:05 [NOTICE] [configure] 1500 configuration steps out of 1576 steps complete.
2026-04-15 07:22:21 [NOTICE] [configure] System configuration has finished.
Success!
* Foreman Proxy is running at https://smartproxy.foo.com:9090

[root@smart-proxy~]# grep -r ssl_ca_combined.pem /etc/
/etc/foreman-installer/scenarios.d/foreman-proxy-content-answers.yaml:  ssl_ca: “/etc/foreman-proxy/ssl_ca_combined.pem”
/etc/foreman-installer/scenarios.d/foreman-proxy-content-answers.yaml:  server_foreman_ssl_ca: “/etc/foreman-proxy/ssl_ca_combined.pem”
/etc/foreman-proxy/settings.yml::ssl_ca_file: /etc/foreman-proxy/ssl_ca_combined.pem

[root@smart-proxy ~]# grep ssl_ca /etc/puppetlabs/puppet/foreman.yaml
:ssl_ca: “/etc/pki/katello/puppet/puppet_client_ca.crt”