Problem: Foreman → Smart Proxy: Oops, we’re sorry but something went wrong SSL_connect returned=1 errno=0 state=error: tlsv1 alert internal error
Expected outcome: Foreman Connect to Smart Proxy
Foreman and Proxy versions:
Foreman: 3.10
Katello: 4.12
Foreman and Proxy plugin versions:
Distribution and version:
RHEL: 9.3
Other relevant data:
Hi All,
Setting up a Foreman just for yum repository, no puppet no dhcp no dns services.
May i understand which certificate or CA is required for Foreman to connect to the Smart Proxy ?
I used a custom certificate to build scenario katello:
foreman-installer --scenario “katello”
–foreman-initial-organization “${ORG}”
–foreman-initial-location “Global”
–foreman-servername “${FOREMAN_HOSTNAME}.${FOREMAN_DOMAIN}”
–foreman-serveraliases “${FOREMAN_FQDN}”
–foreman-proxy-dhcp “false”
–foreman-proxy-dns “false”
–foreman-proxy-tftp “false”
–certs-server-ca-cert “/etc/pki/certs/internalcacerts.crt”
–certs-server-cert “/etc/pki/tls/certs/${FOREMAN_HOSTNAME}.${FOREMAN_DOMAIN}.pem”
–certs-server-key “/etc/pki/tls/private/${FOREMAN_HOSTNAME}.${FOREMAN_DOMAIN}.key”
–foreman-initial-admin-username $(user)
–foreman-initial-admin-password $(secret)
–enable-foreman-plugin-discovery --enable-foreman-proxy-plugin-discovery --foreman-proxy-bind-host ‘*’
Generated a Cert for the Smart Proxy:
foreman-proxy-certs-generate --foreman-proxy-fqdn ${SPROXY_HOSTNAME}
–foreman-proxy-cname ${SPROXY_FQDN}
–certs-tar /var/www/html/pub/${SPROXY_HOSTNAME}/${SPROXY_HOSTNAME}.tar
–server-cert ~/capsule/${SPROXY_HOSTNAME}/${SPROXY_HOSTNAME}.pem
–server-key ~/capsule/${SPROXY_HOSTNAME}/${SPROXY_HOSTNAME}.key
–server-ca-cert /etc/pki/certs/internalcacerts.crt
Then build Smart proxy:
foreman-installer
–scenario foreman-proxy-content
–certs-tar-file “/root/${SPROXY_HOSTNAME}.${SPROXY_DOMAIN}.tar”
–foreman-proxy-register-in-foreman “true”
–foreman-proxy-foreman-base-url “https://${FOREMAN_HOSTNAME}.${FOREMAN_DOMAIN}”
–foreman-proxy-trusted-hosts “${FOREMAN_HOSTNAME}.${FOREMAN_DOMAIN}”
–foreman-proxy-trusted-hosts “${SPROXY_HOSTNAME}.${SPROXY_DOMAIN}”
–foreman-proxy-oauth-consumer-key “${KEY}”
–foreman-proxy-oauth-consumer-secret “${SECRET}”
–foreman-proxy-registration-url “https://${SPROXY_FQDN}:9090”
–certs-cname “${SPROXY_FQDN}”
Installation successful but when I try to verify connection between Foreman to Smart Proxy “Oops, we’re sorry but something went wrong SSL_connect returned=1 errno=0 state=error: tlsv1 alert internal error”
I verified the certificate on smart proxy it requires the the Foreman generated CA and not my custom ones.
openssl s_client -connect ${SPROXY_HOSTNAME}.${SPROXY_DOMAIN}:443
CONNECTED(00000003)
802BF0000F65FA57:error:0A000438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error:ssl/record/rec_layer_s3.c:1600:SSL alert number 80
no peer certificate available
Acceptable client certificate CA names
C = US, ST = North Carolina, L = Raleigh, O = Katello, OU = SomeOrgUnit, CN = ${SPROXY_HOSTNAME}.${SPROXY_DOMAIN}
Which CA do i need to add to default OS bundle to be able to accept connection?