Problem:
We have foreman, foreman-proxy, and puppet running on the same server. In the Foreman WebUI, under Configure > Puppet ENC > Environments, I’m trying to import Puppet environments with the Import environments from myhost.domain button. This fails with
ERF12-2749 [ProxyAPI::ProxyException]: Unable to get environments from Puppet
([RestClient::SSLCertificateNotVerified]: SSL_connect returned=1 errno=0 state=error:
certificate verify failed (unable to get local issuer certificate)) for proxy https://myhost.domain:9090/puppet
At the same time, /var/log/foreman-proxy/proxy.log shows:
2024-09-03T16:32:24 [E] <OpenSSL::SSL::SSLError> SSL_accept returned=1 errno=0 state=error: tlsv1 alert unknown ca
/usr/share/gems/gems/webrick-1.8.1/lib/webrick/server.rb:302:in `accept'
/usr/share/gems/gems/webrick-1.8.1/lib/webrick/server.rb:302:in `block (2 levels) in start_thread'
/usr/share/gems/gems/webrick-1.8.1/lib/webrick/utils.rb:258:in `timeout'
/usr/share/gems/gems/webrick-1.8.1/lib/webrick/server.rb:300:in `block in start_thread'
/usr/share/gems/gems/logging-2.3.1/lib/logging/diagnostic_context.rb:474:in `block in create_with_logging_context'
tlsv1 alert unknown ca sounds like I have an incorrect setting for the CA file somewhere, but I’ve checked every file I can fine under the whole /etc directory, and I can’t find where the error is.
We’re using a Let’s Encrypt cert, and all the YAML files I can find have settings like
:ssl_ca_file: /etc/letsencrypt/myhost.domain_ecc/ca.cer
:ssl_certificate: /etc/letsencrypt/myhost.domain_ecc/myhost.domain.cer
:ssl_private_key: /etc/letsencrypt/myhost.domain_ecc/myhost.domain.key
Those certs for things like Apache, so I think the issue is not with the certs themselves, but with how I’ve configured Foreman to use them. Can anyone point me to where the error is?
Foreman and Proxy versions:
3.11
Distribution and version:
Alma Linux 8.10