I have noticed in the katello-certs-check script that it calls openssl multiple times to check the certs and chain provided. However, the checks don’t disable the default CA path which means openssl will use the default system CA path by default.
It’s my understanding that foreman does not use the default ca path/file when checking internal connections, e.g. from the main server to a proxy. I am not sure but from some of the topics lately I get the impression that it does it this way (which is reasonable).
This would mean that katello-certs-check could verify a cert as O.K. because (part of) the chain is available in CApath even though the given ca bundle alone wouldn’t.
E.g.
function check-ca-bundle () {
printf "Checking CA bundle against the certificate file: "
ERROR_PATTERN="error [0-9]+ at"
CHECK=$(openssl verify -CAfile $CA_BUNDLE_FILE -purpose sslserver -verbose $CERT_FILE 2>&1)
CHECK_STATUS=$?
if [[ $CHECK_STATUS != "0" || $CHECK =~ $ERROR_PATTERN ]]; then
error 4 "The $CA_BUNDLE_FILE does not verify the $CERT_FILE"
echo -e "${CHECK/OK/}\n"
else
success
fi
}
The openssl verify checks the $CERT_FILE file against the $CA_BUNDLE_FILE and the system default CA path. Only if you added -no-CApath it would disable CA path and would check the cert file against the bundle alone.
If foreman doesn’t use the default ca path/file for connection verification then katello-certs-check shouldn’t either to give an accurate assessment of the given cert and bundle.