Use custom SSL certificate

[Leo]

We created the new keys and certificates.
After replacing the files in /var/lib/puppet/ssl/private_keys/server.pem and /var/lib/puppet/ssl/certs/server.pem

The web interface is fine.

However, the node.rb failed with the error:
SSL_connect returned=1 errno=0 state=SSLv3 read server session ticket A: sslv3 alert unsupported certificate

Can anyone help? Thanks.

[tbrisker]

Please take a look at Foreman :: Manual to make sure you didn’t miss any settings.

[m4c3]

had the same issue: the ssl cert needs to support client authentication

[ekohl]

Have a look at

Replacing self-signed certificates

Yes, I’ve been meaning to write a blog about this. I’ll leave placing the certificates in the right place as a users exercise (I used LetsEncrypt). You want to change the CA that’s used to verify as well. I was lazy and used the system CA bundle. You gain additional security against another CA issuing a cert by using the the exact certificate but IMHO that’s a very small chance and not a relevant attack vector for my personal infra. --foreman-server-ssl-cert /etc/letsencrypt/live/$HOSTNAME/cert…

[Leo]

Thanks guys.
m4c3 is right.
Found that when I create the csr, I need to put “extendedKeyUsage = serverAuth, clientAuth” to make node.rb works.