Skip to content

Commit 13895df

Browse files
authored
Refs #36843 - Avoid running katello-certs-check for proxies (theforeman#2566)
The foreman-proxy-certs-generate command (and its branded version) now runs katello-certs-check so there's no more need to run it manually. This greatly simplifies the instructions for users.
1 parent 42eb97f commit 13895df

File tree

2 files changed

+10
-44
lines changed

2 files changed

+10
-44
lines changed

guides/common/assembly_configuring-capsule-custom-server-certificate.adoc

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,7 @@ To configure your {SmartProxyServer} with a custom certificate, complete the fol
1616
//Creating a Custom SSL Certificate for {SmartProxyServer}
1717
include::modules/proc_creating-a-custom-ssl-certificate.adoc[leveloffset=+1]
1818

19-
//Deploying a Custom SSL Certificate to {SmartProxyServer}
20-
// stdout from "katello-certs-check" is branded on Satellite
21-
ifdef::satellite[]
22-
:smart-proxy-capitalized: CAPSULE
23-
endif::[]
24-
ifndef::satellite[]
25-
:smart-proxy-capitalized: FOREMAN_PROXY
26-
endif::[]
2719
include::modules/proc_deploying-a-custom-ssl-certificate-to-smart-proxy-server.adoc[leveloffset=+1]
28-
:!smart-proxy-capitalized:
2920

3021
//Deploying a Custom SSL Certificate to Hosts
3122
include::modules/proc_deploying-a-custom-ssl-certificate-to-hosts.adoc[leveloffset=+1]

guides/common/modules/proc_deploying-a-custom-ssl-certificate-to-smart-proxy-server.adoc

Lines changed: 10 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -14,48 +14,23 @@ For more information, see {InstallingSmartProxyDocURL}registering-to-satellite-s
1414
For more information, see {InstallingSmartProxyDocURL}installing-capsule-server-packages_{smart-proxy-context}[Installing {SmartProxyServer} Packages].
1515

1616
.Procedure
17-
. On your {ProjectServer}, validate the custom SSL certificate input files:
17+
. On your {ProjectServer}, generate a certificate bundle:
1818
+
1919
[options="nowrap", subs="+quotes,attributes"]
2020
----
21-
# katello-certs-check \
22-
-t {certs-proxy-context} \
23-
-c __/root/{smart-proxy-context}_cert/{smart-proxy-context}_cert.pem__ \ <1>
24-
-k __/root/{smart-proxy-context}_cert/{smart-proxy-context}_cert_key.pem__ \ <2>
25-
-b __/root/{smart-proxy-context}_cert/ca_cert_bundle.pem__ <3>
21+
# {certs-generate} \
22+
--foreman-proxy-fqdn _{smartproxy-example-com}_ \
23+
--certs-tar ~/_{smartproxy-example-com}_-certs.tar \
24+
--server-cert /root/__{smart-proxy-context}_cert/{smart-proxy-context}_cert.pem__ \ <1>
25+
--server-key /root/__{smart-proxy-context}_cert/{smart-proxy-context}_cert_key.pem__ \ <2>
26+
--server-ca-cert "/root/__{smart-proxy-context}_cert/ca_cert_bundle.pem__ \ <3>
27+
--certs-update-server
2628
----
29+
+
2730
<1> Path to {SmartProxyServer} certificate file that is signed by a Certificate Authority.
2831
<2> Path to the private key that was used to sign {SmartProxyServer} certificate.
2932
<3> Path to the Certificate Authority bundle.
3033
+
31-
If you set a wildcard value `*` for the certificate's Common Name `CN =` in the `/root/{context}_cert/openssl.cnf` configuration file, you must add the `-t {certs-proxy-context}` option to the `katello-certs-check` command.
32-
+
33-
If the command is successful, it returns two `{certs-generate}` commands, one of which you must use to generate the certificate archive file for your {SmartProxyServer}.
34-
+
35-
.Example output of `katello-certs-check`
36-
[options="nowrap", subs="+quotes,attributes"]
37-
----
38-
Validation succeeded.
39-
40-
To use them inside a NEW ${smart-proxy-capitalized}, run this command:
41-
{certs-generate} --foreman-proxy-fqdn "${smart-proxy-capitalized}" \
42-
--certs-tar "~/{smart-proxy-capitalized}-certs.tar" \
43-
--server-cert "_/root/{smart-proxy-context}_cert/{smart-proxy-context}_cert.pem_" \
44-
--server-key "_/root/{smart-proxy-context}_cert/{smart-proxy-context}_cert_key.pem_" \
45-
--server-ca-cert "_/root/{smart-proxy-context}_cert/ca_cert_bundle.pem_" \
46-
47-
To use them inside an EXISTING ${smart-proxy-capitalized}, run this command INSTEAD:
48-
{certs-generate} --foreman-proxy-fqdn "${smart-proxy-capitalized}" \
49-
--certs-tar "~/{smart-proxy-capitalized}-certs.tar" \
50-
--server-cert "_/root/{smart-proxy-context}_cert/{smart-proxy-context}_cert.pem_" \
51-
--server-key "_/root/{smart-proxy-context}_cert/{smart-proxy-context}_cert_key.pem_" \
52-
--server-ca-cert "_/root/{smart-proxy-context}_cert/ca_cert_bundle.pem_" \
53-
--certs-update-server
54-
----
55-
. On your {ProjectServer}, from the output of the `katello-certs-check` command, depending on your requirements, enter the `{certs-generate}` command that generates a certificate for a new or existing {SmartProxy}.
56-
+
57-
In this command, change `{smart-proxy-capitalized}` to the FQDN of your {SmartProxyServer}.
58-
+
5934
. Retain a copy of the `{foreman-installer}` command that the `{certs-generate}` command returns for deploying the certificate to your {SmartProxyServer}.
6035
+
6136
.Example output of `{certs-generate}`
@@ -75,7 +50,7 @@ _output omitted_
7550
+
7651
[options="nowrap", subs="+quotes,attributes"]
7752
----
78-
# scp /root/{smart-proxy-context}_cert/_{smartproxy-example-com}_-certs.tar \
53+
# scp ~/_{smartproxy-example-com}_-certs.tar \
7954
root@_{smartproxy-example-com}_:/root/_{smartproxy-example-com}_-certs.tar
8055
----
8156
. On your {SmartProxyServer}, to deploy the certificate, enter the `{foreman-installer}` command that the `{certs-generate}` command returns.

0 commit comments

Comments
 (0)