<div dir="ltr"><div>Hey Randy,</div><div><span class="" style="white-space:pre"> </span> Thanks for your reply, yes you have some good points.</div><div><br></div><div>openssl x509 -in rootca.crt -noout -text | grep -i Version:</div><div> Version: 3 (0x2)</div><div><span class="" style="white-space:pre"> </span></div><div>openssl x509 -in pulp01.rap.local.crt -noout -text | grep -i Version:</div><div> Version: 1 (0x0)</div><div><br></div><div>openssl x509 -in pulpca.crt -noout -text | grep -i Version:</div><div> Version: 3 (0x2)</div><div><span class="" style="white-space:pre"> </span></div><div>This step: openssl x509 -req -days 3650 -CA pulpca.crt -CAkey pulpca.key -set_serial 01 -in pulp01.rap.local.csr -out pulp01.rap.local.crt produces an SSLv1 Cert NOT an SSLv3 Cert...<span class="" style="white-space:pre"> </span>need to modify this somehow...<span class="" style="white-space:pre"> </span></div><div><br></div><div><br></div><div>I will use these steps once the above is fixed </div><div><br></div><div>cp -v /etc/pki/pulp_certs/rootca.crt /etc/pki/ca-trust/source/anchors/</div><div>update-ca-trust enable</div><div>update-ca-trust extract</div><div><br></div><div>This time I located the has from rootca.crt, in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem.</div><div><br></div><div>- I will modify this for the pulp_ca_chain file as you explained.</div><div><br></div><div>vim /etc/httpd/conf.d/ssl.conf</div><div><br></div><div>SSLCertificateFile /etc/pki/pulp_certs/pulpca.crt</div><div>SSLCertificateKeyFile /etc/pki/pulp_certs/pulpca.key</div><div>SSLCACertificateFile /etc/pki/pulp_certs/pulpca_chain.crt</div><div><br></div><div>- After some SELinux fun with the certs:</div><div><br></div><div>setsebool -P httpd_read_user_content 1 etc.</div><div><br></div><div>systemctl restart httpd </div><div><br></div><div><a href="https://pulp01.rap.local">https://pulp01.rap.local</a> = shows up as CA Signed from the Intermediate CA. So this is now working fine.</div><div><br></div><div>Understood will not touch any of the certs in: /etc/pki/pulp.</div><div><br></div><div>Went to create the repo:</div><div><br></div><div>pulp-admin -uadmin -padmin rpm repo create --repo-id rhel-7-server \</div><div>--feed <a href="https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os">https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os</a> \</div><div>--feed-ca-cert=/etc/rhsm/ca/redhat-uep.pem \</div><div>--feed-key=/etc/pki/entitlement/66666666-key.pem \</div><div>--feed-cert=/etc/pki/entitlement/66666666.pem \</div><div>--display-name "rhel-7-server" --description "RHEL 7 YUM Files"</div><div><br></div><div>- went to sync the repo :</div><div><br></div><div>pulp-admin rpm repo sync run --repo-id=rhel-7-server</div><div><br></div><div>- same error:</div><div><br></div><div>I have not touched these files certs as they should be overriden by Apache?</div><div><br></div><div>vim /etc/pulp/server.conf</div><div><br></div><div>[security]</div><div>cacert: /etc/pki/pulp/ca.crt</div><div>cakey: /etc/pki/pulp/ca.key</div><div>ssl_ca_certificate: /etc/pki/pulp/ssl_ca.crt</div><div><br></div><div>vim /etc/pulp/admin/admin.conf</div><div><br></div><div>host = pulp01.rap.local</div><div>verify_ssl = True</div><div>ca_path = /etc/pki/tls/certs/ca-bundle.crt</div><div><br></div><div>Leave the above alone same error </div><div><br></div><div>2014-10-31 17:29:24,249 - ERROR - Client-side exception occurred</div><div>Traceback (most recent call last):</div><div><br></div><div><br></div><div>Should I be modifying:</div><div><br></div><div>/etc/pulp/server.conf</div><div>/etc/httpd/conf.d/pulp.conf</div><div>/etc/pulp/admin/admin.conf</div><div><br></div><div>Is there anything obvious now outstanding I have diabled selinux in the meantime.</div><div><br></div><div><br></div><div>Also Even If I want to skip SSL, I still have grief:</div><div><br></div><div>vim /etc/pulp/admin/admin.conf</div><div>verify_ssl = False</div><div><br></div><div>systemctl restart httpd.service = same error.</div><div><br></div><div>I have even checked in the home directory of the user I am using:</div><div>and there is NO: </div><div><br></div><div>~/.pulp/admin.conf</div><div>~/.pulp/server.conf</div><div><br></div><div>Which could override the global settings.</div><div><br></div><div>Thanks for your help so far.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 31, 2014 at 12:22 AM, Randy Barlow <span dir="ltr"><<a href="mailto:rbarlow@redhat.com" target="_blank">rbarlow@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 10/29/2014 07:18 PM, Gavin Jones wrote:<br>
> openssl req -new -key pulpca.key -out pulpca.csr<br>
><br>
><br>
> *# On the MS Root CA*<br>
><br>
> <a href="http://localrootca/certsrv/" target="_blank">http://localrootca/certsrv/</a><br>
><br>
> Request a Certificate > advanced certificate request ><br>
><br>
> Paste the pulpca.csr Into the Saved Request Section ><br>
><br>
> Certifcate Template: Web Server<br>
><br>
> Additional Attributes: Left this blank<br>
><br>
> - Base64 > Download Certificate.<br>
><br>
> scp certnew.cer as user admin across to pulp01<br>
><br>
><br>
> cd /home/admin<br>
><br>
> chown -v root.root certnew.cer<br>
><br>
> cp -v /home/admin/certnew.cer /etc/pki/pulp_certs/pulpca.crt<br>
<br>
One thing you may have missed in the above steps is that intermediate<br>
certificates must be SSL v3 certificates that have the CA constraint set<br>
to true. I'm not familiar with Microsoft, so I can't tell you how to do<br>
it. However, if you want to check if a certificate is a v3 cert, you can<br>
do something like this:<br>
<br>
[rbarlow@where ~]$ openssl x509 -in<br>
Documents/certificates/grapefruit-CA.pem -noout -text<br>
Certificate:<br>
Data:<br>
Version: 3 (0x2)<br>
<snip><br>
X509v3 extensions:<br>
X509v3 Subject Key Identifier:<br>
C7:AF:E2:AC:53:E6:5F:60:D6:52:3B:61:83:02:9F:4F:5C:11:52:DB<br>
X509v3 Authority Key Identifier:<br>
<br>
keyid:5C:88:1C:B7:DF:DC:A8:C1:19:D1:C2:26:E0:DD:4C:A7:91:EC:D7:F3<br>
<br>
X509v3 Basic Constraints:<br>
CA:TRUE<br>
X509v3 Key Usage:<br>
Certificate Sign, CRL Sign<br>
Netscape Cert Type:<br>
SSL CA, S/MIME CA<br>
<snip><br>
<br>
Note that the certificate listed itself as Version 3, and also note the<br>
X509v3 extensions section.<br>
<br>
> cat rootca.crt pulpca.crt > pulpca_chain.crt<br>
<br>
IIRC, a lot of software expects the chain to be in the other order, but<br>
perhaps not all software cares about this.<br>
<br>
> As per Randy's email: to add the certs in to the ca-bundle.crt to<br>
> survive the RHEL package updates to the CA bundle.<br>
><br>
> man update-ca-trust as explained in QUICK HELP 1:<br>
><br>
> cp -v /etc/pki/pulp_certs/rootca.crt /etc/pki/ca-trust/source/anchors/<br>
> update-ca-trust extract && echo $?<br>
<br>
You may need to run update-ca-trust enable one time before extract will<br>
work.<br>
<br>
> vim /etc/httpd/conf.d/ssl.conf<br>
<snip><br>
> SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt = This<br>
> should stay the same as we just updated our CA Trust???<br>
<br>
Changing this value will conflict with Pulp. If you look at<br>
/etc/httpd/conf.d/pulp.conf, you will see that we also set this setting.<br>
This is the CA that Pulp uses to sign client certificates upon login<br>
with pulp-admin. I would recommend leaving it as it was.<br>
<br>
I noted that you never mentioned having done anything with your<br>
pulp_ca_chain file. You should set the mod_ssl SSLCertificateChainFile<br>
Directive[0] to be a path to that file in /etc/httpd/conf.d/ssl.conf if<br>
you want Apache to advertise the chain. Without this, there is no way<br>
for clients to validate that httpd's cert is trusted all the way to a<br>
root CA.<br>
<br>
<br>
> Now Apache is telling me the SSL is self signed and should not be<br>
> trusted.... = Certificate Fail<br>
<br>
I believe this is due to the combination of the above issues.<br>
<br>
> My next question is should I be using separate SSL Certs for Apache and<br>
> PULP? As Pulp should read from Apache's SSL Certs I'd assume they would<br>
> be the same?<br>
<br>
Pulp is served by httpd using the certificates specified in<br>
/etc/httpd/conf.d/ssl.conf. Pulp itself also has some internal<br>
certificates it uses in /etc/pki/pulp, but you should never need to mess<br>
with those and I would recommend you leave them as is.<br>
<br>
[0]<br>
<a href="https://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcertificatechainfile" target="_blank">https://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcertificatechainfile</a><br>
<br>
</blockquote></div><br></div>