<div dir="ltr">Right, but rhsmcertd wasn't running...I'm now trying to turn off Auto-Attach and see if that might help.<div> </div><div>Bob</div><div> </div></div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jun 1, 2020 at 10:59 AM Bryan Kearney <<a href="mailto:bkearney@redhat.com">bkearney@redhat.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">rhsmcertd is not doing the invalidation, it is pulling down the most up2date certificate. Any process you have would need to simulate that. -- bk On 5/28/20 4:18 PM, Gravel Bone wrote: > Also, I shut the service down and ensured it wasn't running and while the entitlement > file in /etc/pki/entitltements didn't change the syncs still failed with the > issue...so while yes, it rhsmcertd can be the culprit, there's something else on Red > Hat side maybe? > > On Thu, May 28, 2020 at 12:24 PM Myers, Mike <<a href="mailto:Mike.Myers@nike.com" target="_blank">Mike.Myers@nike.com</a> > <mailto:<a href="mailto:Mike.Myers@nike.com" target="_blank">Mike.Myers@nike.com</a>>> wrote: > > It’s 100% the rhsmcertd process that’s doing it. From the man page:____ > > __ __ > > rhsmcertd - Periodically scans and updates the entitlement certificates on > a registered system.____ > > __ __ > > What I’m unclear on is why the certs get changed by Red Hat so often when our > entitlements certainly haven’t. And more importantly, what, if anything, we can > do to integrate that process more closely with Pulp.____ > > __ __ > > And to be clear, I’m not trying to call this out as a Pulp project problem or > issue, just wondering if others who use the project have insights or solutions > they’re willing to share.____ > > __ __ > > Cheers,____ > > *Mike Myers*____ > > __ __ > > __ __ > > *From: *Brian Bouterse <<a href="mailto:bmbouter@redhat.com" target="_blank">bmbouter@redhat.com</a> <mailto:<a href="mailto:bmbouter@redhat.com" target="_blank">bmbouter@redhat.com</a>>> > *Date: *Thursday, May 28, 2020 at 8:52 AM > *To: *Gravel Bone <<a href="mailto:gravelbone@gmail.com" target="_blank">gravelbone@gmail.com</a> <mailto:<a href="mailto:gravelbone@gmail.com" target="_blank">gravelbone@gmail.com</a>>> > *Cc: *Mike Myers <<a href="mailto:Mike.Myers@nike.com" target="_blank">Mike.Myers@nike.com</a> <mailto:<a href="mailto:Mike.Myers@nike.com" target="_blank">Mike.Myers@nike.com</a>>>, > "<a href="mailto:pulp-list@redhat.com" target="_blank">pulp-list@redhat.com</a> <mailto:<a href="mailto:pulp-list@redhat.com" target="_blank">pulp-list@redhat.com</a>>" <<a href="mailto:pulp-list@redhat.com" target="_blank">pulp-list@redhat.com</a> > <mailto:<a href="mailto:pulp-list@redhat.com" target="_blank">pulp-list@redhat.com</a>>> > *Subject: *Re: [Pulp-list] <External> Syncing Red hat Repos entitlement issue____ > > __ __ > > One idea to track down which process is editing those certs/files would be to use > auditd or systemtap <a href="https://unix.stackexchange.com/a/99091" rel="noreferrer" target="_blank">https://unix.stackexchange.com/a/99091</a> > <<a href="https://urldefense.com/v3/__https:/unix.stackexchange.com/a/99091__;!!KLCbKzk!3-4lUfRz-2wFNgovtknDNZUEiyn20AZ72aaznXiV_QGBFFfkIRrb454_Sjx08Ns$" rel="noreferrer" target="_blank">https://urldefense.com/v3/__https:/unix.stackexchange.com/a/99091__;!!KLCbKzk!3-4lUfRz-2wFNgovtknDNZUEiyn20AZ72aaznXiV_QGBFFfkIRrb454_Sjx08Ns$</a>> > Just a thought I wanted to share.____ > > __ __ > > On Thu, May 28, 2020 at 9:18 AM Gravel Bone <<a href="mailto:gravelbone@gmail.com" target="_blank">gravelbone@gmail.com</a> > <mailto:<a href="mailto:gravelbone@gmail.com" target="_blank">gravelbone@gmail.com</a>>> wrote:____ > > In this case the entitlement certs themselves aren't expired from a date > perspective, they just no longer work connecting to Red Hat. It's more > like they've been revoked because the server they are on got new entitlement > certs which is happening automatically, I just have not figured out how to > prevent that. I've tried turning of rhsmcertd, disabled subscription > management, and combinations in between.____ > > __ __ > > On Wed, May 27, 2020 at 2:23 PM Brian Bouterse <<a href="mailto:bmbouter@redhat.com" target="_blank">bmbouter@redhat.com</a> > <mailto:<a href="mailto:bmbouter@redhat.com" target="_blank">bmbouter@redhat.com</a>>> wrote:____ > > If the certs are short-lived, then there isn't much to do except ask the > issuer to give you longer ones. You could inspect the certs more closely > I believe using the `rct cat-crt` command. Pulp-certguard has some docs > showing an example with that tool > <a href="https://pulp-certguard.readthedocs.io/en/latest/debugging.html#checking-authorized-urls-in-rhsm-certificates" rel="noreferrer" target="_blank">https://pulp-certguard.readthedocs.io/en/latest/debugging.html#checking-authorized-urls-in-rhsm-certificates</a> > <<a href="https://urldefense.com/v3/__https:/pulp-certguard.readthedocs.io/en/latest/debugging.html*checking-authorized-urls-in-rhsm-certificates__;Iw!!KLCbKzk!3-4lUfRz-2wFNgovtknDNZUEiyn20AZ72aaznXiV_QGBFFfkIRrb454_MFyqH7A$" rel="noreferrer" target="_blank">https://urldefense.com/v3/__https:/pulp-certguard.readthedocs.io/en/latest/debugging.html*checking-authorized-urls-in-rhsm-certificates__;Iw!!KLCbKzk!3-4lUfRz-2wFNgovtknDNZUEiyn20AZ72aaznXiV_QGBFFfkIRrb454_MFyqH7A$</a>>____ > > __ __ > > On Wed, May 27, 2020 at 11:20 AM Myers, Mike <<a href="mailto:Mike.Myers@nike.com" target="_blank">Mike.Myers@nike.com</a> > <mailto:<a href="mailto:Mike.Myers@nike.com" target="_blank">Mike.Myers@nike.com</a>>> wrote:____ > > We’ve faced that too. I’ve love some deeper insight, but what I’ve > found so far is that “rhsmcertd” process does some sort of > check/update on those certs. We’ve just set a process to pull those > from /etc/pki/entitlement into Pulp when such a failure occurs. It > would be nice if there were a Pulp native way to address this (short > of running the whole Satellite suite)____ > > ____ > > Cheers,____ > > *Mike Myers*____ > > ____ > > *From: *<<a href="mailto:pulp-list-bounces@redhat.com" target="_blank">pulp-list-bounces@redhat.com</a> > <mailto:<a href="mailto:pulp-list-bounces@redhat.com" target="_blank">pulp-list-bounces@redhat.com</a>>> on behalf of Gravel Bone > <<a href="mailto:gravelbone@gmail.com" target="_blank">gravelbone@gmail.com</a> <mailto:<a href="mailto:gravelbone@gmail.com" target="_blank">gravelbone@gmail.com</a>>> > *Date: *Wednesday, May 27, 2020 at 5:48 AM > *To: *"<a href="mailto:pulp-list@redhat.com" target="_blank">pulp-list@redhat.com</a> <mailto:<a href="mailto:pulp-list@redhat.com" target="_blank">pulp-list@redhat.com</a>>" > <<a href="mailto:pulp-list@redhat.com" target="_blank">pulp-list@redhat.com</a> <mailto:<a href="mailto:pulp-list@redhat.com" target="_blank">pulp-list@redhat.com</a>>> > *Subject: *<External>[Pulp-list] Syncing Red hat Repos entitlement > issue____ > > ____ > > This is probably something straight forward, but my searches have > found nothing...____ > > ____ > > I pull an entitlement files from our server (well three for three > different subscriptions) and create repos using them to sync the > corresponding Red Hat repository. The problem is, the entitlements > seem to expire about every month. I'm sure it's something I'm > missing that stupid obvious, but google has not been my friend nor > has the documentation...help would be appreciated...____ > > _______________________________________________ > Pulp-list mailing list > <a href="mailto:Pulp-list@redhat.com" target="_blank">Pulp-list@redhat.com</a> <mailto:<a href="mailto:Pulp-list@redhat.com" target="_blank">Pulp-list@redhat.com</a>> > <a href="https://www.redhat.com/mailman/listinfo/pulp-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/pulp-list</a> > <<a href="https://urldefense.com/v3/__https:/www.redhat.com/mailman/listinfo/pulp-list__;!!KLCbKzk!3-4lUfRz-2wFNgovtknDNZUEiyn20AZ72aaznXiV_QGBFFfkIRrb454_ppGV4nQ$" rel="noreferrer" target="_blank">https://urldefense.com/v3/__https:/www.redhat.com/mailman/listinfo/pulp-list__;!!KLCbKzk!3-4lUfRz-2wFNgovtknDNZUEiyn20AZ72aaznXiV_QGBFFfkIRrb454_ppGV4nQ$</a>>____ > > > _______________________________________________ > Pulp-list mailing list > <a href="mailto:Pulp-list@redhat.com" target="_blank">Pulp-list@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/pulp-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/pulp-list</a> > </blockquote></div>