<div dir="ltr">No, unfortunately, I gave up on trying a long time ago, as it seemed like a very hokey approach to first sync using reposync on additional VMs, run createrepo, then add those as channels in Spacewalk. Due to that and other cost saving initiatives, I gave up and changed our infrastructure to avoid using RHEL as much as possible in favor of CentOS...</div><br><div class="gmail_quote"><div dir="ltr">On Tue, Oct 9, 2018 at 11:55 AM Raymond Setchfield <<a href="mailto:raymond.setchfield@gmail.com">raymond.setchfield@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div dir="ltr"></div><div dir="ltr">Have you got this working, Matt?</div></div><div dir="auto"><div dir="ltr"><br>On 9 Oct 2018, at 16:21, Matt Moldvan <<a href="mailto:matt@moldvan.com" target="_blank">matt@moldvan.com</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">Oops, looks like my replies weren't making it to the mailing list (forgot to change the "From" option).<div><br></div><div>Anyway, I intended to reply to the list and not just Robert...<br><br><div class="gmail_quote"><div dir="ltr">On Tue, Oct 9, 2018 at 11:18 AM Matt Moldvan <<a href="mailto:sandwormusmc@gmail.com" target="_blank">sandwormusmc@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Yeah, makes sense. My point was that Red Hat expecting this to be done by it's customers is silly and they shouldn't be using self signed certs in the path and making their customers do extra work...</div><br><div class="gmail_quote"><div dir="ltr">On Tue, Oct 9, 2018 at 9:50 AM Robert Paschedag <<a href="mailto:robert.paschedag@web.de" target="_blank">robert.paschedag@web.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Am 9. Oktober 2018 15:24:55 MESZ schrieb sandwormusmc <<a href="mailto:sandwormusmc@gmail.com" target="_blank">sandwormusmc@gmail.com</a>>:<br>
>Looks like an issue Red Hat should fix, too be honest. While you could<br>
>pull the CA cert of the issuer and import it, I get an invalid issuer<br>
>error when I pull up that URL in my browser, too. So updating your CA<br>
>certs may not help either (unless Red Hat provides the root cert for<br>
>whomever generated the cert for <a href="http://cdn.redhat.com" rel="noreferrer" target="_blank">cdn.redhat.com</a>).<br>
>If you have a Red Hat support contract, I would open a ticket with this<br>
>information and ask for their input. <br>
><br>
><br>
>Sent from my Verizon, Samsung Galaxy smartphone<br>
>-------- Original message --------From: "Irwin, Jeffrey"<br>
><<a href="mailto:Jeffrey.Irwin@rivertechllc.com" target="_blank">Jeffrey.Irwin@rivertechllc.com</a>> Date: 10/9/18 8:46 AM (GMT-05:00)<br>
>To: Robert Paschedag <<a href="mailto:robert.paschedag@web.de" target="_blank">robert.paschedag@web.de</a>>,<br>
><a href="mailto:spacewalk-list@redhat.com" target="_blank">spacewalk-list@redhat.com</a> Subject: Re: [Spacewalk-list] RHEL repo sync<br>
>error - CURL #60 <br>
>I have tried this with a local mirror repo......no dice, tried it with<br>
>subscribed RHEL repo, no dice, trying to track this pesky cert issue. <br>
>Will check out the man page and see, would be nice to see a more<br>
>verbose indication of what cert it is trying to use, where it is, etc..<br>
>________________________________________<br>
>From: Robert Paschedag <<a href="mailto:robert.paschedag@web.de" target="_blank">robert.paschedag@web.de</a>><br>
>Sent: Tuesday, October 9, 2018 8:41 AM<br>
>To: <a href="mailto:spacewalk-list@redhat.com" target="_blank">spacewalk-list@redhat.com</a>; Irwin, Jeffrey;<br>
><a href="mailto:spacewalk-list@redhat.com" target="_blank">spacewalk-list@redhat.com</a><br>
>Subject: Re: [Spacewalk-list] RHEL repo sync error - CURL #60<br>
><br>
>Am 9. Oktober 2018 14:04:25 MESZ schrieb "Irwin, Jeffrey"<br>
><<a href="mailto:Jeffrey.Irwin@rivertechllc.com" target="_blank">Jeffrey.Irwin@rivertechllc.com</a>>:<br>
>>?Same issue I ma having, interested to see the solution.<br>
><br>
>I think manpage of update-ca-certificates should help.<br>
><br>
>Get the issuer cert, update the local CA certs and it should run (in<br>
>case, there is no new rpm which updates the certs)<br>
><br>
>Robert<br>
>><br>
>>________________________________<br>
>>From: <a href="mailto:spacewalk-list-bounces@redhat.com" target="_blank">spacewalk-list-bounces@redhat.com</a><br>
>><<a href="mailto:spacewalk-list-bounces@redhat.com" target="_blank">spacewalk-list-bounces@redhat.com</a>> on behalf of Raymond Setchfield<br>
>><<a href="mailto:raymond.setchfield@gmail.com" target="_blank">raymond.setchfield@gmail.com</a>><br>
>>Sent: Monday, October 8, 2018 6:47 AM<br>
>>To: <a href="mailto:spacewalk-list@redhat.com" target="_blank">spacewalk-list@redhat.com</a><br>
>>Subject: [Spacewalk-list] RHEL repo sync error - CURL #60<br>
>><br>
>>Hi<br>
>><br>
>>I have been attempting to pull the RHEL updates into spacewalk, and I<br>
>>am receiving the following error;<br>
>><br>
>># spacewalk-repo-sync -c rhel07-update<br>
>>11:44:03 ======================================<br>
>>11:44:03 | Channel: rhel07-update<br>
>>11:44:03 ======================================<br>
>>11:44:03 Sync of channel started.<br>
>>11:44:03<br>
>>11:44:03 Processing repository with URL:<br>
>><a href="https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os" rel="noreferrer" target="_blank">https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os</a><br>
>>Repository group_spacewalkproject-java-packages is listed more than<br>
>>once in the configuration<br>
>>11:44:03 ERROR: failure: repodata/repomd.xml from rhel07-update.repo:<br>
>>[Errno 256] No more mirrors to try.<br>
>><a href="https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os/repodata/repomd.xml" rel="noreferrer" target="_blank">https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os/repodata/repomd.xml</a>:<br>
>>[Errno 14] curl#60 - "Peer's certificate issuer has been marked as not<br>
>>trusted by the user."<br>
>>11:44:03 Sync of channel completed in 0:00:00.<br>
>>11:44:03 Total time: 0:00:00<br>
>><br>
>>Looking into this it appears to be a certificate issue from what I can<br>
>>gather. My assumption is to use the "redhat-uep.pem" Is this correct?<br>
>>If so where do I place this to allow the curl to work? Or am I off in<br>
>>the wrong direction<br>
>><br>
>>Thanks<br>
>><br>
>>Ray<br>
><br>
><br>
>--<br>
>sent from my mobile device<br>
><br>
>_______________________________________________<br>
>Spacewalk-list mailing list<br>
><a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a><br>
><a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a><br>
<br>
There is a self signed cert within the SSL path, which does not seem to be on your cert parts.<br>
<br>
So download the certs via the browser (export root ca and intermediate cas), put the in the "anchors" directory (where update-ca-trust or update-ca-certificates wants them to be), update the certs... Then try again.<br>
<br>
Robert<br>
-- <br>
sent from my mobile device<br>
</blockquote></div>
</blockquote></div></div></div>
</div></blockquote><blockquote type="cite"><div dir="ltr"><span>_______________________________________________</span><br><span>Spacewalk-list mailing list</span><br><span><a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a></span><br><span><a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a></span></div></blockquote></div>_______________________________________________<br>
Spacewalk-list mailing list<br>
<a href="mailto:Spacewalk-list@redhat.com" target="_blank">Spacewalk-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/spacewalk-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/spacewalk-list</a></blockquote></div>