<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=gb2312"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> <o:p> </o:p> I think this may not the problem of the client, when I try to add new client server it also has the error: The SSL certificate failed verification. <o:p></o:p> I find this help, change the --serverUrl=https://spacewalk-server/XMLRPC to<o:p></o:p> --serverUrl=http://spacewalk-server/XMLRPC. The system can be registerd, <o:p></o:p> The reason maybe:<o:p></o:p> <ul type="disc"> <li class="MsoNormal" style="color:#252525;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo3;background:white"> System did not have the correct SSL certificate.(I check, server and client have the same sslCACert)<o:p></o:p></li><li class="MsoNormal" style="color:#252525;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo3;background:white"> SSL certificate was corrupted.(how to explain this?)<o:p></o:p></li></ul> <o:p> </o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: spacewalk-list-bounces@redhat.com [mailto:spacewalk-list-bounces@redhat.com] On Behalf Of P.Cookson@bham.ac.uk Sent: 2019年2月28日 17:35 To: spacewalk-list@redhat.com Subject: Re: [Spacewalk-list] Registration to the new server via rhnreg_ks returns an SSL error<o:p></o:p> </div> </div> <o:p> </o:p> Hi<o:p></o:p> <o:p> </o:p> It’s a little more involved than that! I produced these notes, for myself, when un-registering a system from a Dev Spacewalk Server and registering it with a Test Spacewalk Server. It’s effectively the same thing that you need to do though.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Spacewalk does not provide an option to un-register a client system (similar to registering - “rhnreg_ks”) – the only option is to remove the client system’s profile from the Spacewalk server.<o:p></o:p> <o:p> </o:p> To remove a client’s profile from the Spacewalk server perform these steps:<o:p></o:p> <o:p> </o:p> <ol start="1" type="1"> <li class="MsoListParagraphCxSpFirst" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0cm;mso-add-space:auto;line-height:18.0pt;mso-list:l1 level1 lfo2"> Log in to the Spacewalk Console.<o:p></o:p></li><li class="MsoListParagraphCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0cm;mso-add-space:auto;line-height:18.0pt;mso-list:l1 level1 lfo2"> Click on the Systems tab in the top navigation bar and then click on the name of the system which you want to remove from the Systems List.<o:p></o:p></li><li class="MsoListParagraphCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0cm;mso-add-space:auto;line-height:18.0pt;mso-list:l1 level1 lfo2"> Click the Delete System link in the top-right corner of the page.<o:p></o:p></li><li class="MsoListParagraphCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0cm;mso-add-space:auto;line-height:18.0pt;mso-list:l1 level1 lfo2"> Confirm system profile deletion by clicking the Delete Profile button.<o:p></o:p></li><li class="MsoListParagraphCxSpLast" style="margin-left:0cm;mso-add-space:auto;mso-list:l1 level1 lfo2"> Now go to the client system and execute below command to remove the associated System ID file:<o:p></o:p></li></ol> <o:p> </o:p> # rm /etc/sysconfig/rhn/systemid<o:p></o:p> <o:p> </o:p> In addition, remove Spacewalk certificate for Development and add certificate for Test. Then register client system with Test Spacewalk server:<o:p></o:p> <o:p> </o:p> # certutil -d sql:/etc/pki/nssdb -Dn RHN-ORG-TRUSTED-SSL-CERT -t C,, -ai /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT<o:p></o:p> # rpm -ev rhn-org-trusted-ssl-cert-1.0-1.noarch<o:p></o:p> # rpm -Uvh <a href="https://%3cTest"> https://<Test</a> Server>/pub/rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm<o:p></o:p> # certutil -d sql:/etc/pki/nssdb -An RHN-ORG-TRUSTED-SSL-CERT -t C,, -ai /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT<o:p></o:p> # rhnreg_ks --serverUrl=https://<Test Server>/XMLRPC --sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT --activationkey=[ACTIVATION KEY]<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Note, if you’re using OSAD, the service may have stopped during this process and therefore, will need to be re-started. I’ve also found that, even if it’s still running, I’ve had to restart it before actions were automatically picked up again:<o:p></o:p> <o:p> </o:p> # systemctl start osad OR service osad start<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Hope this is of help?<o:p></o:p> <o:p> </o:p> Regards<o:p></o:p> Phil<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: <a href="mailto:spacewalk-list-bounces@redhat.com"> spacewalk-list-bounces@redhat.com</a> <<a href="mailto:spacewalk-list-bounces@redhat.com">spacewalk-list-bounces@redhat.com</a>> On Behalf Of <a href="mailto:rui.a.zhou@nokia-sbell.com">rui.a.zhou@nokia-sbell.com</a> Sent: 28 February 2019 08:57 To: <a href="mailto:spacewalk-list@redhat.com">spacewalk-list@redhat.com</a> Cc: Zhu, Ting (NSB - CN/Shanghai) <<a href="mailto:ting.zhu@nokia-sbell.com">ting.zhu@nokia-sbell.com</a>> Subject: [Spacewalk-list] Registration to the new server via rhnreg_ks returns an SSL error<o:p></o:p> </div> </div> <o:p> </o:p> I re-installed the spacewalk server, and the client can not register to the new installed server.<o:p></o:p> <o:p> </o:p> [root@FNSHB109 rhn]# rpm -e rhn-org-trusted-ssl-cert-1.0-1.noarch<o:p></o:p> <o:p> </o:p> [root@FNSHB109 rhn]# rpm -Uvh <a href="http://spacewalk-server/pub/rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm"> http://spacewalk-server/pub/rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm</a><o:p></o:p> Retrieving <a href="http://spacewalk-server/pub/rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm"> http://spacewalk-server/pub/rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm</a><o:p></o:p> Preparing... ################################# [100%]<o:p></o:p> Updating / installing...<o:p></o:p> 1:rhn-org-trusted-ssl-cert-1.0-1 ################################# [100%]<o:p></o:p> <o:p> </o:p> [root@FNSHB109 rhn]# rhnreg_ks --serverUrl=https://spacewalk-server/XMLRPC --sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT --activationkey=1-centos7.6 --force --verbose<o:p></o:p> D: rpcServer: Calling XMLRPC registration.welcome_message<o:p></o:p> An error has occurred:<o:p></o:p> The SSL certificate failed verification.<o:p></o:p> See /var/log/up2date for more information<o:p></o:p> <o:p> </o:p> [root@FNSHB109 rhn]# cat /etc/sysconfig/rhn/up2date |grep share<o:p></o:p> sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT<o:p></o:p> <o:p> </o:p> [Thu Feb 28 16:53:34 2019] up2date D: rpcServer: Calling XMLRPC registration.welcome_message<o:p></o:p> [Thu Feb 28 16:53:34 2019] up2date <o:p></o:p> Traceback (most recent call last):<o:p></o:p> File "/usr/sbin/rhnreg_ks", line 215, in <module><o:p></o:p> cli.run()<o:p></o:p> File "/usr/lib/python2.7/site-packages/up2date_client/rhncli.py", line 94, in run<o:p></o:p> sys.exit(self.main() or 0)<o:p></o:p> File "/usr/sbin/rhnreg_ks", line 93, in main<o:p></o:p> rhnreg.getCaps()<o:p></o:p> File "/usr/lib/python2.7/site-packages/up2date_client/rhnreg.py", line 264, in getCaps<o:p></o:p> s.capabilities.validate()<o:p></o:p> File "/usr/lib/python2.7/site-packages/up2date_client/rhnserver.py", line 185, in __get_capabilities<o:p></o:p> self.registration.welcome_message()<o:p></o:p> File "/usr/lib/python2.7/site-packages/up2date_client/rhnserver.py", line 84, in __call__<o:p></o:p> raise_with_tb(up2dateErrors.SSLCertificateVerifyFailedError())<o:p></o:p> File "/usr/lib/python2.7/site-packages/up2date_client/rhnserver.py", line 67, in __call__<o:p></o:p> return rpcServer.doCall(method, *args, **kwargs)<o:p></o:p> File "/usr/lib/python2.7/site-packages/up2date_client/rpcServer.py", line 214, in doCall<o:p></o:p> ret = method(*args, **kwargs)<o:p></o:p> File "/usr/lib64/python2.7/xmlrpclib.py", line 1233, in __call__<o:p></o:p> return self.__send(self.__name, args)<o:p></o:p> File "/usr/lib/python2.7/site-packages/up2date_client/rpcServer.py", line 48, in _request1<o:p></o:p> ret = self._request(methodname, params)<o:p></o:p> File "/usr/lib/python2.7/site-packages/rhn/rpclib.py", line 394, in _request<o:p></o:p> self._handler, request, verbose=self._verbose)<o:p></o:p> File "/usr/lib/python2.7/site-packages/rhn/transports.py", line 177, in request<o:p></o:p> headers, fd = req.send_http(host, handler)<o:p></o:p> File "/usr/lib/python2.7/site-packages/rhn/transports.py", line 733, in send_http<o:p></o:p> self._connection.request(self.method, handler, body=bstr(self.data), headers=self.headers)<o:p></o:p> File "/usr/lib64/python2.7/httplib.py", line 1017, in request<o:p></o:p> self._send_request(method, url, body, headers)<o:p></o:p> File "/usr/lib64/python2.7/httplib.py", line 1051, in _send_request<o:p></o:p> self.endheaders(body)<o:p></o:p> File "/usr/lib64/python2.7/httplib.py", line 1013, in endheaders<o:p></o:p> self._send_output(message_body)<o:p></o:p> File "/usr/lib64/python2.7/httplib.py", line 864, in _send_output<o:p></o:p> self.send(msg)<o:p></o:p> File "/usr/lib64/python2.7/httplib.py", line 840, in send<o:p></o:p> self.sock.sendall(data)<o:p></o:p> File "/usr/lib/python2.7/site-packages/rhn/SSL.py", line 264, in write<o:p></o:p> sent = self._connection.send(data)<o:p></o:p> <class 'up2date_client.up2dateErrors.SSLCertificateVerifyFailedError'>: The SSL certificate failed verification.<o:p></o:p> </div> </body> </html>