[Pulp-list] My Failed PULP setup aka SSL Errors

Gavin Jones gavinj84 at gmail.com
Fri Oct 31 06:39:58 UTC 2014

Hey Randy,
       Thanks for your reply, yes you have some good points.

openssl x509 -in rootca.crt -noout -text  | grep -i   Version:
        Version: 3 (0x2)
openssl x509 -in pulp01.rap.local.crt -noout -text | grep -i   Version:
        Version: 1 (0x0)

openssl x509 -in pulpca.crt -noout -text | grep -i   Version:
        Version: 3 (0x2)
This step: openssl x509 -req -days 3650 -CA pulpca.crt -CAkey pulpca.key
-set_serial 01 -in pulp01.rap.local.csr -out pulp01.rap.local.crt produces
an SSLv1 Cert NOT an SSLv3 Cert... need to modify this somehow...

I will use these steps once the above is fixed

cp -v /etc/pki/pulp_certs/rootca.crt /etc/pki/ca-trust/source/anchors/
update-ca-trust enable
update-ca-trust extract

This time I located the has from rootca.crt, in

- I will modify this for the pulp_ca_chain file as you explained.

vim /etc/httpd/conf.d/ssl.conf

SSLCertificateFile /etc/pki/pulp_certs/pulpca.crt
SSLCertificateKeyFile /etc/pki/pulp_certs/pulpca.key
SSLCACertificateFile /etc/pki/pulp_certs/pulpca_chain.crt

- After some SELinux fun with the certs:

setsebool -P httpd_read_user_content 1 etc.

systemctl restart httpd

https://pulp01.rap.local = shows up as CA Signed from the Intermediate CA.
So this is now working fine.

Understood will not touch any of the certs in: /etc/pki/pulp.

Went to create the repo:

pulp-admin -uadmin -padmin rpm repo create --repo-id rhel-7-server \
--feed https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os \
--feed-ca-cert=/etc/rhsm/ca/redhat-uep.pem \
--feed-key=/etc/pki/entitlement/66666666-key.pem \
--feed-cert=/etc/pki/entitlement/66666666.pem \
--display-name "rhel-7-server" --description "RHEL 7 YUM Files"

- went to sync the repo :

pulp-admin rpm repo sync run --repo-id=rhel-7-server

- same error:

I have not touched these files certs as they should be overriden by Apache?

vim /etc/pulp/server.conf

cacert: /etc/pki/pulp/ca.crt
cakey: /etc/pki/pulp/ca.key
ssl_ca_certificate: /etc/pki/pulp/ssl_ca.crt

vim /etc/pulp/admin/admin.conf

host = pulp01.rap.local
verify_ssl = True
ca_path = /etc/pki/tls/certs/ca-bundle.crt

Leave the above alone same error

2014-10-31 17:29:24,249 - ERROR - Client-side exception occurred
Traceback (most recent call last):

Should I be modifying:


Is there anything obvious now outstanding I have diabled selinux in the

Also Even If I want to skip SSL, I still have grief:

vim /etc/pulp/admin/admin.conf
verify_ssl = False

systemctl restart httpd.service = same error.

I have even checked in the home directory of the user I am using:
and there is NO:


Which could override the global settings.

Thanks for your help so far.

On Fri, Oct 31, 2014 at 12:22 AM, Randy Barlow <rbarlow at redhat.com> wrote:

> On 10/29/2014 07:18 PM, Gavin Jones wrote:
> > openssl req -new -key pulpca.key -out pulpca.csr
> >
> >
> > *# On the MS Root CA*
> >
> > http://localrootca/certsrv/
> >
> > Request a Certificate > advanced certificate request >
> >
> > Paste the pulpca.csr Into the Saved Request Section >
> >
> > Certifcate Template: Web Server
> >
> > Additional Attributes: Left this blank
> >
> > - Base64 > Download Certificate.
> >
> > scp certnew.cer as user admin across to pulp01
> >
> >
> > cd /home/admin
> >
> > chown -v root.root certnew.cer
> >
> > cp -v /home/admin/certnew.cer /etc/pki/pulp_certs/pulpca.crt
> One thing you may have missed in the above steps is that intermediate
> certificates must be SSL v3 certificates that have the CA constraint set
> to true. I'm not familiar with Microsoft, so I can't tell you how to do
> it. However, if you want to check if a certificate is a v3 cert, you can
> do something like this:
> [rbarlow at where ~]$ openssl x509 -in
> Documents/certificates/grapefruit-CA.pem -noout -text
> Certificate:
>     Data:
>         Version: 3 (0x2)
>     <snip>
>         X509v3 extensions:
>             X509v3 Subject Key Identifier:
>                 C7:AF:E2:AC:53:E6:5F:60:D6:52:3B:61:83:02:9F:4F:5C:11:52:DB
>             X509v3 Authority Key Identifier:
> keyid:5C:88:1C:B7:DF:DC:A8:C1:19:D1:C2:26:E0:DD:4C:A7:91:EC:D7:F3
>             X509v3 Basic Constraints:
>                 CA:TRUE
>             X509v3 Key Usage:
>                 Certificate Sign, CRL Sign
>             Netscape Cert Type:
>                 SSL CA, S/MIME CA
>     <snip>
> Note that the certificate listed itself as Version 3, and also note the
> X509v3 extensions section.
> > cat rootca.crt pulpca.crt > pulpca_chain.crt
> IIRC, a lot of software expects the chain to be in the other order, but
> perhaps not all software cares about this.
> > As per Randy's email: to add the certs in to the ca-bundle.crt to
> > survive the RHEL package updates to the CA bundle.
> >
> > man update-ca-trust as explained in QUICK HELP 1:
> >
> > cp -v /etc/pki/pulp_certs/rootca.crt /etc/pki/ca-trust/source/anchors/
> > update-ca-trust extract && echo $?
> You may need to run update-ca-trust enable one time before extract will
> work.
> > vim /etc/httpd/conf.d/ssl.conf
> <snip>
> > SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt         = This
> > should stay the same as we just updated our CA Trust???
> Changing this value will conflict with Pulp. If you look at
> /etc/httpd/conf.d/pulp.conf, you will see that we also set this setting.
> This is the CA that Pulp uses to sign client certificates upon login
> with pulp-admin. I would recommend leaving it as it was.
> I noted that you never mentioned having done anything with your
> pulp_ca_chain file. You should set the mod_ssl SSLCertificateChainFile
> Directive[0] to be a path to that file in /etc/httpd/conf.d/ssl.conf if
> you want Apache to advertise the chain. Without this, there is no way
> for clients to validate that httpd's cert is trusted all the way to a
> root CA.
> > Now Apache is telling me the SSL is self signed and should not be
> > trusted.... = Certificate Fail
> I believe this is due to the combination of the above issues.
> > My next question is should I be using separate SSL Certs for Apache and
> > PULP? As Pulp should read from Apache's SSL Certs I'd assume they would
> > be the same?
> Pulp is served by httpd using the certificates specified in
> /etc/httpd/conf.d/ssl.conf. Pulp itself also has some internal
> certificates it uses in /etc/pki/pulp, but you should never need to mess
> with those and I would recommend you leave them as is.
> [0]
> https://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcertificatechainfile
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/pulp-list/attachments/20141031/0bbe4476/attachment.htm>

More information about the Pulp-list mailing list