Clarify where to obtain the CA bundle for MCP server #4425
Conversation
github-actions
bot
added
Needs tech review
|
The PR preview for a314c70 is available at theforeman-foreman-documentation-preview-pr-4425.surge.sh The following output files are affected by this PR: |
| endif::[] | ||
| * The CA bundle for your {Project} is available on the system. | ||
| * The CA bundle for your {Project} is available on your system. | ||
| If you are using the default self-signed {Project} certificate, the CA bundle is located at `_{foreman-example-com}_/pub/katello-server-ca.crt`. |
There was a problem hiding this comment.
I thought we wanted to get rid of the ca cert being served under /pub. Or was it just katello-ca-consumer rpm?
There was a problem hiding this comment.
All I can say is that this is where I found it 🙃
There was a problem hiding this comment.
Would this template help? app/views/unattended/provisioning_templates/registration/foreman_raw_ca.erb in foreman.
There was a problem hiding this comment.
Or is it /etc/rhsm/ca/katello-server-ca.pem?
Well, all I can say now is that I'm really happy we got that bug report. @adamruzicka What is the exact certificate required to start an MCP server and from where should an admin obtain it?
There was a problem hiding this comment.
The /pub location is only available in Katello so if anything, it needs to be hidden behind ifdef::katello,satellite,orcharhino[].
There was a problem hiding this comment.
I wonder if it could be the same SSL CA file that users can find by navigating to Administer > Settings > Authentication and locating the value of the SSL CA file setting. But I'm not sure.
This SSL CA file is used to configure hosts for a secured registration call.
There was a problem hiding this comment.
What is the exact certificate required to start an MCP server
Broadly speaking, it should be the certificate of a certification authority which signed the cert that is used to secure Foreman's webui.
If admin access is available, then personally I would resort to this oneliner and grabbed whatever it gives me
# cat /etc/httpd/conf.d/05-foreman-ssl.conf | awk -F '"' '/SSLCACertificateFile/ { print $2 }'
/etc/pki/katello/certs/katello-default-ca.crt
On a default installation, this is the same thing (same content, but completely individual files with different ownership and permissions, no links or anything) that ends up in /pub as well as the thing pointed at by Administer > Settings > Authentication > SSL CA File
# diff /etc/pki/katello/certs/katello-default-ca.crt /var/www/html/pub/katello-server-ca.crt && echo same
same
# hammer setting info --name ssl_ca_file | grep Value
Value: /etc/foreman/proxy_ca.pem
# diff /etc/pki/katello/certs/katello-default-ca.crt /etc/foreman/proxy_ca.pem && echo same
same
Would this template help?
app/views/unattended/provisioning_templates/registration/foreman_raw_ca.erbin foreman.
Sort of. If we can have the user render it in a preview or something and then copy the result, then that would be probably the easies non-admin way of going about it.
I wonder if it could be the same SSL CA file that users can find
On a default installation that seems to be the one too, but I can't really vouch for it.
Or is it
/etc/rhsm/ca/katello-server-ca.pem?
That would be on the managed host?
guides/common/modules/proc_configuring-the-mcp-server-for-project.adoc
Outdated
Show resolved
Hide resolved
aneta-petrova
force-pushed
the
ca-bundle-mcp
branch
from
dbfcbc6 to
a314c70
Compare
5 participants
What changes are you introducing?
Adding details on how to obtain the CA bundle for MCP server.
Why are you introducing these changes? (Explanation, links to references, issues, etc.)
https://issues.redhat.com/browse/SAT-39417#
Anything else to add? (Considerations, potential downsides, alternative solutions you have explored, etc.)
N/A
Contributor checklists
Please cherry-pick my commits into: