Replies: 10 comments 1 reply
-
Seems your server certificate does not identify you server with the name Have a look at Subject Alternative Name if your name is listed. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the reply: I see this information in this File: [root@spacewalk certs]# cat /etc/pki/tls/certs/spacewalk.crt -----BEGIN CERTIFICATE----- |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
So should I change uyunisuse.nmerit.net which is Uyuni master server name with the client name which is spacewalk.nmerit.net and then save the file and run systemctl restart ?? |
Beta Was this translation helpful? Give feedback.
-
|
I see this currently: X509v3 Subject Alternative Name: what should be the DNS: ? |
Beta Was this translation helpful? Give feedback.
-
|
I have changed the DNS name from spacewalk.nmerit.net to uyunisuse.nmerit.net and try to patch/run the updates and see this error now: mgrcompat_|-sync_states_|-saltutil.sync_states_|-module_run: |
Beta Was this translation helpful? Give feedback.
-
|
These are SSL Certificates which are digitaly signed. You cannot just change texts as this is just the human readable presentation of the block at the end. Please follow https://www.uyuni-project.org/uyuni-docs/en/uyuni/administration/ssl-certs-selfsigned.html#_re_create_existing_server_certificates to create a new one with the right names. https://www.uyuni-project.org/uyuni-docs/en/uyuni/administration/ssl-certs-imported.html#_replace_certificates this explain how to deploy it Good luck |
Beta Was this translation helpful? Give feedback.
-
|
If I create these New CA /SSL /Key will the OLD client still work ? or something to do on old clients as well. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, Where I can get the below information from , locationplease: mgr-ssl-cert-setup --root-ca-file=<Path_to_Root_CA_Certificate> --server-cert-file=<Server_Cert_File> --server-key-file=<Server_Key_File> <Path_to_Root_CA_Certificate> ?? <Server_Cert_File> ??? <Server_Key_File> ?? I have tried this but Error: uyunisuse:~/ssl-build # mgr-ssl-cert-setup --root-ca-file=rhn-ca-openssl.cnf --server-cert-file=RHN-ORG-TRUSTED-SSL-CERT --server-key-file=RHN-ORG-PRIVATE-SSL-KEY ERROR: Unable to read the server key. Encrypted? |
Beta Was this translation helpful? Give feedback.
-
|
mgr-ssl-cert-setup --root-ca-file=<Path_to_Root_CA_Certificate> --server-cert-file=<Server_Cert_File> --server-key-file=<Server_Key_File> What would be the values for this command. |
Beta Was this translation helpful? Give feedback.
-
|
Hello , cat /etc/os-release |
Beta Was this translation helpful? Give feedback.
-
mgrcompat_|-sync_states_|-saltutil.sync_states_|-module_run:
name: saltutil.sync_states
changes:
ret: [
]
comment: Module function saltutil.sync_states executed
result: true
sls: util.syncstates
run_num: 0.0
start_time: '15:12:49.995622'
duration: 322.357
id: sync_states
pkg_|-mgr_absent_ca_package_|-rhn-org-trusted-ssl-cert_|-removed:
name: rhn-org-trusted-ssl-cert
changes: {
}
result: true
comment: All specified packages are already absent
sls: certs
run_num: 1.0
start_time: '15:12:52.654975'
duration: 49.629
id: mgr_absent_ca_package
file_|-mgr_ca_cert_|-/etc/pki/ca-trust/source/anchors/RHN-ORG-TRUSTED-SSL-CERT_|-managed:
changes: {
}
comment: File /etc/pki/ca-trust/source/anchors/RHN-ORG-TRUSTED-SSL-CERT is in the correct state
name: /etc/pki/ca-trust/source/anchors/RHN-ORG-TRUSTED-SSL-CERT
result: true
sls: certs
run_num: 2.0
start_time: '15:12:52.711937'
duration: 144.951
id: mgr_ca_cert
cmd_|-update-ca-certificates_|-/usr/bin/update-ca-trust extract_|-run:
changes: {
}
result: true
duration: 0.005
start_time: '15:12:52.858807'
comment: State was not run because none of the onchanges reqs changed
state_ran: false
run_num: 3.0
sls: certs
file_|-mgr_proxy_ca_cert_symlink_|-/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT_|-symlink:
result: true
name: /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
changes: {
}
comment: onlyif condition is false
skip_watch: true
sls: certs
run_num: 4.0
start_time: '15:12:52.858943'
duration: 1466.991
id: mgr_proxy_ca_cert_symlink
file_|-mgrchannels_susemanagerplugin_yum_|-/usr/share/yum-plugins/susemanagerplugin.py_|-managed:
changes: {
}
comment: File /usr/share/yum-plugins/susemanagerplugin.py is in the correct state
name: /usr/share/yum-plugins/susemanagerplugin.py
result: true
sls: channels
run_num: 5.0
start_time: '15:12:54.326623'
duration: 70.674
id: mgrchannels_susemanagerplugin_yum
file_|-mgrchannels_susemanagerplugin_conf_yum_|-/etc/yum/pluginconf.d/susemanagerplugin.conf_|-managed:
changes: {
}
comment: File /etc/yum/pluginconf.d/susemanagerplugin.conf is in the correct state
name: /etc/yum/pluginconf.d/susemanagerplugin.conf
result: true
sls: channels
run_num: 6.0
start_time: '15:12:54.397604'
duration: 67.093
id: mgrchannels_susemanagerplugin_conf_yum
file_|-mgrchannels_enable_yum_plugins_|-/etc/yum.conf_|-replace:
result: true
name: /etc/yum.conf
changes: {
}
comment: onlyif condition is false
skip_watch: true
sls: channels
run_num: 7.0
start_time: '15:12:54.465020'
duration: 36.734
id: mgrchannels_enable_yum_plugins
file_|-mgrchannels_repo_|-/etc/yum.repos.d/susemanager:channels.repo_|-managed:
changes: {
}
comment: File /etc/yum.repos.d/susemanager:channels.repo is in the correct state
name: /etc/yum.repos.d/susemanager:channels.repo
result: true
sls: channels
run_num: 8.0
start_time: '15:12:54.503882'
duration: 114.002
id: mgrchannels_repo
cmd_|-mgrchannels_yum_clean_all_|-/usr/bin/yum clean all_|-run:
changes: {
}
result: true
duration: 0.005
start_time: '15:12:54.618710'
comment: State was not run because none of the onchanges reqs changed
state_ran: false
run_num: 9.0
sls: channels
cmd_|-trust_res_gpg_key_|-rpm --import https://uyunisuse.nmerit.net:443/pub/res-gpg-pubkey-0182b964.key_|-run:
name: rpm --import https://uyunisuse.nmerit.net:443/pub/res-gpg-pubkey-0182b964.key
changes:
pid: 3334.0
retcode: 1.0
stdout: ''
stderr: |-
curl: (51) Unable to communicate securely with peer: requested domain name does not match the server's certificate.
error: https://uyunisuse.nmerit.net:443/pub/res-gpg-pubkey-0182b964.key: import read failed(2).
result: false
comment: Command "rpm --import https://uyunisuse.nmerit.net:443/pub/res-gpg-pubkey-0182b964.key" run
sls: channels
run_num: 10.0
start_time: '15:12:54.618849'
duration: 498.493
id: trust_res_gpg_key
? cmd_|-trust_suse_manager_tools_rhel_gpg_key_|-rpm --import https://uyunisuse.nmerit.net:443/pub/sle12-gpg-pubkey-39db7c82.key_|-run
: name: rpm --import https://uyunisuse.nmerit.net:443/pub/sle12-gpg-pubkey-39db7c82.key
changes:
pid: 3375.0
retcode: 1.0
stdout: ''
stderr: |-
curl: (51) Unable to communicate securely with peer: requested domain name does not match the server's certificate.
error: https://uyunisuse.nmerit.net:443/pub/sle12-gpg-pubkey-39db7c82.key: import read failed(2).
result: false
comment: Command "rpm --import https://uyunisuse.nmerit.net:443/pub/sle12-gpg-pubkey-39db7c82.key" run
sls: channels
run_num: 11.0
start_time: '15:12:55.118011'
duration: 510.133
id: trust_suse_manager_tools_rhel_gpg_key
pkg_|-pkg_installed_|-pkg_installed_|-installed:
name: pkg_installed
result: false
changes: {
}
comment: "Error occurred installing package(s). Additional info follows:\n\nerrors:\n - Running scope as unit run-3387.scope.\n Loaded plugins:
\ fastestmirror, langpacks, susemanagerplugin\n Loading mirror speeds from cached hostfile\n https://uyunisuse.nmerit.net:443/rhn/manager/download/centos7-uyuni-client-x86_64/repodata/repomd.xml:\
\ [Errno 14] curl#51 - "Unable to communicate securely with peer: requested domain name does not match the server's certificate."\n Trying
\ other mirror.\n \n \n One of the configured repositories failed (Uyuni Client Tools for CentOS 7 (x86_64)),\n and yum doesn't
\ have enough cached data to continue. At this point the only\n safe thing yum can do is fail. There are a few ways to work "fix" this:\n
\ \n 1. Contact the upstream for the repository and get them to fix the problem.\n \n 2. Reconfigure the baseurl/etc.
\ for the repository, to point to a working\n upstream. This is most often useful if you are using a newer\n distribution
\ release than is supported by the repository (and the\n packages for the previous distribution release still work).\n \n
\ 3. Run the command with the repository temporarily disabled\n yum --disablerepo=susemanager:centos7-uyuni-client-x86_64
\ ...\n \n 4. Disable the repository permanently, so yum won't use it by default. Yum\n will then just ignore the repository
\ until you permanently enable it\n again or use --enablerepo for temporary usage:\n \n yum-config-manager --disable
\ susemanager:centos7-uyuni-client-x86_64\n or\n subscription-manager repos --disable=susemanager:centos7-uyuni-client-x86_64\n
\ \n 5. Configure the failing repository to be skipped, if it is unavailable.\n Note that yum will try to contact the
\ repo. when it runs most commands,\n so will have to try and fail each time (and thus. yum will be be much\n slower).
\ If it is a very temporary problem though, this is often a nice\n compromise:\n \n yum-config-manager --save
\ --setopt=susemanager:centos7-uyuni-client-x86_64.skip_if_unavailable=true\n \n failure: repodata/repomd.xml from susemanager:centos7-uyuni-client-x86_64:
\ [Errno 256] No more mirrors to try.\n https://uyunisuse.nmerit.net:443/rhn/manager/download/centos7-uyuni-client-x86_64/repodata/repomd.xml:\
\ [Errno 14] curl#51 - "Unable to communicate securely with peer: requested domain name does not match the server's certificate.""
sls: packages.pkginstall
run_num: 12.0
start_time: '15:12:55.664525'
duration: 5651.433
id: pkg_installed
Beta Was this translation helpful? Give feedback.
All reactions