Chapter 6. Refreshing the self-signed CA certificate on hosts

Procedure

1. In the Satellite web UI, navigate to Monitor > Jobs.
2. Click Run Job.
3. From the Job category list, select Commands.
4. From the Job template list, select Download and run a script.
5. Click Next.
6. Select hosts on which you want to execute the job.

7. In the url field, enter the following URL:

   https://satellite.example.com/unattended/public/foreman_ca_refresh

   Replace satellite.example.com with the FQDN of your Satellite Server.

   You can use HTTP when the CA certificate is expired.

8. Optional: Click Next and configure advanced fields and scheduling as you require.
9. Click Run on selected hosts.

Procedure

1. In the Satellite web UI, navigate to Monitor > Jobs.
2. Click Run Job.
3. From the Job category list, select Ansible Commands.
4. From the Job template list, select Download and execute a script.
5. Click Next.
6. Select hosts on which you want to execute the job.

7. In the url field, enter the following URL:

   https://satellite.example.com/unattended/public/foreman_ca_refresh

   Replace satellite.example.com with the FQDN of your Satellite Server.

   You can use HTTP when the CA certificate is expired.

8. Optional: Click Next and configure advanced fields and scheduling as you require.
9. Click Run on selected hosts.

Procedure

1. Download the certificate on your Satellite Server:

   # curl -o "satellite_ca_cert.crt" https://satellite.example.com/unattended/public/foreman_raw_ca

   Replace satellite.example.com with the FQDN of your Satellite Server.

2. Transfer the CA certificate to your host securely, for example by using scp.
3. Login to your host by using SSH.

4. Copy the certificate to the Subscription Manager configuration directory:

   # cp -u satellite_ca_cert.crt /etc/rhsm/ca/katello-server-ca.pem

5. Copy the certificate to the truststore:

   # cp satellite_ca_cert.crt /etc/pki/ca-trust/source/anchors

6. Update the truststore:

   # update-ca-trust