Chapter 2. Installing Capsule Server

Procedure

1. To store all the source certificate files, create a directory that is accessible only to the root user:

   # mkdir /root/capsule_cert

2. Create a private key with which to sign the certificate signing request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this Capsule Server, skip this step.

   # openssl genrsa -out /root/capsule_cert/capsule_cert_key.pem 4096

3. Create the /root/capsule_cert/openssl.cnf configuration file for the CSR and include the following content:

1. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

   [req_distinguished_name]
   CN = capsule.example.com
   countryName =My_Country_Name 1
   stateOrProvinceName = My_State_Or_Province_Name 2
   localityName = My_Locality_Name 3
   organizationName = My_Organization_Or_Company_Name
   organizationalUnitName = My_Organizational_Unit_Name 4

   1

   Two letter code

   2

   Full name

   3

   Full name (example: New York)

   4

   Division responsible for the certificate (example: IT department)

2. Generate CSR:

   # openssl req -new \
   -key /root/capsule_cert/capsule_cert_key.pem \ 1
   -config /root/capsule_cert/openssl.cnf \ 2
   -out /root/capsule_cert/capsule_cert_csr.pem 3

   1

   Path to the private key

   2

   Path to the configuration file

   3

   Path to the CSR to generate

3. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

Procedure

1. On Satellite Server, validate the custom SSL certificate input files:

   # katello-certs-check \
   -t capsule -c /root/capsule_cert/capsule_cert.pem \      1
   -k /root/capsule_cert/capsule_cert_key.pem \  2
   -b /root/capsule_cert/ca_cert_bundle.pem      3

   1

   Path to Capsule Server certificate file that is signed by a Certificate Authority.

   2

   Path to the private key that was used to sign Capsule Server certificate.

   3

   Path to the Certificate Authority bundle.

   If you set a wildcard value * for the certificate’s Common Name CN = in the /root/capsule_cert/openssl.cnf configuration file, you must add the -t capsule option to the katello-certs-check command.

   If the command is successful, it returns two capsule-certs-generate commands, one of which you must use to generate the certificate archive file for your Capsule Server.

   Example output of katello-certs-check

   Validation succeeded.
   
   To use them inside a NEW $CAPSULE, run this command:
   
   capsule-certs-generate --foreman-proxy-fqdn "$CAPSULE" \
       --certs-tar  "~/$CAPSULE-certs.tar" \
       --server-cert "/root/capsule_cert/capsule_cert.pem" \
       --server-key "/root/capsule_cert/capsule_cert_key.pem" \
       --server-ca-cert "/root/capsule_cert/ca_cert_bundle.pem" \
   
   To use them inside an EXISTING $CAPSULE, run this command INSTEAD:
   
     capsule-certs-generate --foreman-proxy-fqdn "$CAPSULE" \
       --certs-tar "~/$CAPSULE-certs.tar" \
       --server-cert "/root/capsule_cert/capsule_cert.pem" \
       --server-key "/root/capsule_cert/capsule_cert_key.pem" \
       --server-ca-cert "/root/capsule_cert/ca_cert_bundle.pem" \
       --certs-update-server

2. On Satellite Server, from the output of the katello-certs-check command, depending on your requirements, enter the capsule-certs-generate command that generates a certificate for a new or existing Capsule.

   In this command, change $CAPSULE to the FQDN of your Capsule Server.

3. Retain a copy of the satellite-installer command that the capsule-certs-generate command returns for deploying the certificate to your Capsule Server.

   Example output of capsule-certs-generate

   output omitted
   satellite-installer --scenario capsule \
   --certs-tar-file "/root/capsule.example.com-certs.tar" \
   --foreman-proxy-register-in-foreman "true" \
   --foreman-proxy-foreman-base-url "https://satellite.example.com" \
   --foreman-proxy-trusted-hosts "satellite.example.com" \
   --foreman-proxy-trusted-hosts "capsule.example.com" \
   --foreman-proxy-oauth-consumer-key "s97QxvUAgFNAQZNGg4F9zLq2biDsxM7f" \
   --foreman-proxy-oauth-consumer-secret "6bpzAdMpRAfYaVZtaepYetomgBVQ6ehY"

4. On Satellite Server, copy the certificate archive file to your Capsule Server:

   # scp /root/capsule_cert/capsule.example.com-certs.tar \
   root@capsule.example.com:/root/capsule.example.com-certs.tar

5. On Capsule Server, to deploy the certificate, enter the satellite-installer command that the capsule-certs-generate command returns.

   When network connections or ports to Satellite are not yet open, you can set the --foreman-proxy-register-in-foreman option to false to prevent Capsule from attempting to connect to Satellite and reporting errors. Run the installer again with this option set to true when the network and firewalls are correctly configured.

   Important

   Do not delete the certificate archive file after you deploy the certificate. It is required, for example, when upgrading Capsule Server.