Chapter 2. Installing Capsule Server

Procedure

1. To store all the source certificate files, create a directory that is accessible only to the root user:

   # mkdir /root/capsule_cert

2. Create a private key with which to sign the certificate signing request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this Capsule Server, skip this step.

   # openssl genrsa -out /root/capsule_cert/capsule_cert_key.pem 4096

3. Create the /root/capsule_cert/openssl.cnf configuration file for the CSR and include the following content:

   [ req ]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   commonName = capsule.example.com
   
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
   extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
   subjectAltName = @alt_names
   
   [ alt_names ]
   DNS.1 = capsule.example.com

4. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

   [req_distinguished_name]
   CN = capsule.example.com
   countryName =My_Country_Name 1
   stateOrProvinceName = My_State_Or_Province_Name 2
   localityName = My_Locality_Name 3
   organizationName = My_Organization_Or_Company_Name
   organizationalUnitName = My_Organizational_Unit_Name 4

   1

   Two letter code

   2

   Full name

   3

   Full name (example: New York)

   4

   Division responsible for the certificate (example: IT department)

5. Generate CSR:

   # openssl req -new \
   -key /root/capsule_cert/capsule_cert_key.pem \ 1
   -config /root/capsule_cert/openssl.cnf \ 2
   -out /root/capsule_cert/capsule_cert_csr.pem 3

   1

   Path to the private key

   2

   Path to the configuration file

   3

   Path to the CSR to generate

6. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

Procedure

1. On your Satellite Server, generate a certificate bundle:

   # capsule-certs-generate \
   --foreman-proxy-fqdn capsule.example.com \
   --certs-tar ~/capsule.example.com-certs.tar \
   --server-cert /root/capsule_cert/capsule_cert.pem \ 1
   --server-key /root/capsule_cert/capsule_cert_key.pem \ 2
   --server-ca-cert /root/capsule_cert/ca_cert_bundle.pem 3

   1

   Path to Capsule Server certificate file that is signed by a Certificate Authority.

   2

   Path to the private key that was used to sign Capsule Server certificate.

   3

   Path to the Certificate Authority bundle.

2. Retain a copy of the satellite-installer command that the capsule-certs-generate command returns for deploying the certificate to your Capsule Server.

   Example output of capsule-certs-generate

   output omitted
   satellite-installer --scenario capsule \
   --certs-tar-file "/root/capsule.example.com-certs.tar" \
   --foreman-proxy-register-in-foreman "true" \
   --foreman-proxy-foreman-base-url "https://satellite.example.com" \
   --foreman-proxy-trusted-hosts "satellite.example.com" \
   --foreman-proxy-trusted-hosts "capsule.example.com" \
   --foreman-proxy-oauth-consumer-key "My_OAuth_Consumer_Key" \
   --foreman-proxy-oauth-consumer-secret "My_OAuth_Consumer_Secret"

3. On your Satellite Server, copy the certificate archive file to your Capsule Server:

   # scp ~/capsule.example.com-certs.tar \
   root@capsule.example.com:/root/capsule.example.com-certs.tar

4. On your Capsule Server, to deploy the certificate, enter the satellite-installer command that the capsule-certs-generate command returns.

   If network connections or ports to Satellite are not yet open, you can set the --foreman-proxy-register-in-foreman option to false to prevent Capsule from attempting to connect to Satellite and reporting errors. Run the installer again with this option set to true when the network and firewalls are correctly configured.

   Important

   Do not delete the certificate archive file after you deploy the certificate. It is required, for example, when upgrading Capsule Server.