Red Hat Summit Red Hat SummitSupportConsoleDéveloppeursCommencer un essaiContact

Ce contenu n'est pas disponible dans la langue sélectionnée.

Chapter 16. Renewing the Custom SSL Certificate

This chapter provides information on how to renew the custom SSL certificate on Satellite Server as well as on Capsule Server.

16.1. Renewing a Custom SSL Certificate on Satellite Server
Copier lien

Use this procedure to update your custom SSL certificate for Satellite Server.

Prerequisite

  • You must create a new Certificate Signing Request (CSR) and send it to the Certificate Authority to sign the certificate. Refer to the Configuring Satellite Server with a Custom SSL Certificate guide before creating a new CSR because the Server certificate must have X.509 v3 Key Usage and Extended Key Usage extensions with required values. In return, you will receive the Satellite Server certificate and CA bundle.

Procedure

  • Before deploying a renewed custom certificate on your Satellite Server, validate the custom SSL input files. Note that for the katello-certs-check command to work correctly, Common Name (CN) in the certificate must match the FQDN of Satellite Server: 

    # katello-certs-check -t satellite \
-b /root/satellite_cert/ca_cert_bundle.pem \
-c /root/satellite_cert/satellite_cert.pem \
-k /root/satellite_cert/satellite_cert_key.pem
    Copy to Clipboard Toggle word wrap

    If the command is successful, it returns the following satellite-installer command. You can use this command to deploy the renewed CA certificates to Satellite Server: 

    # satellite-installer --scenario satellite \
--certs-server-cert "/root/satellite_cert/satellite_cert.pem" \
--certs-server-key "/root/satellite_cert/satellite_key.pem" \
--certs-server-ca-cert "/root/satellite_cert/ca_cert_bundle.pem" \
--certs-update-server \
--certs-update-server-ca
    Copy to Clipboard Toggle word wrap
Important

Do not delete the certificate files after you deploy the certificate. They are required when upgrading Satellite Server.

Note

If a new consumer package katello-ca-consumer-latest.noarch.rpm is generated due to a different Certificate Signing Authority, all the clients registered to Satellite Server must be updated.

Verification

  1. Access the Satellite web UI from your local machine. For example, https://satellite.example.com.
  2. In your browser, view the certificate details to verify the deployed certificate.

16.2. Renewing a Custom SSL certificate on Capsule Server
Copier lien

Use this procedure to update your custom SSL certificate for Capsule Server. The satellite-installer command, which the capsule-certs-generate command returns, is unique to each Capsule Server. You cannot use the same command on more than one Capsule Server.

Prerequisite

  • You must create a new Certificate Signing Request and send it to the Certificate Authority to sign the certificate. Refer to the Configuring Satellite Server with a Custom SSL Certificate guide before creating a new CSR because the Satellite Server certificate must have X.509 v3 Key Usage and Extended Key Usage extensions with required values. In return, you will receive the Capsule Server certificate and CA bundle.

Procedure

  1. On your Satellite Server, validate the custom SSL certificate input files: 

    # katello-certs-check -t capsule \
-b /root/capsule_cert/ca_cert_bundle.pem \
-c /root/capsule_cert/capsule_cert.pem \
-k /root/capsule_cert/capsule_cert_key.pem
    Copy to Clipboard Toggle word wrap

  2. On your Satellite Server, generate the certificate archive file for your Capsule Server: 

    capsule-certs-generate --foreman-proxy-fqdn "capsule.example.com" \
--certs-tar  "/root/My_Certificates/capsule.example.com-certs.tar" \
--server-cert "/root/My_Certificates/capsule_cert.pem" \
--server-key "/root/My_Certificates/capsule_cert_key.pem" \
--server-ca-cert "/root/My_Certificates/ca_cert_bundle.pem" \
--certs-update-server
    Copy to Clipboard Toggle word wrap

  3. On your Satellite Server, copy the certificate archive file to your Capsule Server: 

    # scp /root/My_Certificates/capsule.example.com-certs.tar user@capsule.example.com:
    Copy to Clipboard Toggle word wrap

    You can move the copied file to the applicable path if required.

  4. Retain a copy of the satellite-installer command that the capsule-certs-generate command returns for deploying the certificate to your Capsule Server.

  5. Deploy the certificate on your Capsule Server using the satellite-installer command returned by the capsule-certs-generate command: 

    # satellite-installer --scenario capsule \
--foreman-proxy-register-in-foreman "true" \
--foreman-proxy-foreman-base-url "https://satellite.example.com" \
--certs-tar-file "/root/My_Certificates/capsule.example.com-certs.tar" \
--certs-update-server
    Copy to Clipboard Toggle word wrap
Important

Do not delete the certificate archive file on the Capsule Server after you deploy the certificate. They are required when upgrading Capsule Server.

Note

If a new consumer package katello-ca-consumer-latest.noarch.rpm is generated due to a different Certificate Signing Authority, all the clients registered to Capsule Server must be updated.

Retour au début
Red Hat logoGithubredditYoutubeTwitter

Apprendre

Essayez, achetez et vendez

Communautés

À propos de la documentation Red Hat

Nous aidons les utilisateurs de Red Hat à innover et à atteindre leurs objectifs grâce à nos produits et services avec un contenu auquel ils peuvent faire confiance. Découvrez nos récentes mises à jour.

Rendre l’open source plus inclusif

Red Hat s'engage à remplacer le langage problématique dans notre code, notre documentation et nos propriétés Web. Pour plus de détails, consultez le Blog Red Hat.

À propos de Red Hat

Nous proposons des solutions renforcées qui facilitent le travail des entreprises sur plusieurs plates-formes et environnements, du centre de données central à la périphérie du réseau.

Theme

© 2025 Red Hat