Chapter 2. Installing Capsule Server

Procedure

1. To store all the source certificate files, create a directory that is accessible only to the root user:

   # mkdir /root/capsule_cert

   Copy to Clipboard Toggle word wrap

2. Create a private key with which to sign the certificate signing request (CSR).

   Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

   If you already have a private key for this Capsule Server, skip this step.

   # openssl genrsa -out /root/capsule_cert/capsule_cert_key.pem 4096

   Copy to Clipboard Toggle word wrap

3. Create the /root/capsule_cert/openssl.cnf configuration file for the CSR and include the following content:

   [ req ]
   req_extensions = v3_req
   distinguished_name = req_distinguished_name
   prompt = no
   
   [ req_distinguished_name ]
   CN = capsule.example.com
   
   [ v3_req ]
   basicConstraints = CA:FALSE
   keyUsage = digitalSignature, keyEncipherment
   extendedKeyUsage = serverAuth, clientAuth
   subjectAltName = @alt_names
   
   [ alt_names ]
   DNS.1 = capsule.example.com

   Copy to Clipboard Toggle word wrap

   For more information about the [ v3_req ] parameters and their purpose, see RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile.

4. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

   [req_distinguished_name]
   CN = capsule.example.com
   countryName =My_Country_Name 

   1

   
   stateOrProvinceName = My_State_Or_Province_Name 

   2

   
   localityName = My_Locality_Name 

   3

   
   organizationName = My_Organization_Or_Company_Name
   organizationalUnitName = My_Organizational_Unit_Name 

   4

   Copy to Clipboard Toggle word wrap

   1

   Two letter code

   2

   Full name

   3

   Full name (example: New York)

   4

   Division responsible for the certificate (example: IT department)

5. Generate CSR:

   # openssl req -new \
   -key /root/capsule_cert/capsule_cert_key.pem \ 

   1

   
   -config /root/capsule_cert/openssl.cnf \ 

   2

   
   -out /root/capsule_cert/capsule_cert_csr.pem 

   3

   Copy to Clipboard Toggle word wrap

   1

   Path to the private key

   2

   Path to the configuration file

   3

   Path to the CSR to generate

6. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for Satellite Server and Capsule Server.

   When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

Procedure

1. On your Satellite Server, validate the custom SSL certificate input files:

   # katello-certs-check \
   -t capsule \
   -c /root/capsule_cert/capsule_cert.pem \ 

   1

   
   -k /root/capsule_cert/capsule_cert_key.pem \ 

   2

   
   -b /root/capsule_cert/ca_cert_bundle.pem 

   3

   Copy to Clipboard Toggle word wrap

   1

   Path to Capsule Server certificate file that is signed by a Certificate Authority.

   2

   Path to the private key that was used to sign Capsule Server certificate.

   3

   Path to the Certificate Authority bundle.

   If you set a wildcard value * for the certificate’s Common Name CN = in the /root/capsule_cert/openssl.cnf configuration file, you must add the -t capsule option to the katello-certs-check command.

   If the command is successful, it returns two capsule-certs-generate commands, one of which you must use to generate the certificate archive file for your Capsule Server.

   Example output of katello-certs-check

   Validation succeeded.
   
   To use them inside a NEW $CAPSULE, run this command:
     capsule-certs-generate --foreman-proxy-fqdn "$CAPSULE" \
       --certs-tar "~/CAPSULE-certs.tar" \
       --server-cert "/root/capsule_cert/capsule_cert.pem" \
       --server-key "/root/capsule_cert/capsule_cert_key.pem" \
       --server-ca-cert "/root/capsule_cert/ca_cert_bundle.pem" \
   
   To use them inside an EXISTING $CAPSULE, run this command INSTEAD:
     capsule-certs-generate --foreman-proxy-fqdn "$CAPSULE" \
       --certs-tar "~/CAPSULE-certs.tar" \
       --server-cert "/root/capsule_cert/capsule_cert.pem" \
       --server-key "/root/capsule_cert/capsule_cert_key.pem" \
       --server-ca-cert "/root/capsule_cert/ca_cert_bundle.pem" \
       --certs-update-server

   Copy to Clipboard Toggle word wrap

2. On your Satellite Server, from the output of the katello-certs-check command, depending on your requirements, enter the capsule-certs-generate command that generates a certificate for a new or existing Capsule.

   In this command, change CAPSULE to the FQDN of your Capsule Server.

3. Retain a copy of the satellite-installer command that the capsule-certs-generate command returns for deploying the certificate to your Capsule Server.

   Example output of capsule-certs-generate

   output omitted
   satellite-installer --scenario capsule \
   --certs-tar-file "/root/capsule.example.com-certs.tar" \
   --foreman-proxy-register-in-foreman "true" \
   --foreman-proxy-foreman-base-url "https://satellite.example.com" \
   --foreman-proxy-trusted-hosts "satellite.example.com" \
   --foreman-proxy-trusted-hosts "capsule.example.com" \
   --foreman-proxy-oauth-consumer-key "My_OAuth_Consumer_Key" \
   --foreman-proxy-oauth-consumer-secret "My_OAuth_Consumer_Secret"

   Copy to Clipboard Toggle word wrap

4. On your Satellite Server, copy the certificate archive file to your Capsule Server:

   # scp /root/capsule_cert/capsule.example.com-certs.tar \
   root@capsule.example.com:/root/capsule.example.com-certs.tar

   Copy to Clipboard Toggle word wrap

5. On your Capsule Server, to deploy the certificate, enter the satellite-installer command that the capsule-certs-generate command returns.

   If network connections or ports to Satellite are not yet open, you can set the --foreman-proxy-register-in-foreman option to false to prevent Capsule from attempting to connect to Satellite and reporting errors. Run the installer again with this option set to true when the network and firewalls are correctly configured.

   Important

   Do not delete the certificate archive file after you deploy the certificate. It is required, for example, when upgrading Capsule Server.