4.3.2. Configuring Capsule Server with Custom SSL Certificates for Load Balancing without Puppet

Procedure

1. Append the following option to the capsule-certs-generate command that you obtain from the output of the katello-certs-check command:

   --foreman-proxy-cname loadbalancer.example.com

   Copy to Clipboard Toggle word wrap

2. On Satellite Server, enter the capsule-certs-generate command to generate Capsule certificates. For example:

   # capsule-certs-generate \
   --foreman-proxy-fqdn capsule.example.com \
   --certs-tar /root/capsule_cert/capsule.tar \
   --server-cert /root/capsule_cert/capsule.pem \
   --server-key /root/capsule_cert/capsule.pem \
   --server-ca-cert /root/capsule_cert/ca_cert_bundle.pem \
   --foreman-proxy-cname loadbalancer.example.com

   Copy to Clipboard Toggle word wrap

   Retain a copy of the example satellite-installer command from the output for installing the Capsule Server certificates.

3. Copy the certificate archive file from Satellite Server to Capsule Server:

   # scp /root/capsule.example.com-certs.tar \
   root@capsule.example.com:capsule.example.com-certs.tar

   Copy to Clipboard Toggle word wrap

4. Append the following options to the satellite-installer command that you obtain from the output of the capsule-certs-generate command. Set the --puppet-ca-server option to point to the Capsule Server where you enter the command. You must install Puppet CA on your Capsule Servers, regardless of whether you intend to use it or not. Puppet is configured in its default single-node configuration.

   --certs-cname                              "loadbalancer.example.com" \
   --puppet-dns-alt-names                     "loadbalancer.example.com" \
   --puppet-ca-server                         "capsule.example.com" \
   --foreman-proxy-puppetca                   "true" \
   --puppet-server-ca                         "true" \
   --enable-foreman-proxy-plugin-remote-execution-ssh

   Copy to Clipboard Toggle word wrap

5. On Capsule Server, enter the satellite-installer command, for example:

   # satellite-installer --scenario capsule \
   --foreman-proxy-content-parent-fqdn        "satellite.example.com" \
   --foreman-proxy-register-in-foreman        "true" \
   --foreman-proxy-foreman-base-url           "https://satellite.example.com" \
   --foreman-proxy-trusted-hosts              "satellite.example.com" \
   --foreman-proxy-trusted-hosts              "capsule.example.com" \
   --foreman-proxy-oauth-consumer-key         "oauth key" \
   --foreman-proxy-oauth-consumer-secret      "oauth secret" \
   --certs-tar-file                           "capsule.example.com-certs.tar" \
   --puppet-server-foreman-url                "https://satellite.example.com" \
   --certs-cname                              "loadbalancer.example.com" \
   --puppet-dns-alt-names                     "loadbalancer.example.com" \
   --puppet-ca-server                         "capsule.example.com" \
   --foreman-proxy-puppetca                   "true" \
   --puppet-server-ca                         "true" \
   --enable-foreman-proxy-plugin-remote-execution-ssh

   Copy to Clipboard Toggle word wrap