9.3. Regenerating and Replacing CA Certificates

There may be a situation when it is necessary to replace the existing CA certificate used for the subscription service. In that case, every system which uses Subscription Asset Manager as its subscription service must be updated to use that new certificate.
This is done by generating a new RPM containing the certificate file and then distributing that RPM to the client systems.
  1. On the Subscription Asset Manager server, generate a new certificate RPM to install on the clients.
    This should all be on a single line; each argument is broken out to show the required options. 
    [root@sam-server ~]# /usr/share/katello/certs/gen-rpm.sh 
	--name "candlepin-cert-consumer-$(hostname)" 
	--version 1.4 
	--release 2 
	--packager None 
	--vendor None 
	--group 'Applications/System' 
	--summary "Subscription-manager consumer certificate for Katello instance $(hostname)" 
	--description 'Consumer certificate and post installation script that configures rhsm.' 
	--requires subscription-manager 
	--post /root/ssl-build/rhsm-katello-reconfigure /etc/rhsm/ca/candlepin-local.pem:644=/root/ssl-build/candlepin-cert.crt 2>>/var/log/katello/katello-configure/certificates.log && /sbin/restorecon ./*rpm
    This script generates a new RPM containing the new Subscription Asset Manager certificate file and sets up the RPM to install that certificate and properly configuration the Red Hat Subscription Manager client on each system. The arguments for the bash script define the RPM settings:
    • --name, --version, and --release set the name of the RPM, in the form name.version-release.rpm.
    • --vendor and --package are required for the RPM information, but the values do not matter.
    • --group specifies the type of application or package which the RPM installs.
    • --summary and --description just set information about the RPM.
    • --requires sets packages that must be available or installed before this RPM can be installed. Since this RPM configures the local Red Hat Subscription Manager client, the subscription-manager package is required.
    • --post runs a given command, script, or series of command once the RPM package is installed. In this case, it configures the local Red Hat Subscription Manager client to use the specified Subscription Asset Manager server as its subscription service and sets the required connection and certificate properties in the Red Hat Subscription Manager configuration file.
  2. Delete any existing certificate RPMs in the /var/www/html/pub directory on the server machine.
  3. Copy the newly-generated RPM to the /var/www/html/pub directory so it can be downloaded via HTTP.
  4. On each Subscription Asset Manager client system, download and install the new RPM. For example: 
    [root@server1 ~]# rpm -ivh http://SAM_server_hostname/pub/candlepin-cert-consumer-SAM_server_hostname.noarch.rpm