Translated message

A translation of this page exists in English.

Warning message

This translation is outdated. For the most up-to-date information, please refer to the English version.

中間 CA でリポジトリー認証が失敗する

Solution Verified - Updated -

Environment

  • RHUI 2.0.2

Issue

  • 中間 CA を使用して ID 証明書に署名をすると、リポジトリーを同期する際にエンタイトルメントの証明書が認証エラーになります。CDS サーバーは、CDS と RHUA との間にリポジトリーの同期に対して認証することができません。

Resolution

チェーンが正しいことが重要です。

  • すべての CA が正しい順序で登録されている証明書チェーンを作成します。
# cat intermediate_CA.cert > chain.pem
# cat root_CA.cert >> chain.pem
  • 証明書チェーンを確認します。
# openssl verify -CAfile chain.pem host-certificate.crt
host-certificate.crt:OK

  • rhui-manager の chain.pem ファイルを ID 証明書として設定します。

  • CDS サーバーに対して、rhui-answer ファイルの chain.pem ファイルを設定します。

Diagnostic Steps

  • 中間 CA を作成し、新しい ID 証明書として設定します。

  • CDS サーバーと同期します。同期に失敗し、ログに HTTP 401 Error コードが記録されます。

以下のように CA を作成します。


# openssl x509 -req -days 365 -in signed_ca-intermediate.csr -CA signing_ca.crt -CAkey signing_ca.key  -extfile ext.cnf -extensions v3_req -out signed_ca-intermediate.crt

# cat ext.cnf
[ v3_req ]
basicConstraints = CA:TRUE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment

実際の結果:


rhua#> cat /var/log/httpd/ssl_access_log
[...]
<ip_addr> - /CN=Red Hat Update Infrastructure [07/Aug/2012:15:43:54 +0200] "GET //pulp/repos/content/dist/rhel/rhui/server/6/6Server/x86_64/optional/os/repodata/repomd.xml HTTP/1.1" 401 493
[...]
  • CDS クライアントからの追加ログ

cds#> cat /var/log/pulp-cds/gofer.log
[...]
2012-08-07 15:43:54,205 [DEBUG][worker-0] _sync_repo() @ cdslib.py:331 - Configuring repository for authentication
2012-08-07 15:43:54,954 [ERROR][worker-0] sync() @ cdslib.py:181 - Error performing repo sync
Traceback (most recent call last):
  File "/usr/lib/python2.6/site-packages/pulp/cds/cdslib.py", line 178, in sync
    self._sync_repo(base_url, repo)
  File "/usr/lib/python2.6/site-packages/pulp/cds/cdslib.py", line 359, in _sync_repo
    fetch.fetchYumRepo(repo_path, verify_options=verify_options)
  File "/usr/lib/python2.6/site-packages/grinder/RepoFetch.py", line 144, in fetchYumRepo
    self.setupYumInfo()
  File "/usr/lib/python2.6/site-packages/grinder/RepoFetch.py", line 108, in setupYumInfo
    info.setUp()
  File "/usr/lib/python2.6/site-packages/grinder/YumInfo.py", line 343, in setUp
    skip=self.skip)
  File "/usr/lib/python2.6/site-packages/grinder/activeobject.py", line 82, in __call__
    return self.object(self, *args, **kwargs)
  File "/usr/lib/python2.6/site-packages/grinder/activeobject.py", line 267, in __call__
    return self.__call(method, args, kwargs)
  File "/usr/lib/python2.6/site-packages/grinder/activeobject.py", line 243, in __call
    return self.__rmi(method.name, args, kwargs)
  File "/usr/lib/python2.6/site-packages/grinder/activeobject.py", line 136, in __rmi
    raise Exception(ex)
Exception:Traceback (most recent call last):

  File "/usr/lib/python2.6/site-packages/grinder/activeobject.py", line 429, in process
    retval = method(*args, **kwargs)

  File "/usr/lib/python2.6/site-packages/grinder/YumInfo.py", line 96, in getDownloadItems
    self.__getRepoData()

  File "/usr/lib/python2.6/site-packages/grinder/YumInfo.py", line 169, in __getRepoData
    for ftype in self.__getRepoXmlFileTypes():

  File "/usr/lib/python2.6/site-packages/grinder/YumInfo.py", line 156, in __getRepoXmlFileTypes
    return self.repo.repoXML.fileTypes()

  File "/usr/lib/python2.6/site-packages/yum/yumRepo.py", line 1454, in <lambda>
    repoXML = property(fget=lambda self: self._getRepoXML(),

  File "/usr/lib/python2.6/site-packages/yum/yumRepo.py", line 1450, in _getRepoXML
    raise Errors.RepoError, msg

RepoError:Cannot retrieve repository metadata (repomd.xml) for repository:.Please verify its path and try again
[...]

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments