<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Arial;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Courier New";
panose-1:2 7 3 9 2 2 5 2 4 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
span.gmail-m2488080285529326609gmail-m-594478028564423228gmailmsg
{mso-style-name:gmail-m_2488080285529326609gmail-m_-594478028564423228gmail_msg;}
span.gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg
{mso-style-name:gmail-m_2488080285529326609gmail-m_-594478028564423228m_7440200668888794961m_2611409000370850777m_-980879755636344940gmail_msg;}
span.gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940m-4789423380628271279hoenzb
{mso-style-name:gmail-m_2488080285529326609gmail-m_-594478028564423228m_7440200668888794961m_2611409000370850777m_-980879755636344940m_-4789423380628271279hoenzb;}
span.gmail-m2488080285529326609gmail-hoenzb
{mso-style-name:gmail-m_2488080285529326609gmail-hoenzb;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Thanks very much for the detailed instructions! I was able to upgrade from 3.6.7 to 4.0.4 successfully. Here are some additional notes for those (like me) who were already using a custom
HTTPS certificate in 3.6:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">On step #3 “b” -- mv YOUR-3RD-PART-CERT.p12 /etc/pki/ovirt-engine/keys/apache.p12 – I didn’t need to perform this as the file was already there from my previous 3.6 configuration; setup
had not removed it. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">On step #4 – extracting private key and certificate – I didn’t need to perform this either; existing files were left intact from version 3.6.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Restarting Apache and oVirt service was not enough to bring up the web admin portal in my case. I had to reboot the server running oVirt engine, after which the web admin portal was accessible.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">I recommend backing up /etc/pki in addition to /etc/ovirt-engine prior to running setup.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Best,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Daniel<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black"><users-bounces@ovirt.org> on behalf of Martin Perina <mperina@redhat.com><br>
<b>Date: </b>Tuesday, November 1, 2016 at 6:29 AM<br>
<b>To: </b>Kenneth Bingham <w@qrk.us><br>
<b>Cc: </b>users <users@ovirt.org><br>
<b>Subject: </b>Re: [ovirt-users] Upgrading oVirt 3.6 with existing HTTPS certificate signed by custom CA to oVirt 4<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:Arial"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Nov 1, 2016 at 11:49 AM, Martin Perina <<a href="mailto:mperina@redhat.com" target="_blank">mperina@redhat.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">So first of all, we don't support replacing oVirt internal CA which is used to sign host certificates. This internal CA is also used to sign HTTPS certificate by default, but you can provided your own HTTPS
certificate signed by custom CA. The correct steps how to do that are (assuming you have you custom CA certififcate in PEM format and HTTPS ceritificate along with private key in PKCS12 format):<br>
<br>
1. Add your commercially issued certificate to the host-wide trust store.<br>
cp YOUR-3RD-PARTY-CA-CERT.pem /etc/pki/ca-trust/source/anchors<br>
update-ca-trust<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">2. Remove Apache CA link pointing to oVirt internal<br>
rm /etc/pki/ovirt-engine/apache-ca.pem<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">3. Install your custom certificate (including complete certificate chain)<span style="font-size:10.0pt;font-family:"Courier New""><br>
</span> mv YOUR-3RD-PARTY-CA-CERT.pem /etc/pki/ovirt-engine/apache-ca.pem<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-family:Arial"> mv YOUR-3RD-PART-CERT.p12 /etc/pki/ovirt-engine/keys/apache.p12<br>
<br>
The above command was missing in original steps, thanks Didi for pointing this out.<br>
<o:p></o:p></span></p>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">4. Extract private key and certificate<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal">openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nocerts -nodes > /etc/pki/ovirt-engine/keys/apache.key.nopass<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">openssl pkcs12 -in /etc/pki/ovirt-engine/keys/apache.p12 -nokeys > /etc/pki/ovirt-engine/certs/apache.cer<o:p></o:p></p>
<div>
<p class="MsoNormal">5. Restart Apache<br>
service httpd restart<br>
<br>
6. Create a new trust store configuration file.<br>
vi /etc/ovirt-engine/engine.conf.d/99-custom-truststore.conf<br>
<br>
Add the following content and save the file.<br>
<br>
ENGINE_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts"<br>
ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD=""<br>
<br>
7. Restart the ovirt-engine service.<br>
systemctl restart ovirt-engine.service<o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-family:Arial">Steps 1., 6. and 7. are new to 4.0, other steps are same as in oVirt 3.x<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-family:Arial">Also it's expected that CA certificate (including whole CA chain) is properly installed in all clients that access oVirt using HTTP and/or Spice.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-family:Arial">Martin Perina<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Oct 27, 2016 at 10:38 PM, Kenneth Bingham <<a href="mailto:w@qrk.us" target="_blank">w@qrk.us</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">That makes sense, but it is also disappointing to realize that oVirt Manager will only trust certificates that itself has issued, and that there is no support for Manager to trust VDSM server certificates issued by another authority.
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If I understand you correctly, then the *only* way to install a VDSM host certificate is by registering with Manager at which time a certificate is automatically issued and installed by Manager's built-in certificate authority.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Oct 27, 2016 at 3:27 PM Ravi Nori <<a href="mailto:rnori@redhat.com" target="_blank">rnori@redhat.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Since you replace ca.pem you need to replace the private key of ca.pem<o:p></o:p></p>
</div>
<p class="MsoNormal">Please copy the private key of /etc/pki/ovirt-engine/ca.pem to /etc/pki/ovirt-engine/private/ca.pem and let me know if everything works<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Oct 27, 2016 at 2:47 PM, Kenneth Bingham <span class="gmail-m2488080285529326609gmail-m-594478028564423228gmailmsg">
<<a href="mailto:w@qrk.us" target="_blank">w@qrk.us</a>></span> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Thanks Ravi, that's helpful and I appreciate the precision and attention to detail. I performed similar steps to install a custom certificate for the oVirt Manager GUI. But what about configuring ovirt-engine to trust a certificate issued
by the same CA and presented by the VDSM host? On the hypervisor host, I used the existing private key to generate the CSR, issued the server certificate, and installed in three locations before bouncing vdsmd.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On the hypervisor Host server (not the Manager/engine server):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">/etc/pki/vdsm/certs/vdsmcert.pem<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">/etc/pki/vdsm/libvirt-spice/server-cert.pem<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">/etc/pki/libvirt/<a href="http://clientcert.pe">clientcert.pe</a>m<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Now, that host is "non responsive" in Manager because ovirt-engine does not trust the new certificate even though I already performed all of the steps that you describe above except that I installed the issuer's CA certificate as the trusted
entity. I've documented all of the steps I took <a href="https://gist.github.com/qrkourier/9c9ac3e8b190dcb91d3767179d5a39ea" target="_blank">
in this Gist</a>.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Oct 27, 2016 at 2:12 PM Ravi Nori <<a href="mailto:rnori@redhat.com" target="_blank">rnori@redhat.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Here is a complete set of instructions that works for me<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">You can skip the first few steps of generating the certificate.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Ravi<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
Generate a self-signed certificate using openssl<br>
======================================<br>
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.pem<br>
<br>
Convert a PEM certificate file and a private key to PKCS#12 (.p12)<br>
=====================================================<br>
openssl pkcs12 -export -out certificate.p12 -inkey privateKey.key -in certificate.pem<br>
<br>
Extract the key from the bundle <br>
=========================<br>
openssl pkcs12 -in certificate.p12 -nocerts -nodes > apache.key.nopass<br>
<br>
Extract the certificate from the bundle<br>
==============================<br>
openssl pkcs12 -in certificate.p12 -nokeys > apache.cer<br>
<br>
Create a new Keystore for testing<br>
==========================<br>
keytool -keystore clientkeystore -genkey -alias client<br>
<br>
Convert .pem to .der<br>
================<br>
openssl x509 -outform der -in certificate.pem -out certificate.der<br>
<br>
Import certificates to keystore<br>
=======================<br>
keytool -import -alias apache -keystore ./clientkeystore -file ./certificate.der<br>
<br>
Create Custom conf for ovirt<br>
======================<br>
vi /etc/ovirt-engine/engine.conf.d/99-custom-truststore.conf<br>
<br>
Set location of truststore and its password<br>
=================================<br>
ENGINE_HTTPS_PKI_TRUST_STORE="/home/rnori/Downloads/Cert/clientkeystore"<br>
ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD="123456"<br>
<br>
Copy the custom certificates<br>
======================<br>
rm /etc/pki/ovirt-engine/apache-ca.pem<br>
cp certificate.pem /etc/pki/ovirt-engine/apache-ca.pem<br>
cp certificate.p12 /etc/pki/ovirt-engine/keys/apache.p12<br>
cp apache.cer /etc/pki/ovirt-engine/certs/apache.cer<br>
cp apache.key.nopass /etc/pki/ovirt-engine/keys/apache.key.nopass<br>
<br>
Restart engine and httpd<br>
===================<br>
service httpd restart<br>
service ovirt-engine restart<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Oct 27, 2016 at 5:30 AM, Nicolas Ecarnot <span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg">
<<a href="mailto:nicolas@ecarnot.net" target="_blank">nicolas@ecarnot.net</a>></span> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal"><span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg">Le 27/10/2016 à 00:14, Kenneth Bingham a écrit :<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">I did install a server certificate from a private CA on the engine<br>
server for the oVirt 4 Manager GUI, but haven't figured out how to<br>
configure engine to trust the same CA which also issued the server<br>
certificate presented by vdsm. This is important for us because this is<br>
the same server certificate presented by the host when using the console<br>
(e.g. websocket console falls silently if the user agent doesn't trust<br>
the console server's certificate).<o:p></o:p></p>
</blockquote>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
Hello,<br>
<br>
Maybe related bug : on an oVirt 4, I followed the same procedure below to install a custom CA, with *SUCCESS*.<br>
<br>
Today, I had to reinstall one of the hosts, and it is failing with :<br>
"CA certificate and CA private key do not match" :<br>
<br>
<a href="http://pastebin.com/9JS05JtJ" target="_blank">http://pastebin.com/9JS05JtJ</a><br>
<br>
Which certificate did we (Kenneth and I) did we mis-used?<br>
What did we do wrong?<br>
<br>
Regards,<br>
<br>
Nicolas ECARNOT<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg">On Wed, Oct 26, 2016, 16:58 Beckman, Daniel</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"><<a href="mailto:Daniel.Beckman@ingramcontent.com" target="_blank">Daniel.Beckman@ingramcontent.com</a></span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"><mailto:<a href="mailto:Daniel.Beckman@ingramcontent.com" target="_blank">Daniel.Beckman@ingramcontent.com</a>>> wrote:</span><br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> We have oVirt 3.6.7 and I am preparing to upgrade to 4.0.4 release.</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> I read the release notes (<a href="https://www.ovirt.org/release/4.0.4/" target="_blank">https://www.ovirt.org/release/4.0.4/</a>)
and</span><br>
noted comment #4 under “Install / Upgrade from previous version”:____<br>
<br>
__ __<br>
<br>
/If you are using HTTPS certificate signed by custom certificate<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> authority, please take a look at
<a href="https://bugzilla.redhat.com/1336838" target="_blank">https://bugzilla.redhat.com/1336838</a></span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> for steps which need to be done after migration to 4.0. Also please</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> consult
<a href="https://bugzilla.redhat.com/1313379" target="_blank">https://bugzilla.redhat.com/1313379</a> how to setup this custom</span><br>
CA for use with virt-viewer clients.____/<br>
<br>
/__ __/<br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> So I referred to the first bugzilla</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> (<a href="https://bugzilla.redhat.com/show_bug.cgi?id=1336838" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1336838</a>),
where it</span><br>
states as follows:____<br>
<br>
__ __<br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> If customer wants to use custom HTTPS certificate signed by</span><br>
different CA, then he has to perform following steps: ____<br>
<br>
__ __<br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> 1. Install custom CA (that signed HTTPS certificate) into host wide</span><br>
trustore (more info can be found in update-ca-trust man page) ____<br>
<br>
__ __<br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> 2. Configure HTTPS certificate in Apache (this step is same as in</span><br>
previous versions) ____<br>
<br>
__ __<br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> 3. Create new configuration file (for example</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> /etc/ovirt-engine/engine.conf.d/99-custom-truststore.conf) with</span><br>
following content: ____<br>
<br>
ENGINE_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts"<br>
ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD="" ____<br>
<br>
__ __<br>
<br>
4. Restart ovirt-engine service____<br>
<br>
__ __<br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> I find it humorous that step # 1 suggests reading the “man page”</span><br>
which is only slightly better than suggesting to “google” it. ____<br>
<br>
__ __<br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> Has anyone using a custom CA for their HTTPS certificate</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> successfully upgraded to oVirt 4? If so could you share your</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> detailed steps? Or can anyone point me to an actual example of this</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"> procedure? I’m a little nervous about the upgrade if you can’t</span><br>
already tell. ____<br>
<br>
__ __<br>
<br>
Thanks,____<br>
<br>
Daniel____<br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto:<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a>><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br>
<br>
<br>
<br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg">_______________________________________________</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg">Users mailing list</span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"><a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a></span><br>
<span class="gmail-m2488080285529326609gmail-m-594478028564423228m7440200668888794961m2611409000370850777m-980879755636344940gmailmsg"><a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a></span><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span style="color:#888888"><br>
<br>
<span class="gmail-m2488080285529326609gmail-hoenzb">-- </span><br>
<span class="gmail-m2488080285529326609gmail-hoenzb">Nicolas ECARNOT </span></span><span class="gmail-m2488080285529326609gmail-hoenzb"><span style="color:#888888"><o:p></o:p></span></span></p>
<div>
<div>
<p class="MsoNormal"><span style="color:#888888"><br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a></span><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</blockquote>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>