<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Sat, May 13, 2017 at 2:35 AM, Jamie Lawrence <span dir="ltr"><<a href="mailto:jlawrence@squaretrade.com" target="_blank">jlawrence@squaretrade.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">The key generated by the engine install ended up with a bad CN; it has a five-digit number appended to the host name, and no SAN.<br></blockquote><div><br></div><div>The 5 random digits are supposed to be OK, and are actually a feature - it ensures uniqueness if you re-generate (most likely reinstall your Engine), as otherwise some browsers fail miserably if a CA cert mismatches what they know.</div><div><br></div><div>SAN is being worked on - we are aware of Chrome 58 now requiring it.</div><div>I sincerely hope to see it in 4.1.2 (see <a href="https://bugzilla.redhat.com/1449084">https://bugzilla.redhat.com/1449084</a> ).</div><div>Y.</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
I've lived with this through setup, but now I'm getting close to prod use, and need to clean up so that it is usable for general consumption. And the SPICE HTML client is completely busted due to this; that's a problem because we're mostly MacOS on the client side, and the Mac Spice client is unusable for normal humans.<br>
<br>
I'm wary of attempting to regenerate these manually, as I don't have a handle on how the keysare used by the various components.<br>
<br>
What is the approved method of regenerating these keys?<br>
<br>
-j<br>
______________________________<wbr>_________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/<wbr>mailman/listinfo/users</a><br>
</blockquote></div><br></div></div>