Re: [ovirt-devel] Re: how to UI/API certificates with a valid one (ex: let's encrypt) ? ( as open shift required one )
9:56 a.m.
Hello,
I too have a problem using custom cert with OCP provisioning on oVirt
I followed the following documentation to update the default cert with my
letsencrypt one :
https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/...
This documentation is similar to the one linked by Yedidyah Bar David :
https://www.ovirt.org/documentation/administration_guide/index.html#appe-...
After following these steps, I can verify in my browser that the engine is
now behind the new custom certificate from letsencrypt.
However, the old certificate is still served by the url :
https://engine.fqdn/ovirt-engine/services/pki-resource?resource=ca-certif...
When running openshift-install create install-config, the certificate that
is automaticlly retrived from engine.fqdn:443 is the old one, not the new
custom one.
Are there missing steps in the above procedures?
Best,
Guillaume Pavese
Ingénieur Système et Réseau
Interactiv-Group
On Tue, Jan 25, 2022 at 1:57 AM Sandro Bonazzola <sbonazzo(a)redhat.com>
wrote:
Il giorno dom 23 gen 2022 alle ore 08:15 Eric Tiquet <
eric.tiquet(a)gmail.com> ha scritto:
> Hello community,
> Would like to use ovirt & openshift, a this might be trivial but I am
> juste blocked at 'step two'.
> (As openshift refuse to use the ovirt without valid certificates and the
> insecure workaround does'not work)
>
> I can't find any usefull information to setup the UI/API certificates. (
> ex: there is no apache...)
> Could someone please point me to the correct tuto's or instruction ?
>
This is the development mailing list. For looking for help on oVirt, I
recommend asking on user mailing list instead:
https://lists.ovirt.org/archives/list/users@ovirt.org/ .
I assume you are following
https://docs.okd.io/4.9/installing/installing_rhv/installing-rhv-default....
If the documentation there is not clear enough, I would recommend opening
an issue on https://github.com/openshift/openshift-docs/issues or
discussing it on https://github.com/openshift/okd/discussions
>
> With kind regards,
> Eric
> _______________________________________________
> Devel mailing list -- devel(a)ovirt.org
> To unsubscribe send an email to devel-leave(a)ovirt.org
> Privacy Statement: https://www.ovirt.org/privacy-policy.html
> oVirt Code of Conduct:
> https://www.ovirt.org/community/about/community-guidelines/
> List Archives:
>
https://lists.ovirt.org/archives/list/devel@ovirt.org/message/A6S264FUJVU...
>
--
Sandro Bonazzola
MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV
Red Hat EMEA <https://www.redhat.com/>
sbonazzo(a)redhat.com
<https://www.redhat.com/>
*Red Hat respects your work life balance. Therefore there is no need to
answer this email out of your office hours.*
_______________________________________________
Devel mailing list -- devel(a)ovirt.org
To unsubscribe send an email to devel-leave(a)ovirt.org
Privacy Statement: https://www.ovirt.org/privacy-policy.html
oVirt Code of Conduct:
https://www.ovirt.org/community/about/community-guidelines/
List Archives:
https://lists.ovirt.org/archives/list/devel@ovirt.org/message/Y4XAESPURFI...
--
Ce message et toutes les pièces jointes (ci-après le “message”) sont
établis à l’intention exclusive de ses destinataires et sont confidentiels.
Si vous recevez ce message par erreur, merci de le détruire et d’en avertir
immédiatement l’expéditeur. Toute utilisation de ce message non conforme a
sa destination, toute diffusion ou toute publication, totale ou partielle,
est interdite, sauf autorisation expresse. L’internet ne permettant pas
d’assurer l’intégrité de ce message . Interactiv-group (et ses filiales)
décline(nt) toute responsabilité au titre de ce message, dans l’hypothèse
ou il aurait été modifié. IT, ES, UK.
<https://interactiv-group.com/disclaimer.html>
11:09 a.m.
New subject: [ovirt-devel] Re: how to UI/API certificates with a valid one (ex: let's encrypt) ? ( as open shift required one )
On Wed, Jan 26, 2022 at 8:56 AM Guillaume Pavese <
guillaume.pavese(a)interactiv-group.com> wrote:
Hello,
I too have a problem using custom cert with OCP provisioning on oVirt
Adding Evgeny and Janos for this.
I followed the following documentation to update the default cert with my
letsencrypt one :
https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/...
This documentation is similar to the one linked by Yedidyah Bar David :
https://www.ovirt.org/documentation/administration_guide/index.html#appe-...
After following these steps, I can verify in my browser that the engine is
now behind the new custom certificate from letsencrypt.
However, the old certificate is still served by the url :
https://engine.fqdn/ovirt-engine/services/pki-resource?resource=ca-certif...
Indeed - that's intentional. This certificate is still in use, internally.
When running openshift-install create install-config, the certificate that
is automaticlly retrived from engine.fqdn:443 is the old one, not the new
custom one.
Are there missing steps in the above procedures?
Not sure how OCP on oVirt does this, but it should not use the above URL.
For doing this safely, it should either use out-of-band means, or let the
user supply the cert(s). If safety is not an issue, you should be able to
get the certs right off the SSL connection, e.g. with 's_client
--showcerts',
e.g.:
https://stackoverflow.com/questions/7885785/using-openssl-to-get-the-cert...
Good luck and best regards,
--
Didi
1028
days inactive
1028
days old
1 comments
2 participants
participants (2)
-
Guillaume Pavese -
Yedidyah Bar David