Re: [ovirt-users] Error during hosted-engine-setup for 3.5.1 on F20 (Cannot add the host to cluster ... SSH has failed)

----- Original Message ----- This is another things: having the user explicitly trusting the CA cert by manually and explicitly checking its fingerprint on both the host is the right solution but is more invasive and a lot of user is already complaining that hosted-engine involves to many steps. No, I didn't said that I trust the network to be secure cause it's a local network. I said another thing, please read it carefully and follow me: 1. in order to trust an https connection you need to trust the CA that signed the cert that the engine host is using. 2. that CA is by default a private CA and so it has just been created on engine VM, so you don't have the CA cert on the host 3. so, to trust the https connection, you need to have/download the CA cert from the engine VM to the host 4. if you just download engine CA via http (https is not more secure at this point cause you are still trusting everything cause you don't have the CA cert) you just moved the issue instead of solving it So the issue is that the CA cert should reach the host in secure way otherwise you are in the same situation: somebody could provide a tampered CA cert and make you trusting a tampered https connection. It's just false security: it simply adds complexity without adding real security. I would be different if we ask to the user to copy and paste the engine CA cert by himself or at least to validate its fingerprint, without that step its really the same.