On 5/2/23 19:27, michael.d1.holt(a)lmco.com wrote:
ovirt 4.4.10.x, using self signed certificates with a self hosted
engine. apache certs expired, renewed manually via guides provided by RHEL and oVirt using
the pki_enroll_pkcs12.sh script. Engine certs are also expired and cannot update certs via
gui and no option to renew the certs when running using engine-setup --offline. The error
I am getting is a VDSM certificate error on the hosted engine in the engine.log file. I
have attempted to manually run the pki_enroll_pkcs12.sh script with "engine" in
the name and the subject of the previous engine.cer file with no luck. I copied the p12,
key and cert from that attempt into the engine.cer, engine.p12 and engine_id_rsa files,
but when booting the hosted engine VM, the first error in the engine.log is "VDC
cannot find the engine certificate". This also breaks my access to the web interface
for oVirt administration. When the expired engine certs are restored, I have GUI access
but still see the VDSM errors on the ovirt-engine. That I hav
e web access with the expired engine certs indicate to me that the apache certificates
are correct (but i could be wrong in that evaluation).
Basically i am looking for a way to either force the enroll pki option in the
engine-setup --offline script or manually generate and update the engine.cer, engine.p12
(and if needed, but i couldn't determine where it was used) the engine_id_rsa key.
I just did 'engine-setup --offline' on my install which also had its
cert expired en it renewed it and problem gone.
Joop