Auto-detect and normalize installer certificates by ehelms · Pull Request #421 · theforeman/foremanctl

ehelms · 2026-03-25T16:16:56Z

Summary

Users upgrading from foreman-installer need their existing certificates to continue working.
Previously, foremanctl required --certificate-source=installer and maintained separate
variable paths pointing to /root/ssl-build/, meaning it could read installer certificates
but not manage their lifecycle — no issuing new certificates using the existing CA, and no
path to dropping katello-certs-tools.

This PR embeds migration of the installer certificates into the standard location of the default certificates. When foremanctl migrate run it will move certificates at /root/ssl-build/, it copies them into
/root/certificates/, backs up the original, and manages them natively using OpenSSL.

Changes

Test plan

[ ]

evgeni · 2026-04-17T12:06:33Z

@ehelms could you please rebase this one

evgeni · 2026-04-20T07:55:43Z


- name: 'Issue other certificates'
+- name: Issue host certificates
  ansible.builtin.include_tasks: issue.yml


This fails for "installer" certs, as the CA password is not properly loaded.

OTOH, I don't see why it would re-generate the installer issued certs to begin with.

evgeni · 2026-04-20T07:56:46Z

+  ansible.builtin.file:
+    path: "{{ certificates_ca_directory_keys }}"
+    state: directory
+    mode: '0755'


the keys really should not be world readable

evgeni · 2026-04-20T08:32:29Z

certs-check is right, /root/certificates/certs/quadlet.example.com.crt is signed by Foreman Self-signed CA, not by Custom Test CA - but why?!

"TASK [certificates : Sign server certificate] **********************************" did re-sign the cert, it really should not for "custom" certs, those can't be managed by us.

evgeni · 2026-04-21T05:55:44Z

  ansible.builtin.include_tasks: ca.yml
-  when: certificates_ca
+  when:
+    - certificates_ca


At this point, will that ever be false?

evgeni · 2026-04-21T05:57:22Z

-  when: certificates_ca
+  when:
+    - certificates_ca
+    - not certificates_installer_ca.stat.exists


normalize.yml deletes /root/ssl-build/katello-default-ca.crt after execution, so on the next run of the role not certificates_installer_ca.stat.exists will be true and ca.yml will run -- is that intentional?

yepp, ran into this in https://github.com/theforeman/foremanctl/actions/runs/24706818357/job/72261872791?pr=421

evgeni · 2026-04-21T06:05:12Z

    - "../../vars/defaults.yml"
    - "../../vars/flavors/{{ flavor }}.yml"
-    - "../../vars/{{ certificate_source }}_certificates.yml"
+    - "../../vars/default_certificates.yml"


arguably, this file now should be just certificates.yml, right?

evgeni · 2026-04-21T08:00:40Z

The more I think about it, the more I think normalize should be part of the "one time migration from old installer" (as started in #446), not a thing that "continuously" runs as I think copying files is not sufficient for that step. We need to at least also make foremanctl aware of the passphrase of the CA (I hacked that up with slurp now, but I hate it) and ideally also import the old CA properties so that it does not get regenerated on follow up runs.

and the custom cert setup is a nice addition, but is also valuable outside the normalize flow, so IMHO this PR should be two?

ehelms · 2026-04-21T13:45:15Z

I agree I can now pull out the custom certificates to their own PR. And that, installer certificates via migration handling makes more sense as a one time operation.

Do you generally agree on the direction of installer certs support? That is should be "converted" so foremanctl manages it like our default ones?

ehelms · 2026-04-21T18:57:29Z

Custom certificate handling now exists at: #462
This will need to be incorporated into the migrate command once that's available. Setting this to draft for now as it will require re-work once those two conditions are met.

evgeni · 2026-04-22T06:50:34Z

Do you generally agree on the direction of installer certs support? That is should be "converted" so foremanctl manages it like our default ones?

Yes, as the setup (well, at the very least the CA) need to be fully usable in foremanctl to deploy new proxies etc.

The default and custom_server certificate vars files defined identical paths since custom certificates are normalized into the same directory structure during deployment. Remove the vars file indirection and use a single certificates.yml for all certificate sources. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add a dedicated CI job that exercises the foremanctl migrate workflow: install foreman-installer to create a realistic environment with an answer file and certificates, run foremanctl migrate to convert the answer file to foremanctl parameters, then deploy and test the result. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Move foreman-installer certificate normalization into the migrate subcommand so it runs once during migration rather than on every deploy. The migrate_certificates role copies certs from /root/ssl-build/ into /root/certificates/, persists the CA passphrase into parameters.yaml, and backs up the original directory. Detect custom server certificates by comparing the internal CA with the server CA. When they differ, persist certificates_source: custom_server to prevent subsequent deploys from overwriting the custom server cert. Remove the installer certificate source since migrated certs use the default source paths after normalization. Mark certificate path parameters as IGNORE in the answer file migration since the role handles cert files directly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

pr-processor Bot added the Not yet reviewed label Mar 25, 2026

ehelms force-pushed the installer-certificates-management branch 5 times, most recently from 252977b to 28bad69 Compare March 30, 2026 18:53

ehelms mentioned this pull request Apr 1, 2026

Generate certificate bundle #90

Open

ehelms force-pushed the installer-certificates-management branch from 28bad69 to da1cd29 Compare April 1, 2026 15:42

ehelms mentioned this pull request Apr 14, 2026

Use community.crypto for the certificates role #441

Merged

ehelms force-pushed the installer-certificates-management branch 2 times, most recently from e96db39 to 5d8e7a7 Compare April 17, 2026 20:09

evgeni reviewed Apr 20, 2026

View reviewed changes

pr-processor Bot removed the Not yet reviewed label Apr 20, 2026

evgeni reviewed Apr 20, 2026

View reviewed changes

evgeni force-pushed the installer-certificates-management branch 2 times, most recently from 552ddf4 to 5d317ef Compare April 20, 2026 15:06

evgeni reviewed Apr 21, 2026

View reviewed changes

evgeni force-pushed the installer-certificates-management branch 2 times, most recently from a7444fc to dfde810 Compare April 21, 2026 07:53

ehelms mentioned this pull request Apr 21, 2026

Add certs expiry params #456

Merged

2 tasks

evgeni mentioned this pull request Apr 21, 2026

Add migration subcommand #446

Merged

ehelms marked this pull request as draft April 21, 2026 18:56

evgeni mentioned this pull request Apr 22, 2026

Add custom server certificate support #462

Merged

2 tasks

ehelms force-pushed the installer-certificates-management branch from dfde810 to 93f61e8 Compare April 27, 2026 13:14

ehelms force-pushed the installer-certificates-management branch from 93f61e8 to 0807995 Compare May 5, 2026 20:21

ehelms marked this pull request as ready for review May 5, 2026 20:22

ehelms and others added 3 commits May 6, 2026 17:02

ehelms force-pushed the installer-certificates-management branch from 0807995 to b14f1a8 Compare May 7, 2026 01:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Auto-detect and normalize installer certificates#421

Auto-detect and normalize installer certificates#421
ehelms wants to merge 3 commits intotheforeman:masterfrom
ehelms:installer-certificates-management

ehelms commented Mar 25, 2026 •

edited

Loading

Uh oh!

evgeni commented Apr 17, 2026

Uh oh!

evgeni Apr 20, 2026

Uh oh!

evgeni Apr 20, 2026

Uh oh!

evgeni commented Apr 20, 2026 •

edited

Loading

Uh oh!

evgeni Apr 21, 2026

Uh oh!

evgeni Apr 21, 2026

Uh oh!

evgeni Apr 21, 2026

Uh oh!

evgeni Apr 21, 2026

Uh oh!

evgeni commented Apr 21, 2026 •

edited

Loading

Uh oh!

ehelms commented Apr 21, 2026

Uh oh!

ehelms commented Apr 21, 2026

Uh oh!

evgeni commented Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ehelms commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

Uh oh!

evgeni commented Apr 17, 2026

Uh oh!

evgeni Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

evgeni Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

evgeni commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

evgeni Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

evgeni Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

evgeni Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

evgeni Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

evgeni commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ehelms commented Apr 21, 2026

Uh oh!

ehelms commented Apr 21, 2026

Uh oh!

evgeni commented Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ehelms commented Mar 25, 2026 •

edited

Loading

evgeni commented Apr 20, 2026 •

edited

Loading

evgeni commented Apr 21, 2026 •

edited

Loading