repo sync breaks in uyuni for rhel 7 and rhel8 due to certificate issue

[jawahk]

Hi ,
I designed the repo in uyuni for RHEL7 and RHEL8, but it breaks for every 2 days due to certificate error.
error message

2023/09/13 02:49:28 -00:00 Updating overview of 1 systems
2023/09/14 02:47:14 -00:00 Command: ['/usr/bin/spacewalk-repo-sync', '--channel', 'baserhel7', '--type', 'yum', '--non-interactive']
2023/09/14 02:47:14 -00:00 Sync of channel started.
Preparing custom SSL CAPATH at /var/cache/rhn/reposync/.ssl-certs/1
2023/09/14 02:47:16 -00:00 RepoMDError: Cannot access repository.
Repository 'baserhel7' is invalid.
[baserhel7|https://cdn.redhat.com/content/dist/rhel/server/7/7.9/x86_64/os?ssl_capath=/var/cache/rhn/reposync/.ssl-certs/1&ssl_clientcert=/var/cache/rhn/reposync/.ssl-certs/1/Entitlement-Cert-5092023.pem&ssl_clientkey=/var/cache/rhn/reposync/.ssl-certs/1/Entitlement-Key-5092023.pem] Valid metadata not found at specified URL
History:

• [|] Error trying to read from 'https://cdn.redhat.com/content/dist/rhel/server/7/7.9/x86_64/os?ssl_capath=/var/cache/rhn/reposync/.ssl-certs/1&ssl_clientcert=/var/cache/rhn/reposync/.ssl-certs/1/Entitlement-Cert-xxyy.pem&ssl_clientkey=/var/cache/rhn/reposync/.ssl-certs/1/Entitlement-Key-xxyy.pem'
• Permission to access 'https://cdn.redhat.com/content/dist/rhel/server/7/7.9/x86_64/os/content?ssl_capath=/var/cache/rhn/reposync/.ssl-certs/1&ssl_clientcert=/var/cache/rhn/reposync/.ssl-certs/1/Entitlement-Cert-xxyy.pem&ssl_clientkey=/var/cache/rhn/reposync/.ssl-certs/1/Entitlement-Key-xxyy.pem' denied.

Please check if the URIs defined for this repository are pointing to a valid repository.
Skipping repository 'baserhel7' because of the above error.
Could not refresh the repositories because of errors.

is there any permanent fix for this issue, kindly help on it

[juliogonzalez]

but it breaks for every 2 days due to certificate error

That probably means the certificate is expired/revoked. If you are using certificates from a Cloud VM, that usually happens if you destroy such VM, as obviously the certificates are not needed anymore and gets revoked.

[jawahk]

Hi ,
thank you for the answer, but we did not destroy the VM but certificate got changed, any suggestions ?

[juliogonzalez]

Not 100% sure, but maybe happens if the instance is stopped as well. If not, could be Red Hat changed recently something on how the certificates are handled.

Would be good if someone with Red Hat instances can confirm as well.

[mcalmer]

With the next Uyuni version you can use PAYG Client Connection feature to fetch certificates from the instance every 10 Minutes.
This was developed for the cloud, but maybe it works also with an instance connected to the CDN. I expect some changes are required to make it work.
As we have not such an instance, we would need help to adapt the implementation.

[jawahk]

Hello , thank you for the reply.
any tentative for next version to be released ?

[jawahk]

also is there any way we can update redhat subscription in uyuni so that the cert. will fetch automatically ?