Bootstrap to SUSE Manager fails on RHEL6 client due to certificate verification issues

This document (7022888) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Manager 3.1
Red Hat Enterprise Linux 6.x (RHEL6)

Situation

Bootstrap fails with the following errors:

[root@rhel6 ~]# ./bootstrap.sh
SUSE Manager Server Client bootstrap script v4.0
...
Preparing... ########################################### [100%]
1:rhn-org-trusted-ssl-cer########################################### [100%]
update-ca-trust: Warning: The dynamic CA configuration feature is in the disabled state
...
Setting up Install Process
https://suse.manager.tld/pub/repositories/res/6/bootstrap/repodata/repomd.xml: [Errno 14] Peer cert cannot be verified or peer cert invalid
Trying other mirror.
It was impossible to connect to the Red Hat servers.
...
Error: Cannot retrieve repository metadata (repomd.xml) for repository: susemanager:bootstrap. Please verify its path and try again
...

Resolution

Enable the dynamic CA configuration feature before running the bootstrap script:

[root@rhel6 ~]# /usr/bin/update-ca-trust force-enable

Cause

By default, RHEL6 systems disable dynamic CA configuration for security reasons.

The post-install script for the rhn-org-trusted-ssl-cert package installed by the bootstrap script depends on this feature to configure the SUSE Manager CA certificate on the client.

See man 8 update-ca-trust on a RHEL6 system for more info.

Additional Information

This script may be used to check whether this feature is disabled:

[root@rhel6 ~]# /usr/bin/update-ca-trust check |grep "DISABLED" && echo 'Dynamic CA-Trust Updates are disabled. To continue bootstrapping, enable dynamic CA trust updates with "/usr/bin/update-ca-trust force-enable"'

If no output is returned, the feature is already enabled.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.