Bootstrap returns Repository 'susemanager:bootstrap' is invalid

This document (7023770) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Manager 3
SUSE Manager 3.1
SUSE Manager 3.2

Situation

Debugging a bootstap process with "sh -x bootstrap.sh" shows

+ echo ' adding client software repository at https://suma3.lab.suse.com/pub/repositories/sle/12/3/bootstrap'
adding client software repository at https://suma3.lab.suse.com/pub/repositories/sle/12/3/bootstrap
+ cat
+ zypper --non-interactive --gpg-auto-import-keys refresh susemanager:bootstrap
Retrieving repository 'susemanager:bootstrap' metadata [.
Download (curl) error for 'https://suma3.lab.suse.com/pub/repositories/sle/12/3/bootstrap/repodata/repomd.xml':
Error code: Curl error 60
Error message: SSL certificate problem: unable to get local issuer certificate

Abort, retry, ignore? [a/r/i/...? shows all options] (a): a
Abort, retry, ignore? [a/r/i/...? shows all options] (a): a
error]
Repository 'susemanager:bootstrap' is invalid.

which is unexpected as the certificate was installed during the bootstap process:

+ rpm -Uvh --force --replacefiles --replacepkgs rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm
Preparing... ########################################
Updating / installing...
rhn-org-trusted-ssl-cert-1.0-1 ########################################
+ rm -f rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm
+ '[' 1 -eq 0 ']'
+ echo

Resolution

On the SUSE Manager Server, make a backup copy of the following directories.

- /etc/pki/trust/anchors/
- /root/ssl-build/

Then create a new rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm with:

rhn-ssl-tool --gen-ca --rpm-only --dir="/root/ssl-build"

/usr/bin/rhn-deploy-ca-cert.pl --source-dir /root/ssl-build \
--target-dir /srv/www/htdocs/pub/ --trust-dir=/etc/pki/trust/anchors/

and restart the services with:

spacewalk-service restart

When finished run the bootstrap.sh script again on the client.

Cause

The rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm used was from a previous version of SUSE Manager. The server was migrated to 3.1 or later.

This rhn-org-trusted-ssl-cert-1.0-1.noarch.rpm did not contain the post installation scripts coming with newer versions of SUSE Manager.

Which creates

a symbolic link in /etc/pki/trust/anchors/ like:

RHN-ORG-TRUSTED-SSL-CERT -> /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT

and executes /usr/sbin/update-ca-certificates to add the certificate as trusted.

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.