Installing the SUSE Manager CA certificate

By default, the importer binary suse_manager_import validates the SUSE Manager server certificate. The remote server certificate is self-signed, therefore there is no CA bundled with the SA OSPWopenssl component. To enable access for suse_manager_import to SUSE Manager server, you must install the self-signed server certificate in the OSPWopenssl trust store.

To install SUSE Manager CA certificate:

1. Download the self-signed certificate from SUSE Manager.
   1. Install the self-signed certificate in the SA trust store.
2. Verify if OPSWopenssl is validating the server certificate.

Downloading the self-signed certificate from SUSE Manger

The self-signed certificate is made public by SUSE Manager at /pub/RHN-ORG-TRUSTED-SSL-CERT. Run the following command to download the certificate file:

wget -O /tmp/RHN-ORG-TRUSTED-SSL-CERT http://suse.manager.hostname/pub/RHN-ORG-TRUSTED-SSL-CERT

If you need proxy access to SUSE Manager server, you can export the http_proxy environment variable and the wget command will use the exported value.

Installing the self-signed certificate in SA trust store

1. Open the downloaded file, copy the following text appearing at the end of the file:

   -----BEGIN CERTIFICATE-----
   MIIE4TCCA8mgAwIBAgIJANwa5OFPkBHHMA0GCSqGSIb3DQEBCwUAMIGGMQswCQYD
   haXhmbq+5pEkpxGAactW+tORsJmpgTdAXeq2rreYtgZ2/vCwdM0iwSVakGNFAvni
   T9lnSVrADcO/S8V/DzcH30RzSpIS44beE23zag82019fCrsZg9VkYJER4Fn0tRq4
   6U9I4OgBSPSU34MXclGld0BAN+mANWHQYacZ7hHQJtMRP+mc8ZgHIvsKNnKRoHOd
   Rhla7cP7GYrXn/piQAxRW66fOYJOeVIsAWJvgUb+A8ecwb+s6k56cQdLKkm0wKD0
   2zUFMAg=
   -----END CERTIFICATE-----

2. Open the /opt/opsware/openssl/cert.pem file in an editor and paste the copied text at the end of the file.

   The certificate will be installed in the SA trust store. Ensure that the openssl tool verifies the SUSE Manager server certificate.

Verifying that OPSWopenssl is validating the server certificate

After the CA certificate is installed in SA trust store, verify if openssl validates the SUSE Manager certificate before running the importer:

/opt/opsware/bin/openssl s_client -connect suse.manager.hostname:443 -verify 3

If the verification process is successful, the following message will be displayed at the end of the output:

Verify return code: 0 (ok)

If the verification fails, a non-zero value will be returned:

Verify return code: 21 (unable to verify the first certificate)