Host registration with Red Hat Satellite fails with error curl: (60) SSL certificate problem: unable to get local issuer certificate

Environment

• Red Hat Satellite 6

Issue

• Error while registering host with Red Hat Satellite:

     [root@Satellite.example.com ~]# set -o pipefail && curl -sS  'https://192.168.xx.xx/register?activation_keys=ak-rhel8-test&hostgroup_id=2&ignore_subman_errors=true&location_id=2&operatingsystem_id=4&organization_id=1&setup_insights=true&setup_remote_execution=true&update_packages=false' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo0LCJpYXQiOjE3MzU2MjY2MzksImp0aSI6ImFiMGEzMThiNmQ4NjJkMmNiN2RkZGVkYjE1OTYyZDJkNGNlZTJjMTU2NTEzMGI4NjMwZmZkNDc2OTRlOTdhZjUiLCJzY29wZSI6InJlZ2lzdHJhdGlvbiNnbG9iYWwgcmVnaXN0cmF0aW9uI2hvc3QifQ.04WZrXaHkC64MfEhHhGT9j2abLvLr1r0JZ_IJSdf0r0' | bash
  curl: (60) SSL certificate problem: unable to get local issuer certificate      <<<<<<<<<<<<<<
  More details here: https://curl.se/docs/sslcerts.html
  
     curl failed to verify the legitimacy of the server and therefore could not
     establish a secure connection to it. To learn more about this situation and
     how to fix it, please visit the web page mentioned above.
  

Resolution

1. Use sed and replace the IP with the FQDN of the Red Hat Satellite before executing the curl via bash:

   set -o pipefail && curl -sS --insecure 'https://192.168.xx.xx/register?activation_keys=ak-rhel8-test&force=true&location_id=2&operatingsystem_id=5&organization_id=1&update_packages=false' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo0LCJpYXQiOjE3MzYxNDc0MTUsImp0aSI6ImUyMzAxZTc3OGMwMDgwOTc5NjczOWFkYTVlMTcwZGI0YzdkNTg0YmI0MjdmMTZlNWJkYTNlOTU2MDMzOThmNGMiLCJleHAiOjE3MzYxNjE4MTUsInNjb3BlIjoicmVnaXN0cmF0aW9uI2dsb2JhbCByZWdpc3RyYXRpb24jaG9zdCJ9.sYCGkV8Jn5aXRfk-WxInaBF5NRQqy3bJgSAg-jkz1pQ' | sed 's/192.168.xx.xx/satellite.example.com/g' | bash
   

2. Run the command in step (1) on the client host to register it.

For more KB articles/solutions related to Red Hat Satellite 6.x Client Host Registration Issues, please refer to the Consolidated Troubleshooting Article for Red Hat Satellite 6.x Host Registration Issues

Root Cause

• A curl command was generated when the Red Hat Satellite WebUI was accessed using its IP address instead of its Fully Qualified Domain Name (FQDN).
• As a consequence, the IP address was placed in the main command by the system. Within that command, another curl call was configured to be executed, by which the same IP address was utilized. The error was subsequently raised by this secondary curl call.

Diagnostic Steps

1. Verify that the curl command to register the client host was generated with the fully qualified domain name (FQDN) and not the IP address of the Satellite server.

2. If the curl command contains the FQDN of the Satellite server instead of its IP address, then you might want to refer to Host registration with Red Hat Satellite or Capsule server fails with error curl: (60) SSL certificate problem: unable to get local issuer certificate. Otherwise, proceed with the steps in the Resolution section above.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.