Host registration with Red Hat Satellite or Capsule server fails with error curl: (60) SSL certificate problem: unable to get local issuer certificate

Solution Verified - Updated

Environment

  • Red Hat Satellite 6.x
  • Red Hat Capsule 6.x
  • Red Hat Enterprise Linux 8.x client host

Issue

  • Registering a host with a Red Hat Satellite or Capsule server fails with error:

      # set -o pipefail && curl -sS  'https://satellite.example.com:9090/register?activation_keys=ak-rhel8-test&hostgroup_id=1&location_id=2&operatingsystem_id=3&organization_id=1&update_packages=false' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjo0LCJpYXQiOjE3NTY5NzgyMzYsImp0aSI6IjUzZTk5MTIwOWU1MzFkYTk2ZjhiOGFhMzk5OTk3NzUzN2NhNWQ2YjY1NTJlOTEzYTA0OGJjYmI4MjE5Y2ZhODQiLCJzY29wZSI6InJlZ2lzdHJhdGlvbiNnbG9iYWwgcmVnaXN0cmF0aW9uI2hvc3QifQ.yrL7si9xtn7aG-5GOetFucokybinxBGStt3czskP7kM' | bash
  curl: (60) SSL certificate problem: unable to get local issuer certificate
  More details here: https://curl.haxx.se/docs/sslcerts.html

  curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Resolution

  1. Apply the steps in the Diagnostic Steps section below.

  2. Follow the procedure to generate the curl command are documented in 4.3.3. Registering a host, making sure that the 'insecure' checkbox is checked.

  3. Run the command generated in step (1) on the client host to register it.

For more KB articles/solutions related to Red Hat Satellite 6.x Client Host Registration Issues, please refer to the Consolidated Troubleshooting Article for Red Hat Satellite 6.x Host Registration Issues.

Root Cause

If the target machine (Satellite or Capsule server) does not trust the host SSL certificate. Therefore, the initial connection could be subject to a man-in-the-middle attack. If you accept the risk and do not require the server authenticity to be verified, you can enable the insecure argument for the initial curl. Note that all subsequent communication is then properly secured, because the initial request deploys the SSL certificate for the rest of the registration process.

Diagnostic Steps

  1. Verify that the curl command to register the client host was generated with the fully qualified domain name (FQDN) and not the IP address of the Satellite server.

  2. If the curl command contains the IP address of the Satellite server instead of its FQDN, then refer to Host registration with Red Hat Satellite fails with error curl: (60) SSL certificate problem: unable to get local issuer certificate. Otherwise, proceed with the steps in the Resolution section above.

SBR
Product(s)
Category

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.