Re: Client get "Invalid client certificate error"

On Mon, 2002-07-08 at 21:50, Yiping Zhang wrote:
> John Berninger wrote:
> 
> >Yiping -
> >
> >        The next two things to check would be to make sure rhn_register
> >on the client works properly and has been run (you must register with
> >the Current server), and to check the time differential between the
> >machines.  The clock should be synchronized, or Current and up2date will
> >have issues.
> >  
> >
> Thanks , that worked !
> 
> Somehow, I was under the impression that I needed to run rhn_register 
> against *RedHat*
> rhn server to get a systemid, then copy over my own RHNS-CA-CERT to 
> clients.
> 
> Instead, the correct sequence is to setup the Current server first, 
> generate certificate and copy your own RHNS-CA-CERT to your client 
> machines and then run rhn_register from client against your own Current 
> server.
> 
> I am going back to read current docs again to see how did I get that 
> wrong impression in the first place.

If you locate where you think the doc is unclear, OR that that should
have been written out explicitly, I will correct the docs in the next
patch release.

We treat doc bugs just like code bugs around here.


> 
> :)
> 
> Yiping,
> 
> >On Mon, 08 Jul 2002, Yiping Zhang wrote:
> >
> >  
> >
> >>Hi,
> >>
> >>I just installed current 1.0.5-1 on my server and followed instructions 
> >>in intallation.txt. When I try to run up2date on a client, I always get 
> >>an error saying "Invalid client certificate".
> >>
> >>I am  ABSOLUTELY POSITIVE that :
> >>
> >>1) client's /usr/share/rhn/RHNS-CA-CERT is the one genereated on server 
> >>by "cadmin create-certificate" command.
> >>
> >>2) all port numbers 8080/8081 in /etc/sysconfig/rhn/{rhn_register, 
> >>up2date} on client side matches the port numbers in 
> >>/etc/current/current.conf on the server.  FQDN are used through out and 
> >>during certificate generation.
> >>
> >>3) both current.pem and RHNS-CA-CERT have 600 permissions.
> >>
> >>I have struggled with this for a couple of days now. I appreciate very 
> >>much if anyone can provide some help as to where did I do wrong.
> >>
> >>Thanks
> >>
> >>Yiping
> >>
> >>Question:  I am a bit worried seeing that in server's output, "client 
> >>address" and "127.0.0.1" are in there. Did server think client's address 
> >>is really 127.0.0.1 ???
> >>
> >>Here are the output from both server and client machines.
> >>
> >>On server:
> >>
> >>[root@antibody current]# current -l - -n -v -v -v -v
> >>Jul 08 15:40:45 Current server v1.0.5 starting, released under the GPL
> >>Jul 08 15:40:45 Starting up Backend
> >>Jul 08 15:40:45 Starting Up Frontend
> >>Jul 07 15:40:57 /usr/share/current/standalone.py:do_POST(None)
> >>Jul 08 15:40:57 Requesting: up2date.login
> >>Jul 08 15:40:57 module = up2date
> >>Jul 08 15:40:57 function = login
> >>Jul 08 15:40:57 Dispatching: up2date.login
> >>Jul 07 15:40:57 /usr/share/current/up2date.py:login({'connInfo': 
> >>{'client_address': ('127.0.0.1', 32977),
> >>'command': 'POST', 'version': '', 'headers': <mimetools.Message instance 
> >>at 81a8990>, 'path': 'https://antibody.fudan.net:8081/XMLRPC'}, 
> >>'sysid_string': '<?xml 
> >>version="1.0"?>\012<params>\012<param>\012<value><struct>\012<member>\012<name>type</name>\012<value><string>REAL</string></value>\012</member>\012<member>\012<name>checksum</name>\012<value><string>8d94d6fb5fb5a41f923e3d6f5bfb4c28</string></value>\012</member>\012<member>\012<name>description</name>\012<value><string>Red 
> >>Hat Linux, release 7.2, running on 
> >>i686</string></value>\012</member>\012<member>\012<name>os_release</name>\012<value><string>7.2</string></value>\012</member>\012<member>\012<name>architecture</name>\012<value><string>i686</string></value>\012</member>\012<member>\012<name>system_id</name>\012<value><string>ID-1000999862</string></value>\012</member>\012<member>\012<name>operating_system</name>\012<value><string>Red 
> >>Hat 
> >>Linux</string></value>\012</member>\012<member>\012<name>profile_name</name>\012<value><string>vaccine</string></value>\012</member>\012<member>\012<name>fields</name>\012<value><array><data>\012<value><string>system_id</string></value>\012<value><string>os_release</string></value>\012<value><string>operating_system</string></value>\012<value><string>architecture</string></value>\012<value><string>username</string></value>\012<value><string>type</string></value>\012</data></array></value>\012</member>\012<member>\012<name>username</name>\012<value><string>tester</string></value>\012</member>\012</struct></value>\012</param>\012</params>\012'})
> >>Jul 08 15:40:57 Result is a Fault
> >>Jul 08 15:40:57 sendClientResult() finished
> >>
> >>
> >>
> >>On client:
> >>
> >>[root@vaccine rhn]#
> >>[root@vaccine rhn]# up2date --showall
> >>Traceback (innermost last):
> >>  File "/usr/sbin/up2date", line 996, in ?
> >>    main()
> >>  File "/usr/sbin/up2date", line 271, in main
> >>    up2date.updateLoginInfo()
> >>  File "/usr/share/rhn/up2date_client/up2date.py", line 426, in 
> >>updateLoginInfo
> >>    loginInfo = login()
> >>  File "/usr/share/rhn/up2date_client/up2date.py", line 339, in login
> >>    loginInfo = doCall(server.up2date.login, systemId)
> >>  File "/usr/share/rhn/up2date_client/up2date.py", line 313, in doCall
> >>    raise CommunicationError(e.errmsg)
> >>up2date_client.up2date.CommunicationError: Error communicating with 
> >>server.  The message was:
> >>Invalid client certificate.
> >>[root@vaccine rhn]#
> >>
> >>
> >>_______________________________________________
> >>Current-server mailing list
> >>[email protected]
> >>http://lists.dulug.duke.edu/mailman/listinfo/current-server
> >>    
> >>
> >
> >  
> >
> 
> 
-- 
Hunter Matthews                          Unix / Network Administrator
Office: BioScience 145/244               Duke Univ. Biology Department
Key: F0F88438 / FFB5 34C0 B350 99A4 BB02  9779 A5DB 8B09 F0F8 8438
Never take candy from strangers. Especially on the internet.