The document proc-configuring-controller-ldap-security.adoc describes a verification procedure. The openssl x509 -in /etc/pki/tls/certs/bundle-ca.crt -noout -text command used there cannot work this way. According to the deployment, the created secret is mounted in /etc/pki/ca-trust/extracted in the init container:
initContainers:
- name: configure-bundle-ca-cert
image: 'registry.redhat.io/ansible-automation-platform-25/gateway-rhel8@sha256:10c79502d33e6061e5038a66abdf45dcec555b3cc75c60f81935be53bb72cc80'
command:
- /bin/sh
- '-c'
- |
mkdir -p /etc/pki/ca-trust/extracted/{java,pem,openssl,edk2}
update-ca-trust
resources:
requests:
cpu: 50m
memory: 750Mi
volumeMounts:
- name: ca-trust-extracted
mountPath: /etc/pki/ca-trust/extracted
- name: aap-ocppoc-gateway-bundle-cacert
readOnly: true
mountPath: /etc/pki/ca-trust/source/anchors/bundle-ca.crt
subPath: bundle-ca.crt
It is never available in /etc/pki/tls/certs/bundle-ca.crt
Perhaps you should change the verification to openssl x509 -in /etc/pki/ca-trust/source/anchors/bundle-ca.crt -noout -text ?
The document proc-configuring-controller-ldap-security.adoc describes a verification procedure. The
openssl x509 -in /etc/pki/tls/certs/bundle-ca.crt -noout -textcommand used there cannot work this way. According to the deployment, the created secret is mounted in/etc/pki/ca-trust/extractedin the init container:It is never available in
/etc/pki/tls/certs/bundle-ca.crtPerhaps you should change the verification to
openssl x509 -in /etc/pki/ca-trust/source/anchors/bundle-ca.crt -noout -text?