Red Hat NETWORK SATELLITE SERVER 4.1.0, Installation Manual

Page: 58 / 80

54 Chapter 7. Troubleshooting
To resolve this problem, identify the contents of the
/etc/hosts
file. It may look like
this:
127.0.0.1 this_machine.example.com this_machine localhost.localdomain \
localhost
First, in a text editor, remove the offending machine information, like so:
127.0.0.1 localhost.localdomain.com localhost
Then, save the file and attempt to re-run the RHN client applications or the Apache HTTP
Server. If they still fail, explicitly identify the IP address of the Satellite in the file, such as:
127.0.0.1 localhost.localdomain.com localhost
123.45.67.8 this_machine.example.com this_machine
Replace the value here with the actual IP address of the Satellite. This should resolve the
problem. Keep in mind, if the specific IP address is stipulated, the file will need to be
updated when the machine obtains a new address.
7.4. Connection Errors
A common connection problem, indicated by SSL_CONNECT errors, is the result of a
Satellite being installed on a machine whose time had been improperly set. During the
Satellite installation process, SSL certificates are created with inaccurate times. If the Satel-
lite’s time is then corrected, the certificate start date and time may be set in the future,
making it invalid.
To troubleshoot this, check the date and time on the clients and the Satellite with the fol-
lowing command:
date
The results should be nearly identical for all machines and within the "notBefore" and
"notAfter" validity windows of the certificates. Check the client certificate dates and times
with the following command:
openssl x509 -dates -noout -in /usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT
Check the Satellite server certificate dates and times with the following command:
openssl x509 -dates -noout -in /etc/httpd/conf/ssl.crt/server.crt
By default, the server certificate has a one-year life while client certificates are good for 10
years. If you find the certificates are incorrect, you can either wait for the valid start time,
if possible, or create new certificates, preferably with all system times set to GMT.