mgradm upgrade podman asking for Server CA password

[achotsimple]

Good morning, after having updated to a custom SSL certificate in my server successfully, and previously not having had this issue, suddenly my mgradm upgrade podman is asking for the current server CA password. What would cause this? I'm not sure where to look. The server itself is running fine, but the upgrade process can't complete.

[aaannz]

Is this an upgrade to the separate database container? From which version are you upgrading?

[achotsimple]

I am currently on version 5.0.5 of SUMA, looking to upgrade to 5.1. It looks like the 5.0 -> 5.1 upgrade introduces a separate database container.

[aaannz]

So that is the reason. Database also uses it's own certificate.
The logic currently tests server and database containers independently so even if server uses 3rd party certificate, when migration detects database cert is missing and no 3rd party cert is provided, it tries to generate it.

As you are using custom SSL certificates, fix is to add --ssl-db-cert and --ssl-db-key options with values pointing to the database certificate.
Either create new certificate (remember to use SAN db and SAN reportdb) or if your server cert has those SANs, you can use that too.

[achotsimple]

As with all things, managed to get back burnered and back to it today. I notice the message is slightly different when I gave it a shot today: Password for the CA key to generate:

That made more sense to me. However the mgradm_config.yml entry for a password for the CA not being read in adds to the confusion. I am sure this means that there are additional options I can add to that for the db container and will need to review the docs to see what that looks like. Thank you for the reply and sorry it took me so long to get back to.

[achotsimple]

One last question regarding this. Is it recommended to have two different certs? Does it matter one way or the other? If I use an updated cert with those SANs on it, can I specify the locations in the mgradm_config file? Or do I always need to specify the options?

[achotsimple]

One additional thing, the root ca and any intermediates must be specified as well during the upgrade. For my particular system I used the same cert for my db as for my initial 5.0 container with additional SANs. It should be noted that the paths in use reference the host system. I will end up trying one more upgrade with a separate certificate so that I don't change my salt CA. Thanks for the help along the way here. The entire command for my upgrade looked like:

mgradm upgrade podman --ssl-db-ca-root=/path/to/root_ca --ssl-db-ca-intermediate=/path/to/intermediate_ca --ssl-db-cert=/path/to/db_cert --ssl-db-key=/path/to/db_key