Oracle is replacing Symantec-branded certificates with Digicert-branded certificates across all of its infrastructure to prevent trust warnings from Chrome and Firefox.
Due to the nature of how Oracle Linux systems connect to Unbreakable Linux Network (ULN), this change requires that client certificates on all Oracle Linux systems receiving updates from ULN be updated. The change in server certificates on ULN will occur on October 9, 2018. After that time, Oracle Linux systems will only be able to connect to ULN with an updated client certificate.
Please make sure to have following or later version of the packages installed on all the systems that are registered directly to ULN before October 9, 2018:
Note: newer Oracle Linux 8, 9 and 10 are not affected by this issue.
Oracle Linux 7
rhn-client-tools-2.0.2-21.0.9.el7.noarch.rpm
rhn-setup-2.0.2-21.0.9.el7.noarch.rpm
rhn-check-2.0.2-21.0.9.el7.noarch.rpm
rhn-setup-gnome-2.0.2-21.0.9.el7.noarch.rpm (if the older version of this package is installed)
Oracle Linux 6
rhn-setup-1.0.0.1-45.0.3.el6.noarch.rpm
rhn-client-tools-1.0.0.1-45.0.3.el6.noarch.rpm
rhn-check-1.0.0.1-45.0.3.el6.noarch.rpm
rhn-setup-gnome-1.0.0.1-45.0.3.el6.noarch.rpm (if the older version of this package is installed)
Oracle Linux 5
x86_64:
up2date-5.10.1-41.30.el5.x86_64.rpm
up2date-gnome-5.10.1-41.30.el5.x86_64.rpm (if the older version of this package is installed)
i386:
up2date-5.10.1-41.30.el5.i386.rpm
up2date-gnome-5.10.1-41.30.el5.i386.rpm (if the older version of this package is installed)
ia64:
up2date-5.10.1-41.30.el5.ia64.rpm
up2date-gnome-5.10.1-41.30.el5.ia64.rpm (if the older version of this package is installed)
If the above packages are not installed on your registered system before October 9, 2018, you will be unable to connect to ULN and will receive one of the following errors:
The certificate /usr/share/rhn/ULN-CA-CERT is expired. Please ensure you
have the correct certificate and your system time is correct.
OR
There was an SSL error: [('SSL routines', 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')]
A common cause of this error is the system time being incorrect. Verify that the time on this system is correct.
After October 9, 2018 client SSL certificate need to be replaced manually. To manually replace the client SSL certificate on an Oracle Linux machine, run the following steps as root on each server:
# cp /usr/share/rhn/ULN-CA-CERT /usr/share/rhn/ULN-CA-CERT.old
# wget https://linux-update.oracle.com/rpms/ULN-CA-CERT.sha2
# cp ULN-CA-CERT.sha2 /usr/share/rhn/ULN-CA-CERT
After this file has been updated you can continue using ULN as normal. After making this manual replacement, connectivity to ULN should be restored. The packages above should then be updated as part of your standard patching cycle. If you have any questions about this update please see the "How can I get help?" section of this document.