Skip to content

Import self-signed certificates during registration#3055

Merged
imobachgs merged 21 commits intomasterfrom
import-ssl-certs
Jan 21, 2026
Merged

Import self-signed certificates during registration#3055
imobachgs merged 21 commits intomasterfrom
import-ssl-certs

Conversation

@imobachgs
Copy link
Copy Markdown
Contributor

@imobachgs imobachgs commented Jan 21, 2026 •
edited
Loading

Problem

It is not possible to register the system with a registration server that uses a self-signed certificate.

Solution

Introduce a new agama-security service which should take care of handling security-related tasks. At this point it only implements two actions:

  • CheckCertificate: asks the user whether to trust a certificate. If the user accepts, imports the certificate.
  • Finish: copies the imported certificates to the installed system.

Testing

  • Added a new unit test
  • Tested manually

Screenshots

Asking to import a certificate Captura desde 2026-01-21 10-35-00

Follow-up

  • Fix several problems in the registration UI.
  • Use agama-security to import GPG keys.

@imobachgs
Do not insist on registering the system when it failed
c8c7a50
@imobachgs
RegistrationBuilder::register does not consume the builder
026b95a
@imobachgs
Handle SSL problems when registering a system
9d2290b
@imobachgs
Add ca-certificates as dependency
0f26a22 
* It is needed to import the registration certificates.
@imobachgs
Do not use async/await in the zypp_server module
91b12cf
@imobachgs
Reload certificates after importing them
b0f9d20
@imobachgs
Add a new agama-security package
ddb6b83
@imobachgs
Add a minimal security service to keep the fingerprints
c0dc10b
@imobachgs
Extend the security service to check certificates
a330c62
@imobachgs
Delegate registration certificate checks to the security service
5103278
@imobachgs
Add tests for the agama-security
3a02acc
@imobachgs
Reset the list of trusted certificates
5d58d1b
@imobachgs
Fix deserializing of fingerprints
ea07ac5
@imobachgs
Make sure fingerprint is always normalized
e08bbf2
@imobachgs
Add a Finish action to the security service
5f7b4d5 
* It copies the certificates to the target system.
@imobachgs
Adapt the registration certificate question
baf2a42
@imobachgs
Add some documentation
6c28a4e
@imobachgs
Fix RegistrationCertificateQuestion test
7b64a61
@imobachgs
Update changes files
e1f8346
@imobachgs
Merge branch 'master' into import-ssl-certs
1d36ae2
jreidinger
jreidinger reviewed Jan 21, 2026
View reviewed changes
jreidinger
jreidinger reviewed Jan 21, 2026
View reviewed changes
@imobachgs imobachgs merged commit d879585 into master Jan 21, 2026
17 checks passed
@imobachgs imobachgs deleted the import-ssl-certs branch January 21, 2026 13:13
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this pull request Jan 26, 2026
@bmwiedemann
Update agama-web-ui to version 0 / rev 32 via SR 1328665
513caac 
https://build.opensuse.org/request/show/1328665
by user IGonzalezSosa + anag_factory
- Adapt to the changes in the question about trusting
  certificates from the registration (gh#agama-project/agama#3055).

- Update look&feel of some pages to make them match the new style
  (gh#agama-project/agama#3050).

- Avoid flicker on the product selection page by deferring the
  display of current product information
  (gh#agama-project/agama#3049).

- Internal fix to prevent warnings (not visible for users) in the
  product selection form (gh#agama-project/agama#3048).

- Fix query refetch (gh#agama-project/agama#3044).

- Avoid flickering on the overview page by stabilizing progress
  updates (gh#agama-project/agama#3042).

- Enhance product selection page (gh#agama-project/agama#3039):
  - Keep the selected product’s radio button checked after
    interacting with other controls.
bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this pull request Jan 28, 2026
@bmwiedemann
Update agama to version 0 / rev 33 via SR 1329457
9349923 
https://build.opensuse.org/request/show/1329457
by user IGonzalezSosa + anag_factory
- Fixed removing automatically selected recommended patterns
  (gh#agama-project/agama#3072)

- Follow suit, do not package /usr/share/locale itself
  (gh#agama-project/agama#3071).

- Copy the SCC credentials and the libzypp services
  (gh#agama-project/agama#3053).

- Use the right architecture when regisrering a system in ppc64le
  (gh#agama-project/agama#3068).

- Consider inst.register_url as part of the "extended configuration"
  (bsc#1256907).
- Try to register the system even if only a registration URL was
  specified (without a code).
- When the registration fails, retry it on the next SetConfig call.

- Allow importing SSL certificates from registration servers
  (gh#agama-project/agama#3055).

- Fix enabling NetworkManager service in the target system
  (gh#agama-project/agam
@imobachgs imobachgs mentioned this pull request Mar 17, 2026
Merged
imobachgs added a commit that referenced this pull request Mar 17, 2026
@imobachgs
Release version 19 (#3292)
e4e1132 
Prepare to release version 19.

* #1829
* #2508
* #2772
* #2818
* #2826
* #2848
* #2860
* #2863
* #2864
* #2866
* #2867
* #2869
* #2870
* #2871
* #2872
* #2873
* #2874
* #2875
* #2876
* #2877
* #2880
* #2881
* #2882
* #2884
* #2885
* #2886
* #2891
* #2892
* #2893
* #2894
* #2895
* #2896
* #2897
* #2898
* #2899
* #2900
* #2901
* #2902
* #2903
* #2904
* #2908
* #2909
* #2910
* #2912
* #2913
* #2914
* #2915
* #2916
* #2917
* #2918
* #2920
* #2921
* #2923
* #2924
* #2926
* #2928
* #2929
* #2930
* #2933
* #2934
* #2935
* #2936
* #2937
* #2938
* #2939
* #2942
* #2943
* #2944
* #2945
* #2946
* #2947
* #2948
* #2949
* #2950
* #2951
* #2952
* #2954
* #2955
* #2956
* #2957
* #2958
* #2959
* #2960
* #2961
* #2963
* #2964
* #2965
* #2967
* #2968
* #2969
* #2970
* #2971
* #2972
* #2974
* #2975
* #2977
* #2978
* #2980
* #2981
* #2982
* #2983
* #2984
* #2988
* #2989
* #2990
* #2991
* #2992
* #2993
* #2994
* #2995
* #2996
* #2997
* #2998
* #2999
* #3000
* #3001
* #3002
* #3004
* #3005
* #3006
* #3007
* #3008
* #3009
* #3011
* #3012
* #3013
* #3014
* #3015
* #3016
* #3018
* #3019
* #3020
* #3021
* #3022
* #3023
* #3024
* #3025
* #3026
* #3027
* #3028
* #3029
* #3030
* #3031
* #3033
* #3034
* #3035
* #3036
* #3037
* #3039
* #3040
* #3041
* #3042
* #3043
* #3044
* #3045
* #3046
* #3047
* #3048
* #3049
* #3050
* #3051
* #3052
* #3053
* #3054
* #3055
* #3056
* #3057
* #3058
* #3060
* #3061
* #3062
* #3063
* #3064
* #3065
* #3066
* #3067
* #3068
* #3069
* #3070
* #3071
* #3072
* #3073
* #3074
* #3075
* #3076
* #3077
* #3078
* #3079
* #3086
* #3087
* #3088
* #3089
* #3090
* #3091
* #3092
* #3093
* #3094
* #3095
* #3096
* #3097
* #3098
* #3099
* #3100
* #3101
* #3102
* #3103
* #3104
* #3105
* #3106
* #3107
* #3108
* #3109
* #3110
* #3112
* #3113
* #3114
* #3115
* #3116
* #3117
* #3118
* #3119
* #3120
* #3122
* #3123
* #3124
* #3127
* #3128
* #3129
* #3130
* #3131
* #3133
* #3134
* #3135
* #3136
* #3137
* #3138
* #3139
* #3140
* #3141
* #3142
* #3143
* #3144
* #3145
* #3146
* #3147
* #3148
* #3149
* #3150
* #3151
* #3152
* #3153
* #3154
* #3155
* #3157
* #3158
* #3159
* #3160
* #3161
* #3162
* #3163
* #3164
* #3165
* #3166
* #3167
* #3168
* #3169
* #3170
* #3174
* #3175
* #3176
* #3177
* #3178
* #3179
* #3181
* #3182
* #3184
* #3185
* #3186
* #3188
* #3189
* #3190
* #3191
* #3192
* #3194
* #3195
* #3196
* #3197
* #3198
* #3199
* #3200
* #3201
* #3202
* #3203
* #3205
* #3206
* #3208
* #3209
* #3210
* #3213
* #3214
* #3215
* #3216
* #3217
* #3218
* #3219
* #3220
* #3222
* #3223
* #3224
* #3225
* #3226
* #3227
* #3228
* #3229
* #3230
* #3231
* #3232
* #3233
* #3234
* #3235
* #3236
* #3237
* #3238
* #3239
* #3240
* #3241
* #3242
* #3243
* #3244
* #3246
* #3247
* #3248
* #3250
* #3251
* #3252
* #3253
* #3254
* #3255
* #3256
* #3257
* #3258
* #3259
* #3260
* #3261
* #3262
* #3263
* #3265
* #3266
* #3267
* #3268
* #3269
* #3270
* #3271
* #3272
* #3273
* #3274
* #3275
* #3276
* #3277
* #3278
* #3279
* #3280
* #3281
* #3282
* #3283
* #3284
* #3285
* #3286
* #3287
* #3288
* #3289
* #3290
* #3291
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jreidinger jreidinger jreidinger approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@imobachgs @jreidinger