This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 45%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJS%3C/text%3E%3C/svg%3E)
I'm trying to do some automation on building a RHEL image using the RHEL88-Gen2 SKU and when using cloud-init to do a package upgrade it keeps failing for this: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/troubleshoot-linux-rhui-certificate-issues?tabs=rhel8-eus%2Crhel7-noneus%2Crhel7-rhel-sap-apps%2Crhel8-rhel-sap-apps%2Crhel9-rhel-sap-apps#cause-3-rhui-package-is-missing
Does this then mean my attempt at automation is not possible without Microsoft/Red Hat fixing the image? I've tried RHEL8.8, RHEL8.7, RHEL 8.4 (based on https://learn.microsoft.com/en-us/azure/virtual-machines/linux/using-cloud-init#rhel) and they all fail for RHUI being missing. I haven't yet tried the RAW images but I suspect the problem will still be present.
Does anyone have any ideas on how else to do this or am I waiting for Microsoft/Red Hat in this circumstance?
Thanks community.
Hi @deherman-MSFT therein lies the problem - cloud-init will do an upgrade/update BEFORE it'll do an install.
However, you've given me an idea as ca-certificates are injected/updated by cloud-init before anything to do with package management.
If I grab a copy of the certificate I might be able to inject it prior to the package proceeding.
Thanks for the idea - I'll let you know if that works.
The error messages keep changing. First it was RHUI as a package itself, now kernel updates get the same error:
[MIRROR] kernel-4.18.0-477.15.1.el8_8.x86_64.rpm: Curl error (58): Problem with the local SSL certificate for https://rhui-1.microsoft.com/pulp/repos/content/dist/rhel8/rhui/8/x86_64/baseos/os/Packages/k/kernel-4.18.0-477.15.1.el8_8.x86_64.rpm [could not load PEM client certificate, OpenSSL error error:02001002:system library:fopen:No such file or directory, (no key found, wrong pass phrase, or wrong file format?)]
On a RHEL 8.8, 8.7 and 8.4 LVM image, the files in /etc/pki/rhui/private and /etc/pki/rhui/product are named key-base.pem and content-base.crt respectively when cloud-init gets that error message, however when doing a yum upgrade -y in the console the package installs fine suggesting it's not the presence of the certificate unless the certificate isn't present for RHUI at the stage when cloud-init executes the init-final stage?
To test matters further, I added the key and the certificate using cloud-init's write_files function which occurs before the package management activities proceed and the result was still a failure.
Looking at the repos, I can see it all looks healthy:
ansible-2-for-rhel-8-x86_64-rhui-rpms Red Hat Ansible Engine 2 for RHEL 8 x86_64 (RPMs) from RHUI
codeready-builder-for-rhel-8-x86_64-rhui-rpms Red Hat CodeReady Linux Builder for RHEL 8 x86_64 (RPMs) from RHUI
packages-microsoft-com-prod packages-microsoft-com-prod
rhel-8-for-x86_64-appstream-rhui-rpms Red Hat Enterprise Linux 8 for x86_64 - AppStream from RHUI (RPMs)
rhel-8-for-x86_64-baseos-rhui-rpms Red Hat Enterprise Linux 8 for x86_64 - BaseOS from RHUI (RPMs)
rhel-8-for-x86_64-supplementary-rhui-rpms Red Hat Enterprise Linux 8 for x86_64 - Supplementary (RPMs) from RHUI
rhui-microsoft-azure-rhel8 Microsoft Azure RPMs for Red Hat Enterprise Linux 8 (rhel8)
so the need to reinstall the repo seems redundant. After doing the yum upgrade -y in the console the certificates there don't change either.
I thought perhaps its because the package is out of date or perhaps missing. Here is the yum history for an 8.7 machine with just the extension for AAD auth being added.
ID | Command line | Date and time | Action(s) | Altered
10 | -q -y install aadsshlogin | 2023-07-14 12:47 | Install | 1 EE
9 | -q -y install aadsshlogin-selinux | 2023-07-14 12:46 | Install | 1
8 | update -y -q --disablerepo=* --enablerepo=*microsoft-azur | 2023-07-14 12:45 | Upgrade | 1
7 | update -y | 2023-02-25 00:47 | I, U | 119
6 | install -y lsscsi psmisc lvm2 uuid at patch cryptsetup cr | 2023-02-25 00:47 | I, U | 10
5 | update -y --disablerepo=* --enablerepo=*microsoft-azure-r | 2023-02-25 00:46 | Upgrade | 1
4 | install -y cloud-init cloud-utils-growpart gdisk hyperv-d | 2022-12-22 18:26 | Install | 22 EE
3 | install -y WALinuxAgent | 2022-12-22 18:26 | Install | 5
2 | install -c /var/run/installFromMsRhui-repo.config -y rhui | 2022-12-22 18:25 | Install | 1
1 | | 2022-12-22 18:20 | Install | 596 EE
And here it is when we try to use cloud-init to auto-upgrade and install some pre-reqs for MDE + the AAD auth extension:
11 | -q -y install aadsshlogin | 2023-07-14 13:08 | Install | 1 EE
10 | -q -y install aadsshlogin-selinux | 2023-07-14 13:07 | Install | 1
9 | -y install libnetfilter_queue mde-netfilter | 2023-07-14 13:07 | Install | 2 EE
8 | update -y -q --disablerepo=* --enablerepo=*microsoft-azur | 2023-07-14 13:06 | Upgrade | 1 EE
7 | update -y | 2023-02-25 00:47 | I, U | 119
6 | install -y lsscsi psmisc lvm2 uuid at patch cryptsetup cr | 2023-02-25 00:47 | I, U | 10
5 | update -y --disablerepo=* --enablerepo=*microsoft-azure-r | 2023-02-25 00:46 | Upgrade | 1
4 | install -y cloud-init cloud-utils-growpart gdisk hyperv-d | 2022-12-22 18:26 | Install | 22 EE
3 | install -y WALinuxAgent | 2022-12-22 18:26 | Install | 5
2 | install -c /var/run/installFromMsRhui-repo.config -y rhui | 2022-12-22 18:25 | Install | 1
1 | | 2022-12-22 18:20 | Install | 596 EE
This seems to suggest that the repos are correct as other packages can be pulled down and installed all OK, and the cloud-init upgrade isn't occuring before the RHUI install on action 2.
Waiting to be able to post another response.
Is the certificate missing or just needing to be updated? The solution for both of these can be found here. You could include this fix prior to running the package update as a workaround.