Foreman » Installer

foreman-proxy-certs-generate uses the value for --foreman-proxy-cname to add a DNS record in the SAN field regardless of that setting making sense or not. E.g. DNS:[] and DNS: <= empty string.

This is what foreman-proxy-certs-generate is generating for qpid-router-server.crt: (used by capsules' qdrouterd on port 5647 to listen to clients' goferds)

X509v3 Subject Alternative Name: 
                DNS:mycapsule.example.com, DNS:[]

The DNS:[] comes from the default value for --foreman-proxy-cname:
~~~
[root@sat65a ~]# foreman-proxy-certs-generate --help

(...snip...)

= Module foreman_proxy_certs:
--certs-tar Path to tar file with certs to generate (current: UNDEF)
--foreman-proxy-cname additional names of the foreman proxy (current: ["[]"]) <========= here
--foreman-proxy-fqdn FQDN of the foreman proxy (current: "sat65a.usersys.redhat.com")

Turns out, if you use `--foreman-proxy-cname ""` with `foreman-proxy-certs-generate` it will still generate certs with DNS:<fqdn>, DNS: <==== second DNS entry empty.

The problem is that puppet-strings parses the default as the string "[]" rather than an empty array [].