Problem:
The GridSite.spec.trust.certFingerprint field expects colon-separated hex (ab:cd:ef:...), not plain hex (abcdef...). The operator computes the fingerprint as:
digest.iter().map(|b| format!("{b:02x}")).collect::<Vec<_>>().join(":")
The fingerprint is a SHA-256 hash of the trimmed PEM string bytes (not DER). Using openssl x509 -fingerprint or sha256sum without
colon formatting produces a mismatch, and the site stays in Connecting with TrustPolicyMismatch.
Workaround: Compute fingerprints using the PEM from publicCertPem in the GridSite status, with colon-separated output:
CERT_PEM=$(oc get gridsite <name> -o jsonpath='{.status.publicCertPem}')
echo -n "$CERT_PEM" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | sha256sum | awk '{print $1}' | sed 's/\(..\)/\1:/g;s/:$//'
Proposed fix:
Document the fingerprint format in the CRD description. Consider also accepting plain hex (without colons) and normalizing internally.
Problem:
The
GridSite.spec.trust.certFingerprintfield expects colon-separated hex (ab:cd:ef:...), not plain hex (abcdef...). The operator computes the fingerprint as:The fingerprint is a SHA-256 hash of the trimmed PEM string bytes (not DER). Using
openssl x509 -fingerprintorsha256sumwithoutcolon formatting produces a mismatch, and the site stays in
ConnectingwithTrustPolicyMismatch.Workaround: Compute fingerprints using the PEM from
publicCertPemin the GridSite status, with colon-separated output:Proposed fix:
Document the fingerprint format in the CRD description. Consider also accepting plain hex (without colons) and normalizing internally.