Use certs directly instead of a keystore for Candlepin

[evgeni]

1. needs Use OpenSSL FFM puppet-candlepin#286
2. will need to bump the lower bound of candlepin module to the one containing PR 286

[Odilhao]

I think we need this now, since we already merged theforeman/puppet-candlepin#286

I'm seeing this on nightly:

[2026-08-06T03:02:16.239Z]     stdout: |-
[2026-08-06T03:02:16.239Z]         2026-08-06 02:59:59 [NOTICE] [root] Loading installer configuration. This will take some time.
[2026-08-06T03:02:16.239Z]         2026-08-06 03:00:11 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
[2026-08-06T03:02:16.239Z]         2026-08-06 03:00:11 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
[2026-08-06T03:02:16.239Z]         2026-08-06 03:00:13 [NOTICE] [checks] System checks passed
[2026-08-06T03:02:16.239Z]         2026-08-06 03:02:02 [NOTICE] [configure] Starting system configuration.
[2026-08-06T03:02:16.239Z]         2026-08-06 03:02:16 [ERROR ] [configure] Evaluation Error: Error while evaluating a Resource Statement, Class[Candlepin]:
[2026-08-06T03:02:16.239Z]         2026-08-06 03:02:16 [ERROR ] [configure] has no parameter named 'keystore_file'
[2026-08-06T03:02:16.239Z]         2026-08-06 03:02:16 [ERROR ] [configure] has no parameter named 'keystore_password'
[2026-08-06T03:02:16.239Z]         2026-08-06 03:02:16 [ERROR ] [configure] has no parameter named 'truststore_file'
[2026-08-06T03:02:16.240Z]         2026-08-06 03:02:16 [ERROR ] [configure] has no parameter named 'truststore_password' (file: /usr/share/foreman-installer/modules/katello/manifests/candlepin.pp, line: 47, column: 3) on node pipe-katello-server-nightly-centos9-stream.example.com
[2026-08-06T03:02:16.240Z]         2026-08-06 03:02:16 [NOTICE] [configure] System configuration has finished.
[2026-08-06T03:02:16.240Z] 
[2026-08-06T03:02:16.240Z]         There were errors detected during installation.
[2026-08-06T03:02:16.240Z]         Please address the errors and re-run the installer to ensure the system is properly configured.
[2026-08-06T03:02:16.240Z]         Failure to do so will likely cause installation or runtime failures.
[2026-08-06T03:02:16.240Z] 
[2026-08-06T03:02:16.240Z]         The full log is available at /var/log/foreman-installer/katello.log
[2026-08-06T03:02:16.240Z]     stdout_lines: <omitted>
[2026-08-06T03:02:16.240Z] 

[ehelms]

I pushed some updates that point at theforeman/puppet-certs#509 to see tests pass here. I'll update and take it out of draft after the puppet-certs PR is merged.

[evgeni]

Is this an enhancement? A breaking change? :D

[ekohl]

Technically this should bump the minimum version of puppet-candlepin, even though that doesn't exist yet. I think that makes it a breaking change. Does it also need a newer puppet-certs?

[ehelms]

Technically this should bump the minimum version of puppet-candlepin, even though that doesn't exist yet. I think that makes it a breaking change. Does it also need a newer puppet-certs?

It will yes, but as you say, those are unreleased at the moment. I have added the backwards incompatible label and will merge this to allow the pipes to run.