fix inoperable test14

[sinonkt]

test14 going down again, seems like obsolete crab-secret are not only reasons behind this.

The problematic error in pipeline could be seen here: https://gitlab.cern.ch/crab3/CRABServer/-/jobs/52043185

[belforte]

[28/Feb/2025:14:01:54] File "/usr/local/lib/python3.8/site-packages/WMCore/Services/pycurl_manager.py", line 338, in request - Podname=crabserver-7d94f6f6d4-77756 Type=cherrypylog
[28/Feb/2025:14:01:54] curl.perform() - Podname=crabserver-7d94f6f6d4-77756 Type=cherrypylog
[28/Feb/2025:14:01:54] pycurl.error: (58, 'could not load PEM client certificate, OpenSSL error error:0909006C:PEM routines:get_name:no start line, (no key found, wrong pass phrase, or wrong file format?)') - Podname=crabserver-7d94f6f6d4-77756 Type=cherrypylog

[sinonkt]

[28/Feb/2025:14:01:54] File "/usr/local/lib/python3.8/site-packages/WMCore/Services/pycurl_manager.py", line 338, in request - Podname=crabserver-7d94f6f6d4-77756 Type=cherrypylog [28/Feb/2025:14:01:54] curl.perform() - Podname=crabserver-7d94f6f6d4-77756 Type=cherrypylog [28/Feb/2025:14:01:54] pycurl.error: (58, 'could not load PEM client certificate, OpenSSL error error:0909006C:PEM routines:get_name:no start line, (no key found, wrong pass phrase, or wrong file format?)') - Podname=crabserver-7d94f6f6d4-77756 Type=cherrypylog

Thanks for hint!

[belforte]

hhmmm....

the location of the certificate is in the crabserver/config,py file.
data.serverhostcert = "%s/auth/crabserver/dmwm-service-cert.pem" % file.rsplit('/', 3)[0]

On cmsweb-test2:

crab3@crabserver-6fb55ff99-27bsr:/data$ openssl x509  -subject -dates -noout  -in /data/srv/current/auth/crabserver/dmwm-service-cert.pem 
subject=DC = ch, DC = cern, OU = Organic Units, OU = Users, CN = crabcms, CN = 852819, CN = Robot: CRAB CMS Web Service Account
notBefore=Apr 30 06:08:05 2024 GMT
notAfter=Jun  4 06:08:05 2025 GMT
crab3@crabserver-6fb55ff99-27bsr:/data$ 

on test14 there is a very old thing . I leave it to you to check there an in other clusters.

I am lead to fear that our instructions for deploying secrets are not complete/correct :-(

Please take this chance to review them.