This is because ca.crt does point to the server certificate, instead of CA. For self-signed cert this is okay, once you have separate CA (which is expected on production systems, here the case is wild-card), then there is no way to change that on oVirt/RHEV side as it's "hardcoded" in the codebase.

I asked RHEV devs to allow some nice change of CA but it looks like this was marked as doco only: https://bugzilla.redhat.com/show_bug.cgi?id=1125933

WORKAROUND: Put your proper CA file to /var/www/htdocs and remove the proxy for the /ca.crt url:

  cp your_ca.crt /var/www/html/ca.crt
   (optionally relabel the file)
  sed -iE 's/ca.crt$|//' /etc/httpd/conf.d/z-ovirt-engine-proxy.conf

I think we should consider to allow users to input their CA into the field manually. I don't know why do we prevent that at all. Fetching the /ca.crt is not what is expected from RHEV side as they describe this "for testing purposes only".

Lukas Zapletal wrote:

I think we should consider to allow users to input their CA into the field manually. I don't know why do we prevent that at all. Fetching the /ca.crt is not what is expected from RHEV side as they describe this "for testing purposes only".

AFAIR we discussed this already and agreed to allow it?

Yes, I filed another issue/BZ for this because I am not 100% sure if the wildcard issue is another one or it will be solve by that: http://projects.theforeman.org/issues/7522

I will fix this today as it's a easy fix and this one is annoying.