FOG Server : Certificate validation failed

[fgaudin]

Hello,
Just moved my FOG-server to version 1.5.10.2482 on Debian 13.5

used “./installfog.sh -y -C”

During installation/update the process was uncapable to generate new certificates , giving this kind of error-message “Cannot read Secure Boot signing file: /opt/fog/pki/secureboot/leaf/sign.key”

The Google’s IA showed me a way to generate manually those certificates

But now, the computer-stations still cannot communicate well with the server

Middleware::Communication Download: http://fogserver/fog/management/other/ssl/srvpublic.crt
Data::RSA FOG Server CA cert found
Data::RSA ERROR: Certificate validation failed
Data::RSA ERROR: Trust chain did not complete to the known authority anchor. Thumbprints did not match.
Middleware::Authentication ERROR: Could not authenticate
Middleware::Athentication ERROR: Certificate is not from FOG CA

Also I noticed that folder /var/www/fog/management/other/ssl/ does not contain the file srvpublic.crt although downloading of that file works. Is it a redirection inside Apache configuration ?

Should I completely destroy my server and build a new one to fix the problem ? Already spent many hours vannishing trying to fix it by myself.

[Tom Elliott]

@fgaudin Do not rebuild the server. The -C flag caused this, and you can recover from it.

-C means --recreate-CA. It deletes the FOG root CA and makes a new one. It also deletes the Secure Boot keys under /opt/fog/pki/secureboot. Each FOG Client stored the old CA when it was installed. The new server certificate is signed by a different CA, so the client says “Certificate is not from FOG CA”. This is expected after -C.

Do these steps:

1. Remove the certificates that you made by hand. They are not part of the FOG chain, and they add a second problem.
2. Run the installer again without -C: ./installfog.sh -y. The installer makes the missing pieces from the new CA.
3. On each Windows client, open certlm.msc. Go to Trusted Root Certification Authorities > Certificates. Delete “FOG Server CA”. Restart the FOGService. The client then gets the new CA from the server. If that does not work, reinstall the FOG Client on that computer.

About srvpublic.crt: Apache does not redirect it. On Debian the web files are in /var/www/html/fog/. Look in /var/www/html/fog/management/other/ssl/.

If step 2 shows “Cannot read Secure Boot signing file” again, post the full installer command and the log from bin/error_logs/ in your fogproject folder.