can't install fog client 0.11.19 "Unable to install CA certificate"

[lebrun78]

I tried with the smart installer and I got the same error.

[lebrun78]

I installed the client without the https.
After installation, I edited the settings.json file to enable https.
I get the following error in the log

------------------------------------------------------------------------------
--------------------------------Authentication--------------------------------
------------------------------------------------------------------------------
 03/03/2020 17:13:59 Client-Info Version: 0.11.19
 03/03/2020 17:13:59 Client-Info OS:      Windows
 03/03/2020 17:13:59 Middleware::Authentication Waiting for authentication timeout to pass
 03/03/2020 17:13:59 Middleware::Communication Download: https://fogus.istic.univ-rennes1.fr/fog/management/other/ssl/srvpublic.crt
 03/03/2020 17:13:59 Data::RSA FOG Server CA cert found
 03/03/2020 17:13:59 Data::RSA ERROR: Certificate validation failed
 03/03/2020 17:13:59 Data::RSA ERROR: Trust chain did not complete to the known authority anchor. Errors: Une chaîne de certificats n’a pas pu être établie vers une autorité racine de confiance. (PartialChain)
 03/03/2020 17:13:59 Middleware::Communication SSL certificate chain error: Une chaîne de certificats a été traitée mais s’est terminée par un certificat racine qui n’est pas approuvé par le fournisseur d’approbation.

 03/03/2020 17:13:59 Middleware::Communication ERROR: Could not download file
 03/03/2020 17:13:59 Middleware::Communication ERROR: La connexion sous-jacente a été fermée : Impossible d'établir une relation de confiance pour le canal sécurisé SSL/TLS.

[Sebastian Roth]

@lebrun78 said in can't install fog client 0.11.19 "Unable to install CA certificate":

I can’t install my fog client using msi file.

Do you have other hosts with fog-client already installed from before the update? Do they still work properly?

Are you sure the installer script finished all the way to the end? Restarted the whole server after that (usually not needed but give it a try in this case).

Have you messed with the certificates on your FOG server at some point?

Please run the following commands to see if the certs are still fine - post output here:

grep -e pem -e key /etc/apache2/sites-available/*.conf
md5sum /opt/fog/snapins/ssl/CA/.fogCA.pem /var/www/html/fog/management/other/ca.cert.pem
openssl verify -verbose -CAfile /opt/fog/snapins/ssl/CA/.fogCA.pem /var/www/fog/management/other/ssl/srvpublic.crt
echo -n | openssl s_client -CAfile /var/www/html/fog/management/other/ca.cert.pem -connect fogus.istic.univ-rennes1.fr:443 | head

[lebrun78]

Hello Sebastian,
I 've just restart the serer.
On an old installation client I get

------------------------------------------------------------------------------
--------------------------------Authentication--------------------------------
------------------------------------------------------------------------------
 04/03/2020 11:45:48 Client-Info Version: 0.11.19
 04/03/2020 11:45:48 Client-Info OS:      Windows
 04/03/2020 11:45:48 Middleware::Authentication Waiting for authentication timeout to pass
 04/03/2020 11:45:48 Middleware::Communication Download: https://fogus/fog/management/other/ssl/srvpublic.crt
 04/03/2020 11:45:48 Data::RSA FOG Server CA cert found
 04/03/2020 11:45:48 Middleware::Authentication Cert OK
 04/03/2020 11:45:48 Middleware::Authentication ERROR: Could not get security token
 04/03/2020 11:45:48 Middleware::Authentication ERROR: Le chemin d’accès spécifié est introuvable.

 04/03/2020 11:45:48 Middleware::Communication POST URL: https://fogus/fog/management/index.php?sub=requestClientInfo&authorize&newService
 04/03/2020 11:45:48 Middleware::Response Success
 04/03/2020 11:45:48 Middleware::Authentication Authenticated


 04/03/2020 11:45:48 Middleware::Communication URL: https://fogus/fog/management/index.php?sub=requestClientInfo&configure&newService&json
 04/03/2020 11:45:48 Middleware::Response Success
 04/03/2020 11:45:48 Middleware::Communication URL: https://fogus/fog/management/index.php?sub=requestClientInfo&mac=52:54:00:CE:A1:DD&newService&json
 04/03/2020 11:45:49 Middleware::Response Success
 04/03/2020 11:45:49 Middleware::Communication URL: https://fogus/fog/service/getversion.php?clientver&newService&json
 04/03/2020 11:45:49 Middleware::Communication URL: https://fogus/fog/service/getversion.php?newService&json

 04/03/2020 11:45:49 Service Creating user agent cache
 04/03/2020 11:45:49 Middleware::Response Success
 04/03/2020 11:45:49 Middleware::Response Module is disabled globally on the FOG server
 04/03/2020 11:45:49 Middleware::Response Success
 04/03/2020 11:45:49 Service Initializing modules

------------------------------------------------------------------------------
---------------------------------ClientUpdater--------------------------------
------------------------------------------------------------------------------
 04/03/2020 11:45:49 Client-Info Client Version: 0.11.19
 04/03/2020 11:45:49 Client-Info Client OS:      Windows
 04/03/2020 11:45:49 Client-Info Server Version: 1.5.8
 04/03/2020 11:45:49 Middleware::Response Success
------------------------------------------------------------------------------

It seems working even if I have this errors in thelog:

Middleware::Authentication ERROR: Could not get security token
 04/03/2020 11:45:48 Middleware::Authentication ERROR: Le chemin d’accès spécifié est introuvable.

On the server:

grep -e pem -e key /etc/httpd/conf.d/*.conf
/etc/httpd/conf.d/fog.conf:    SSLCertificateKeyFile /opt/fog/snapins/ssl//.srvprivate.key
/etc/httpd/conf.d/fog.conf:    SSLCACertificateFile /var/www/html/fog//management/other/ca.cert.pem
/etc/httpd/conf.d/ssl.conf:#   If the key is not combined with the certificate, use this
/etc/httpd/conf.d/ssl.conf:#   directive to point at the key file.  Keep in mind that if
/etc/httpd/conf.d/ssl.conf:#   you've both a RSA and a DSA private key you can configure
/etc/httpd/conf.d/ssl.conf:#   ECC keys, when in use, can also be configured in parallel
/etc/httpd/conf.d/ssl.conf:SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

md5sum /opt/fog/snapins/ssl/CA/.fogCA.pem /var/www/html/fog/management/other/ca.cert.pem
c5023563df0eeeac5186bd9b641426dc  /opt/fog/snapins/ssl/CA/.fogCA.pem
c5023563df0eeeac5186bd9b641426dc  /var/www/html/fog/management/other/ca.cert.pem

openssl verify -verbose -CAfile /opt/fog/snapins/ssl/CA/.fogCA.pem /var/www/fog/management/other/ssl/srvpublic.crt
/var/www/fog/management/other/ssl/srvpublic.crt: OK

May be the problem is here, initially the server name was fogus2, rename to fogus
with this command that you proposed to me, we find traces of fogus2

echo -n | openssl s_client -CAfile /var/www/html/fog/management/other/ca.cert.pem -connect fogus.istic.univ-rennes1.fr:443 | head
depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify error:num=19:self signed certificate in certificate chain
verify return:1
depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify return:1
depth=0 C = US, O = Unspecified, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify return:1
CONNECTED(00000003)
---
Certificate chain
 0 s:C = US, O = Unspecified, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
   i:C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
 1 s:C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
   i:C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
---
Server certificate
-----BEGIN CERTIFICATE-----
DONE

[Sebastian Roth]

@lebrun78 Well, fairly clear. You seem to have a custom CA installed on your FOG server. While it’s fine to do it’s not supported by FOG yet and running the installer will mess things up. I am in the process of changing this but it needs a lot more work.

Please run grep "SSLC" /etc/httpd/conf.d/*.conf and post output here.

[lebrun78]

@Sebastian-Roth

Thank you for your help Sebastian, I’m not good at all in cert management !

grep “SSLC” /etc/httpd/conf.d/*.conf

/etc/httpd/conf.d/fog.conf:    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
/etc/httpd/conf.d/fog.conf:    SSLCertificateFile /var/www/html/fog//management/other/ssl/srvpublic.crt
/etc/httpd/conf.d/fog.conf:    SSLCertificateKeyFile /opt/fog/snapins/ssl//.srvprivate.key
/etc/httpd/conf.d/fog.conf:    SSLCACertificateFile /var/www/html/fog//management/other/ca.cert.pem
/etc/httpd/conf.d/ssl.conf:# Use "SSLCryptoDevice" to enable any supported hardware
/etc/httpd/conf.d/ssl.conf:SSLCryptoDevice builtin
/etc/httpd/conf.d/ssl.conf:#SSLCryptoDevice ubsec
/etc/httpd/conf.d/ssl.conf:SSLCipherSuite PROFILE=SYSTEM
/etc/httpd/conf.d/ssl.conf:#   Point SSLCertificateFile at a PEM encoded certificate.  If
/etc/httpd/conf.d/ssl.conf:SSLCertificateFile /etc/pki/tls/certs/localhost.crt
/etc/httpd/conf.d/ssl.conf:SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
/etc/httpd/conf.d/ssl.conf:#   Point SSLCertificateChainFile at a file containing the
/etc/httpd/conf.d/ssl.conf:#   the referenced file can be the same as SSLCertificateFile
/etc/httpd/conf.d/ssl.conf:#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
/etc/httpd/conf.d/ssl.conf:#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

[Sebastian Roth]

@lebrun78 I have a feeling that the hostname does not point to the server you think it should point to. Please run the following commands on your FOG server and post output here:

ping -c 1 fogus
ping -c 1 fogus.istic.univ-rennes1.fr
ping -c 1 fogus2.istic.univ-rennes1.fr
ip a s

[lebrun78]

Here are the result fo the command:

ping -c 1 fogus2.istic.univ-rennes1.fr
ping: fogus2.istic.univ-rennes1.fr: Nom ou service inconnu
[root@fogus ~]# ping -c 1 fogus.istic.univ-rennes1.fr
PING fogus.istic.univ-rennes1.fr (148.60.4.1) 56(84) bytes of data.
64 bytes from fogus.istic.univ-rennes1.fr (148.60.4.1): icmp_seq=1 ttl=64 time=0.035 ms

--- fogus.istic.univ-rennes1.fr ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.035/0.035/0.035/0.000 ms
[root@fogus ~]# ping -c 1 fogus
PING fogus.istic.univ-rennes1.fr (148.60.4.1) 56(84) bytes of data.
64 bytes from fogus.istic.univ-rennes1.fr (148.60.4.1): icmp_seq=1 ttl=64 time=0.051 ms

--- fogus.istic.univ-rennes1.fr ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.051/0.051/0.051/0.000 ms
[root@fogus ~]# ping -c 1 fogus2
ping: fogus2: Nom ou service inconnu

ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens2f0np0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether b0:26:28:78:ce:d0 brd ff:ff:ff:ff:ff:ff
    inet 148.60.4.1/21 brd 148.60.7.255 scope global noprefixroute ens2f0np0
       valid_lft forever preferred_lft forever
    inet6 fe80::b226:28ff:fe78:ced0/64 scope link 
       valid_lft forever preferred_lft forever
3: eno1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 4c:d9:8f:8e:41:0f brd ff:ff:ff:ff:ff:ff
4: ens2f1np1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether b0:26:28:78:ce:d1 brd ff:ff:ff:ff:ff:ff
5: eno2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 4c:d9:8f:8e:41:10 brd ff:ff:ff:ff:ff:ff
6: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:1e:69:b9 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
7: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:1e:69:b9 brd ff:ff:ff:ff:ff:ff

I try to find fogus2 string in /etc:

grep -Ri fogus2 /etc/*
grep: /etc/grub2.cfg: Aucun fichier ou dossier de ce type
grep: /etc/httpd/run/cgisock.2085: Aucun périphérique ou adresse
/etc/lvm/backup/cl:creation_host = "fogus2.istic.univ-rennes1.fr"	# Linux fogus2.istic.univ-rennes1.fr 4.18.0-80.11.2.el8_0.x86_64 #1 SMP Tue Sep 24 11:32:19 UTC 2019 x86_64
/etc/lvm/archive/cl_00000-2032209725.vg:creation_host = "fogus2.istic.univ-rennes1.fr"	# Linux fogus2.istic.univ-rennes1.fr 4.18.0-80.11.2.el8_0.x86_64 #1 SMP Tue Sep 24 11:32:19 UTC 2019 x86_64
/etc/mail/sendmail.cf:##### built by root@fogus2.istic.univ-rennes1.fr on ven. nov. 29 09:28:55 CET 2019

[Sebastian Roth]

@lebrun78 DNS naming seems ok. fogus2* doesn’t exist and fogus* both point to the same IP which we see in ip a s as well.

But …

echo -n | openssl s_client -CAfile /var/www/html/fog/management/other/ca.cert.pem -connect fogus.istic.univ-rennes1.fr:443 | head
depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify error:num=19:self signed certificate in certificate chain
verify return:1
depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify return:1
depth=0 C = US, O = Unspecified, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify return:1
CONNECTED(00000003)

This obviously tells us there are other certificates in place. Ahhhh… I just remembered seeing some weird issue with virtual host naming on Ubuntu one day. I can imagine this happening to you here as well, maybe different but still.

Run the following two commands and post full output here.

apachectl -S
grep Server /etc/httpd/conf.d/*

[lebrun78]

@Sebastian-Roth said in can't install fog client 0.11.19 "Unable to install CA certificate":

apachectl -S
grep Server /etc/httpd/conf.d/*

[root@fogus ~]# apachectl -S

VirtualHost configuration:
*:80                   148.60.4.1 (/etc/httpd/conf.d/fog.conf:1)
*:443                  is a NameVirtualHost
         default server 148.60.4.1 (/etc/httpd/conf.d/fog.conf:14)
         port 443 namevhost 148.60.4.1 (/etc/httpd/conf.d/fog.conf:14)
                 alias fogus
         port 443 namevhost fogus.istic.univ-rennes1.fr (/etc/httpd/conf.d/ssl.conf:40)
ServerRoot: "/etc/httpd"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/etc/httpd/logs/error_log"
Mutex authdigest-opaque: using_defaults
Mutex watchdog-callback: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex authdigest-client: using_defaults
Mutex lua-ivm-shm: using_defaults
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex authn-socache: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/etc/httpd/run/" mechanism=default 
Mutex cache-socache: using_defaults
PidFile: "/etc/httpd/run/httpd.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="apache" id=48
Group: name="apache" id=48 

[root@fogus ~]# grep Server /etc/httpd/conf.d/*

/etc/httpd/conf.d/fog.conf:    ServerName 148.60.4.1
/etc/httpd/conf.d/fog.conf:    ServerAlias fogus
/etc/httpd/conf.d/fog.conf:    ServerName 148.60.4.1
/etc/httpd/conf.d/fog.conf:    ServerAlias fogus
/etc/httpd/conf.d/fog.conf.org:    ServerName 148.60.4.1
/etc/httpd/conf.d/fog.conf.org:    ServerAlias fogus
/etc/httpd/conf.d/fog.conf.org:    ServerName 148.60.4.1
/etc/httpd/conf.d/fog.conf.org:    ServerAlias fogus
/etc/httpd/conf.d/README:This directory holds configuration files for the Apache HTTP Server;
/etc/httpd/conf.d/ssl.conf:#ServerName www.example.com:443
/etc/httpd/conf.d/ssl.conf:#   Server Private Key:
/etc/httpd/conf.d/ssl.conf:#   Server Certificate Chain:
/etc/httpd/conf.d/ssl.conf:#   Per-Server Logging:

[Sebastian Roth]

@lebrun78 said:

port 443 namevhost fogus.istic.univ-rennes1.fr (/etc/httpd/conf.d/ssl.conf:40)

Here we are I’d say. If you use hostname fogus.istic.univ-rennes1.fr you will be served by the certificate specified in ssl.conf instead of our fog.conf. I should have figured this out earlier, really.

Try using hostname fogus in your fog-client install and it should just work I’d say.

If you are really keen we can work through FOG’s certificate generation again and make it use the full qualified name instead.

[lebrun78]

Thank you for you answer Sebastian,

I should reinstall using : “./installfog.sh -W https://fogus.istic.univ-rennes1.fr -S” ?
I will wait for the end of the college year to resintall and generate a new certificate.

[Sebastian Roth]

@lebrun78 No, using the -W does not exactly do what you might expect it to do. The installer help text on this might be a bit confusing as the parameter should only be used to set the webroot - default is /fog/ - but not the whole URL as in your example!

Are you sure you want to use full qualified domain name from now on? I am just asking because one of the fog-client logs you posted shows that clients might use the short name fogus and they will break if you simply switch to full qualified, unless you edit C:\Program Files (x86)\FOG\settings.json on all those machines.

If you only want to go with full dns name I’d suggest you edit /opt/fog/.fogsettings and make sure the following three options are set correctly.

hostname='fogus.istic.univ-rennes1.fr'
webroot='/fog/'
httpproto='https'

Then re-run the installer without any command line options. That should re-generate the webserver cert and config for you (using the full qualified domain name). There should be no issue with the fog-clients being pinned to that server as the CA cert itself stays untouched. But as mentioned above you will probably need to change settings.json on all the existing clients.

The other option you have is to manually fiddle with the certificate stuff and add a second hostname (fogus.istic.univ-rennes1.fr and fogus). This is possible but needs manual file edit and calling commands and I don’t recommend it right now because the installer is not ready for it and will break your setup as soon as you run it again after the manual adjustments.

EDIT: Now that I think a bit more about it, we might even add short and full qualified dns name to the certificate by default in the installer as it might help others as well.
Give me a bit more time and I might add this to dev-branch in the next couple of days.

[lebrun78]

Thank you Sebastian for this explanation.
I actually use the short name but by default, I would have preferred to use the long name.
But the whole is currently configured as well, so I will stay on this configuration while waiting to update the posts with a new image at the end of the school year.