can't install fog client 0.11.19 "Unable to install CA certificate"

[Sebastian Roth]

@lebrun78 Well, fairly clear. You seem to have a custom CA installed on your FOG server. While it’s fine to do it’s not supported by FOG yet and running the installer will mess things up. I am in the process of changing this but it needs a lot more work.

Please run grep "SSLC" /etc/httpd/conf.d/*.conf and post output here.

[lebrun78]

@Sebastian-Roth

Thank you for your help Sebastian, I’m not good at all in cert management !

grep “SSLC” /etc/httpd/conf.d/*.conf

/etc/httpd/conf.d/fog.conf:    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
/etc/httpd/conf.d/fog.conf:    SSLCertificateFile /var/www/html/fog//management/other/ssl/srvpublic.crt
/etc/httpd/conf.d/fog.conf:    SSLCertificateKeyFile /opt/fog/snapins/ssl//.srvprivate.key
/etc/httpd/conf.d/fog.conf:    SSLCACertificateFile /var/www/html/fog//management/other/ca.cert.pem
/etc/httpd/conf.d/ssl.conf:# Use "SSLCryptoDevice" to enable any supported hardware
/etc/httpd/conf.d/ssl.conf:SSLCryptoDevice builtin
/etc/httpd/conf.d/ssl.conf:#SSLCryptoDevice ubsec
/etc/httpd/conf.d/ssl.conf:SSLCipherSuite PROFILE=SYSTEM
/etc/httpd/conf.d/ssl.conf:#   Point SSLCertificateFile at a PEM encoded certificate.  If
/etc/httpd/conf.d/ssl.conf:SSLCertificateFile /etc/pki/tls/certs/localhost.crt
/etc/httpd/conf.d/ssl.conf:SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
/etc/httpd/conf.d/ssl.conf:#   Point SSLCertificateChainFile at a file containing the
/etc/httpd/conf.d/ssl.conf:#   the referenced file can be the same as SSLCertificateFile
/etc/httpd/conf.d/ssl.conf:#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
/etc/httpd/conf.d/ssl.conf:#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

[Sebastian Roth]

@lebrun78 I have a feeling that the hostname does not point to the server you think it should point to. Please run the following commands on your FOG server and post output here:

ping -c 1 fogus
ping -c 1 fogus.istic.univ-rennes1.fr
ping -c 1 fogus2.istic.univ-rennes1.fr
ip a s

[lebrun78]

Here are the result fo the command:

ping -c 1 fogus2.istic.univ-rennes1.fr
ping: fogus2.istic.univ-rennes1.fr: Nom ou service inconnu
[root@fogus ~]# ping -c 1 fogus.istic.univ-rennes1.fr
PING fogus.istic.univ-rennes1.fr (148.60.4.1) 56(84) bytes of data.
64 bytes from fogus.istic.univ-rennes1.fr (148.60.4.1): icmp_seq=1 ttl=64 time=0.035 ms

--- fogus.istic.univ-rennes1.fr ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.035/0.035/0.035/0.000 ms
[root@fogus ~]# ping -c 1 fogus
PING fogus.istic.univ-rennes1.fr (148.60.4.1) 56(84) bytes of data.
64 bytes from fogus.istic.univ-rennes1.fr (148.60.4.1): icmp_seq=1 ttl=64 time=0.051 ms

--- fogus.istic.univ-rennes1.fr ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.051/0.051/0.051/0.000 ms
[root@fogus ~]# ping -c 1 fogus2
ping: fogus2: Nom ou service inconnu

ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens2f0np0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether b0:26:28:78:ce:d0 brd ff:ff:ff:ff:ff:ff
    inet 148.60.4.1/21 brd 148.60.7.255 scope global noprefixroute ens2f0np0
       valid_lft forever preferred_lft forever
    inet6 fe80::b226:28ff:fe78:ced0/64 scope link 
       valid_lft forever preferred_lft forever
3: eno1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 4c:d9:8f:8e:41:0f brd ff:ff:ff:ff:ff:ff
4: ens2f1np1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether b0:26:28:78:ce:d1 brd ff:ff:ff:ff:ff:ff
5: eno2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 4c:d9:8f:8e:41:10 brd ff:ff:ff:ff:ff:ff
6: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
    link/ether 52:54:00:1e:69:b9 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
7: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel master virbr0 state DOWN group default qlen 1000
    link/ether 52:54:00:1e:69:b9 brd ff:ff:ff:ff:ff:ff

I try to find fogus2 string in /etc:

grep -Ri fogus2 /etc/*
grep: /etc/grub2.cfg: Aucun fichier ou dossier de ce type
grep: /etc/httpd/run/cgisock.2085: Aucun périphérique ou adresse
/etc/lvm/backup/cl:creation_host = "fogus2.istic.univ-rennes1.fr"	# Linux fogus2.istic.univ-rennes1.fr 4.18.0-80.11.2.el8_0.x86_64 #1 SMP Tue Sep 24 11:32:19 UTC 2019 x86_64
/etc/lvm/archive/cl_00000-2032209725.vg:creation_host = "fogus2.istic.univ-rennes1.fr"	# Linux fogus2.istic.univ-rennes1.fr 4.18.0-80.11.2.el8_0.x86_64 #1 SMP Tue Sep 24 11:32:19 UTC 2019 x86_64
/etc/mail/sendmail.cf:##### built by root@fogus2.istic.univ-rennes1.fr on ven. nov. 29 09:28:55 CET 2019

[Sebastian Roth]

@lebrun78 DNS naming seems ok. fogus2* doesn’t exist and fogus* both point to the same IP which we see in ip a s as well.

But …

echo -n | openssl s_client -CAfile /var/www/html/fog/management/other/ca.cert.pem -connect fogus.istic.univ-rennes1.fr:443 | head
depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify error:num=19:self signed certificate in certificate chain
verify return:1
depth=1 C = US, O = Unspecified, OU = ca-7711430350767482536, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify return:1
depth=0 C = US, O = Unspecified, CN = fogus2.istic.univ-rennes1.fr, emailAddress = root@fogus2.istic.univ-rennes1.fr
verify return:1
CONNECTED(00000003)

This obviously tells us there are other certificates in place. Ahhhh… I just remembered seeing some weird issue with virtual host naming on Ubuntu one day. I can imagine this happening to you here as well, maybe different but still.

Run the following two commands and post full output here.

apachectl -S
grep Server /etc/httpd/conf.d/*

[lebrun78]

@Sebastian-Roth said in can't install fog client 0.11.19 "Unable to install CA certificate":

apachectl -S
grep Server /etc/httpd/conf.d/*

[root@fogus ~]# apachectl -S

VirtualHost configuration:
*:80                   148.60.4.1 (/etc/httpd/conf.d/fog.conf:1)
*:443                  is a NameVirtualHost
         default server 148.60.4.1 (/etc/httpd/conf.d/fog.conf:14)
         port 443 namevhost 148.60.4.1 (/etc/httpd/conf.d/fog.conf:14)
                 alias fogus
         port 443 namevhost fogus.istic.univ-rennes1.fr (/etc/httpd/conf.d/ssl.conf:40)
ServerRoot: "/etc/httpd"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/etc/httpd/logs/error_log"
Mutex authdigest-opaque: using_defaults
Mutex watchdog-callback: using_defaults
Mutex proxy-balancer-shm: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex authdigest-client: using_defaults
Mutex lua-ivm-shm: using_defaults
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex authn-socache: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/etc/httpd/run/" mechanism=default 
Mutex cache-socache: using_defaults
PidFile: "/etc/httpd/run/httpd.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="apache" id=48
Group: name="apache" id=48 

[root@fogus ~]# grep Server /etc/httpd/conf.d/*

/etc/httpd/conf.d/fog.conf:    ServerName 148.60.4.1
/etc/httpd/conf.d/fog.conf:    ServerAlias fogus
/etc/httpd/conf.d/fog.conf:    ServerName 148.60.4.1
/etc/httpd/conf.d/fog.conf:    ServerAlias fogus
/etc/httpd/conf.d/fog.conf.org:    ServerName 148.60.4.1
/etc/httpd/conf.d/fog.conf.org:    ServerAlias fogus
/etc/httpd/conf.d/fog.conf.org:    ServerName 148.60.4.1
/etc/httpd/conf.d/fog.conf.org:    ServerAlias fogus
/etc/httpd/conf.d/README:This directory holds configuration files for the Apache HTTP Server;
/etc/httpd/conf.d/ssl.conf:#ServerName www.example.com:443
/etc/httpd/conf.d/ssl.conf:#   Server Private Key:
/etc/httpd/conf.d/ssl.conf:#   Server Certificate Chain:
/etc/httpd/conf.d/ssl.conf:#   Per-Server Logging:

[Sebastian Roth]

@lebrun78 said:

port 443 namevhost fogus.istic.univ-rennes1.fr (/etc/httpd/conf.d/ssl.conf:40)

Here we are I’d say. If you use hostname fogus.istic.univ-rennes1.fr you will be served by the certificate specified in ssl.conf instead of our fog.conf. I should have figured this out earlier, really.

Try using hostname fogus in your fog-client install and it should just work I’d say.

If you are really keen we can work through FOG’s certificate generation again and make it use the full qualified name instead.

[lebrun78]

Thank you for you answer Sebastian,

I should reinstall using : “./installfog.sh -W https://fogus.istic.univ-rennes1.fr -S” ?
I will wait for the end of the college year to resintall and generate a new certificate.

[Sebastian Roth]

@lebrun78 No, using the -W does not exactly do what you might expect it to do. The installer help text on this might be a bit confusing as the parameter should only be used to set the webroot - default is /fog/ - but not the whole URL as in your example!

Are you sure you want to use full qualified domain name from now on? I am just asking because one of the fog-client logs you posted shows that clients might use the short name fogus and they will break if you simply switch to full qualified, unless you edit C:\Program Files (x86)\FOG\settings.json on all those machines.

If you only want to go with full dns name I’d suggest you edit /opt/fog/.fogsettings and make sure the following three options are set correctly.

hostname='fogus.istic.univ-rennes1.fr'
webroot='/fog/'
httpproto='https'

Then re-run the installer without any command line options. That should re-generate the webserver cert and config for you (using the full qualified domain name). There should be no issue with the fog-clients being pinned to that server as the CA cert itself stays untouched. But as mentioned above you will probably need to change settings.json on all the existing clients.

The other option you have is to manually fiddle with the certificate stuff and add a second hostname (fogus.istic.univ-rennes1.fr and fogus). This is possible but needs manual file edit and calling commands and I don’t recommend it right now because the installer is not ready for it and will break your setup as soon as you run it again after the manual adjustments.

EDIT: Now that I think a bit more about it, we might even add short and full qualified dns name to the certificate by default in the installer as it might help others as well.
Give me a bit more time and I might add this to dev-branch in the next couple of days.

[lebrun78]

Thank you Sebastian for this explanation.
I actually use the short name but by default, I would have preferred to use the long name.
But the whole is currently configured as well, so I will stay on this configuration while waiting to update the posts with a new image at the end of the school year.